Skip to content

Commit 1c9a890

Browse files
wvuwvu
committed
Land rapid7#7949, nfsmount and snmp_login docs
2 parents 176e88f + 4f8e208 commit 1c9a890

File tree

2 files changed

+207
-0
lines changed

2 files changed

+207
-0
lines changed

‎documentation/modules/auxiliary/scanner/nfs/nfsmount.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
## Vulnerable Application
2+
3+
NFS is very common, and this scanner searches for a mis-configuration, not a vulnerable software version. Installation instructions for NFS can be found for every operating system.
4+
The [Ubuntu 14.04](https://help.ubuntu.com/14.04/serverguide/network-file-system.html) instructions can be used as an example for installing and configuring NFS. The
5+
following was done on Kali linux:
6+
7+
1. `apt-get install nfs-kernel-server`
8+
2. Create 2 folders to share:
9+
```
10+
mkdir /tmp/open_share
11+
mkdir /tmp/closed_share
12+
```
13+
3. Add them to the list of shares:
14+
```
15+
echo "/tmp/closed_share 10.1.2.3(ro,sync,no_root_squash)" >> /etc/exports
16+
echo "/tmp/open_share *(rw,sync,no_root_squash)" >> /etc/exports
17+
```
18+
4. Restart the service: `service nfs-kernel-server restart`
19+
20+
In this scenario, `closed_share` is set to read only, and only mountable by the IP 10.1.2.3. `open_share` is mountable by anyone (`*`) in read/write mode.
21+
22+
## Verification Steps
23+
24+
1. Install and configure NFS
25+
2. Start msfconsole
26+
3. Do: `use auxiliary/scanner/nfs/nfsmount`
27+
4. Do: `run`
28+
29+
## Scenarios
30+
31+
A run against the configuration from these docs
32+
33+
```
34+
msf > use auxiliary/scanner/nfs/nfsmount
35+
msf auxiliary(nfsmount) > set rhosts 127.0.0.1
36+
rhosts => 127.0.0.1
37+
msf auxiliary(nfsmount) > run
38+
39+
[+] 127.0.0.1:111 - 127.0.0.1 NFS Export: /tmp/open_share [*]
40+
[+] 127.0.0.1:111 - 127.0.0.1 NFS Export: /tmp/closed_share [10.1.2.3]
41+
[*] Scanned 1 of 1 hosts (100% complete)
42+
[*] Auxiliary module execution completed
43+
```
44+
45+
Another example can be found at this [source](http://bitvijays.github.io/blog/2016/03/03/learning-from-the-field-basic-network-hygiene/):
46+
47+
```
48+
[*] Scanned 24 of 240 hosts (10% complete)
49+
[+] 10.10.xx.xx NFS Export: /data/iso [0.0.0.0/0.0.0.0]
50+
[*] Scanned 48 of 240 hosts (20% complete)
51+
[+] 10.10.xx.xx NFS Export: /DataVolume/Public [*]
52+
[+] 10.10.xx.xx NFS Export: /DataVolume/Download [*]
53+
[+] 10.10.xx.xx NFS Export: /DataVolume/Softshare [*]
54+
[*] Scanned 72 of 240 hosts (30% complete)
55+
[+] 10.10.xx.xx NFS Export: /var/ftp/pub [10.0.0.0/255.255.255.0]
56+
[*] Scanned 96 of 240 hosts (40% complete)
57+
[+] 10.10.xx.xx NFS Export: /common []
58+
```
59+
60+
## Confirming
61+
62+
Since NFS has been around since 1989, with modern NFS(v4) being released in 2000, there are many tools which can also be used to verify this configuration issue.
63+
The following are other industry tools which can also be used.
64+
65+
### [nmap](https://nmap.org/nsedoc/scripts/nfs-showmount.html)
66+
67+
```
68+
nmap -p 111 --script=nfs-showmount 127.0.0.1
69+
70+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-02-12 19:41 EST
71+
Nmap scan report for localhost (127.0.0.1)
72+
Host is up (0.000037s latency).
73+
PORT STATE SERVICE
74+
111/tcp open rpcbind
75+
| nfs-showmount:
76+
| /tmp/open_share *
77+
|_ /tmp/closed_share 10.1.2.3
78+
79+
Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds
80+
```
81+
82+
### [showmount](https://packages.debian.org/sid/amd64/nfs-common/filelist)
83+
84+
showmount is a part of the `nfs-common` package for debian.
85+
86+
```
87+
showmount -e 127.0.0.1
88+
Export list for 127.0.0.1:
89+
/tmp/open_share *
90+
/tmp/closed_share 10.1.2.3
91+
```
92+
93+
## Exploitation
94+
95+
Exploiting this mis-configuration is trivial, however exploitation doesn't necessarily give access (command execution) to the system.
96+
If a share is mountable, ie you either are the IP listed in the filter (or could assume it through a DoS), or it is open (*), mounting is trivial.
97+
The following instructions were written for Kali linux.
98+
99+
1. Create a new directory to mount the remote volume to: `mkdir /mnt/remote`
100+
2. Use `mount` to link the remote volume to the local folder: `mount -t nfs 127.0.0.1:/tmp/open_share /mnt/remote`
101+
102+
The mount and its writability can now be tested:
103+
104+
1. Write a file: `echo "hello" > /mnt/remote/test`
105+
2. The remote end now has the file locally:
106+
```
107+
cat /tmp/open_share/test
108+
hello
109+
```
110+
111+
1. To unmount: `umount /mnt/remote`
112+
113+
At this point, its time to hope for a file of value. Maybe code with hardcoded credentials, a `passwords.txt`, or an `id_rsa`.

‎documentation/modules/auxiliary/scanner/snmp/snmp_login.md

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
## Vulnerable Application
2+
3+
Installation instructions for SNMP server can be found for every operating system.
4+
The [Ubuntu 14.04](https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-an-snmp-daemon-and-client-on-ubuntu-14-04) instructions can be used as an example for installing and configuring NFS. The
5+
following was done on Kali linux:
6+
7+
1. `sudo apt-get install snmpd`
8+
2. Set SNMP to listen on non-localhost: `nano /etc/snmp/snmpd.conf`
9+
```
10+
# Listen for connections from the local system only
11+
#agentAddress udp:127.0.0.1:161
12+
# Listen for connections on all interfaces (both IPv4 *and* IPv6)
13+
agentAddress udp:161,udp6:[::1]:161
14+
```
15+
3. Restart the service: `service snmpd restart`
16+
17+
### SNMP Versions
18+
19+
SNMP has 3 main versions.
20+
* **1**, **2c**: both use simple password protection (string), and are often defaulted to `public` (read only), and `private` (read/write). Version 2 is backwards compatible with version 1. This is a plaintext protocol and is vulenrable to being intercepted.
21+
* **3**: has several security levels and is significantly more complex, but also not covered in this module.
22+
23+
## Verification Steps
24+
25+
1. Install and configure SNMP
26+
2. Start msfconsole
27+
3. Do: `use auxiliary/scanner/snmp/snmp_login`
28+
4. Do: `run`
29+
30+
## Scenarios
31+
32+
A run against the configuration from these docs
33+
34+
```
35+
msf > use auxiliary/scanner/snmp/snmp_login
36+
msf auxiliary(snmp_login) > set rhosts 127.0.0.1
37+
rhosts => 127.0.0.1
38+
msf auxiliary(snmp_login) > run
39+
40+
[!] No active DB -- Credential data will not be saved!
41+
[+] 127.0.0.1:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): Linux hostname 4.9.0-kali1-amd64 #1 SMP Debian 4.9.6-3kali2 (2017-01-30) x86_64
42+
[*] Scanned 1 of 1 hosts (100% complete)
43+
[*] Auxiliary module execution completed
44+
```
45+
46+
Another example can be found at this [source](http://bitvijays.github.io/blog/2016/03/03/learning-from-the-field-basic-network-hygiene/):
47+
48+
```
49+
[+] 10.4.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): Cisco IOS Software, C1130 Software (C1130-K9W7-M), Version 12.4(10b)JA, RELEASE SOFTWARE (fc2)
50+
Technical Support: http://www.cisco.com/techsupport
51+
Copyright (c) 1986-2007 by Cisco Systems, Inc.
52+
Compiled Wed 24-Oct-07 15:17 by prod_rel_team
53+
[*] Scanned 12 of 58 hosts (20% complete)
54+
[*] Scanned 18 of 58 hosts (31% complete)
55+
[+] 10.10.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): Digi Connect ME Version 82000856_F6 07/21/2006
56+
[+] 10.10.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): Digi Connect ME Version 82000856_F6 07/21/2006
57+
[*] Scanned 24 of 58 hosts (41% complete)
58+
[+] 10.11.xx.xx:161 - LOGIN SUCCESSFUL: private (Access level: read-write); Proof (sysDescr.0): ExtremeXOS version 12.2.2.11 v1222b11 by release-manager on Mon Mar 23 17:54:47 PDT 2009
59+
[+] 10.11.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): ExtremeXOS version 12.2.2.11 v1222b11 by release-manager on Mon Mar 23 17:54:47 PDT 2009
60+
[+] 10.11.xx.xx:161 - LOGIN SUCCESSFUL: private (Access level: read-write); Proof (sysDescr.0): ExtremeXOS version 12.2.2.11 v1222b11 by release-manager on Mon Mar 23 17:54:47 PDT 2009
61+
[+] 10.11.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): ExtremeXOS version 12.2.2.11 v1222b11 by release-manager on Mon Mar 23 17:54:47 PDT 2009
62+
[+] 10.11.xx.xx:161 - LOGIN SUCCESSFUL: private (Access level: read-write); Proof (sysDescr.0): ExtremeXOS version 12.2.2.11 v1222b11 by release-manager on Mon Mar 23 17:54:47 PDT 2009
63+
[+] 10.11.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): ExtremeXOS version 12.2.2.11 v1222b11 by release-manager on Mon Mar 23 17:54:47 PDT 2009
64+
[*] Scanned 29 of 58 hosts (50% complete)
65+
[*] Scanned 35 of 58 hosts (60% complete)
66+
[*] Scanned 41 of 58 hosts (70% complete)
67+
[*] Scanned 47 of 58 hosts (81% complete)
68+
[+] 10.25.xx.xx:161 - LOGIN SUCCESSFUL: public (Access level: read-only); Proof (sysDescr.0): Digi Connect ME Version 82000856_F6 07/21/2006
69+
```
70+
71+
## Confirming
72+
73+
Since SNMP has been around for quite a while, there are many tools which can also be used to verify this configuration issue.
74+
The following are other industry tools which can also be used.
75+
76+
### [nmap](https://nmap.org/nsedoc/scripts/snmp-info.html)
77+
78+
```
79+
nmap -p 161 -sU --script=snmp-info 127.0.0.1
80+
81+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-02-12 23:00 EST
82+
Nmap scan report for localhost (127.0.0.1)
83+
Host is up (0.00017s latency).
84+
PORT STATE SERVICE
85+
161/udp open snmp
86+
| snmp-info:
87+
| enterprise: net-snmp
88+
| engineIDFormat: unknown
89+
| engineIDData: 54ad55664725a15800000000
90+
| snmpEngineBoots: 2
91+
|_ snmpEngineTime: 31m30s
92+
93+
Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds
94+
```

0 commit comments

Comments
 (0)