Discussion on the Content of random numbers after Penetration

Discussion on the Content of random numbers after Penetration

Concept
Random Number is the result of a special random test.
Before The Passage
The Penetration Process has no bright spots. No great skill, just for fun.
Begin
The target website is aspx and uses commercial source code. Log on to the system, find the upload location, and view the source code.
If (fileext! = ". Rar" & fileext! = ". Rar" & fileext! = "" & Fileext! = ". Doc" & fileext! = ". Xls" & fileext! = ". Ppt" & fileext! = ". Pdf ")
{
Alert ("select rar, doc, xls, ppt, PDF file ");
Return false;
}
Js is used to determine the suffix. Use burp to capture packets and change the number of seconds to kill. Packed the source code, dragged the library, and left a backdoor. I used several anti-privilege kicers and got killed. The server is installed with eset endpoint security. Simple shelling and soft removal. Overflow: capture the administrator password. The Ip address is in the Intranet. If you encounter eset endpoint security on a similar machine, it may intercept outbound requests. If you are afraid of making things bigger, you will not forward the Ip address 3389, and then you will quietly leave. A few days later, the station issued an announcement saying that the system had discovered major vulnerabilities and needed maintenance. I guess it was previously inevitable that the promotion of privilege was killed, and the Administrator saw a prompt and found signs of intrusion. Things are still getting bigger, so I was scared for several days. One week later, my website went online and I was not held accountable. After a rough look, the Code has been changed, the upload vulnerability is gone, and the backdoor is deleted. Because there is no need for it, I just took over.
Later, the website interface was used, but the website restricted normal permission users. At this time, the idea of a second intrusion emerged. Find the upload point again and find that it is still verified by the suffix of js. You can upload any file and download it to the uploaded file using the file stream, the purpose is to read the file stream and send it to the output stream. Files uploaded after childbirth are renamed as random strings, such as 2b538465-8ff9-4ee5-89cc-d9e71495f267.asp. The problem is that the path of the uploaded file cannot be found. Remember that the previously uploaded folder is/uploadfile /. Try/uploadfile/2b538465-8ff9-4ee5-89cc-d9e71495f267.asp with the Error 404. No way, you can only go through the previous code to see if you can find anything related to the file to be uploaded. Find the corresponding dll from the aspx file on the upload page and decompile it with reflector .. The decompiled code of the net file is quite readable ~ The key code for generating file names is
Random _ gc * random = _ gc new Random (); str = String: Concat (HttpContext :: current-> Session [S "UserId"]-> ToString (), random-> Next (0x186a0, 0xf423f)-> ToString (), str3 );
Str3 indicates the file suffix. The algorithm is followed by UserId and 6 from 100000 to 999999 is a random number. That is to say, it can be cracked.
Academic time
The most important thing about penetration is that you cannot expose yourself too early. I think it is worthwhile to spend a lot of time locally on a server with a smaller probability of being discovered. If you just want to guess it, the worst luck would be 900000 times. For the moment, it is regarded as 1000000 times. There are two ways to reduce the number of brute-force cracking guesses.
The first method is to increase the number of uploaded asp trojan files to reduce the number of guesses. One asp file requires a maximum of 1000000 guesses, two asp files require a maximum of 500000 guesses, and four asp files require a maximum of 250000 guesses... We can see that increasing from one file to four files can greatly reduce the number of guesses. From the server log, uploading an asp Trojan is a request and guessing that a file is also a request. But in fact, there is a difference between the two. Set weights for uploads and guesses respectively. Set the upload weight to 10 and the guess weight to 1. 10 guesses are equivalent to uploading an asp Trojan. In this way, we can obtain the optimal number of uploads and guesses. After a series of mathematical calculations...

In the second method, since a random number is used to generate a file name, we all know that the random numbers in the computer are pseudo-random, and a series of operations are performed by a seed to obtain a string of values. In this way, pseudo-random may be guessed. If the method is proper, the scope of the guess can be reduced. Go to msdn and check the definition of random numbers in c.
Http://msdn.microsoft.com/zh-cn/library/vstudio/h343ddh9.aspx
The default sub-value of the constructor Random () is derived from the system clock and has a limited resolution. Therefore, different Random objects that are frequently created by calling the default constructor will have the same default seed value, and several groups of identical Random numbers will be generated. That is to say, if the time when random numbers are generated locally and on the server is the same, the same random sequence may appear. The server time can be obtained from the http response header. However, the time in the http response header is in GMT format and needs to be converted to correspond to each other. To test this idea, we installed visual stadio 2012 and found a piece of code online for testing.
Public static string ToGMTString (DateTime dt)
{
Return dt. ToUniversalTime (). ToString ("r ");
}
Static void Main (string [] args)
{
For (int I = 0; I 100000000; I ++)
{
Console. Write (DateTime. Now. TimeOfDay. ToString ());
Console. Write ("");
Console. Write (ToGMTString (DateTime. Now ));
Console. Write ("");
Random r = new Random ();
Console. WriteLine (r. Next (0x186a0, 0xf423f). ToString ());

}
}
After compilation is successful, the local machine runs two processes and redirects the output to the txt file.

Two conclusions can be drawn. First, random numbers are repeated at the approximate time points. Second, if two processes take random numbers at the same time or are close to each other, they may obtain the same random number. What if I run on two different computers?

The conclusion is that two different computers, even if the time is close to the random number, are different.

This is not scientific!
Decompile the random class and find the constructor.
Public: Random ();
Public: Random (Int32 _ gc * Seed );
Where
Public: Random (): this (Environment: TickCount)
That is to say, Random () still calls the Random (Int32 _ gc * Seed ). Trace Environment: TickCount,
Public: _ property static Int32 _ gc * get_TickCount ()
{
Return Environment: nativeGetTickCount ();
}
Searched for the nativeGetTickCount () function, which starts timing from 0 and returns the number of milliseconds (excluding the system pause time) after the device is started. For details, see "interval 30 days. So, the number of bursts required is about 100060606024*30 = 155520000000 = 155.52G. According to the current computer performance, it may not take long. However, we do not know how long the server has been running. We can only obtain a random number generated by the system first, then obtain the time when the system was running through brute-force cracking, and record the server response time. Then, a request is sent to record the response time, and the system running time is deduced. Then, a random number is generated locally for a short period of time and then cracked. This involves the issue of probability duplication. Set the random number value range to n. If n is too small, many repeated values may appear after a group of random numbers are generated, which will affect the determination of system time. At this time, multiple time-related random samples must be generated on the server to predict the current running time of the server with a higher probability. The number of samples is inversely proportional to the probability of incorrect guesses. Or you can try to restart the server by using DDOS to reduce the number of guesses and reduce the probability of false guesses ~ (I guess I am not responsible for this without testing)
OK, return to penetration. To reduce the size of the package, the HEAD package instead of the GET package is used to detect whether the resource exists. Use the intruder function of burp to adjust the number of threads and the packet sending time. After cracking for a period of time, there was no result in crash. Because the brute-force cracking has started, logs must be left on the server. In this case, you can only succeed and do not fail. There is a kind of wind, Xiao, Yi, water, cold, strong enough to go again. Go back to the website to find a copy of my website file, myuid760682.doc. Access/uploadfile/myuid760682.doc, also displays 404. However, this file exists, and the/uploadfile/directory also exists. Check the source code. The/uploadfile/directory is also used to store the uploaded files. The idea is stuck.
At this time, I thought that I had dragged the database and had the administrator password. Log on to the server, find the upload point in the add article, and verify the js Code. You can upload the image in the article. The image address can also be found. The folder is/ImageData /. Upload an asp statement, 404. Upload a sentence with the cer suffix, 404. Upload aspx in one sentence, the kitchen knife cannot be connected, but the status is 200 this time. Nima, are you playing with me? Directly upload the aspx Trojan and log on successfully. View web. config and check that the permission to log on to the directory is verified. Currently, the browser has an administrator cookie, So you can open the trojan without the Administrator cookie, so it cannot work normally. This website does not parse asp... After obtaining the website revision from web. config, all uploaded files are stored in the website directory. No wonder the uploaded files cannot be found. A new source code is prepared to decompile related files and find that the data you want is provided on a third-party server using web interfaces. Now that you have the source code, follow the calling principle and write a calling program to get the data ~
The goal has been achieved here, and it should have ended. But I tested it again. Run the aspxspy command, ping 127.0.0.1, return normal results, ping the server of the same network segment and adjacent network segments, and return normal results. ping 8.8.8.8.8, timeout, Ping www.baidu.com, and cannot be parsed. That is to say, the Outbound icmp protocol and dns protocol packets are intercepted on the vro. Aspxspy's built-in port forwarding fails. Use ipvh. aspx to try port forwarding and fail to connect to ipvh. aspx. The client is stuck. The website can call an interface remotely (the Internet ip address is not in the adjacent network segment), but the ping fails. I guess the router has made some rules. So far.