前言

在面对勒索病毒这样的网络威胁时,我们不能被动等待,而要积极应对。我们需要了解攻击的原理和过程,熟练掌握应急响应和取证分析的技术,以便在面对真实的威胁时能够迅速有效地应对。

vulntarget-n是一个模拟全球化勒索病毒高发环境下的应急响应和取证分析案例,其模拟了一个正常运行的业务服务被勒索病毒攻击的情景:

  • 客户在阿里云部署的业务环境
  • 今天突然发现首页变成了一个勒索的界面,要求用户支付赎金以解密数据
  • 客户发现其中部分重要文件被加密为.vulntarget结尾

随即客户要你进行应急响应并取证分析,因为是阿里云的ECS,客户将阿里云ECS实例镜像导出到本地,要求你在明天分析出结果。

具体要求如下:

  • 分析攻击事件是如何发生的,请给出攻击画像
  • 解密勒索
  • 恢复原来的index.jsp页面,恢复正常的web服务
  • 找到隐藏在其中的3flag

已知服务器系统为Ubuntu20.04,账号密码: 账号:root 密码:Vulntarget@123

ps:在本次靶场设计中少了一次反弹shell的操作,主要是防止设计者的ip出现泄露,在攻击路径描述中可以直接把反弹shell的步骤加上即可。

准备工作

解压完是个raw文件,VMware无法直接打开

可利用qemu工具转换为vmdk格式

1
2
3
4
5
工具下载地址:
https://qemu.weilnetz.de/w64/

转换命令:
qemu-img.exe convert -f raw -O vmdk vuln_m-j6cegcrhehdcba0r5h4v_system.raw vulntarget-n.vmdk

然后新建虚拟机,稍后安装操作系统,选择磁盘为使用现有虚拟磁盘,保持现有格式即可

应急响应

首先查询特权用户特权用户等情况,未发现异常账号

然后检查是否存在异常端口、进程、开机启动项等,但也未发现异常

接着,再来查看历史命令发现flag:flag{vulntarget_very_G00d}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
root@iZj6c6hytildlalnu0cwt4Z:~# cat .bash_history
1 apt update && apt install openjdk-8-jdk && apt install unzip -y
2 vim /etc/profile
3 source /etc/profile
4 wget https://archive.apache.org/dist/tomcat/tomcat-7/v7.0.79/bin/apache-tomcat-7.0.79.zip
5 unzip apache-tomcat-7.0.79.zip
6 mv apache-tomcat-7.0.79 /opt/tomcatmv apache-tomcat-7.0.79 /opt/tomcat
7 mv apache-tomcat-7.0.79 /opt/tomcat
8 chmod +x /opt/tomcat/bin/*.sh
9 ls
10 history
11 flag{vulntarget_very_G00d}
12 /opt/tomcat/bin/startup.sh
13 cp /opt/tomcat/conf/server.xml /opt/tomcat/conf/server.xml.bak
14 vim /opt/tomcat/conf/server.xml
15 ps -axu | grep tomcat
16 kill -9 6961
17 /opt/tomcat/bin/startup.sh
18 cp web.xml web.xml.bak
19 pwd
20 cd ..
21 ls
22 cd /opt/
23 ls
24 cd tomcat/
25 ls
26 cd conf/
27 cp web.xml web.xml.bak
28 vim web.xml
29 ps -axu | grep tomcat
30 kill -9 7409
31 /opt/tomcat/bin/startup.sh
32 pwd
33 cd ..
34 ls
35 cd webapps/
36 ls
37 cd ROOT/
38 ls
39 rm favicon.ico
40 cp index.jsp index.jsp.bak
41 ls
42 vim index.jsp
43 rm index.jsp
44 vim index.jsp
45 crontab -e
46 history
47 ls
48 mv vulntargetn.jsp 404.jsp
49 ls
50 rm index.jsp.bak
51 pip3 install rsa
52 ls
53 ls -lha
54 mkdir .vulntarget
55 cd .vulntarget/
56 ls
57 mkdir keys
58 ls
59 history
60 ls
61 vim get_pem.py
62 python3 get_pem.py
63 ls
64 rm get_pem.py
65 ls
66 cd ..
67 ls
68 cp .vulntarget/keys/pubkey.pem .
69 ls
70 ls | grep jsp
71 vim encrypt_vulntarget.py
72 ls
73 vim flag.jsp
74 ls | grep jsp
75 python3 encrypt_vulntarget.py
76 ls
77 cd .vulntarget/
78 ls
79 cd keys/
80 ls
81 cat pubkey.pem
82 cat privkey.pem
83 cd ..
84 ls
85 cd ..
86 ls
87 rm encrypt_vulntarget.py
88 rm pubkey.pem
89 ls
90 vim index.jsp
91 ls
92 cd ..
93 ls
94 cd ..
95 ls
96 cd logs/
97 ls
98 cat localhost_access_log.2024-06-04.txt
99 vim localhost_access_log.2024-06-04.txt
100 ls
101 vim localhost_access_log.2024-06-04.txt
102 ls
103 history
104 curl http://127.0.0.1
105 ls
106 cd
107 ls
108 ls -lha
109 cat .bashrc
110 ls
111 history > .bash_history
apt update && apt install openjdk-8-jdk && apt install unzip -y
vim /etc/profile
source /etc/profile
wget https://archive.apache.org/dist/tomcat/tomcat-7/v7.0.79/bin/apache-tomcat-7.0.79.zip
unzip apache-tomcat-7.0.79.zip
mv apache-tomcat-7.0.79 /opt/tomcatmv apache-tomcat-7.0.79 /opt/tomcat
mv apache-tomcat-7.0.79 /opt/tomcat
chmod +x /opt/tomcat/bin/*.sh
ls
history
flag{vulntarget_very_G00d}
/opt/tomcat/bin/startup.sh
cp /opt/tomcat/conf/server.xml /opt/tomcat/conf/server.xml.bak
vim /opt/tomcat/conf/server.xml
ps -axu | grep tomcat
kill -9 6961
/opt/tomcat/bin/startup.sh
cp web.xml web.xml.bak
pwd
cd ..
ls
cd /opt/
ls
cd tomcat/
ls
cd conf/
cp web.xml web.xml.bak
vim web.xml
ps -axu | grep tomcat
kill -9 7409
/opt/tomcat/bin/startup.sh
pwd
cd ..
ls
cd webapps/
ls
cd ROOT/
ls
rm favicon.ico
cp index.jsp index.jsp.bak
ls
vim index.jsp
rm index.jsp
vim index.jsp
crontab -e
history
ls
mv vulntargetn.jsp 404.jsp
ls
rm index.jsp.bak
pip3 install rsa
ls
ls -lha
mkdir .vulntarget
cd .vulntarget/
ls
mkdir keys
ls
history
ls
vim get_pem.py
python3 get_pem.py
ls
rm get_pem.py
ls
cd ..
ls
cp .vulntarget/keys/pubkey.pem .
ls
ls | grep jsp
vim encrypt_vulntarget.py
ls
vim flag.jsp
ls | grep jsp
python3 encrypt_vulntarget.py
ls
cd .vulntarget/
ls
cd keys/
ls
cat pubkey.pem
cat privkey.pem
cd ..
ls
cd ..
ls
rm encrypt_vulntarget.py
rm pubkey.pem
ls
vim index.jsp
ls
cd ..
ls
cd ..
ls
cd logs/
ls
cat localhost_access_log.2024-06-04.txt
vim localhost_access_log.2024-06-04.txt
ls
vim localhost_access_log.2024-06-04.txt
ls
history
curl http://127.0.0.1
ls
cd
ls
ls -lha
cat .bashrc
ls
history > .bash_history
history
exit

分析这些敏感历史命令发现攻击者可能将webshell写入到tomcat目录下,同时还发现了攻击者创建隐藏目录.vulntarget,并且编写运行get_pem.pyencrypt_vulntarget.py这两个rsa加密脚本来生成加密密钥对并加密

根据历史命令来查看tomcat日志localhost_access_log.2024-06-04.txt,可知是tomcat PUT文件上传

并且得到flag:flag{Welcome_t0_join_Us}

进入tomcat的web目录下发现一共加密了4个文件

1
2
3
4
5
6
7
8
9
10
11
root@iZj6c6hytildlalnu0cwt4Z:~# cat /opt/tomcat/webapps/ROOT/404.jsp.vulntarget 
N/nNQJJ60jZ6WvLltQK5U6+jKQ0HicpJW2gGt8YbxWqZxE+k4KyIpaDZCicGRsOHAuo+hYuLLX1wRDLt7BDvfnPdqeI/XMiGsL7nkx2Hc5FwD/MJrZYy0i5bzQvg955W6YiI8KKcfpeYI0+aZMuP7tP9duuiu+YHvmnD/1Wq0n1r/fEhWoSnZyAm5Gcc9AjpCPQQI3yF1APbDyHywCW64kOmN+kd/B5cLi62zfxgYnfUff31gtHf+G0FgHFEB0bze+epyKfBumuDGklzKajtJm79fGqlwjh26sPz6jUR1k54h6jDqM15qZKbD3z7E37k3IPpfjspTWwKchmHB6oMmEfLSXGvI4ECNb9KIVxjUADSO8oYZpNaNJmOKF4x/GndhCK++jPOHhZywhjhDHthqH+yLQGsN2+KiLqBJp8RyP8dFXbANgp+agls4cMfVTgEfQzjkJKtELBzmQoskB+WdUk9v0vczio4d//nGXeWm1eRDbL5BhQQuo2cTEFBA9aDC8mJtFCqxafLoVeWxjYac8r+0iXPIfPklpcxqDwdTam5n7GlNOeJZgFwrmuREyTQ+iGijTzIcX4eqPTTowdi+GpLTXGF1XSESl9g/OLRKrai+DVM3AoQ8fOR5DSS6b8RZvPjKNoqXpS4jSn02w7GXz3SdJcqbZwRdQ/lS712S5g=

root@iZj6c6hytildlalnu0cwt4Z:~# cat /opt/tomcat/webapps/ROOT/flag.jsp.vulntarget
Au+XkLqSjNieysLjjYxz9/XKnZ0l5iyhvBi4/zXw7LBBD/LykamEm5MrEIboYoL/zYE+AhvCf2a84e9ApJxsBrzcwCLSxv77dbkqzLy9+W127e1k0iz+1SM60W2315Yq1aYeEWcznVrzY9qrjtv/eXXOVEMUHONm3VLCs3mHDc0=

root@iZj6c6hytildlalnu0cwt4Z:~# cat /opt/tomcat/webapps/ROOT/index.jsp.vulntarget
EBbRcDBnaxuKDku6RvtR5RTXLK9MowxgL/CnNMpmvkYfzZ6qMu3wP/Op55J9SZi8/T5dnXBKceyVfrC9ogN0d5ndAvKfEjhp8qTU8/kg0fjPiyb6qGErFAFcz/jHpykVEeSeOyD3WwhVloDR/if08Jyg9Soc95r2oqHmYeH2zNkqZehD1lPG01bAikUXo2h4DqJld8ZoV2N5HvJGjl3rMyN5839YYno4gGN9W8ruVwe27cBFseQ/5rY7/tzy54zklD6PO0f5tLoUKE7AAkhcWOcfaqDHiZE/WlqPBxkP+/rIgWyHRYUQjAETiEw9u4TJWAQq7njrK14VHyGuvmt3VH8if2TEpBgNnFFJ36hx7QsvbAkJ5pafrxNjYmcFHHAHTd5P6Z2fB06uU0TtAc61RcLFsYb0+IhckfwK3USXWp0HOUlmkmCx4+0yMBX4/d7bovg7AsMAc3toH127db3ytTFY1yHq2rq+V1f+IRGLv6fnkYJ/j0NVD8GSuKAcDntaC9rXUiFTi+lcwOmEeqgxrmOZvpuzoqmoqI8P7W6UngEZhq9RhZzmf7ytYF/BORONft39B3H4cM9X2Zc8fX39LlE2OC56cjySnTqrlPJ55USecv8xO5bpKvqG2Cra1umPbqCcXeZPDb1buQ270F4zNll4fTmMe3WI8aj9nCrSpuxhgv4UQsCi6cE99e+vGSFEk0ag12siFGpycfOKe7T53fceyuteUwDs9begfzSC9H13qc3Ny9QDtuYHzJnO4qKdiNOtali++uLitUxW8QM7sacsB1y3SOSJ58p/JwLjqet8+H9Cjka8OCIq2WWxMISmvtdNPIRVj0Cgu1dwIBcVA04oAibcm8pE7gp9PWoDMiMGH7IxrsGceWlVgLBCwa2iFsUeCqqXht1amX9vqYSCLHYVHgSMlMzBrC6Jod2kDCT34QrQkS7Xar6qsC9xX4EgavXutE8Oyy4MXgBRGaIg7IjUO+Sr7d3CNF1gBKBnvz4wMi4n/prqf8D/VLwFP75qNawk2/znc0w+cq6jHpRJHqB2PbKA/n4hCpern+RgyZ4fRBHykAXChCp6zVw7FdZDTQ9J1H0UR//FEB0KDEUerYUy51Eqbvd8r2nD/dHpzds0aXtMeEjUWYYak8mpgrUL9viVH9YHtMC3ukf5QeY10AU5qNhEJOx4Z9cieSDKfzQWQE2zJu8JHprwBpgJ3+PQQox0IxEr/VTN2fy4QKK7szXvVLeGUVvtShEhreJjaYQjM6YCVoNwp1WQWWUU845Nq8hp1z2ErJKoox2dIMtVEounm3BxmqT0oHZbO//nMwlZy3o5XwvVRBn7aYUfSJx8a2Zx6bWUMj9fOfAgSHgx3m96o7qro7r77m9sklPCYwIHQuLIpeiMBA81HO0bLaukoJM7/jbVhxtKYlQSmtwoNN5bDlgf2+GzyCFZzGnF7UCpb9PFB80WtdyvRvDJ7AeJb2h7x9PI9jq7flZVtYyGNavOMMZNSEVt/tNNKYNvMtYccXqi98q4QL0R0TZqHZdcWGxhyUY/VBSZXfuOGLNQ3TzN6sIuaMggbb47Cd2IsUuRYV4HefanRbr0y8XDIYM+TAZO8yCTadiKyWvjzZXczMMfaS3yhES5JjcJbedOqay5SrUUla2+c04hBxu2uujc1XuHhCEOTZv1OeH1z8FN15Se4+T+s9rYbBw4EsOM2WpU3h4pQJjw1MajSJvTLiA+W5vfDAN6tO2feEQUUrqOw40L1HLl/ZQCw7gt4IRx9EI9ZVxUjq6o0HPCB6vJuwjdlr7+0J4OTzAS3dBu1aXvX3InbBWKHRkiCK5fWJCBYgoRs/ncEDoL8Xv0xT6nEvtG2xcGtZ8h1BeOqkZ2Mao3Q0+PUCNaNXoftQ0XfnrRPy5Swyo7+Kdt2YAPIdiAl//OUAc/BnvOvlso+8bhcxmXtXt9tBXmTFZCXJdx+Hd1CVKRNBPNqbFHmZ2NSILPnWeSwxY0oZ1XrQy11dq3yq51zrHl1+Hy4xSDoGbM34sia0AXLlxb3fqBgdYbwM5j9MEgdy5XLH4AJH8LeTdDJwasHXZ1qFopZE8P/9zne/BEpM462zG4LsZ79pIg0qZy2JgbDecpzZLu7LTW/bgstgsCvMxTy1XuGZs9m3nq/31kEnyB3SCEw6/A4LZSnOtIXu2Z4/EzTGHfpxM7VfxZxgSJDc/QIRgn4dXvTsI5BZ8/pk97nLXCKTCUO7bwLf8u3Z5lbVg23EyBuEY8a2z3oKA1VBeQ4b/O4fIjdIFl08ppc5VHrYRf5zzvycFjPiD4tRSS3TGNnHtFPze6JXnmIfrZVY2HWt5chxMdLp/0arktyT4TPKPoL4gPhXy/1KU0St95+u4rMHXY43WYJTo3QE1/5Q8pGu06h2OCtKQbD34qEAARcUevxK3SEFhx93Wt/1r2tECOdRNjYcEJQhikwnK2oO5+bd+UqIzQI0QWFAMgJh6e0PFWx5LyTC0SaGqX9oZ7ax74uHKjb0D9jctzdptlQ7G1304SBhK8A3MEqQSTNo151GbJw6LEvkYRynke1iI9LfXqnpuPVXWNhvpoHgr9cZhajAesCWuSY/Ee6HEcrvlLFiVSzWGcM7jHj+4oOYI2sogkYkfqHwkz1psS72gH3OvnAELV3qS/s5YHx6j47BxTglT4V+LYVhvDp+zq8j1S86VnPla5rNETDsWU2/2ILD5pCc8+kXbku7rCyExemEZ6ViCYyjhuyB0yLLGgXtcHi0KPR1ehnC7f+/Lp628zm/nyHp+NT4UibTARLz+OsCs4UptaAmzUzUUT8DodQrIvqujRShiQLwMzn9Z6iQI2y36JHRrxv1RWysyrNqoyezbiOr+CPwpKnNcQlawBrGDArdo9pqyJ3bJt6ICDcE/RfAGmVEJU9Wcx6H5TsCHcO5ppP8qHAXLugmxIH6vxVxI7z90mWud/HhsjDVusboh8dUYZZYHLafFAZ3zuF2RMMG6sHgUvCiFPeNfTgcTGnCJ29zzjjVjbfAEZm9YbQC1jkpmYDz3vMmJHEdwuN42eBSETH/TIK4vCrEDoRq4qZbzxUZ7R25bOZP3A7lNuURH54cA1mJNTvBCcFcEqeol/C3wFmEP9SAKWbtfFC8fqBoZJoBvObXe0GR6xaEsAdluihxQ21aC3/+xaB46wxsIEd5PUdwtC0IfLM4l3+oH5KS3yfEKzJ1kwT4A5/S+EEV0wDC7+DSVkete6sjAXIeWCSgc=

root@iZj6c6hytildlalnu0cwt4Z:~# cat /opt/tomcat/webapps/ROOT/vulntarget.jsp.vulntarget
goH93IcI5UeCpubU5frhuBhnmDcKEXVyE0i7yE07yyuHTVwnhRq8u44y2EbZiH77amDZrn+mWvhohGKC4is9mrjh2Fj7QuMSe5mqi9zSM4UhmIF+H8PjcYJny3KPoLko8kl+8tNMZxYiAtl9RIJ3cdXMLDPxyP6Mq42jisW2K+o=

历史命令中搜索.pem文件,找到私钥文件

从而解密得到flag:flag{https://github.com/crow821/vulntarget}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa
from base64 import b64decode

# 读取公钥和私钥文件
with open('privkey.pem', 'rb') as key_file:
private_key = serialization.load_pem_private_key(
key_file.read(),
password=None,
)

# 读取密文
encrypted_flag = b64decode('Au+XkLqSjNieysLjjYxz9/XKnZ0l5iyhvBi4/zXw7LBBD/LykamEm5MrEIboYoL/zYE+AhvCf2a84e9ApJxsBrzcwCLSxv77dbkqzLy9+W127e1k0iz+1SM60W2315Yq1aYeEWcznVrzY9qrjtv/eXXOVEMUHONm3VLCs3mHDc0=')

# 解密密文
decrypted_flag = private_key.decrypt(
encrypted_flag,
padding.PKCS1v15() # 使用PKCS#1 v1.5 padding
)

print(f"{decrypted_flag.decode('utf-8')}")

漏洞复现

直接PUT方式上传文件发现不修改后缀名上传失败了

在后面加个/验证上传成功,至此即可确认入口点为Tomcat PUT任意文件上传漏洞

业务恢复

由于网站首页也被修改了,还需要解密前面的index.jsp.vulntarget

用之前的脚本会发现报错长度不一致

后面利用在线工具解密成功

替换解密后的index.jsp即可恢复