M系列Mac搭建Pwn环境
1. 虚拟机选择:UTM
2.download ubuntu iso
mirrors.ustc.edu.cn/ubuntu-rele…
3. 导入UTM
选择模拟CPU
打开刚创建的虚拟机 等待加载至桌面后选择install Ubuntu
安装完成后点击重启
按提示删除刚才的iso文件后 输入ENTER键 等待进度条读取加载完成后看到图形界面然后关机
关机完成后 清除iso路径后再打开虚拟机 等待
更新的都不更新 一律跳过/下一步
4.set mirror
nano /etc/apt/sources.list
# 默认注释了源码镜像以提高 apt update 速度,如有需要可自行取消注释
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy restricted multiverse universe main
deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy restricted multiverse universe main
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-updates restricted multiverse universe main
deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-updates restricted multiverse universe main
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-backports restricted multiverse universe main
deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ jammy-backports restricted multiverse universe main
deb http://security.ubuntu.com/ubuntu/ jammy-security restricted multiverse universe main
deb-src http://security.ubuntu.com/ubuntu/ jammy-security restricted multiverse universe mai
5. SSH连接
UTM自带的UI界面简直不能再卡,本身模拟就很卡,基本无法操作,所以暂时先忍受卡顿安装SSH服务,用本机的远程连接操作shell会好很多
sudo apt update
# 安装net-tools
sudo apt install net-tools
# 安装openssh-server
sudo apt install openssh-server -y
# 启动ssh服务
sudo systemctl start ssh
# 设置开机自启
sudo systemctl enable ssh
# 查看状态
sudo systemctl status ssh
# 配置防火墙允许SSH
sudo ufw allow ssh
# 重启防火墙并重新加载配置
sudo ufw enable && sudo ufw reload
然后查看虚拟机ip
# ifconfig
查看本机ip,第一个网卡里的ip就是我们虚拟机的ip,此时可以尝试用宿主机去ping一下,应该可以ping通。
code ~/.ssh/config
Host ubuntu
Hostname 192.168.64.6
User ubuntu22
Port 22
ssh ubuntu
# inter password
# 重启防火墙并重新加载配置
sudo ufw enable && sudo ufw reload
# 修改/etc/ssh/sshd_config文件
# 将PermitRootLogin prohibit-password改为PermitRootLogin yes
# 将PasswordAuthentication no改为PasswordAuthentication yes
# 重启ssh服务
sudo systemctl restart ssh
# ubuntu生成ssh密钥
ssh-keygen -t rsa -b 4096
#copy
/home/ubuntu22/.ssh/id_rsa.pub to macos ~/.ssh
mv id_rsa.pub id_rsa_ubuntu.pub
# 本地mac添加免密配置
cd ~/.ssh
ssh-copy-id -i id_rsa_ubuntu.pub ubuntu22@192.168.64.6
# 添加本地mac免密登录alias
alias u22='ssh geekhour@192.168.105.13'
随后我们就可以用mac的终端新建远程连接到ubuntu。
6. 配置共享文件夹
sudo apt install spice-vdagent spice-webdavd
配置UTM共享选项,选择SPICE WebDAV
我们安装davfs2实现挂载
sudo apt install davfs2
安装完成后,可以直接使用以下指令挂载davfs
sudo mount -t davfs http://localhost:9843 <your ubuntu path>
sudo mount -t davfs http://localhost:9843 ~/macos
实现开机免密自动挂载
sudo vim /etc/davfs2/davfs2.conf
sudo vim /etc/davfs2/secrets
http://localhost:9843 1 1
7. (可选) 卸载ubuntu桌面
sudo vim /etc/default/grub
修改
GRUB_CMDLINE_LINUX_DEFAULT=“quiet splash”
⬇️
GRUB_CMDLINE_LINUX_DEFAULT=“text”
执行
# sudo update-grub
# sudo systemctl set-default multi-user.target
# sudo reboot
# 重启后
# sudo apt-get remove gnome-shell
# sudo apt-get remove gnome
# sudo apt-get autoremove
# sudo apt-get purge gnome
# sudo snap remove store
# sudo snap remove gnome*
# sudo apt remove snapd
# sudo apt-get autoclean
# sudo apt-get clean
8. 工具安装
# 安装基础工具
sudo apt install git
sudo apt install vim
# 安装pip
sudo apt install python3-pip -y
# 安装pwntools
pip3 install pwntools -i https://pypi.tuna.tsinghua.edu.cn/simple
install gef
wget -O /home/ubuntu22/pwn/gdb_tools/gef/gdbinit-gef.py -q https://www.gitlink.org.cn/api/dnrops/gef/raw/gef.py?ref=main
clone peda,pwndbg,Pwngdb
cd /home/ubuntu22/pwn/gdb_tools
git clone https://gitlink.org.cn/dnrops/peda.git
git clone https://gitlink.org.cn/dnrops/pwndbg.git
git clone https://gitlink.org.cn/dnrops/Pwngdb.git
而ubuntu22.04 的/usr/bin目录下并没有python,而是python3,
cd /usr/bin
sudo ln -s python3 python
install pwndbg
cd pwndbg
sh setup.sh
set gdbinit
nano ~.gdbinit
---
source ~/tools/pwndbg/gdbinit.py
source ~/tools/Pwngdb/pwngdb.py
source ~/tools/Pwngdb/angelheap/gdbinit.py
define hook-run
python
import angelheap
angelheap.init_angelheap()
end
end