在一次内网入侵中，通过安装gina木马，记录下了管理员账号密码。通过这个账号和密码去尝试远程登陆该网段其他服务器，大部分主机都能登陆（先鄙视一下管理员），其中远程登陆一台服务器时，连上去发现是Windows 2008，现在大部分服务器还是Windows 2003，我就想好好的保护这台肉鸡，供自己使用学习。为了防止管理员修改密码，决定在这个服务器上留下自己的后门，首先我上传配置好的木马替换系统system32文件夹下fi_nd,exe文件，但在替换文件时却出现。
替换其他系统文件也替换不了，我又想还是留粘滞键后门吧，把cmd．exe复制到其他文件夹下改成sethc．exe，去替换系统文件夹下面的，发现也是提示需要权限。当我右键一属性一安全一编辑，发现所有配置都是灰色的。
![R34[KMG[7%1YX{M]GD[`8$V.png](http://www.weixianmanbu.com/zb_users/upload/2017/06/201706221498103770902159.png)
在安全里面一高级一编辑，新窗口中发现只有一个查看按钮可以点击，原来传统的编辑按钮不存在了。
我点击“查看”按钮，发现里面的所有配置都是灰色的，无法做任何修改。我使用以往的命令行cacls．exe文件来配置其他文件的权限，却提示“拒绝访问”，晕！难道Windows 2008使用管理员账号也不能修改文件权限？后来经过我上网查找资料，发现真正造成这个回题的原因是文件的所有者，在Windows 2008系统中，系统所有文件和文件夹的权限所有者默认都是“Trustedlnstaller”。
在计算机管理里面用户管理界面上找不到这个用户，具体这个用户的属性我没有查找官方的相关说明，不知道它对系统安全具体起到什么作用。我们只需要将文件的所有者“Trustedlnstaller”修改成“Administrators”，那么我们对文件权限的操作就会随心所欲了，我们在“所有者”窗口上，选择“Administrators”，点击应用。这样就可以修改文件的权限所有者。现在我们对文件权限可以进行任何编辑替换了。以前是灰色无法编辑的部分都已经可以进行修改了。
具体文件权限的修改方法我这里就不再做任何说明，和原来Windows 2003上是一样的。我通过修改文件权限，舰利替换粘滞键，留下自己的后门。
在这里想告诉危险漫步的粉丝们，遇到问题要想办法解决，俗话说的好“方法总比困难多”，只有这样我们的技术才会不断进步。
[9] To ensure that the ProFTP server running on (192.168.79.135) starts every time Linux is restarted, the initialization script (init script) that comes with the source of the ProFTP was copied to the CentOS INIT V (initialization system V) script directory (/etc/rc.d/init.d). Then the script was made executable. Finally, the ProFTPD service was turned on, using the chkconfig command.# cp /usr/local/src/proftpd-1.3.3a/contrib/dist/rpm/proftpd.init.d /etc/rc.d/init.d/proftpd# chmod 775 /etc/rc.d/init.d/proftpd# chkconfig proftpd onReconnaissance, Footprinting, and Exploitation[1]Reconnaissance and FootprintingThe first step in every vulnerability assessment is to find what services are running and the version of the service; this is called reconnaissance and footprinting. To complete this step a port scan against the target machine should be launched. Following the same principal, nmap port scanner was launched against the machine using the following parameters:root@bt:~#nmap -sS -PN -n -sV -sC 192.168.79.135
The Nmap scan result indicated that the remote machine has two open ports: 22 (SSH) and 21 (FTP). Also, the version of the FTP server running on the remote machine is ProFTPD 1.3.3a and that of SSH is OpenSSH 5.3. Also, the SSH server only supports SSH protocol version 2.0.[2] Buffer Overflow Attack Against theProFTPDServiceWhen known vulnerabilities for ProFTPD 1.3.3a were searched on the Internet, the following results were obtained:
The vulnerability “CVE-2010-4221” was identified to be affecting the version of ProFTPD 1.3.3.a that we were running. According to the site, “Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.”
To successfully exploit the remote machine running the vulnerable version of ProFTPD, metasploit was launched using the following commands in Backtrack Linux system:root@bt:~#cd /opt/metasploit/msf3root@bt:/opt/metasploit/msf3#./msfconsole
The exploit for the vulnerable version of ProFTPD running on 192.168.79.135 was loaded using the following command (commands are in red):
[2] Brute-Force and Password Reuse Attack Against the ProFTP ServerTo carry out a password brute-force attack against the ProFTP server, the following Python script was written. This script tries to brute-force the password of users prithak, chintan, and daniel. The default password file that comes with bracktrack is used as the password database file.
It can be seen that the all the hosts have different MAC addresses associated with them. Now, since the attacker is on the same LAN segment as the FTP server and the FTP client, it is possible for the attacker to launch an ARP poisoning attack so that he can sit in the middle of the FTP exchanges and sniff the password. To do this, the following steps were performed on the attacker’s machine:
Also, passwords used for the FTP server should be secure and strong. The FTP users should have their shell changed to /bin/false, which will ensure that the FTP users will not be able to login over SSH, telnet, or TTY sessions. This was done using the following commands:# chsh -s /bin/false prithak# chsh -s /bin/false daniel# chsh -s /bin/false chintan# echo /bin/false >> /etc/shells
