轻松渗透 Windows 之利用 phpmyadmin
提要
在网上看到一个练习用的渗透靶场，没有看到管理密码。那么今天我们就来渗透下这个靶场。
链接：https://pan.baidu.com/s/1I0oJLdVzjv0grHzlgITvLg 提取码：dcib
目标
对目标系统快速 getshell
信息收集
使用 nmap 扫描主机
# vmware 的网卡设置在 192.168.10 网段（根据实际情况修改）
# 确认网段内主机数量
nmap -Pn 192.168.10.0/24
# 确认感兴趣主机是否为靶场
nmap -A 192.168.10.146
Starting Nmap 7.80 ( https://nmap.org ) at 2020-11-26 17:39 ?D1ú±ê×?ê±??
Nmap scan report for 192.168.10.146
Host is up (0.00015s latency).
Not shown: 982 closed ports
PORT STATE SERVICE VERSION
53/tcp open domain?
| fingerprint-strings:
| DNSVersionBindReqTCP:
| version
|_ bind
88/tcp open http Microsoft IIS httpd
|_http-title: Site doesn't have a title (text/html).
89/tcp open http Microsoft IIS httpd
|_http-title: Site doesn't have a title (text/html).
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2003 3790 Service Pack 2 microsoft-ds
1025/tcp open msrpc Microsoft Windows RPC
1026/tcp open msrpc Microsoft Windows RPC
1029/tcp open msrpc Microsoft Windows RPC
1433/tcp open ms-sql-s Microsoft SQL Server 2005 9.00.1399.00; RTM
| ms-sql-ntlm-info:
|_ Product_Version: 5.2.3790
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2020-11-26T14:12:06
|_Not valid after: 2050-11-26T14:12:06
|_ssl-date: 2020-11-26T09:43:03+00:00; 0s from scanner time.
2383/tcp open ms-olap4?
3306/tcp open mysql MySQL (unauthorized)
3389/tcp open ms-wbt-server Microsoft Terminal Service
5555/tcp open freeciv?
8001/tcp open http Microsoft IIS httpd
|_http-title: Site doesn't have a title (text/html).
8002/tcp open http Microsoft IIS httpd
|_http-title: Site doesn't have a title (text/html).
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
| http-methods:
|_ Potentially risky methods: PUT DELETE
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache-Coyote/1.1
|_http-title: Directory Listing For /
8402/tcp open http Microsoft IIS httpd
|_http-title: Site doesn't have a title (text/html).
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=11/26%Time=5FBF77F1%P=i686-pc-windows-windows%r
SF:(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07ver
SF:sion\x04bind\0\0\x10\0\x03");
MAC Address: 00:0C:29:0E:72:D5 (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_server_2003
Host script results:
|_clock-skew: mean: -2h39m59s, deviation: 4h37m07s, median: 0s
| ms-sql-info:
| 192.168.10.146:1433:
| Version:
| name: Microsoft SQL Server 2005 RTM
| number: 9.00.1399.00
| Product: Microsoft SQL Server 2005
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_nbstat: NetBIOS name: TOMAS-CB1004C61, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:0e:72:d5 (VMware)
| smb-os-discovery:
| OS: Windows Server 2003 3790 Service Pack 2 (Windows Server 2003 5.2)
| OS CPE: cpe:/o:microsoft:windows_server_2003::sp2
| Computer name: tomas-cb1004c61
| NetBIOS computer name: TOMAS-CB1004C61\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2020-11-26T17:42:13+08:00
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)
TRACEROUTE
HOP RTT ADDRESS
1 0.15 ms 192.168.10.146
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 203.74 seconds
收集到信息：
目录爆破
选择一个站点，看下目录
发现目标站点有 phpinfo, phpmyadmin；根据以上收集的简单信息，尝试利用 phpmyadmin 与 mysql 进行写 shell。
phpmyadmin 爆破
爆破下 phpmyadmin 试试，
成功获取账户与密码，可以看到是 root 用户
开启 mysql 远程
登录后，尝试下开始 root 远程登录，失败。
mysql 写日志
改变下思路，尝试利用 mysql 的写日志功能 getshell。
查看下当前日志配置，
设置日志文件路径
写一句话，到我们指定的日志文件
getshell
使用 菜刀连接
至此 getshell 目标达成。
我们试试执行下命令看是否可以提权呢？
执行简单命令提示失败。上传个 cmd 试试
尝试上传 cmd，提示成功；但是文件管理没有显示，看起来有防护呢
改变个思路，上个大马看看，能否运行命令
虽然是 php+mysql 环境，根据前面收集到信息看到系统是 2003，那么 asp/aspx 也是可以解析的。
访问我们的大马
看到了云锁、安全狗进程，看来我们上传的 cmd 被云锁拦截了。
如果想要提权， 需要绕过云锁与安全狗。
具体操作且听下回分解。
深圳德慎思信息安全
专为金融、政府及企事业单位提供红队实战的安全测评服务，德慎思立足深圳放眼世界，紧抓中华民族复兴机遇，以科创为民的精神贡献自身卓越技能。
