【Vulnhub】Five86-2

最新推荐文章于 2024-06-16 13:15:43 发布

丶4ut15m

最新推荐文章于 2024-06-16 13:15:43 发布

阅读量815

点赞数

分类专栏： vulnhub 文章标签：安全经验分享

本文链接：https://blog.csdn.net/xia739635297/article/details/104282343

版权

vulnhub 专栏收录该内容

5 篇文章 1 订阅

订阅专栏

Description

Five86-2 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

The ultimate goal of this challenge is to get root and to read the one and only flag.

信息搜集

惯例,先探测存活主机,再探测主机开放端口及服务

nmap -sP 192.168.1.0/24

Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-12 17:41 CST
Nmap scan report for 192.168.1.1
Host is up (0.0035s latency).
MAC Address: C4:F0:EC:7F:52:EC (Fiberhome Telecommunication Technologies)
Nmap scan report for 192.168.1.3
Host is up (0.086s latency).
MAC Address: A4:50:46:DD:59:5A (Xiaomi Communications)
Nmap scan report for 192.168.1.4
Host is up (0.080s latency).
MAC Address: 74:23:44:8D:74:79 (Xiaomi Communications)
Nmap scan report for 192.168.1.5
Host is up (0.28s latency).
MAC Address: DC:55:83:05:16:7B (Guangdong Oppo Mobile Telecommunications)
Nmap scan report for 192.168.1.6
Host is up (0.90s latency).
MAC Address: 7C:6B:9C:7C:90:9B (Guangdong Oppo Mobile Telecommunications)
Nmap scan report for 192.168.1.8
Host is up (0.41s latency).
MAC Address: 34:CE:00:A5:BC:2D (Xiaomi Electronics,co.)
Nmap scan report for 192.168.1.14
Host is up.

很好,可以看到里面没有我们的靶机.我沉吟片刻,便想到了问题所在.

靶机没开.

好了,重新扫描,结果如下

Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-12 17:47 CST
Nmap scan report for 192.168.1.1
Host is up (0.022s latency).
MAC Address: C4:F0:EC:7F:52:EC (Fiberhome Telecommunication Technologies)
Nmap scan report for 192.168.1.2
Host is up (0.10s latency).
MAC Address: 20:34:FB:CF:B4:38 (Xiaomi Communications)
Nmap scan report for 192.168.1.3
Host is up (0.18s latency).
MAC Address: A4:50:46:DD:59:5A (Xiaomi Communications)
Nmap scan report for 192.168.1.4
Host is up (0.45s latency).
MAC Address: 74:23:44:8D:74:79 (Xiaomi Communications)
Nmap scan report for 192.168.1.5
Host is up (0.28s latency).
MAC Address: DC:55:83:05:16:7B (Guangdong Oppo Mobile Telecommunications)
Nmap scan report for 192.168.1.6
Host is up (0.27s latency).
MAC Address: 7C:6B:9C:7C:90:9B (Guangdong Oppo Mobile Telecommunications)
Nmap scan report for 192.168.1.8
Host is up (0.35s latency).
MAC Address: 34:CE:00:A5:BC:2D (Xiaomi Electronics,co.)
Nmap scan report for five86-2 (192.168.1.11)
Host is up (0.00035s latency).
MAC Address: B0:35:9F:56:8C:A9 (Intel Corporate)
Nmap scan report for 192.168.1.14
Host is up.

确定目标主机为192.168.1.11,下面进行服务探测

nmap -sS 192.168.1.11 -p1-65535

Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-12 17:53 CST
Nmap scan report for five86-2 (192.168.1.11)
Host is up (0.00044s latency).
Not shown: 65532 filtered ports
PORT   STATE  SERVICE
20/tcp closed ftp-data
21/tcp open   ftp
80/tcp open   http
MAC Address: B0:35:9F:56:8C:A9 (Intel Corporate)

很好,主机上有ftp服务和web服务.让我们先看看它的web服务.

中规中矩的wordpress.简单找了一下,发现就是一个刚装好的wordpress.

众所周知,打wordpress害得用wpscan.

先列举一下wordpress存在的用户.

wpscan --url http://192.168.1.11 -e u

再进行常规的密码暴破

密码暴破的时候去看看ftp服务.

手动尝试了一下ftp弱口令,没什么效果,先放放.

暴破出了两个用户的密码

get shell

两个用户都登上去看过了.stephen是个普通用户,什么也做不了.

但是在barney用户上有发现.

众所周知:worpress要getshell除了管理员用户直接改主题文件之外,还可以找找插件漏洞.

Insert or Embed Articulate Content into WordPress Trial插件存在getshell漏洞

根据漏洞exp可知,我们可以上传一个webshell到服务器上.为了方便后续渗透,我选择了生成msf的php后门,如下.

而后新post一篇文章,如下

插入之后,shell便已上传,这篇文章post还是不post并不重要.

使用msf建立监听

msfconsole -r resource.rc #-r选项是载入资源文件

而后访问我们方才的后门文件,路径:

/wp-content/uploads/articulate_uploads/4ut15m/shell.php

很美好,shell成功弹回

提权

先取得一个tty会话.

为了提权,又是一顿喜闻乐见的信息搜集

find / -type f -user www-data 2>/dev/null

www-data用户可以查看的东西还挺多的,就是都没什么用.

东找找西看看都没有什么有用的发现,所以我决定用工具来帮助提权.

众所周知:LinEnum是帮助提权的好工具,链接

先把LineEnum上传到服务器上.

运行结果很长,就不贴了.

在后面,我们可以看到很亮的一点信息:

sudo版本1.8.27,看到这个,我承认我开心的笑了.

众所周知:sudo版本低于1.8.28存在提权漏洞(CVE-2019-14287)

简单示范一下该漏洞,如下

漏洞细节,看上面的CVE-2019-14287.

现在为了能使用sudo命令,需要一个有权限的用户(www-data不可)

再想想方才wpscan扫出的两个密码,试着登录,发现stephen用户可登录!

然后....完美,不能执行sudo.

这时候只得先转换思路,再去看看LinEnum搜集到的信息.细细看后,有了发现.

2min前paul运行了ftp_upload.sh 并且向172.18.0.10主机发起了ftp连接.我心里有了猜测,于是再一次运行LinEnum

明了.大概paul用户设置了定时任务,每两分钟运行一次ftp_upload.sh,发起连接.

众所周知:ftp传输没有加密机制,也即是明文传输.

抓到paul的ftp连接请求包便可以......

tcpdump用法

linux自带tcpdump.

这里我们用tcpdump抓取服务器发往172.18..0.10主机的数据包,如下

timeout 120 tcpdump host 172.18.0.10 >info.txt

设置timeout为120是因为ftp_upload.sh每两分钟运行一次,确保能抓到我们想要的数据包.

OK!可以看到,用户名和密码都有了.

让我们看看ftp里有什么好东西.

file.txt为空...

试着切换为paul用户,发现可以.

验证一下我之前的猜想.

crontab -l

果然.

在sudo -l中发现.paul可以以peter的身份执行service命令

利用service获取peter用户权限

进一步发现peter可以以root的身份执行passwd命令

使用passwd修改root密码

over.

丶4ut15m

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
【Vulnhub】Five86-2

DescriptionFive86-2 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.The ultimate goal of this challenge is to get root and to re...
复制链接

扫一扫

专栏目录