공격자 IP주소 추가하기
Attacker ~# ifconfig eth0:1 192.168.108.103
Attacker ~# ifconfig eth0:2 192.168.108.104
Attacker ~# ifconfig eth0:3 192.168.108.105
Attacker ~# ifconfig
| eth0: flags=4163<up,broadcast,running,multicast> mtu 1500</up,broadcast,running,multicast> inet 192.168.108.102 netmask 255.255.255.0 broadcast 192.168.108.255 inet6 fe80::20c:29ff:fee6:4d4a prefixlen 64 scopeid 0x20 ether 00:0c:29:e6:4d:4a txqueuelen 1000 (Ethernet) RX packets 220534 bytes 205104464 (195.6 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 118047 bytes 9911218 (9.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 eth0:1: flags=4163<up,broadcast,running,multicast> mtu 1500</up,broadcast,running,multicast> inet 192.168.108.103 netmask 255.255.255.0 broadcast 192.168.108.255 ether 00:0c:29:e6:4d:4a txqueuelen 1000 (Ethernet) eth0:2: flags=4163<up,broadcast,running,multicast> mtu 1500</up,broadcast,running,multicast> inet 192.168.108.104 netmask 255.255.255.0 broadcast 192.168.108.255 ether 00:0c:29:e6:4d:4a txqueuelen 1000 (Ethernet) eth0:3: flags=4163<up,broadcast,running,multicast> mtu 1500</up,broadcast,running,multicast> inet 192.168.108.105 netmask 255.255.255.0 broadcast 192.168.108.255 ether 00:0c:29:e6:4d:4a txqueuelen 1000 (Ethernet) lo: flags=73<up,loopback,running> mtu 65536</up,loopback,running> inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 1000 (Local Loopback) RX packets 48 bytes 3817 (3.7 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 48 bytes 3817 (3.7 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 |
Attacker ~# ssh -b 192.168.108.103 admin@192.168.108.100
admin@192.168.108.100's password: <-- 비밀번호 아무거나
Permission denied, please try again.
admin@192.168.108.100's password: <-- Ctrl + C
Attacker ~# ssh -b 192.168.108.104 admin@192.168.108.100
admin@192.168.108.100's password: <-- 비밀번호 아무거나
Permission denied, please try again.
admin@192.168.108.100's password: <-- Ctrl + C
Attacker ~# ssh -b 192.168.108.105 admin@192.168.108.100
admin@192.168.108.100's password: <-- 비밀번호 아무거나
Permission denied, please try again.
admin@192.168.108.100's password: <-- Ctrl + C
Victim 에서 로그를 확인하면 IP주소가 로그에 기록되어 있는걸 확인할 수 있다.
Victim ~# grep 'Failed password for invalid user' /var/log/secure | awk '{print $13}' | sort | uniq
192.168.108.102
192.168.108.103
192.168.108.104
192.168.108.105
로그를 확인해서 DROPIP 체인에 IP주소를 기록한다.
Victim ~# dropip.sh
192.168.108.102 방화벽에 이미 등록됨
방화벽 룰을 확인하면 103 ~ 105번 까지 IP주소가 잘 등록된걸 확인할 수 있다.
Victim ~# iptables -nL
| Chain INPUT (policy ACCEPT) target prot opt source destination DROPIP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain DROPIP (1 references) target prot opt source destination DROP all -- 192.168.108.102 0.0.0.0/0 DROP all -- 192.168.108.103 0.0.0.0/0 DROP all -- 192.168.108.104 0.0.0.0/0 DROP all -- 192.168.108.105 0.0.0.0/0 |
'Linux > 모의해킹' 카테고리의 다른 글
| Bee-Box 설정하기 (0) | 2021.12.28 |
|---|---|
| [Kali] dropip.sh 파일을 cron 에 등록하기 (0) | 2021.12.28 |
| [Kali] 쉘 스크립트를 이용한 자동화된 공격 IP 차단 룰 생성 프로그램 (0) | 2021.12.28 |
| [Kali] hydra 무차별 대입 공격 (0) | 2021.12.28 |
| tracert 를 이용한 경로 추적하기 (0) | 2021.12.28 |