DC-7
作者:互联网
1 信息收集
惯例先找下靶机在哪,再扫一下全端口
开了http
和ssh
,linux(debian) + apache
{"ip":"192.168.68.228","port":80,"service":"http","Banner":"","url":"http://192.168.68.228:80"}
{"ip":"192.168.68.228","port":22,"service":"ssh","Banner":"SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u6\\x0a","url":""}
{"url":"http://192.168.68.228:80","StatusCode":200,"Title":"WelcometoDC-7|D7","HeaderDigest":"server:Apache/2.4.25 (Debian)","Length":8709,"KeywordFinger":"Drupal","HashFinger":""}
2 先看看web
和DC-1
一样,用的Drupal
,提示说不是靠爆破,而且需要逃出盒子,指逃逸?页面底部发现了DC7USER
,但说了靠爆破行不通,也不存在密码重置的通用漏洞
扫目录,发现了robots.txt
,看看Disallow
Disallow: /core/
Disallow: /profiles/
# Files
Disallow: /README.txt
Disallow: /web.config
# Paths (clean URLs)
Disallow: /admin/
Disallow: /comment/reply/
Disallow: /filter/tips
Disallow: /node/add/
Disallow: /search/
Disallow: /user/register/
Disallow: /user/password/
Disallow: /user/login/
Disallow: /user/logout/
# Paths (no clean URLs)
Disallow: /index.php/admin/
Disallow: /index.php/comment/reply/
Disallow: /index.php/filter/tips
Disallow: /index.php/node/add/
Disallow: /index.php/search/
Disallow: /index.php/user/password/
Disallow: /index.php/user/register/
Disallow: /index.php/user/login/
Disallow: /index.php/user/logout/
信息总结:
- PHP >= 5.5.9
Drupal
- apache禁掉了部分危险后缀
- 疑似用户名:DC7USER
漏洞走不通,爆破也不行,今天刚好做了点趣味题,想到这个new concept
会不会和社工相关,搜了一下DC7USER
,发现排在最上面的就是github
和小蓝鸟账号
github
里面有个库staffdb
(员工数据库)
下载到本地挨个看看
泄露了mysql
配置
<?php
$servername = "localhost";
$username = "dc7user";
$password = "MdR3xOgB7#dW";
$dbname = "Staff";
$conn = mysqli_connect($servername, $username, $password, $dbname);
?>
泄露了几条数据
$sql = "INSERT INTO StaffDetails (firstname, lastname, phone, email)
VALUES ('John', 'Doe', '048547896425', 'john@example.com')";
$sql .= "INSERT INTO StaffDetails (firstname, lastname, position, phone, email)
VALUES ('Mary', 'Moe', 'CEO', '46478415155456', 'mary@example.com');";
$sql .= "INSERT INTO StaffDetails (firstname, lastname, position, phone, email)
VALUES ('Julie', 'Dooley', 'Human Resources', '46457131654', 'julie@example.com')";
文件包含
<?php
$file = 'contact-info.php';
if(file_exists($file)) {
include($file);
} else {
echo "The file does not exist" . "<br />";
$file = $_GET['file'];
include('directory/' . $file);
}
?>
尝试过发现这些文件并不是80端口web应用的,那就只剩下mysql
配置文件能用,测试发现mysql
也连不上去,只能试试ssh
3 提权
有mbox
,看了下是定时任务/opt/scripts/backups.sh
的提醒邮件,数据备份到了/home/dc7user/backups/website.sql
,
From root@dc-7 Thu Aug 29 17:45:11 2019
Return-path: <root@dc-7>
Envelope-to: root@dc-7
Delivery-date: Thu, 29 Aug 2019 17:45:11 +1000
Received: from root by dc-7 with local (Exim 4.89)
(envelope-from <root@dc-7>)
id 1i3F7H-0000G3-Nb
for root@dc-7; Thu, 29 Aug 2019 17:45:11 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron <root@dc-7> /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <LOGNAME=root>
Message-Id: <E1i3F7H-0000G3-Nb@dc-7>
Date: Thu, 29 Aug 2019 17:45:11 +1000
Database dump saved to /home/dc7user/backups/website.sql [success]
gpg: symmetric encryption of '/home/dc7user/backups/website.tar.gz' failed: File exists
gpg: symmetric encryption of '/home/dc7user/backups/website.sql' failed: File exists
尝试解密,但需要口令,按照逻辑,加密口令也应该在定时任务脚本里,找到了口令PickYourOwnPassword
解密拿回本地,notepad++
直接卡死,2亿字符,换vscode
搜admin
一共有20w+
个结果,果断放弃。。。去看看wp
原来使用drush
这个脚本(drupal
的命令行管理工具)
一开始报错了,搜了下了解到drush
还是需要调用drupal
cms本身的一些代码,所以需要到目录下面
拿到密码愣了一下,为啥要拿密码呢,不该是提权吗,回去看了下之前做的步骤,发现最直接的提权方法就是root
定时执行的备份脚本,看了下权限
www-data
是有权限修改的,所以我们要做的是往脚本里写点恶意代码,这需要借助Drupal
的功能点,这部分过程比较麻烦
- 登录后台
Extend
->Install new module
https://ftp.drupal.org/files/projects/php-8.x-1.x-dev.tar.gz
下载插件,安装,enable newly added modules
Extend
->FILTERS
类 ->在PHP FILTER
前打勾 -> 页面底部INSTALL
这个插件允许运行自定义代码(php),所以我们在Content
-> Create Basic Page
新建一个页面,用system
函数反弹shell,同时在本地监听对应端口
保存,预览,拿shell
惯例,python -c "import pty;pty.spawn('/bin/bash')"
拿pty模拟终端
向定时任务脚本里写反弹shell命令
拿到flag
也不一定要反弹shell,也可以和前面teehee
的做法一样,添加用户,不过注意要用>>
而不是>
标签:index,DC,Disallow,Cron,user,php,root 来源: https://www.cnblogs.com/R3col/p/16170402.html