Windows System Vulnerability claim

Suppose you've uploaded Webshell on the target server.

To view information about the target server:

User:

Network, Port:

Component:

Then execute the cmd command:

Click to execute:

From this you can know that the system Cmd.exe is not available, may be deleted or banned. We need to upload a cmd.exe, here to pay attention to the upload directory must be readable writable executable directory.

We upload a Cmd.exe directly to the root directory of the site

ASP file Upload function not available, server support ASPX, so we can use ASP Webshell to create a new ASPX Webshell file

When the new is complete, we visit this aspx Webshell file and click Execute cmd command. General ASPX permissions are relatively large, you can directly execute system cmd.

Because the command is executed in ASPX, the Web page dies, so use this webshell to upload a cmd.exe and return to the original Webshell to execute the command.

To see the system patches because you want to exploit the system vulnerabilities.

Found that there are a lot of system vulnerability patches are not installed. Then we can use the exploit tool of the loophole to attack according to the flaw number, here we use IIS6.exe to carry on the claim. First Use Aspxshell upload IIS6.exe.

Then execute IIS6.exe.

This step is also a claim to be successful, if you want to long-term control of the target host, it is necessary to continue to go down.

1. Modify Admin account password (undesirable will be found, and impact on target host, make admin unable to login)

2. Add an admin (undesirable, easy to find)

3. Read Admin account password (requires Administrator account not logged off)

4. Read Admin password hash

5. Trojan Planting, remote control

Here is a possible solution, the system users have a system help account, which is the system's own account is not easy to detect. We can elevate it to system permissions.

Read the administrator password to see if the administrator account is logged out.

The system administrator is running, then upload the tool and get the admin account password.

After obtaining the account password, connect 3389 ports.