Tidesec @ new information
Escort for network security
2000- to date
Sheng Ming
This article was first published by "you can't hurt me" member of the tide security team in freebuf tidesec column:
https://www.freebuf.com/column/200844.html
The technologies, ideas and tools involved in this article are only for learning and exchange for safety purposes, and no one is allowed to use them for illegal purposes and profit purposes, or the consequences will be borne by themselves!
1、 Foreword
Up to now, I have done several sets of targets on vulnhub, although they are not very difficult, but I still learned a lot of knowledge. This time, I will try to change a target machine with medium difficulty, and record my actual combat process to communicate and learn with you.
2、 Installation and operation instructions
* target difficulty: Intermediate
* target: raise root and obtain flag
* operating environment: Kali Linux
Target aircraft fristileaks (download address: https://download.vulnhub.com/fristileaks/fristileaks_.3. OVA)
Both are running in VMWare
* network settings: the connection mode is NAT mode
3、 Infiltrate the actual combat process
1. Target discovery, catalog explosion
First, turn on Kali and the target, and then use nmap to find the target IP address according to the old routine
Here, the target's address is 192.168.50.143. First, use a browser to access a wave
There is a link in the middle. Click to have a look
Links to twitter... OK, let's do the target machine actual combat instead of turning over the (harmonious) wall course, let's ignore it first. Click the source code of the opening page again
There is nothing found in the source code. The author said that it should be finished in 4 hours. Try to meet the requirements, ha ha
Since the IP access fails, the directory will be exploded
I don't know why, dirbuster always reports an error after scanning for some time. If you understand, please give me some advice
Next, according to the existing blasting results of dirbuster, first open images to see
Open two pictures respectively
It's both pictures, which seem useless. Next, use nmap to scan the IP address, and see how many ports are open
Input nmap-sv-p-192.168.50.143 in the Kali command line to scan the port of the target. It turns out that the target machine has only opened an 80 port, and after visiting it, it is still the above web page
Nothing. Next, scan port 80. On the Kali command line, enter nmap - A - O - p80 192.168.50.143
The scanning results show that there is also a robots.txt under the face-to-face address. Visit it and have a look
According to the page prompts, access the cola, Sisi, beer directories in turn, and the results are all the same
Ah, it's a sad story. I've been busy for a long time without any valuable information. All of a sudden, I found that there are several same pictures of keep call and drink fristI. Try to visit 192.168.50.143/fristi
I have to sigh that the author's brain hole is big.... Now we have a landing page, but according to my previous experience of making a target machine, it is generally not advisable to brutally crack the landing, first look at the source code.
Note that this eezeepz is probably the login user name. Continue to scroll down. There is Base64 code under the web page
Take it to decrypt, except for the PNG at the beginning to let me know that this may be a picture, all the others are garbled
I can't help but write a py script according to the experts' tutorial
In Kali's home directory, I got a picture like this
This should be the password. Go back to the previous page and log in
Login, log in successfully. It is a file upload page
2. Rebound shell by using file upload vulnerability
If the web page shows that we want to upload pictures, we will use the shell in the format of pictures to bounce back. First, monitor in Kali, then modify the shell, and change the IP address and port number to the corresponding Kali machine's
Save the shell as a PNG file, upload it and access it in uploads, and successfully rebound the shell
3. Upgrade permissions and obtain flag
After the rebound shell is successful, first ls to see what files are available
Find the home directory, open it and have a look
Eezeepz is our user name when we log in. Let's see what's in it
Here is a note.txt. Open it and have a look
The author said that to go back to the / tmp directory and create the runthis file, try it. The command window executes "echo" / usr / bin /.. / bin / Chmod - R 777 / home / Admin "> / TMP / runthis, and then creates runthis
OK, the creation is successful. Next, look at the admin directory
There are four files worthy of our attention. Cronjob.py is the PY file of the load command. The encryption code is cryptpass.py. The other two TXT documents are the encrypted code. However, I really have limited ability to decrypt the two documents (not because it's too delicious). According to the documents decrypted by the great gods, whoisyougodnow.txt corresponds to lettherebefristi!. Cryptedpass.txt decrypts the corresponding thisisalsopw123.
Next, try switching user accounts and enter the command Su – fristignod
This situation has happened many times. Enter the code directly
Python - C 'import Pty; Pty. Spawn ("/ bin / bash")' enter
Enter the password lettherebefristi! And log in successfully
Let's see what files there are. LS has nothing. Maybe it's hidden. Direct ls-la
There is a history file. Open it and have a look
You can see that "fristignod" always uses sudo to execute commands. Let's try it, too
Then try to generate a shell by imitating the previous bash command execution history
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom /bin/bash
Get flag successfully
Four, summarize
After finishing the target machine, I feel that I have benefited a lot. It's OK to do something simpler before. Once I improve the difficulty, I have no clue. And I also found that I really have a lot to improve. The front part of the target machine can still be solved by myself. At the back, especially the power lifting part, I exposed a lot of weaknesses. I found that I really have a lot of shortcomings. I hope I can improve my technical level as soon as possible. In short, in the absence of reference materials and expert tutorial guidance, I failed to complete independently, after that, I need to broaden my mind and practice more.
E
N
D
G an
shut
Zh
notes
W
I
Men
People
Tide security team was formally established in January 2019. It is a security team under the banner of new information, aiming at the research of Internet attack and defense technology. At present, it has gathered more than ten professional security attack and defense technology researchers, focusing on network attack and defense, web security, mobile terminals, security development, IOT / Internet of things / industrial control security and other directions.
For more Tide security teams, please pay attention to team official website: http://www.TideSec.net or long by two-dimensional code, pay attention to official account number:
Trendy information
Professional focus excellence safety