fowsniff WP - 技术栈

下载地址：

https://download.vulnhub.com/fowsniff/Fowsniff_CTF_ova.7z

category：重要

awk剪切得到字典，巩固awk使用技巧

motd提权，有意思的提权方式

这篇WP详细讲了motd提权，感兴趣可以看看，带有一定推测，欢迎大佬指点纠正

一两个月前打的，凭记忆复现，可能攻击链的体现不是特别流畅，望海涵

扫描，开了通信服务，稍后可能会用得到

访问web服务：

给了一个账户，查看

且文中说用户的用户名和密码都已泄露

所以去谷歌搜索看是否有相关信息

可以找到这样一个文件：

shell 复制代码

FOWSNIFF CORP PASSWORD LEAK
            ''~``
           ( o o )
+-----.oooO--(_)--Oooo.------+
|                            |
|          FOWSNIFF          |
|            got             |
|           PWN3D!!!         |
|                            |         
|       .oooO                |         
|        (   )   Oooo.       |         
+---------\ (----(   )-------+
           \_)    ) /
                 (_/
FowSniff Corp got pwn3d by B1gN1nj4!
No one is safe from my 1337 skillz!
 
 
mauer@fowsniff:8a28a94a588a95b80163709ab4313aa4
mustikka@fowsniff:ae1644dac5b77c0cf51e0d26ad6d7e56
tegel@fowsniff:1dc352435fecca338acfd4be10984009
baksteen@fowsniff:19f5af754c31f1e2651edde9250d69bb
seina@fowsniff:90dc16d47114aa13671c697fd506cf26
stone@fowsniff:a92b8a29ef1183192e3d35187e0cfabd
mursten@fowsniff:0e9588cb62f4b6f27e33d449e2ba0b3b
parede@fowsniff:4d6e42f56e127803285a0a7649b5ab11
sciana@fowsniff:f7fd98d380735e859f8b2ffbbede5a7e
 
Fowsniff Corporation Passwords LEAKED!
FOWSNIFF CORP PASSWORD DUMP!
 
Here are their email passwords dumped from their databases.
They left their pop3 server WIDE OPEN, too!
 
MD5 is insecure, so you shouldn't have trouble cracking them but I was too lazy haha =P
 
l8r n00bz!
 
B1gN1nj4

-------------------------------------------------------------------------------------------------
This list is entirely fictional and is part of a Capture the Flag educational challenge.

--- THIS IS NOT A REAL PASSWORD LEAK ---
 
All information contained within is invented solely for this purpose and does not correspond
to any real persons or organizations.
 
Any similarities to actual people or entities is purely coincidental and occurred accidentally.

虽然说让员工修改密码，不排除有漏网之鱼

我们可以剪切得到字典进行爆破

Here are their email passwords dumped from their databases.

They left their pop3 server WIDE OPEN, too!

这段话的意思是这些账户是邮箱的密码，pop3完全开放，也就是不需要其他验证（没有其他认证保护）就可以就可以凭借凭据登录

接下来思路很明确了

爆破一下这些md5

应该是raw-md5

raw-md5的特征

特征项	描述
长度	32 个十六进制字符（128 位）
编码	纯小写或大写十六进制（无 Base64、无前缀）
字符集	只包含 `0-9` 和 `a-f` （或 `A-F` ）
示例	`8a28a94a588a95b80163709ab4313aa4`

John 会自动解析文件中的每行，识别冒号分割的字段，将哈希字段提取出来用于爆破。

所以这里不用awk,直接拿给john爆破

拿到很多用户凭据，先试试碰撞ssh,不成再找找别的地方是否能用上

可以看到碰撞失败

（这里用crackmapexec效果差不多）

继续回到80端口

如果能扫到登录页面，就可以继续碰撞

扫描完发现不成，这时想到pop3服务是否可以爆破，查询hydra 爆破pop3

空格的awk可以直接指定字段不指定分隔符

爆破成功

pop3尝试登录查看邮件信息

pop3语法总结

命令	作用
`STAT`	查看邮件数量和总字节数
`LIST`	列出所有邮件编号和大小
`LIST <n>`	列出第 n 封邮件的大小
`RETR <n>`	取回第 n 封邮件的内容
`DELE <n>`	删除第 n 封邮件（退出前不生效）
`NOOP`	空操作，保持连接
`RSET`	取消已标记删除的邮件
`TOP <n> <x>`	查看第 n 封邮件前 x 行正文（不含附件）

可以看到有两封邮件，第一封写道：

shell 复制代码

 nc 10.10.10.129 110
+OK Welcome to the Fowsniff Corporate Mail Server!
USER seina
+OK
PASS scoobydoo2
+OK Logged in.
STAT
+OK 2 2902
LIST
+OK 2 messages:
1 1622
2 1280
.
LIST 1
+OK 1 1622
RETR 1
+OK 1622 octets
Return-Path: <stone@fowsniff>
X-Original-To: seina@fowsniff
Delivered-To: seina@fowsniff
Received: by fowsniff (Postfix, from userid 1000)
	id 0FA3916A; Tue, 13 Mar 2018 14:51:07 -0400 (EDT)
To: baksteen@fowsniff, mauer@fowsniff, mursten@fowsniff,
    mustikka@fowsniff, parede@fowsniff, sciana@fowsniff, seina@fowsniff,
    tegel@fowsniff
Subject: URGENT! Security EVENT!
Message-Id: <20180313185107.0FA3916A@fowsniff>
Date: Tue, 13 Mar 2018 14:51:07 -0400 (EDT)
From: stone@fowsniff (stone)

Dear All,

A few days ago, a malicious actor was able to gain entry to
our internal email systems. The attacker was able to exploit
incorrectly filtered escape characters within our SQL database
to access our login credentials. Both the SQL and authentication
system used legacy methods that had not been updated in some time.

We have been instructed to perform a complete internal system
overhaul. While the main systems are "in the shop," we have
moved to this isolated, temporary server that has minimal
functionality.

This server is capable of sending and receiving emails, but only
locally. That means you can only send emails to other users, not
to the world wide web. You can, however, access this system via 
the SSH protocol.

The temporary password for SSH is "S1ck3nBluff+secureshell"

You MUST change this password as soon as possible, and you will do so under my
guidance. I saw the leak the attacker posted online, and I must say that your
passwords were not very secure.

Come see me in my office at your earliest convenience and we'll set it up.

Thanks,
A.J Stone

可以看到，这里给了员工 ssh的临时密码并且让他们尽快修改，这是我们要碰撞一下看是否有员工尚未修改，有的话可以直接拿到shell

可以看到，这位员工没有修改密码，尝试ssh连接

连接成功：

这时再看一下第二封信，说不定可以决定提权的方向

第二封信写道：

shell 复制代码

RETR 2
+OK 1280 octets
Return-Path: <baksteen@fowsniff>
X-Original-To: seina@fowsniff
Delivered-To: seina@fowsniff
Received: by fowsniff (Postfix, from userid 1004)
	id 101CA1AC2; Tue, 13 Mar 2018 14:54:05 -0400 (EDT)
To: seina@fowsniff
Subject: You missed out!
Message-Id: <20180313185405.101CA1AC2@fowsniff>
Date: Tue, 13 Mar 2018 14:54:05 -0400 (EDT)
From: baksteen@fowsniff

Devin,

You should have seen the brass lay into AJ today!
We are going to be talking about this one for a looooong time hahaha.
Who knew the regional manager had been in the navy? She was swearing like a sailor!

I don't know what kind of pneumonia or something you brought back with
you from your camping trip, but I think I'm coming down with it myself.
How long have you been gone - a week?
Next time you're going to get sick and miss the managerial blowout of the century,
at least keep it to yourself!

I'm going to head home early and eat some chicken soup. 
I think I just got an email from Stone, too, but it's probably just some
"Let me explain the tone of my meeting with management" face-saving mail.
I'll read it when I get back.

Feel better,

Skyler

PS: Make sure you change your email password. 
AJ had been telling us to do that right before Captain Profanity showed up.

第二封信可以看出，这个署名为Skyler的人应该就是没有修改密码的员工baksteen, 因为他使用自己的昵称Skyler作为他自己的邮箱密码。之所以没改密码是因为他觉得不舒服，要回家先喝鸡汤再看，不巧被我们捷足先登了；以及stone管理员因为数据库泄露被区域经理骂了。总之，应该没有什么重要线索，不过不得不说这个靶机的情景设计十分用心

所以接下来常规提权