如何在AIX和Power架构上运行Metasploit Framework – 作者:secist

本文将向大家介绍如何在AIX和Power架构上运行Metasploit框架，这对于那些想要尝试在这些架构上运行Metasploit的人可能会有所帮助（至少目前我还没有在网上发现关于这方面的教程内容）。

我已在我的笔记本电脑上使用qemu-system-ppc64完成了所有这些工作（有关如何在QEMU下运行的更多细节请参阅：https://astr0paby.wordpress.com/2018/11/04/running-aix-7-2-tl3sp1-on-x86_64-via-qemu-system-ppc64/），它非常适合在真正的硬件上进行tinkering（意为探究和动手体验）和测试。另外，请确保你为qemu模拟处理器分配至少4 GB的内存，否则你将无法运行metasploit（它会一直尝试加载）这是我的qemu加载器脚本。

附：对于新的qemu-system-ppc64版本和AIX 7.2可能会存在一些问题。我使用的版本可以正常顺利的工作，因此这里我将其命名为qemu-system-ppc64-old

QEMU模拟器版本为3.0.50 (v3.0.0-614-g19b599f766-dirty)

./qemu-system-ppc64-old -cpu POWER8 -machine pseries -m 4096 -serial stdio -drive file=disk.img,if=none,id=drive-virtio-disk0 -device virtio-scsi-pci,id=scsi -device scsi-hd,drive=drive-virtio-disk0 -cdrom aix.iso -prom-env boot-command='boot disk: ' -net nic -net tap -display vnc=:1

首先，我们需要安装一些依赖项。我将通过yum从Aixtoolbox public repo中包含我已安装在系统中的所有RPM。

AIX-rpm
SDL
SDL-devel
SDL_mixer
SDL_ttf
SDL_ttf-devel
audiofile
audiofile-devel
autoconf
automake
bash
bzip2
bzip2-devel
ca-certificates
cmake
coreutils
cups
cups-libs
curl
cyrus-sasl
db
dbus
esound
esound-devel
expat
expat-devel
expect
flac
fontconfig
fontconfig-devel
freetype2
freetype2-devel
gcc
gcc-c++
gcc-cpp
gcc-go
gdbm
gdbm-devel
gettext
gettext-devel
glib
glib-devel
glib2
glib2-devel
gmp
gmp-devel
gnutls
grep
gtk+
info
less
libXft
libXft-devel
libXrandr
libXrender
libXrender-devel
libffi
libffi-devel
libgcc
libgcrypt
libgcrypt-devel
libgo
libgo-devel
libgpg-error
libgpg-error-devel
libiconv
libjpeg
libmikmod
libmpc
libogg
libogg-devel
libpcap
libpcap-devel
libpng
libpng-devel
libssh2
libssh2-devel
libstdc++
libstdc++-devel
libtasn1
libtool
libvorbis
libvorbis-devel
libxml2
libxml2-devel
libxml2-python
libxslt
libxslt-devel
lua
m4
mpfr
ncurses
ncurses-devel
nettle
nmap
openldap
p11-kit
patch
pcre
pcre-devel
perl
pkg-config
postgresql
postgresql-devel
postgresql-libs
pth
pysqlite
python
python-cryptography
python-devel
python-iniparse
python-passlib
python-pyasn1
python-pycurl
python-six
python-tools
python-urlgrabber
python3
readline
readline-devel
renderproto
rsync
sed
smpeg
smpeg-libs
sqlite
sqlite-devel
tar
tcl
tcsh
tightvnc-server
tk
unzip
wget
xz
xz-devel
xz-libs
yum
yum-metadata-parser
zlib
zlib-devel

由于来自https://public.dhe.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/ruby/的ruby-2.5.1和ruby-devel-2.5.1 RPM在编译Metasploit所依赖的gem时无法正常工作，因此我选择在AIX上从源码构建Ruby。这并不难（我们将安装到 /usr/local以和/opt/freeware分开）。

在本例中，我使用Ruby 2.5.1版本，但你也可以使用2.5.5或2.6.3版效果是一样的。

$ wget https://cache.ruby-lang.org/pub/ruby/2.5/ruby-2.5.1.tar.gz
$ tar -zxvf ruby-2.5.1.tar.gz
$ cd ruby-2.5.1
$ ./configure
$ make
$ su - 
# make install

一旦我们安装了Ruby（确保在你的配置文件中已包含/usr/local），我们就可以继续从git下载Metasploit快照。我之所以选择获取ZIP快照，是因为它在ppc64模拟器下速度会更快。

$ wget  https://github.com/rapid7/metasploit-framework/archive/master.zip
$ unzip master.zip 
$ cd metasploit-framework-master

下一步是在metasploit目录中运行bunlde install，但我们现在将跳过此步骤，因为我们需要在本地自定义2个gem，并在AIX 7.2上编译和构建它们。

nokogiri-1.10.3.gem
bcrypt-3.1.13

由于nokogiri不会在AIX上构建，因为缺少vasprintf()函数，它不是POSIX接口，并且不在AIX中的C库中，如果不修改构建过程gem将构建和编译，但最终库将不起作用，并出现以下错误：

bash-5.0# /usr/local/bin/gem install nokogiri-1.10.3.gem
Building native extensions. This could take a while...
Successfully installed nokogiri-1.10.3
Parsing documentation for nokogiri-1.10.3
Done installing documentation for nokogiri after 49 seconds
1 gem installed
bash-5.0# /usr/local/bin/nokogiri
Traceback (most recent call last):
8: from /usr/local/bin/nokogiri:23:in <main>' 7: from /usr/local/bin/nokogiri:23:in load' 6: from /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/bin/nokogiri:6:in <top (required)>' 5: from /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' 4: from /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' 3: from /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri.rb:28:in <top (required)>' 2: from /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri.rb:32:in rescue in <top (required)>' 1: from /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' /usr/local/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in `require': load failed - /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogir.so. Please issue below command for detailed reasons: (LoadError) /usr/sbin/execerror ruby "(ld 3 1 vasprintf /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogiri.so"

我们可以通过运行命令来检查错误的详细信息：

bash-5.0# /usr/sbin/execerror ruby 
"(ld 3 1 vasprintf /usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogiri.so"
exec(): 0509-036 Cannot load program ruby because of the following errors:
rtld: 0712-001 Symbol vasprintf was referenced from module
/usr/local/lib/ruby/gems/2.5.0/gems/nokogiri-1.10.3/lib/nokogiri/nokogiri.so(),
but a runtime definition of the symbol was not found.

可以看到缺少vasprintf符号并被调用。

让我们为Ruby gem创建一个工作目录并下载nokogiri。

$ mkdir GEMS
$ cd GEMS
$ gem fetch nokogiri 
Fetching: nokogiri-1.10.3.gem (100%)
Downloaded nokogiri-1.10.3
$ gem spec nokogiri-1.10.3.gem --ruby > nokogiri.gemspec
$ gem unpack nokogiri-1.10.3.gem
Unpacked gem: '/home/root/LOCAL-GEMS/TT/nokogiri-1.10.3'
$ mv nokogiri.gemspec nokogiri-1.10.3
$ cd  nokogiri-1.10.3
$ cd ext/nokogiri

现在，我们将修改extconf.rb文件以包含构建过程，并在AIX上创建一个工作的nokogiri.so共享库并定位到nix? $CFLAGS <<

修改为：

$CFLAGS << " -DXP_WIN -DXP_WIN32 -DUSE_INCLUDED_VASPRINTF "

保存并返回到构建nokogiri gem

$ cd ../.. 
$ gem build nokogiri.gemspec 
WARNING:  ports/archives/libxml2-2.9.9.tar.gz is not world-readable
WARNING:  ports/archives/libxslt-1.1.33.tar.gz is not world-readable
WARNING:  no homepage specified
WARNING:  pessimistic dependency on mini_portile2 (~> 2.4.0) may be overly strict
  if mini_portile2 is semantically versioned, use:
    add_runtime_dependency 'mini_portile2', '~> 2.4', '>= 2.4.0'
WARNING:  pessimistic dependency on racc (~> 1.4.14, development) may be overly strict
  if racc is semantically versioned, use:
    add_development_dependency 'racc', '~> 1.4', '>= 1.4.14'
WARNING:  pessimistic dependency on rake-compiler (~> 1.0.3, development) may be overly strict
  if rake-compiler is semantically versioned, use:
    add_development_dependency 'rake-compiler', '~> 1.0', '>= 1.0.3'
WARNING:  pessimistic dependency on rexical (~> 1.0.5, development) may be overly strict
  if rexical is semantically versioned, use:
    add_development_dependency 'rexical', '~> 1.0', '>= 1.0.5'
WARNING:  See http://guides.rubygems.org/specification-reference/ for help
  Successfully built RubyGem
  Name: nokogiri
  Version: 1.10.3
  File: nokogiri-1.10.3.gem

$ su 
# gem install  nokogiri-1.10.3.gem

经过一段时间后最终它将被构建（在qemu下它的速度很慢）我们可以通过执行gem本身来检查最终的nokogiri gem是否真的已经工作。

# gem install bcrypt 
Fetching: bcrypt-3.1.13.gem (100%)
Building native extensions. This could take a while...
ERROR:  Error installing bcrypt:
        ERROR: Failed to build gem native extension.

    current directory: /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13/ext/mri
/usr/local/bin/ruby -r ./siteconf20190624-6029732-1f0poah.rb extconf.rb
creating Makefile

current directory: /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13/ext/mri
make "DESTDIR=" clean

current directory: /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13/ext/mri
make "DESTDIR="
compiling bcrypt_ext.c
compiling crypt_blowfish.c
compiling crypt_gensalt.c
compiling wrapper.c
linking shared-object bcrypt_ext.so
gcc: error: x86.o: No such file or directory
make: 1254-004 The error code from the last command is 1.

Stop.

make failed, exit code 2

Gem files will remain installed in /usr/local/lib/ruby/gems/2.5.0/gems/bcrypt-3.1.13 
for inspection.
Results logged to /usr/local/lib/ruby/gems/2.5.0/extensions/powerpc-aix-7/2.5.0-static/bcrypt-3.1.13/gem_make.out

在ppc64 AIX平台上使用x86.o对象文件也出现了一些问题…但修复起来也很容易，你只需重复上面的操作获取gem并修改构建过程就行了。

$ gem fetch bcrypt 
Fetching: bcrypt-3.1.13.gem (100%)
Downloaded bcrypt-3.1.13
$ gem spec bcrypt-3.1.13.gem --ruby > bcrypt.gemspec
$ gem unpack bcrypt-3.1.13.gem
$ mv bcrypt.gemspec bcrypt-3.1.13 
$ cd bcrypt-3.1.13
$ cd ext/mri

让我们再次编辑extconf.rb文件并删除x86引用

删除x86.o保存并重新生成gem

$ cd ../.. 
$ gem build bcrypt.gemspec
WARNING:  open-ended dependency on rspec (>= 3, development) is not recommended
  if rspec is semantically versioned, use:
    add_development_dependency 'rspec', '~> 3'
WARNING:  See http://guides.rubygems.org/specification-reference/ for help
  Successfully built RubyGem
  Name: bcrypt
  Version: 3.1.13
  File: bcrypt-3.1.13.gem

$ su 
# gem install bcrypt-3.1.13.gem
Building native extensions. This could take a while...
Successfully installed bcrypt-3.1.13
Parsing documentation for bcrypt-3.1.13
Installing ri documentation for bcrypt-3.1.13
Done installing documentation for bcrypt after 26 seconds
1 gem installed

现在，我们应该已将所有Metasploit框架所需的缺失gem都安装上了，所以只需从metasploit根目录运行bundle install即可

$ cd metasploit-framework-master
$ bundle install

因为这需要一些时间，因此你可以泡杯咖啡/茶慢慢品尝。在这个时间里我打算去外面转转。

现在，你是否已准备好在AIX 7.2上运行Metasploit框架了？我想说是的！

我们可以运行./msfconsole（这在qemu下可能需要一些时间）

甚至可以对up2date windows 10 1903（10.0.18362.175）执行一些实时测试，并在运行时绕过MS Defender；）

 *参考来源：astr0baby，FB小编secist编译，转载请注明来自FreeBuf.COM

来源：freebuf.com 2019-07-09 13:00:38 by: secist