The ever-present specter in memory-A Post Exploitation Toolkit for High Value Systems.pdf

1、演讲人：Skay时间：2024.08.25PART ONE01MANDAMUS MEDIOCREM REREHENDUNT漏洞价值最大化全面、长期、隐蔽高价值Web应用后渗透high-value web applicationsdomain management team buildingdefect tracking platforms,documents code repository management platformsApplication-orientedMANT EUM EList applicationsList applicationsList applicationsLi

2、st applicationsMANT EUM E初始权限初始权限获取初始权限PART ONE02Post-Exploitation Post-Exploitation F Functions unctions List applicationsMANT EUM E为了提高后门的隐蔽性，采用无需落地的内存Shell，针对重启失效问题，可以采用agent形式，但是与其新增一个落地jar文件，不如修改已有文件。当然还需修改文件修改时间zimbra本身功能上支持插件扩展，且默认安装以下常用插件持久性后门隐藏MANT EUM EMemory-ShellMANT EUM EObtain the desi

3、red DATAObtain the desired DATAMANT EUM ENo,we have a better wayNo,we have a better wayhttps:/ the python-zimbra library.Offer functionality to handle the creation of Zimbra SOAP queries.Send HTTP requests to the backend for processing.Retrieve desired data by calling SOAP API through HTTP requests.

4、Is it really necessary to make such a fuss about it?DebugDebugObtain the desired DATAObtain the desired DATADebugDebug从层紧密嵌套的调用栈数据库连接数据库连接Obtain the desired DATADatabase Connection InformationObtain the desired DATAObtain the desired DATAUser list and details retrieval分析认证机制分析认证机制Obtain the desired

5、DATAObtain the desired DATA Generate arbitrary user login credentials凭证伪造凭证伪造会话劫持会话劫持try to construct OperationContext,SearchParams,Mailbox,etc.Among themObtain the desired DATAObtain the desired DATAObtain the desired DATAObtain the desired DATAMail information retrievaDebugDebugObtain the desired

6、DATAObtain the desired DATAMail information retrievaDebugDebugDebugDebug流量侧隐蔽流量侧隐蔽Mail information retrievaPART ONE021obtaining domain controller administrator information and database-stored domain information,2obtaining database connection information,3obtaining integrated thir