Bravery

Recon

使用netdiscover对本地网络进行arp扫描。

 ┌──(kali㉿kali)-[~]

└─$ sudo netdiscover -r 192.168.80.0/24

 Currently scanning: Finished!   |   Screen View: Unique Hosts                                                                         

 5 Captured ARP Req/Rep packets, from 5 hosts.   Total size: 300

 _____________________________________________________________________________

   IP            At MAC Address     Count     Len  MAC Vendor / Hostname

 -----------------------------------------------------------------------------

 192.168.80.1    00:50:56:c0:00:08      1      60  VMware, Inc.

 192.168.80.2    00:50:56:ed:65:ac      1      60  VMware, Inc.

 192.168.80.131  00:0c:29:5a:0f:b5      1      60  VMware, Inc.

 192.168.80.133  00:0c:29:b9:af:ac      1      60  VMware, Inc.

 192.168.80.254  00:50:56:fd:b9:5a      1      60  VMware, Inc.

┌──(kali㉿kali)-[~]

└─$ sudo nmap -sS -p- -sV 192.168.80.131

Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-07 00:49 EDT

Nmap scan report for 192.168.80.131

Host is up (0.0010s latency).

Not shown: 65522 closed tcp ports (reset)

PORT      STATE SERVICE     VERSION

22/tcp    open  ssh         OpenSSH 7.4 (protocol 2.0)

53/tcp    open  domain      dnsmasq 2.76

80/tcp    open  http        Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)

111/tcp   open  rpcbind     2-4 (RPC #100000)

139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

443/tcp   open  ssl/http    Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)

445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

2049/tcp  open  nfs_acl     3 (RPC #100227)

3306/tcp  open  mysql       MariaDB (unauthorized)

8080/tcp  open  http        nginx 1.12.2

20048/tcp open  mountd      1-3 (RPC #100005)

37985/tcp open  status      1 (RPC #100024)

44626/tcp open  nlockmgr    1-4 (RPC #100021)

MAC Address: 00:0C:29:5A:0F:B5 (VMware)

Service Info: Host: BRAVERY

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 21.52 seconds

发现目标靶机开启了DNS、HTTP、HTTPS和Samba、NFS等一系列的服务。

Process

我们首先发现了NFS这个有趣的服务，我们直接尝试挂载到本地。

┌──(kali㉿kali)-[~/Labs/Bravery]

└─$ sudo mount -t nfs 192.168.80.131:/ nfs

┌──(kali㉿kali)-[~/…/Bravery/nfs/var/nfsshare]

└─$ ls

discovery  enumeration  explore  itinerary  password.txt  qwertyuioplkjhgfdsazxcvbnm  README.txt

其中的内容，大部分没有什么作用，但是我们关注到一个奇怪的文件（此处埋下伏笔）。

┌──(kali㉿kali)-[~/…/Bravery/nfs/var/nfsshare]

└─$ cat qwertyuioplkjhgfdsazxcvbnm

Sometimes, the answer you seek may be right before your very eyes.

NFS中有效的内容不多，此时将我们的目光放到Samba上，目标为Linux机器，要想枚举目标的Samba信息，我们有个得力的工具enum4linux，工具的详细信息。

通过enum4linux工具的输出，我们能够获得Linux主机上的用户和共享文件夹（下为部分内容）。

======================================( Users on 192.168.80.131 )======================================

index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: david    Name: david     Desc:

index: 0x2 RID: 0x3e9 acb: 0x00000010 Account: rick     Name:   Desc: 

user:[david] rid:[0x3e8]

user:[rick] rid:[0x3e9]

 ================================( Share Enumeration on 192.168.80.131 )================================

        Sharename       Type      Comment

        ---------       ----      -------

        anonymous       Disk

        secured         Disk

        IPC$            IPC       IPC Service (Samba Server 4.7.1)

我们获得了用户david和rick，以及共享文件夹anonymous和secured。我们首先通过smbclient工具访问共享文件夹anonymous。

┌──(kali㉿kali)-[~/Labs/Bravery]

└─$ smbclient //192.168.80.131/anonymous -U %

Try "help" to get a list of possible commands.

smb: \> dir

  .                                   D        0  Fri Sep 28 09:01:35 2018

  ..                                  D        0  Thu Jun 14 12:30:39 2018

  patrick's folder                    D        0  Fri Sep 28 08:38:27 2018

  qiu's folder                        D        0  Fri Sep 28 09:27:20 2018

  genevieve's folder                  D        0  Fri Sep 28 09:08:31 2018

  david's folder                      D        0  Tue Dec 25 21:19:51 2018

  kenny's folder                      D        0  Fri Sep 28 08:52:49 2018

  qinyi's folder                      D        0  Fri Sep 28 08:45:22 2018

  sara's folder                       D        0  Fri Sep 28 09:34:23 2018

  readme.txt                          N      489  Fri Sep 28 09:54:03 2018

  17811456 blocks of size 1024. 12839656 blocks available

我们获得了一部分用户和readme.txt，但这些文件夹并没有实际的作用。readme.txt只告诉我们这个samba共享系统可能即将被替换到Sharepoint。那么我们就尝试访问另一个secured文件夹，此时之前埋下的伏笔就起到了作用，它是david账户的密码。在文件夹中我们发现了三个文件。

┌──(kali㉿kali)-[~/Labs/Bravery/smbd]

└─$ cat david.txt

I have concerns over how the developers are designing their webpage. The use of "developmentsecretpage" is too long and unwieldy. We should cut short the addresses in our local domain.

1. Reminder to tell Patrick to replace "developmentsecretpage" with "devops".

2. Request the intern to adjust her Favourites to http://<developmentIPandport>/devops/directortestpagev1.php.

david.txt文件也是一个伏笔，不过这个靶机无关。其中最为关键的是genevieve.txt文件。其中有一个url值得我们关注。

┌──(kali㉿kali)-[~/Labs/Bravery/smbd]

└─$ cat genevieve.txt

Hi! This is Genevieve!

We are still trying to construct our department's IT infrastructure; it's been proving painful so far.

If you wouldn't mind, please do not subject my site (http://192.168.254.155/genevieve) to any load-test as of yet. We're trying to establish quite a few things:

a) File-share to our director.

b) Setting up our CMS.

c) Requesting for a HIDS solution to secure our host.

我们尝试访问它。发现是一个类似CMS的测试页。

然后再Internal Use Only中发现了管理员登录的页面。

我们发现是Cuppa CMS，我们首先通过searchsploit查找目标是否存在漏洞。

我们找到了一个本地/远程文件包含的漏洞，接下来尝试进行利用。

通过查看文件中描述的EXPLOIT，我们首先尝试验证漏洞是否存在。

漏洞存在，我们接下来准备上传Shell。通过python开启http服务器，并准备PHP的Reverse Shell，使用nc监听端口。（PHP Reverse Shell不做展开）最后通过curl发送请求触发漏洞，获得Shell。

Privilege Escalation

在上面的过程中我们获得了Shell，但是Shell处于一个低权限的状态，下面通过一种方式提权。

通过查找具有粘滞位权限的命令，我们找到了cp这个命令。

我们通过将passwd文件cp至当前目录，并通过cat构造一个newpasswd文件，并将构造好的用户添加入newpasswd，再通过cp的粘滞位权限将其替换/etc/passwd进行提权。

需要注意的一点，hacker用户的密码需要自行按照当前系统所使用的密码编码生成，比如CentOS与Ubuntu所使用的hash算法不同，则不能相互识别。

提权成功。

Vulnhub Bravery靶机 Walkthrough的相关教程结束。