BevictorΰµÂ

֤ȯ¼ò³Æ£ºBevictorΰµÂ ֤ȯ´úÂ룺002212
È«Ììºò7x24Сʱ·þÎñ£º 400-777-0777

¼ì²âÓë·À»¤ÄÜÁ¦-Òþ²Ø³¤ÆÚפÁôÖ®Òþ²ØÆô¶¯

³¤ÆÚ»¯ÊÇÒ»¸ö¹¥»÷Á´ÖÜÆÚÖкÜÊÇÖ÷ÒªµÄ»·½Ú £¬Ö¸ÓÃwebshell¡¢·´µ¯shell¡¢ºóÃÅ¡¢rootkitºã¾Ã¿ØÖÆÊ§ÏÝ»úеµÄÒ»ÖÖÊÖÒÕ £¬¿ÉÄÜ»áÉæ¼°µ½dnsËíµÀ¡¢http¡¢icmp ËíµÀÒÔ¼°¼ÓÃÜÁ÷Á¿ £¬´Ó¶øµÖ´ïÒ»Ö±¿ØÖÆÊ§ÏÝ»úе¶ø²»±»·¢Ã÷µÄÄ¿µÄ¡£

¼ì²âÓë·À»¤ÄÜÁ¦-Òþ²Ø³¤ÆÚפÁôÖ®Òþ²ØÆô¶¯

Ðû²¼Ê±¼ä£º2021-07-28
ä¯ÀÀ´ÎÊý£º3544
·ÖÏí£º

01 Òþ²Ø³¤ÆÚפÁô

1.1 Åä¾°

³¤ÆÚ»¯ÊÇÒ»¸ö¹¥»÷Á´ÖÜÆÚÖкÜÊÇÖ÷ÒªµÄ»·½Ú £¬Ö¸ÓÃwebshell¡¢·´µ¯shell¡¢ºóÃÅ¡¢rootkitºã¾Ã¿ØÖÆÊ§ÏÝ»úеµÄÒ»ÖÖÊÖÒÕ £¬¿ÉÄÜ»áÉæ¼°µ½dnsËíµÀ¡¢http¡¢icmp ËíµÀÒÔ¼°¼ÓÃÜÁ÷Á¿ £¬´Ó¶øµÖ´ïÒ»Ö±¿ØÖÆÊ§ÏÝ»úе¶ø²»±»·¢Ã÷µÄÄ¿µÄ¡£

ÔÚ¹¥»÷ÕßʹÓÃÎó²î»ñÈ¡µ½Ä³Ì¨»úеµÄ¿ØÖÆÈ¨ÏÞÖ®ºó £¬»á˼Á¿½«¸Ã»úе×÷Ϊһ¸ö³¤ÆÚ»¯µÄ¾Ýµã £¬ÝªÖ²Ò»¸ö¾ß±¸³¤ÆÚ»¯µÄºóÃÅ £¬×ÝÈ»ÔÚ×°±¸ÖØÆô¡¢Æ¾Ö¤Ð޸ĻòÆäËû¿ÉÄÜÆÆËðÄ¿½ñ¶ñÒâÔ˶¯µÄ²Ù×÷±¬·¢ºó £¬Ò²Äܹ»ËæÊ±ÅþÁ¬¸Ã±»¿Ø»úе¾ÙÐÐÉîÈëÉøÍ¸¡£

1.2 ³¤ÆÚפÁôÒªÁì

1.2.1 Òþ²ØÆô¶¯

1.2.1.1 SystemdÆô¶¯

SystemĬÈÏ´ÓĿ¼/etc/systemd/system/¶ÁÈ¡ÉèÖÃÎļþ¡£¿ÉÊÇÄÚÀï´æ·ÅµÄ´ó²¿·ÖÎļþ¶¼ÊÇ·ûºÅÁ´½Ó £¬Ö¸ÏòĿ¼/lib/systemd/system/ £¬ÕæÕýµÄÉèÖÃÎļþ´æ·ÅÓÚÕâ¸öĿ¼ÖС£

Ò»Ñùƽ³£ÏµÍ³ÊÖ¹¤½¨ÉèµÄµ¥Î»Îļþ½¨Òé´æ·ÅÔÚ/etc/system/system/Ŀ¼Ï¡£

1. Ê×ÏȱàÒëÌáǰÉèÖúõĺóÃÅÎļþ¡£

2. ÔÚ/etc/Ŀ¼Ï½¨Éèdemo.local£¨Ãû³Æ£© £¬ÄÚÀïдÈëÖ±½ÓÖ´ÐкóÃÅÎļþ¡£

3. ÐÞ¸ÄȨÏÞ¡£

4. ÔÚ/etc/system/system/Ŀ¼Ï½¨ÉèÒ»¸ödemo.serviceÎļþ¡£

5. ÉèÖÃÆô¶¯Á´½Ó¡£

6. ÖØÆô»ñµÃshell¡£

1.2.1.2¶þ½øÖÆÎļþѬȾ

»ù±¾Á÷³Ì

Íê³É¿ÉÓÿռäµÄºóÃÅ´úÂë(Ìí¼ÓÇø¶Î)£»

Ð®ÖÆÖ´ÐÐÁ÷³Ì£»

×¢ÈëºóÃÅ´úÂ룻

»Ö¸´Ö´ÐÐÁ÷³Ì¡£

µÚÒ»²½£ºÐèÒªÕÒµ½¿ÉÓÿռä¡£

ÔõÑùÔÚPEÎļþÖÐÑ¡ÔñºÏÊʵĿռäÀ´²åÈëºóÃÅ´úÂëºÜÊÇÖ÷Òª, Õ⽫ӰÏìµ½ºóÃű»¼ì²âµ½µÄΣº¦ÏµÊý¡£

½èÖúÓÚÒ»¸öÃûΪCminerµÄ¹¤¾ß £¬ºÜÈÝÒ×ö¾Ù¶þ½øÖÆÎļþµÄËùÓдúÂë¶´¡£

./Cminer putty.exe 300 ÏÂÁîö¾ÙCode Caves´óÓÚ300×Ö½Ú¡£

ÔÚÕâÖÖÇéÐÎÏ £¬ÓÐ5¸öºÃµÄCode Caves¿ÉÒÔʹÓá£ÆðʼµØÖ·¸ø³öÁËCavesµÄÐéÄâÄÚ´æµØÖ·£¨VMA£©¡£ÕâÊÇCavesµÄµØÖ· £¬µ±PEÎļþ¼ÓÔØµ½ÄÚ´æÖÐʱ £¬ÎļþÆ«ÒÆÁ¿ÊÇÒÔ×Ö½ÚΪµ¥Î»µÄPEÎļþÄÚµÄCavesµØÖ·¡£

Óɴ˿ɼû´ó²¿·ÖCaves¶¼ÔÚÊý¾Ý¶ÎÄÚ £¬ÓÉÓÚÊý¾Ý¶ÎûÓÐÖ´ÐÐÌØÈ¨¶Î±ê¼Ç, ÕâÀïÐèÒª¸ü¸Ä¡£ºóÃÅ´úÂë»òÐí400-500×Ö½Ú×óÓÒ £¬ÒÔÊÇ5¸öCavesÊÇ×ã¹»µÄ¡£CavesµÄÆðʼµØÖ·Ó¦¸Ã±»ÉúÑÄ £¬ÔÚ½«¶ÎÌØÈ¨¸ü¸ÄΪR/W/Eºó £¬µÚÒ»²½µÄºóÃÅÀú³Ì¾ÍÍê³ÉÁË¡£

µÚ¶þ²½£ºÍ¨¹ýÐÞ¸ÄÄ¿µÄ¿ÉÖ´ÐÐÎļþµÄÖ¸Áî £¬½«Ö´ÐÐÁ÷ÖØ¶¨Ïòµ½ºóÃÅ´úÂë¡£

ÕâÀïÓÐÒ»¸ö¹ØÓÚÑ¡Ôñ½«±»Ð޸ĵÄÖ¸ÁîÖ÷Ҫϸ½Ú, ËùÓжþ½øÖÆÖ¸Áî¾ßÓÐ×Ö½Ú¾Þϸ £¬ÎªÁËÌø×ªµ½ºóÃÅ´úÂëµØÖ· £¬½«Ê¹ÓÃ5»ò6×ֽڵij¤ÌøÔ¾¡£Òò´Ë £¬µ±ÐÞ²¹¶þ½øÖÆÊ± £¬½«±»ÐÞ²¹µÄÖ¸ÁîÐèÒªÓë³¤Ìø×ªÖ¸ÁîµÄ¾ÞϸÏàͬ £¬²»È»ÉÏÒ»Ìõ»òÏÂÒ»ÌõÖ¸Á±»ÆÆËð¡£

ÔÚputtyÆô¶¯ºóµÄ½çÃæÖÐ, µã»÷ ¡°Open¡± °´Å¥»áÆô¶¯Ò»¸ö¼ì²éIPµØÖ·ÊÇ·ñÓÐÓõĹ¦Ð§¡£

ÈôÊÇIPµØÖ·×Ö¶ÎÖµ²»Îª¿Õ²¢ÇÒÓÐÓà £¬ÔòËüÆô¶¯ÊµÑéÅþÁ¬¸ø¶¨IPµØÖ·µÄÅþÁ¬¹¦Ð§¡£ÈôÊǿͻ§¶ËÀֳɽ¨ÉèSSH»á»° £¬½«µ¯³öÒ»¸öд°¿Ú²¢ÇëÇóƾ֤¡£

´Ë´¦ÊÇÖØ¶¨Ïò±¬·¢µÄµã £¬ÓÉÓÚAV²úÆ·²»¿É¹»¸´ÖÆÕâÖÖÖØ´óµÄÇéÐÎ £¬Ö²ÈëµÄºóÃŽ«²»»á±»×Ô¶¯»¯É³ºÐºÍ¶¯Ì¬ÆÊÎö»úÖÆ¼ì²âµ½¡£

ʹÓûù±¾µÄÄæÏòÒªÁì £¬ËÑË÷ÏÂÃæµÄ×Ö·û´®ºÍ×Ö·û´®ÒýÓà £¬²»ÄÑÕÒµ½ÅþÁ¬º¯ÊýµÄµØÖ· £¬ÒªÁìÈçÏ£º¿Í»§¶Ë½¨ÉèÓë¸ø¶¨IPµÄÅþÁ¬ºó £¬ÓÐÒ»¸ö×Ö·û´® ¡°login as:¡± ´òÓ¡µ½·ºÆðµÄ´°¿Ú¡£Õâ¸ö×Ö·û´®¿ÉÒÔ×ÊÖúÎÒÃÇÕÒµ½ÅþÁ¬º¯ÊýµÄµØÖ· £¬IDA ProÔÚÕâ·½Ãæ×öµÃºÜºÃ¡£

ΪÁËÕÒµ½ ¡°login as:¡± ×Ö·û´®, ÔÚIDAÉÏÒÀ´Î·­¿ª Views->Open Subviews->Strings

ÕÒµ½×Ö·û´®ºó £¬Ë«»÷תµ½ËùÔÚλÖà £¬ÔÚÊý¾Ý½ÚÄÚ²¿IDA²éÕÒËùÓжÔ×Ö·û´®µÄ½»Ö¯ÒýÓà £¬°´ ¡°Ctrl+X¡± £¬ÏÔʾËùÓн»Ö¯ÒýÓà £¬²¢Õâ¸öÒýÓÃÔÚ´òÓ¡ ¡°login as:¡± ×Ö·û´®µÄº¯ÊýÄÚ²¿¡£

ÕâÀïÊÇÒªÐÞ²¹µÄÖ¸Áî¡£ÔÚ¾ÙÐÐÈκθü¸Ä֮ǰ £¬Çë×¢ÖØÉÏÏÂÎĵÄÖ¸Áî¡£

Ö´ÐкóÃÅ´úÂëºóÖ¸ÁÔÙ´ÎʹÓá£

ͨ¹ý½«PUSH 467C7CÖ¸Áî¸ÄΪJMP 0x47A478 £¬Íê³ÉºóÃÅÀú³ÌµÄÖØ¶¨Ïò½×¶Î¡£ÐèÒª×¢ÖØµÄÊÇÏÂÒ»¸öÖ¸ÁîµØÖ·¡£Ëü½«ÔÚÖ´ÐкóÃÅ´úÂëºóÓÃ×÷·µ»ØµØÖ·¡£

µÚÈý²½£ººóÃÅ´úÂë×¢Èë¡£

Ê×ÏÈÔÚÖ´ÐкóÃÅÖ®ËÞÊÀ´æ¼Ä´æÆ÷ÖеÄÄÚÈÝ¡£¼Ä´æÆ÷ÖеÄÿ¸öÖµ¹ØÓÚ³ÌÐòµÄÖ´Ðж¼ÊǺÜÊÇÖ÷ÒªµÄ¡£Í¨¹ýÔÚ´úÂëµÄOEP(³ÌÐòÈë¿Úµã)°²ÅÅPUSHEDºÍPUSHEDÖ¸Áî £¬°ÑËùÓмĴæÆ÷ÄÚµÄÖµºÍ¼Ä´æÆ÷±ê¼Ç¶¼´æ´¢ÔÚ¿ÍÕ»ÖС£ÕâЩֵ½«ÔÚÖ´ÐÐÍêºóÃÅ´úÂëÖ®ºóµ¯³ö £¬ÒÔ±ã³ÌÐò¿ÉÒÔ¼ÌÐøÖ´Ðв»ÍÉ»¯¡£

ʹÓõĺóÃÅ´úÂëÊÇmeterpreter·´ÏòTCP ShellCode¡£¿ÉÊÇÔÚShellCodeÖÐÐèÒª×öÉÙÁ¿Ð޸ġ£Í¨³£·´ÏòTCP ShellCode»áÓÐʵÑéÅþÁ¬Ëæ´¦Öóͷ£³ÌÐòµÄ´ÎÊý»òʱ¼äÏÞÖÆ £¬ÈôÊÇÅþÁ¬Ê§°Ü £¬Ôòͨ¹ýŲÓÃExitProcess APIŲÓùرÕÀú³Ì¡£

ÕâÀïÊÇÎÊÌâËùÔÚ £¬ÈôÊÇÅþÁ¬Ëæ´¦Öóͷ£³ÌÐòʧ°Ü £¬putty¿Í»§¶ËµÄÖ´Ðн«×èÖ¹¡£¸Ä±ä¼¸ÐÐShellCodeʹÆäÿ´ÎÅþÁ¬Ê§°ÜʱShellCodeÖØÊÔÅþÁ¬´¦Öóͷ£Æ÷ £¬ÕâÑùÒ²»áÏìÓ¦µÄïÔÌ­ShellCodeµÄÌå»ý¡£

ÔÚ»ã±à´úÂëÖоÙÐиü¸Äºó £¬Ê¹ÓÃnasm -f bin stager_reverse_tcp_nx.asmÏÂÁî¾ÙÐбàÒë¡£ÏÖÔÚ·´ÏòµÄTCP ShellCodeÒѾ­¿ÉÒÔʹÓÃÁË £¬¿ÉÊÇËü²»»á±»Ö±½Ó°²ÅÅ¡£ÎÒÃǵÄÄ¿µÄÊÇÔÚÐÂÏß³ÌÉÏÖ´ÐÐShellCode¡£

ΪÁ˽¨ÉèÒ»¸öеÄÏß³ÌʵÀý £¬ÐèÒªÁíÒ»¸öShellCode £¬Ê¹CreateThreadAPIŲÓÃÖ¸Ïò·´ÏòTCP ShellCode¡£ÕâÀïʹÓÃMetasploitÏîÄ¿Öн¨ÉèÏ̵߳Äshellcode¡£

½« createthread.asm ÎļþÖеĴúÂëת»»ÎªÊ®Áù½øÖÆÃûÌõÄShellCode £¬Ê¹ÓÃnasm -f bin createthread.asmÏÂÁî¾ÙÐбàÒë¡£ÔÚÕâÀï £¬ShellCode×¼±¸²åÈëµ½CavesÖÐ £¬µ«ÔÚ²åÈëShellCode֮ǰӦ¸Ã¶ÔÆä±àÂë £¬ÒÔ±ãÈÆ¹ýAV²úÆ·µÄ¾²Ì¬/ÌØÕ÷ÆÊÎö»úÖÆ¡£ÓÉÓÚMetasploitÏîÄ¿ÖеÄËùÓбàÂëÆ÷±»´ó´ó¶¼AV²úÆ·ËùÖª £¬ÒÔÊÇÇ¿ÁÒ½¨ÒéʹÓÃ×Ô½ç˵±àÂëÆ÷¡£

ÔÚ׼ȷ±àÂëShellCodeÖ®ºó £¬¾Í¿ÉÒÔ°ÑËü²åÈëCode Caves¡£Ñ¡ÔñÔÚPUSHFDϵÄÖ¸Áî £¬È»ºóÔÚÃâµ÷ÊÔÆ÷Éϰ´Ï ¡°Ctrl + E¡± £¬ShellCode½«ÒÔÊ®Áù½øÖÆÃûÌÃÕ³Ìù¡£

ʹÓÃxxd -ps createthreadÏÂÁî £¬ÒÔÊ®Áù½øÖÆÃûÌôòÓ¡±àÂ뽨ÉèÏ̵߳ÄShellCode»òʹÓÃÊ®Áù½øÖƱ༭Æ÷·­¿ªShellCode²¢¸´ÖÆÊ®Áù½øÖÆÖµ¡£µ±½«Ê®Áù½øÖÆÖµÕ³Ìùµ½µ÷ÊÔÆ÷ʱ £¬ÐèÒª×¢ÖØ×Ö½ÚÏÞÖÆ £¬ÓÉÓÚÕâЩÐÞ²¹²Ù×÷ÊÇÓÃÃâÊÔÆ÷¾ÙÐÐµÄ £¬Ãâµ÷ÊÔÆ÷ÔÚÕ³Ìùµ½±à¼­´úÂë´°¿ÚʱÓÐÒ»¸ö×Ö½ÚÏÞÖÆ¡£Õ³ÌùµÄShellCode¿ÉÄÜ»áÓÐÒÅ©¡£µ±ËùÓÐShellCodeÕ³Ìùµ½Code CaveʱºóÃÅ´úÂë¾Í²åÈëÍê³É¡£

µÚËIJ½£º»Ö¸´Ö´ÐÐÁ÷³Ì¡£

ÔÚ½¨ÉèºóÃÅ´úÂëÏß³ÌÖ®ºó £¬³ÌÐòÐèÒª»Ö¸´µ½ÆäÕý³£Ö´ÐÐÁ÷³Ì £¬ÕâÒâζ×ÅEIPÓ¦¸ÃÌø»Øµ½½«Ö´ÐÐÖØ¶¨Ïòµ½CaveµÄº¯Êý¡£¿ÉÊÇÔÚÌø»Øµ½¸Ãº¯Êý֮ǰ £¬Ó¦¸Ã¼ìË÷ËùÓÐÉúÑĵļĴæÆ÷¡£

ͨ¹ýÔÚShellCodeµÄĩβ°²ÅÅPOPFDºÍPOPADÖ¸Áî £¬ËùÓÐÉúÑĵļĴæÆ÷¶¼ÒÔÏàͬµÄ˳Ðò´Ó¿ÍÕ»Öе¯³ö¡£ÔÚ¼ìË÷¼Ä´æÆ÷ºó £¬ÉÐÓÐÒ»¼þÊÂÒª×ö £¬¼´Ö´Ðб»Ð®ÖƵÄÖ¸Áî¡£

ΪÁ˽«³ÌÐòµÄÖ´ÐÐÖØ¶¨Ïòµ½Code Cave, ÎÒÃǽ«PUSH 467C7CÖ¸ÁîÌæ»»ÎªÁËJMP 0x47A478¡£°ÑPUSH 467C7CÖ¸Áî·ÅÔÚ×îºó £¬´Ëʱ±»Ð®ÖƵÄÖ¸ÁîÒ²±»¼ìË÷¡£ÏÖÔÚ¿ÉÒÔ·µ»Øµ½Í¨¹ý²åÈëJMP 0x41CB73Ö¸ÁִÐÐÖØ¶¨Ïòµ½CaveµÄº¯ÊýµÄʱ¼ä £¬Ð§¹û´úÂëÓ¦ÈçÏÂͼËùʾ¡£

×îºóÑ¡ÔñËùÓÐÐÞ²¹ºÍ²åÈëµÄÖ¸Áî £¬°´ÓÒ¼üµ¥»÷²¢¸´ÖƵ½¿ÉÖ´ÐÐÎļþ¡£´Ë²Ù×÷ÐèÒª¶ÔÒÑÐ޸ĵÄÿ¸öÖ¸ÁîÖ´ÐС£µ±ËùÓÐÖ¸Áî±»¸´ÖƲ¢ÉúÑĵ½Îļþʱ £¬¹Ø±Õµ÷ÊÔÆ÷²¢²âÊÔ¿ÉÖ´ÐÐÎļþ £¬ÈôÊÇ¿ÉÖ´ÐÐÎļþÔËÐÐ˳³© £¬ÔòºóÃÅ¿ÉÒÔʹÓá£

02 ×ܽá

Ëæ×ŶԿ¹ÊÖ¶ÎÈÕÒæÖØ´ó»¯ £¬³¤ÆÚ»¯ÊÖÒÕÒ²½«ÑݱäµÃÔ½·¢Òþ²Ø £¬Í¬Ê±Ò²¶Ô·ÀÊØ·½Ìá³öÁËÒ»¸öÆæÒìµÄÌôÕ½ £¬ÓÉÓÚËüÃÇ¿ÉÒÔÒþ²ØÖ´ÐкóÃÅ´úÂë £¬ÒÔÊǼì²âºÍÆÊÎöÀú³Ì¾ÍÔ½·¢¾ßÓÐÌôÕ½ÐÔ £¬ÐèÒªÊÕÂÞ´ó×ÚµÄÊý¾Ý¾ÙÐÐÆÊÎöÅб𠣬ÔõÑùÔÚ´ó×ÚµÄÈÕÖ¾ÖÐÔõÑùÓÐÓõľÙÐмì²â £¬×èֹ̫¹ýÏûºÄ×ÊÔ´ £¬¶¼ÊÇÇå¾²ÔËÓªÖ°Ô±ÒªÃæÁÙµÄÌôÕ½¡£

ºóÐø½«¼ÌÐøÏÈÈÝÒþ²Ø³¤ÆÚפÁôµÄÆäËûÒªÁì £¬¾´ÇëÆÚ´ý¡£

Òªº¦´Ê±êÇ©£º
BevictorΰµÂ ¼ì²âÓë·À»¤ ³¤ÆÚ»¯
¿Í»§·þÎñÈÈÏß

400-777-0777
7*24Сʱ·þÎñ

ÁªÏµÓÊÏä

servicing@topsec.com.cn

ɨÂë¹Ø×¢
ÍøÕ¾µØÍ¼