内网渗透frp

需求：家里能访问部署在公司局域网的网站环境：一台阿里云，一台公司内部的虚拟机(局域网)首先下载frp 下载地址 https://github.com/fatedier/frp/releases#解压之后目录太长，个人习惯mv成frp：[root@iZwz9bpgupcehi7r19i7uaZ ~]# ll frp/total 22992-rwxr-xr-x 1 1001 121 9973760 J

水煮胡萝卜

2288人浏览 · 2021-08-10 09:47:57

水煮胡萝卜 · 2021-08-10 09:47:57 发布

需求：家里能访问部署在公司局域网的网站

环境：一台阿里云，一台公司内部的虚拟机(局域网)

首先下载frp 下载地址 https://github.com/fatedier/frp/releases

#解压之后目录太长，个人习惯mv成frp：
[root@iZwz9bpgupcehi7r19i7uaZ ~]# ll frp/
total 22992
-rwxr-xr-x 1 1001 121 9973760 Jun 3 01:02 frpc
-rw-r--r-- 1 1001 121 9503 Jun 3 01:06 frpc_full.ini
-rw-r--r-- 1 1001 121 126 Jun 3 01:06 frpc.ini
-rwxr-xr-x 1 1001 121 13180928 Jun 3 01:02 frps
-rw-r--r-- 1 1001 121 5051 Jun 3 01:06 frps_full.ini
-rw-r--r-- 1 1001 121 133 Aug 3 16:20 frps.ini
-rw-r--r-- 1 1001 121 11358 Jun 3 01:06 LICENSE
-rw------- 1 root root 338093 Aug 4 09:16 nohup.out
drwxr-xr-x 2 1001 121 4096 Jun 3 01:06 systemd

解压文件夹内：

"frps"、"frps_full.ini"、"frps.ini"是放在服务器端运行的可执行文件和配置文件。
"frpc"、"frpc_full.ini"、"frpc.ini"是放在客户端端运行的可执行文件和配置文件。

服务器端配置文件：编辑 frps.ini
vi frpc.ini
#配置文件内容如下：
[common]
bind_addr=0.0.0.0
bind_port = 17000
auto_token=123456

dashboard_port = 7500
dashboard_user = admin
dashboard_pwd = admin

#注释：
"bind_addr"是服务器本地IP，不改。
"bind_port"是frp监听端口。
"token"是验证token建议设置上。
"dashboard_port"是frp面板端口。
"dashboard_user""dashboard_pwd"是面板的账户密码。

启动执行： ./frps -c ./frps.ini

浏览器访问： http://服务器ip:7500
#上面配置的7500端口，使用上面配置的用户名和密码 admin/admin

客户端端配置文件：编辑 frpc.ini
[root@localhost frp]# cat frpc.ini
[common]
server_addr = 120.25.2.1
server_port = 17000
token = 123456
[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22519
remote_port = 6000

[web]
type = tcp
local_ip = 127.0.0.1
local_port = 80
remote_port = 8088

启动执行： ./frpc -c ./frpc.ini

#客户定启动成功之后不会有端口

日志如下：
客户端：
[root@localhost frp]# cat nohup.out
2021/08/04 12:10:45 [I] [service.go:304] [b3d1aa8e914229fc] login to server success, get run id [b3d1aa8e914229fc], server udp port [0]
2021/08/04 12:10:45 [I] [proxy_manager.go:144] [b3d1aa8e914229fc] proxy added: [ssh web]
2021/08/04 12:10:45 [I] [control.go:180] [b3d1aa8e914229fc] [web] start proxy success
2021/08/04 12:10:45 [I] [control.go:180] [b3d1aa8e914229fc] [ssh] start proxy success

服务器端：
[root@iZwz9bpgupcehi7r19i7uaZ ~]# cat nohup.out
2021/08/04 12:10:30 [I] [root.go:200] frps uses config file: frp/frps.ini
2021/08/04 12:10:30 [I] [service.go:192] frps tcp listen on 0.0.0.0:17000
2021/08/04 12:10:30 [I] [service.go:294] Dashboard listen on 0.0.0.0:7500
2021/08/04 12:10:30 [I] [root.go:209] frps started successfully
2021/08/04 12:10:30 [I] [service.go:449] [83c7bc960dad95e6] client login info: ip [114.255.193.227:55586] version [0.37.0] hostname [] os [linux] arch [amd64]
2021/08/04 12:10:30 [I] [tcp.go:63] [83c7bc960dad95e6] [ssh] tcp proxy listen port [6000]
2021/08/04 12:10:30 [I] [control.go:444] [83c7bc960dad95e6] new proxy [ssh] success
2021/08/04 12:10:30 [I] [tcp.go:63] [83c7bc960dad95e6] [web] tcp proxy listen port [8088]
2021/08/04 12:10:30 [I] [control.go:444] [83c7bc960dad95e6] new proxy [web] success
2021/08/04 12:10:36 [I] [control.go:307] [83c7bc960dad95e6] control writer is closing
2021/08/04 12:10:36 [I] [proxy.go:87] [83c7bc960dad95e6] [web] proxy closing
2021/08/04 12:10:36 [I] [proxy.go:159] [83c7bc960dad95e6] [web] listener is closed
2021/08/04 12:10:36 [I] [proxy.go:87] [83c7bc960dad95e6] [ssh] proxy closing
2021/08/04 12:10:36 [I] [proxy.go:159] [83c7bc960dad95e6] [ssh] listener is closed
2021/08/04 12:10:36 [I] [control.go:382] [83c7bc960dad95e6] client exit success
2021/08/04 12:10:45 [I] [service.go:449] [b3d1aa8e914229fc] client login info: ip [114.255.193.227:55588] version [0.37.0] hostname [] os [linux] arch [amd64]
2021/08/04 12:10:45 [I] [tcp.go:63] [b3d1aa8e914229fc] [web] tcp proxy listen port [8088]
2021/08/04 12:10:45 [I] [control.go:444] [b3d1aa8e914229fc] new proxy [web] success
2021/08/04 12:10:45 [I] [tcp.go:63] [b3d1aa8e914229fc] [ssh] tcp proxy listen port [6000]
2021/08/04 12:10:45 [I] [control.go:444] [b3d1aa8e914229fc] new proxy [ssh] success