内网渗透流程

1 Initial Access

Basic Web Vulnerability (weak password, file upload, file inclusion, RCE, deserialization)

Various basic services 0/1/N Day RCE (vsftpd, Samba, fastcgi)

Personal machine (fishing and cooking)

Supply Chain Attack

VPN, VNC, TV, etc.

0/1day

1.1 网络位置判断

Network Area

DMZ

Production Network

Office network

Host role judgment

Operation and maintenance

administrative

…

Connectivity judgment

icmp

1.2 Proxy

Online Test

exe or ps1

TCP/UDP/HTTP/HTTPS/DNS/ICMP

Port or Socket

1.3 Recon

Work Group or Domain

Domain Admin or !Admin

Command or Secret File

Host Discovery

1.3.1 浏览器历史及密码

Firefox

Chrome

…

1.3.2 RDP

Logon event

MSTSC history

1.3.3 凭据管理器

Web Credentials

1.3.4 信息收集

Agent

Network Discovery

1.3.5 用户监控

Login Monitoring

Drag monitoring