West-wild
信息收集
# nmap -sn 192.168.1.0/24 -oN live.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-04 14:45 CST
Nmap scan report for 192.168.1.1
Host is up (0.00063s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.1.2
Host is up (0.00021s latency).
MAC Address: 00:50:56:FE:B1:6F (VMware)
Nmap scan report for 192.168.1.101
Host is up (0.00026s latency).
MAC Address: 00:0C:29:86:15:5B (VMware)
Nmap scan report for 192.168.1.254
Host is up (0.00020s latency).
MAC Address: 00:50:56:E9:BE:3C (VMware)
Nmap scan report for 192.168.1.60
Host is up.192.168.1.101是新增加的靶机IP！
# nmap -sT --min-rate 10000 -p- 192.168.1.101 -oN port.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-04 14:45 CST
Nmap scan report for 192.168.1.101
Host is up (0.00085s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:0C:29:86:15:5B (VMware)开放端口四个，分别是22 80 139 445端口 分别对应着ssh http和smb服务！
# nmap -sT -sC -sV -O -p22,80,139,445 192.168.1.101 -oN details.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-04 14:48 CST
Nmap scan report for 192.168.1.101
Host is up (0.00063s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 6f:ee:95:91:9c:62:b2:14:cd:63:0a:3e:f8:10:9e:da (DSA)
| 2048 10:45:94:fe:a7:2f:02:8a:9b:21:1a:31:c5:03:30:48 (RSA)
| 256 97:94:17:86:18:e2:8e:7a:73:8e:41:20:76:ba:51:73 (ECDSA)
|_ 256 23:81:c7:76:bb:37:78:ee:3b:73:e2:55:ad:81:32:72 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.7 (Ubuntu)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open DDtb Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
MAC Address: 00:0C:29:86:15:5B (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Host: WESTWILD; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_nbstat: NetBIOS name: WESTWILD, NetBIOS user: , NetBIOS MAC: (unknown)
| smb2-time:
| date: 2024-02-04T06:48:14
|_ start_date: N/A
|_clock-skew: mean: -1h00m00s, deviation: 1h43m55s, median: 0s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: westwild
| NetBIOS computer name: WESTWILD\x00
| Domain name: \x00
| FQDN: westwild
|_ System time: 2024-02-04T09:48:14+03:00
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.14 seconds 端口的详细信息展示了80端口是Apache 2.4.7起的服务，操作系统是Ubuntu系统，同时smb服务也暴露出来了相关的信息！
# nmap -sT --script=vuln -p22,80,139,445 192.168.1.101 -oN vuln.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-04 14:48 CST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 192.168.1.101
Host is up (0.0012s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-slowloris-check:
| VULNERABLE:
| Slowloris DOS attack
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2007-6750
| Slowloris tries to keep many connections to the target web server open and hold
| them open as long as possible. It accomplishes this by opening connections to
| the target web server and sending a partial request. By doing so, it starves
| the http server's resources causing Denial Of Service.
|
| Disclosure date: 2009-09-17
| References:
| http://ha.ckers.org/slowloris/
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 00:0C:29:86:15:5B (VMware)
Host script results:
|_smb-vuln-ms10-054: false
| smb-vuln-regsvc-dos:
| VULNERABLE:
| Service regsvc in Microsoft Windows systems vulnerable to denial of service
| State: VULNERABLE
| The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
| pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
| while working on smb-enum-sessions.
|_
|_smb-vuln-ms10-061: false
Nmap done: 1 IP address (1 host up) scanned in 345.64 seconds80端口上没什么信息，然后就是smb服务可能存在漏洞，之后做了一下UDP端口的探测：
发现开放的端口是137端口！先看一下smb服务，是否开启了什么共享，没突破的话还是重点放在80端口上！
寻找立足点
smbclient尝试列出服务器所分享的所有资源信息：
发现了存在共享，其中的print是打印机，看一下wave吧：
发现存在文件，直接全部下载：
下载完成退出即可！
发现flag文件中疑似是base64编码的字符串，直接解码！得到了一对用户和密码信息，再看看另一个文件：
这是一个邮件，aveng发送给wave的，说是他的密码不记得了，让我们给他重置！既然上面拿到了一组凭据信息，就尝试去ssh登陆一下：
没错，确实利用这个账号和密码登录上来，建立了初始的立足点！
提权
当前用户无sudo，查看了suid文件，发现了pkexec，暂时先不用，因为另一个文件提示我们说更改avong的密码；但是我不知道如何去更改他的密码，于是上传了linpeas进行提权的信息枚举！
发现了一个名字很奇怪的文件，这个文件名就很像重置密码的脚本！查看这个文件的内容：
看到了aveng的密码！不知道是不是，先尝试一下：
没错，这个就是他的密码！看看sudo吧：
提权成功！