Online but not online machine
Introduction of the machine without going online
It is a common problem for us to go online but not to go online. How to go online on the intranet without going online? We have divided it into the following forms. Based on what we have learned before, we started to experiment. The common network topology is as follows:
The general infiltration scenario is as follows. The hacker owns a hacker machine and a VPS machine located on the public network. Both machines can access the Internet, and the target company is divided into two areas, A area and B area. The computers in the area can access whether they access the Internet or access him from the Internet. However, the computers in area B are restricted due to the internal network environment, and cannot directly access the Internet environment. They can only access the internal machines of the company, such as The web server in area A or other hosts that also exist in area B
Classification of machines not connected to the Internet
The machine that goes online but does not go online generally means that we control the computer in area A, and then we need to go online with the computer in area B to the CS tool or MSF, because the machine in B cannot communicate with the VPS without going online. Network machines are generally in two situations:
- Pure intranet environment, no port goes out of the network, and cannot directly access the Internet environment
- Only specific ports can go out of the network, such as ports 53 and 80, we can only access the Internet through a certain port
There are also the following two situations for the machines that go out of the network in area A. Computers located in area A generally have dual or multiple network cards, and can access machines on the internal network or the Internet. We generally have a special term to describe it (transit machine or springboard machine), in the infiltration process, it is very important to find the computer in area A (how to find the computer in area A? Here is a small question, we can use RPC to call without authorization oxid interface, so as to realize the detection of machines with multiple network cards in the intranet):
- Machines in area A can access the Internet, and machines in area A can access the Internet
- Only specific ports in area A can go out of the network, such as port 53. Machines in area A can only access the Internet through port 53.