BackupBuddy pg walkthrough Intermediate

nmap

┌──(root㉿kali)-[~/lab]
└─# nmap -p- -A 192.168.189.43
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-29 02:10 UTC
Stats: 0:00:17 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 8.81% done; ETC: 02:13 (0:03:06 remaining)
Nmap scan report for 192.168.189.43
Host is up (0.072s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
80/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-title: PHP File Manager
|_http-server-header: Apache/2.4.52 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|specialized|storage-misc
Running (JUST GUESSING): Linux 4.X|5.X|2.6.X|3.X (90%), Crestron 2-Series (86%), HP embedded (85%)
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:crestron:2_series cpe:/o:linux:linux_kernel:3.13 cpe:/h:hp:p2000_g3
Aggressive OS guesses: Linux 4.15 - 5.8 (90%), Linux 5.0 - 5.4 (90%), Linux 5.3 - 5.4 (89%), Linux 2.6.32 (89%), Linux 5.0 (88%), Linux 5.0 - 5.5 (88%), Crestron XPanel control system (86%), Linux 3.13 (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT      ADDRESS
1   69.91 ms 192.168.45.1
2   69.88 ms 192.168.45.254
3   71.34 ms 192.168.251.1
4   71.36 ms 192.168.189.43

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 122.71 seconds

发现只有80和22端口 这种方向就很明确了 突破口只能在80端口的web站点上

先看看首页是啥



是个filemanager

是个文件管理界面

尝试弱口令admin admin登录失败

发现源码https://github.com/alexantr/filemanager

查看源码我们发现了默认密码

尝试登录 发现成功登录



发现了一个用户brian

发现任意文件读取



获取id_rsa



爆破出密钥 密码

其实这题作者把他改简单了 他修改了源码 但是源码也有漏洞 只不过他把源码改了之后这个漏洞就变得更简单了

原本源码有个参数p的过滤器的

长这样但是我们还是能构造出目录穿越语句的

但是他的题目将这个过滤 器改了

我都服了 导致我以为我代码审计审计错了 后来才发现是他直接把代码改了

提权阶段

发现有个suid的文件

分析了一下文件



应该是加载libm.so文件 但是目前这个文件没有 而且我们可以自己创建

我们写写好提权脚本



编译gcc -shared -fPIC -o libm.so mylib.c

然后传到靶机上

然后再运行backup就提权成功了