tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.10.14.50/23 scope global tun0
valid_lft forever preferred_lft forever
inet6 dead:beef:2::1030/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::5fd0:9e3a:8065:d66a/64 scope link stable-privacy
valid_lft forever preferred_lft forever
与HTB连接的网卡10.10.14.50
b)HTB靶机地址
c) ping 测试
ping 10.10.11.8
PING 10.10.11.8 (10.10.11.8) 56(84) bytes of data.
64 bytes from 10.10.11.8: icmp_seq=1 ttl=63 time=330 ms
64 bytes from 10.10.11.8: icmp_seq=2 ttl=63 time=328 ms
2) nmap扫描
a) 端口发现
# 以最低10000速率，以tcp扫面全端口 结果输出到ports文件中
nmap -sT -p- --min-rate 10000 10.10.11.8 -o ports
Starting Nmap 7.93 ( https://nmap.org ) at 2024-07-27 22:32 EDT
Warning: 10.10.11.8 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.8
Host is up (0.33s latency).
Not shown: 65178 closed tcp ports (conn-refused), 355 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
5000/tcp open upnp
Nmap done: 1 IP address (1 host up) scanned in 54.36 seconds
b) 端口详细信息
# 以tcp连接，输出详细信息，以默认脚本 扫描22,5000端口，结果输出到details文件中
nmap -sT -sV -sC -p22,5000 10.10.11.8 -o details
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
| 256 900294283dab2274df0ea3b20f2bc617 (ECDSA)
|_ 256 2eb90824021b609460b384a99e1a60ca (ED25519)
5000/tcp open upnp?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Server: Werkzeug/2.2.2 Python/3.11.2
| Date: Sun, 28 Jul 2024 02:48:15 GMT
| Content-Type: text/html; charset=utf-8
| Content-Length: 2799
| Set-Cookie: is_admin=InVzZXIi.uAlmXlTvm8vyihjNaPDWnvB_Zfs; Path=/
| Connection: close
可以看到5000端口像是一个web服务，22号端口就是常规的ssh服务
2、web渗透
1）访问5000端口
发现有一个For questions的按钮，我们点击进去，看到一个表单，尝试XSS注入
点击提交
上面显示
Your IP address has been flagged, a report with your browser information has been sent to the administrators for investigation.
dvir@headless:~$ cd /home/dvir
cd /home/dvir
dvir@headless:~$ cat user.txt
cat user.txt
c62add3a4cecb6ace7242e40305e9ed2
4、提权到root
1）发现邮件系统
通过枚举目标系统，发现目标有邮件
cd /var/mail
cat dvir
Subject: Important Update: New System Check Script
Hello!
We have an important update regarding our server. In response to recent compatibility and crashing issues, we've introduced a new system check script.
What's special for you?
- You've been granted special privileges to use this script.
- It will help identify and resolve system issues more efficiently.
- It ensures that necessary updates are applied when needed.
Rest assured, this script is at your disposal and won't affect your regular use of the system.
If you have any questions or notice anything unusual, please don't hesitate to reach out to us. We're here to assist you with any concerns.
By the way, we're still waiting on you to create the database initialization script!
Best regards,
Headless
意思就是说：为了应对最近的兼容性和崩溃问题，我们引入了一个新的系统检查脚本。
这个脚本应该就是我们提权的关键
# 运行 sudo -l 可以看到检查文件的路径
sudo -l
Matching Defaults entries for dvir on headless:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
use_pty
User dvir may run the following commands on headless:
(ALL) NOPASSWD: /usr/bin/syscheck
#查看一下脚本
cat /sur/bin/syscheck
#!/bin/bash
if [ "$EUID" -ne 0 ]; then
exit 1
fi
last_modified_time=$(/usr/bin/find /boot -name 'vmlinuz*' -exec stat -c %Y {} + | /usr/bin/sort -n | /usr/bin/tail -n 1)
formatted_time=$(/usr/bin/date -d "@$last_modified_time" +"%d/%m/%Y %H:%M")
/usr/bin/echo "Last Kernel Modification Time: $formatted_time"
disk_space=$(/usr/bin/df -h / | /usr/bin/awk 'NR==2 {print $4}')
/usr/bin/echo "Available disk space: $disk_space"
load_average=$(/usr/bin/uptime | /usr/bin/awk -F'load average:' '{print $2}')
/usr/bin/echo "System load average: $load_average"
if ! /usr/bin/pgrep -x "initdb.sh" &>/dev/null; then
/usr/bin/echo "Database service is not running. Starting it..."
./initdb.sh 2>/dev/null
else
/usr/bin/echo "Database service is running."
fi
exit 0
load_average=$(/usr/bin/uptime | /usr/bin/awk -F'load average:' '{print $2}')
/usr/bin/echo "System load average: $load_average"
if ! /usr/bin/pgrep -x "initdb.sh" &>/dev/null; then
/usr/bin/echo "Database service is not running. Starting it..."
./initdb.sh 2>/dev/null
else
/usr/bin/echo "Database service is running."
fi
dvir@headless:/tmp$ sudo syscheck
sudo syscheck
Last Kernel Modification Time: 01/02/2024 10:05
Available disk space: 2.0G
System load average: 0.00, 0.00, 0.00
Database service is not running. Starting it...
id
id
uid=0(root) gid=0(root) groups=0(root)