怎么在AIX和Power架构上运行Metasploit Framework
怎么在AIX和Power架构上运行Metasploit Framework，很多新手对此不是很清楚，为了帮助大家解决这个难题，下面小编将为大家详细讲解，有这方面需求的人可以来学习下，希望你能有所收获。
我已在我的笔记本电脑上使用qemu-system-ppc64完成了所有这些工作，它非常适合在真正的硬件上进行tinkering（意为探究和动手体验）和测试。另外，请确保你为qemu模拟处理器分配至少4 GB的内存，否则你将无法运行metasploit（它会一直尝试加载）这是我的qemu加载器脚本。
附：对于新的qemu-system-ppc64版本和AIX 7.2可能会存在一些问题。我使用的版本可以正常顺利的工作，因此这里我将其命名为qemu-system-ppc64-old
QEMU模拟器版本为3.0.50 (v3.0.0-614-g19b599f766-dirty)
./qemu-system-ppc64-old -cpu POWER8 -machine pseries -m 4096 -serial stdio -drive file=disk.img,if=none,id=drive-virtio-disk0 -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=drive-virtio-disk0 -cdrom aix.iso -prom-env boot-command='boot disk: ' -net nic -net tap -display vnc=:1
首先，我们需要安装一些依赖项。我将通过yum从Aixtoolbox public repo中包含我已安装在系统中的所有RPM。
AIX-rpm SDL SDL-devel SDL_mixer SDL_ttf SDL_ttf-devel audiofile audiofile-devel autoconf automake bash bzip2 bzip2-devel ca-certificates cmake coreutils cups cups-libs curl cyrus-sasl db dbus esound esound-devel expat expat-devel expect flac fontconfig fontconfig-devel freetype2 freetype2-devel gcc gcc-c++ gcc-cpp gcc-go gdbm gdbm-devel gettext gettext-devel glib glib-devel glib2 glib2-devel gmp gmp-devel gnutls grep gtk+ info less libXft libXft-devel libXrandr libXrender libXrender-devel libffi libffi-devel libgcc libgcrypt libgcrypt-devel libgo libgo-devel libgpg-error libgpg-error-devel libiconv libjpeg libmikmod libmpc libogg libogg-devel libpcap libpcap-devel libpng libpng-devel libssh3 libssh3-devel libstdc++ libstdc++-devel libtasn1 libtool libvorbis libvorbis-devel libxml2 libxml2-devel libxml2-python libxslt libxslt-devel lua m4 mpfr ncurses ncurses-devel nettle nmap openldap p11-kit patch pcre pcre-devel perl pkg-config postgresql postgresql-devel postgresql-libs pth pysqlite python python-cryptography python-devel python-iniparse python-passlib python-pyasn1 python-pycurl python-six python-tools python-urlgrabber python3 readline readline-devel renderproto rsync sed smpeg smpeg-libs sqlite sqlite-devel tar tcl tcsh tightvnc-server tk unzip wget xz xz-devel xz-libs yum yum-metadata-parser zlib zlib-devel
由于来自https://public.dhe.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/ruby/的ruby-2.5.1和ruby-devel-2.5.1 RPM在编译Metasploit所依赖的gem时无法正常工作，因此我选择在AIX上从源码构建Ruby。这并不难（我们将安装到 /usr/local以和/opt/freeware分开）。
在本例中，我使用Ruby 2.5.1版本，但你也可以使用2.5.5或2.6.3版效果是一样的。
$ wget https://cache.ruby-lang.org/pub/ruby/2.5/ruby-2.5.1.tar.gz $ tar -zxvf ruby-2.5.1.tar.gz $ cd ruby-2.5.1 $ ./configure $ make $ su - # make install
一旦我们安装了Ruby（确保在你的配置文件中已包含/usr/local），我们就可以继续从git下载Metasploit快照。我之所以选择获取ZIP快照，是因为它在ppc64模拟器下速度会更快。
$ wget https://github.com/rapid7/metasploit-framework/archive/master.zip $ unzip master.zip $ cd metasploit-framework-master
下一步是在metasploit目录中运行bunlde install，但我们现在将跳过此步骤，因为我们需要在本地自定义2个gem，并在AIX 7.2上编译和构建它们。
nokogiri-1.10.3.gem bcrypt-3.1.13
由于nokogiri不会在AIX上构建，因为缺少vasprintf()函数，它不是POSIX接口，并且不在AIX中的C库中，如果不修改构建过程gem将构建和编译，但最终库将不起作用，并出现以下错误：
bash-5.0# /usr/local/bin/gem install nokogiri-1.10.3.gem Building native extensions. This could take a while... Successfully installed nokogiri-1.10.3 Parsing documentation for nokogiri-1.10.3 Done installing documentation for nokogiri after 49 seconds 1 gem installed bash-5.0# /usr/local/bin/nokogiri Traceback (most recent call last): 8: from /usr/local/bin/nokogiri:23:in <main>' 7: from /usr/local/bin/nokogiri:23:in load' 6: from /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/bin/nokogiri:6:in <top (required)>' 5: from /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' 4: from /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' 3: from /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri.rb:28:in <top (required)>' 2: from /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri.rb:32:in rescue in <top (required)>' 1: from /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in `require': load failed - /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogir.so. Please issue below command for detailed reasons: (LoadError) /usr/sbin/execerror ruby "(ld 3 1 vasprintf /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogiri.so"
我们可以通过运行命令来检查错误的详细信息：
bash-5.0# /usr/sbin/execerror ruby "(ld 3 1 vasprintf /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogiri.so" exec(): 0509-036 Cannot load program ruby because of the following errors: rtld: 0712-001 Symbol vasprintf was referenced from module /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogiri.so(), but a runtime definition of the symbol was not found.
可以看到缺少vasprintf符号并被调用。
让我们为Ruby gem创建一个工作目录并下载nokogiri。
$ mkdir GEMS $ cd GEMS $ gem fetch nokogiri Fetching: nokogiri-1.10.3.gem (100%) Downloaded nokogiri-1.10.3 $ gem spec nokogiri-1.10.3.gem --ruby > nokogiri.gemspec $ gem unpack nokogiri-1.10.3.gem Unpacked gem: '/home/root/LOCAL-GEMS/TT/nokogiri-1.10.3' $ mv nokogiri.gemspec nokogiri-1.10.3 $ cd nokogiri-1.10.3 $ cd ext/nokogiri
现在，我们将修改extconf.rb文件以包含构建过程，并在AIX上创建一个工作的nokogiri.so共享库并定位到nix? $CFLAGS <<
修改为：
$CFLAGS << " -DXP_WIN -DXP_WIN32 -DUSE_INCLUDED_VASPRINTF "
保存并返回到构建nokogiri gem
$ cd ../.. $ gem build nokogiri.gemspec WARNING: ports/archives/libxml2-2.9.9.tar.gz is not world-readable WARNING: ports/archives/libxslt-1.1.33.tar.gz is not world-readable WARNING: no homepage specified WARNING: pessimistic dependency on mini_portile2 (~> 2.4.0) may be overly strict if mini_portile2 is semantically versioned, use: add_runtime_dependency 'mini_portile2', '~> 2.4', '>= 2.4.0' WARNING: pessimistic dependency on racc (~> 1.4.14, development) may be overly strict if racc is semantically versioned, use: add_development_dependency 'racc', '~> 1.4', '>= 1.4.14' WARNING: pessimistic dependency on rake-compiler (~> 1.0.3, development) may be overly strict if rake-compiler is semantically versioned, use: add_development_dependency 'rake-compiler', '~> 1.0', '>= 1.0.3' WARNING: pessimistic dependency on rexical (~> 1.0.5, development) may be overly strict if rexical is semantically versioned, use: add_development_dependency 'rexical', '~> 1.0', '>= 1.0.5' WARNING: See http://guides.rubygems.org/specification-reference/ for help Successfully built RubyGem Name: nokogiri Version: 1.10.3 File: nokogiri-1.10.3.gem $ su # gem install nokogiri-1.10.3.gem
经过一段时间后最终它将被构建（在qemu下它的速度很慢）我们可以通过执行gem本身来检查最终的nokogiri gem是否真的已经工作。
# gem install bcrypt Fetching: bcrypt-3.1.13.gem (100%) Building native extensions. This could take a while... ERROR: Error installing bcrypt: ERROR: Failed to build gem native extension. current directory: /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13/ext/mri /usr/local/bin/ruby -r ./siteconf20190624-6029732-1f0poah.rb extconf.rb creating Makefile current directory: /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13/ext/mri make "DESTDIR=" clean current directory: /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13/ext/mri make "DESTDIR=" compiling bcrypt_ext.c compiling crypt_blowfish.c compiling crypt_gensalt.c compiling wrapper.c linking shared-object bcrypt_ext.so gcc: error: x86.o: No such file or directory make: 1254-004 The error code from the last command is 1. Stop. make failed, exit code 2 Gem files will remain installed in /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13 for inspection. Results logged to /usr/local/lib/ruby/gems/2.5.0/extensions/powerpc-aix-7/2.5.0-static/bcrypt-3.1.13/gem_make.out
在ppc64 AIX平台上使用x86.o对象文件也出现了一些问题...但修复起来也很容易，你只需重复上面的操作获取gem并修改构建过程就行了。
$ gem fetch bcrypt Fetching: bcrypt-3.1.13.gem (100%) Downloaded bcrypt-3.1.13 $ gem spec bcrypt-3.1.13.gem --ruby > bcrypt.gemspec $ gem unpack bcrypt-3.1.13.gem $ mv bcrypt.gemspec bcrypt-3.1.13 $ cd bcrypt-3.1.13 $ cd ext/mri
让我们再次编辑extconf.rb文件并删除x86引用
删除x86.o保存并重新生成gem
$ cd ../.. $ gem build bcrypt.gemspec WARNING: open-ended dependency on rspec (>= 3, development) is not recommended if rspec is semantically versioned, use: add_development_dependency 'rspec', '~> 3' WARNING: See http://guides.rubygems.org/specification-reference/ for help Successfully built RubyGem Name: bcrypt Version: 3.1.13 File: bcrypt-3.1.13.gem $ su # gem install bcrypt-3.1.13.gem Building native extensions. This could take a while... Successfully installed bcrypt-3.1.13 Parsing documentation for bcrypt-3.1.13 Installing ri documentation for bcrypt-3.1.13 Done installing documentation for bcrypt after 26 seconds 1 gem installed
现在，我们应该已将所有Metasploit框架所需的缺失gem都安装上了，所以只需从metasploit根目录运行bundle install即可
$ cd metasploit-framework-master $ bundle install
因为这需要一些时间，因此你可以泡杯咖啡/茶慢慢品尝。在这个时间里我打算去外面转转。
现在，你是否已准备好在AIX 7.2上运行Metasploit框架了？我想说是的！
我们可以运行./msfconsole（这在qemu下可能需要一些时间）
甚至可以对up2date windows 10 1903（10.0.18362.175）执行一些实时测试，并在运行时绕过MS Defender；）
看完上述内容是否对您有帮助呢？如果还想对相关知识有进一步的了解或阅读更多相关文章，请关注蜗牛博客行业资讯频道，感谢您对蜗牛博客的支持。
免责声明：本站发布的内容（图片、视频和文字）以原创、转载和分享为主，文章观点不代表本网站立场，如果涉及侵权请联系站长邮箱：niceseo99@gmail.com进行举报，并提供相关证据，一经查实，将立刻删除涉嫌侵权内容。
版权声明：如无特殊标注，文章均为本站原创，转载时请以链接形式注明文章出处。
评论