Fractal pg walkthrough Easy

WSssSW發表於2024-11-26

nmap

┌──(root㉿kali)-[~]
└─# nmap -p- -A 192.168.157.233
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-25 07:59 UTC
Nmap scan report for 192.168.157.233
Host is up (0.072s latency).
Not shown: 64513 closed tcp ports (reset), 1019 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     ProFTPD
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 c1:99:4b:95:22:25:ed:0f:85:20:d3:63:b4:48:bb:cf (RSA)
|   256 0f:44:8b:ad:ad:95:b8:22:6a:f0:36:ac:19:d0:0e:f3 (ECDSA)
|_  256 32:e1:2a:6c:cc:7c:e6:3e:23:f4:80:8d:33:ce:9b:3a (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Welcome!
| http-robots.txt: 2 disallowed entries 
|_/app_dev.php /app_dev.php/*
|_http-server-header: Apache/2.4.41 (Ubuntu)
Aggressive OS guesses: Linux 5.0 (92%), Linux 5.0 - 5.4 (92%), Linux 4.15 - 5.8 (89%), HP P2000 G3 NAS device (89%), Linux 5.3 - 5.4 (89%), Linux 2.6.32 (89%), Ubiquiti AirMax NanoStation WAP (Linux 2.6.32) (88%), Linux 5.0 - 5.5 (88%), Linux 5.1 (88%), Ubiquiti AirOS 5.5.9 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT      ADDRESS
1   70.42 ms 192.168.45.1
2   70.27 ms 192.168.45.254
3   71.39 ms 192.168.251.1
4   71.81 ms 192.168.157.233

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 55.54 seconds

dirsearch

[08:00:35] Starting: 
[08:00:37] 301 -  315B  - /js  ->  http://192.168.157.233/js/               
[08:00:41] 403 -  280B  - /.ht_wsr.txt                                      
[08:00:41] 403 -  280B  - /.htaccess.bak1                                   
[08:00:41] 403 -  280B  - /.htaccess.orig                                   
[08:00:41] 403 -  280B  - /.htaccess.save                                   
[08:00:41] 403 -  280B  - /.htaccess.sample
[08:00:41] 403 -  280B  - /.htaccess_extra                                  
[08:00:41] 403 -  280B  - /.htaccess_orig
[08:00:41] 403 -  280B  - /.htaccess_sc
[08:00:41] 403 -  280B  - /.htaccessOLD
[08:00:41] 403 -  280B  - /.htaccessBAK
[08:00:41] 403 -  280B  - /.htaccessOLD2                                    
[08:00:41] 403 -  280B  - /.htm
[08:00:41] 403 -  280B  - /.html                                            
[08:00:41] 403 -  280B  - /.htpasswd_test                                   
[08:00:41] 403 -  280B  - /.httr-oauth
[08:00:41] 403 -  280B  - /.htpasswds
[08:00:43] 403 -  280B  - /.php                                             
[08:00:47] 403 -  471B  - /_fragment                                        
[08:00:56] 301 -  312B  - /app.php  ->  http://192.168.157.233/             
[08:00:56] 200 -    9KB - /app_dev.php                                      
[08:01:00] 403 -   46B  - /config.php                                       
[08:01:02] 301 -  316B  - /css  ->  http://192.168.157.233/css/             
[08:01:06] 200 -    6KB - /favicon.ico                                      
[08:01:09] 301 -  316B  - /img  ->  http://192.168.157.233/img/             
[08:01:11] 404 -  277B  - /javascript/tiny_mce                              
[08:01:11] 301 -  323B  - /javascript  ->  http://192.168.157.233/javascript/
[08:01:11] 404 -  277B  - /javascript/editors/fckeditor                     
[08:01:20] 301 -  323B  - /phpmyadmin  ->  http://192.168.157.233/phpmyadmin/
[08:01:21] 404 -  277B  - /phpmyadmin/ChangeLog                             
[08:01:21] 404 -  277B  - /phpmyadmin/docs/html/index.html
[08:01:21] 404 -  277B  - /phpmyadmin/scripts/setup.php
[08:01:21] 404 -  277B  - /phpmyadmin/README                                
[08:01:21] 404 -  277B  - /phpmyadmin/phpmyadmin/index.php                  
[08:01:21] 200 -    3KB - /phpmyadmin/doc/html/index.html                   
[08:01:22] 200 -    3KB - /phpmyadmin/index.php                             
[08:01:22] 200 -    3KB - /phpmyadmin/                                      
[08:01:25] 200 -   85B  - /robots.txt                                       
[08:01:26] 403 -  280B  - /server-status                                    
[08:01:26] 403 -  280B  - /server-status/

發現了cms的名稱
我們在hacktrick上找到了這篇文章
https://infosecwriteups.com/how-i-was-able-to-find-multiple-vulnerabilities-of-a-symfony-web-framework-web-application-2b82cd5de144
通讀這篇文章我們發現該網站是開啟了debug模式然後我們可以讀取到配置檔案

嘗試過用這個密碼以及使用者名稱ssh登入發現不行
那就是看看這個secret有啥用了
hacktricks第一篇文章告訴我們有了secret就能執行程式碼

通讀完文章我大概知道邏輯了當我們有了secret是這個secret加密後透過get方法作為的引數hash 來當做憑據
然後我們就可以指定呼叫php函式以及向該函式傳參
但是我嘗試構造出hash之後拼接文章裡的payload發現不能呼叫到函式
估計是不同版本的secret加密邏輯不同導致我的生成的hash是錯誤的
最後還是上網找到了exp
https://github.com/ambionics/symfony-exploits/blob/main/secret_fragment_exploit.py

成功執行程式碼
成功rce