Vulnhub Bravery靶机 Walkthrough
Bravery
Recon
使用netdiscover对本地网络进行arp扫描。
┌──(kali?kali)-[~]
└─$ sudo netdiscover -r 192.168.80.0/24
Currently scanning: Finished! | Screen View: Unique Hosts
5 Captured ARP Req/Rep packets, from 5 hosts. Total size: 300
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.80.1 00:50:56:c0:00:08 1 60 VMware, Inc.
192.168.80.2 00:50:56:ed:65:ac 1 60 VMware, Inc.
192.168.80.131 00:0c:29:5a:0f:b5 1 60 VMware, Inc.
192.168.80.133 00:0c:29:b9:af:ac 1 60 VMware, Inc.
192.168.80.254 00:50:56:fd:b9:5a 1 60 VMware, Inc.
┌──(kali?kali)-[~]
└─$ sudo nmap -sS -p- -sV 192.168.80.131
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-07 00:49 EDT
Nmap scan report for 192.168.80.131
Host is up (0.0010s latency).
Not shown: 65522 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
53/tcp open domain dnsmasq 2.76
80/tcp open http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)
111/tcp open rpcbind 2-4 (RPC #100000)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
443/tcp open ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
2049/tcp open nfs_acl 3 (RPC #100227)
3306/tcp open mysql MariaDB (unauthorized)
8080/tcp open http nginx 1.12.2
20048/tcp open mountd 1-3 (RPC #100005)
37985/tcp open status 1 (RPC #100024)
44626/tcp open nlockmgr 1-4 (RPC #100021)
MAC Address: 00:0C:29:5A:0F:B5 (VMware)
Service Info: Host: BRAVERY
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.52 seconds
发现目标靶机开启了DNS、HTTP、HTTPS和Samba、NFS等一系列的服务。
Process
我们首先发现了NFS这个有趣的服务，我们直接尝试挂载到本地。
┌──(kali?kali)-[~/Labs/Bravery]
└─$ sudo mount -t nfs 192.168.80.131:/ nfs
┌──(kali?kali)-[~/…/Bravery/nfs/var/nfsshare]
└─$ ls
discovery enumeration explore itinerary password.txt qwertyuioplkjhgfdsazxcvbnm README.txt
其中的内容，大部分没有什么作用，但是我们关注到一个奇怪的文件（此处埋下伏笔）。
┌──(kali?kali)-[~/…/Bravery/nfs/var/nfsshare]
└─$ cat qwertyuioplkjhgfdsazxcvbnm
Sometimes, the answer you seek may be right before your very eyes.
NFS中有效的内容不多，此时将我们的目光放到Samba上，目标为Linux机器，要想枚举目标的Samba信息，我们有个得力的工具enum4linux，工具的详细信息。
通过enum4linux工具的输出，我们能够获得Linux主机上的用户和共享文件夹（下为部分内容）。
======================================( Users on 192.168.80.131 )======================================
index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: david Name: david Desc:
index: 0x2 RID: 0x3e9 acb: 0x00000010 Account: rick Name: Desc:
user:[david] rid:[0x3e8]
user:[rick] rid:[0x3e9]
================================( Share Enumeration on 192.168.80.131 )================================
Sharename Type Comment
--------- ---- -------
anonymous Disk
secured Disk
IPC$ IPC IPC Service (Samba Server 4.7.1)
我们获得了用户david和rick，以及共享文件夹anonymous和secured。我们首先通过smbclient工具访问共享文件夹anonymous。
┌──(kali?kali)-[~/Labs/Bravery]
└─$ smbclient //192.168.80.131/anonymous -U %
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Fri Sep 28 09:01:35 2018
.. D 0 Thu Jun 14 12:30:39 2018
patrick's folder D 0 Fri Sep 28 08:38:27 2018
qiu's folder D 0 Fri Sep 28 09:27:20 2018
genevieve's folder D 0 Fri Sep 28 09:08:31 2018
david's folder D 0 Tue Dec 25 21:19:51 2018
kenny's folder D 0 Fri Sep 28 08:52:49 2018
qinyi's folder D 0 Fri Sep 28 08:45:22 2018
sara's folder D 0 Fri Sep 28 09:34:23 2018
readme.txt N 489 Fri Sep 28 09:54:03 2018
17811456 blocks of size 1024. 12839656 blocks available
我们获得了一部分用户和readme.txt，但这些文件夹并没有实际的作用。readme.txt只告诉我们这个samba共享系统可能即将被替换到Sharepoint。那么我们就尝试访问另一个secured文件夹，此时之前埋下的伏笔就起到了作用，它是david账户的密码。在文件夹中我们发现了三个文件。
┌──(kali?kali)-[~/Labs/Bravery/smbd]
└─$ cat david.txt
I have concerns over how the developers are designing their webpage. The use of "developmentsecretpage" is too long and unwieldy. We should cut short the addresses in our local domain.
1. Reminder to tell Patrick to replace "developmentsecretpage" with "devops".
2. Request the intern to adjust her Favourites to http://<developmentIPandport>/devops/directortestpagev1.php.
david.txt文件也是一个伏笔，不过这个靶机无关。其中最为关键的是genevieve.txt文件。其中有一个url值得我们关注。
┌──(kali?kali)-[~/Labs/Bravery/smbd]
└─$ cat genevieve.txt
Hi! This is Genevieve!
We are still trying to construct our department's IT infrastructure; it's been proving painful so far.
If you wouldn't mind, please do not subject my site (http://192.168.254.155/genevieve) to any load-test as of yet. We're trying to establish quite a few things:
a) File-share to our director.
b) Setting up our CMS.
c) Requesting for a HIDS solution to secure our host.
我们尝试访问它。发现是一个类似CMS的测试页。
然后再Internal Use Only中发现了管理员登录的页面。
我们发现是Cuppa CMS，我们首先通过searchsploit查找目标是否存在漏洞。
我们找到了一个本地/远程文件包含的漏洞，接下来尝试进行利用。
通过查看文件中描述的EXPLOIT，我们首先尝试验证漏洞是否存在。
漏洞存在，我们接下来准备上传Shell。通过python开启http服务器，并准备PHP的Reverse Shell，使用nc监听端口。（PHP Reverse Shell不做展开）最后通过curl发送请求触发漏洞，获得Shell。
Privilege Escalation
在上面的过程中我们获得了Shell，但是Shell处于一个低权限的状态，下面通过一种方式提权。
通过查找具有粘滞位权限的命令，我们找到了cp这个命令。
我们通过将passwd文件cp至当前目录，并通过cat构造一个newpasswd文件，并将构造好的用户添加入newpasswd，再通过cp的粘滞位权限将其替换/etc/passwd进行提权。
需要注意的一点，hacker用户的密码需要自行按照当前系统所使用的密码编码生成，比如CentOS与Ubuntu所使用的hash算法不同，则不能相互识别。
提权成功。
