【HTB系列】靶機Chaos的滲透測試詳解

2019 年 10 月 7 日
筆記

本文作者：是大方子（Ms08067實驗室核心成員）

知識點：

1. 通過域名或者IP可能會得到網站的不同響應

2. Wpscan的掃描wordpress

3. 修改hosts來對網頁郵件系統webmail進行訪問

4. LaTax反彈shell

5. 通過tar來進行限制shell的繞過並修復shell的PATH

6. 用firefox_decrypt提取火狐的用戶憑證快取

介紹

Kali: 10.10.12.87

靶機地址：10.10.10.120

先用Nmap來進行探測

root@kali:~/HTB# nmap -sV -T5 -sC 10.10.10.120 Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-08 13:18 CSTNmap scan report for 10.10.10.120Host is up (0.21s latency).Not shown: 994 closed portsPORT STATE SERVICE VERSION80/tcp open http Apache httpd 2.4.34 ((Ubuntu))|_http-server-header: Apache/2.4.34 (Ubuntu)|_http-title: Site doesn't have a title (text/html).110/tcp open pop3 Dovecot pop3d|_pop3-capabilities: STLS UIDL TOP SASL RESP-CODES CAPA AUTH-RESP-CODE PIPELINING| ssl-cert: Subject: commonName=chaos| Subject Alternative Name: DNS:chaos| Not valid before: 2018-10-28T10:01:49|_Not valid after: 2028-10-25T10:01:49|_ssl-date: TLS randomness does not represent time143/tcp open imap Dovecot imapd (Ubuntu)|_imap-capabilities: STARTTLS ENABLE LITERAL+ OK IMAP4rev1 SASL-IR LOGINDISABLEDA0001 have post-login listed ID IDLE LOGIN-REFERRALS capabilities more Pre-login| ssl-cert: Subject: commonName=chaos| Subject Alternative Name: DNS:chaos| Not valid before: 2018-10-28T10:01:49|_Not valid after: 2028-10-25T10:01:49|_ssl-date: TLS randomness does not represent time993/tcp open ssl/imap Dovecot imapd (Ubuntu)|_imap-capabilities: ENABLE LITERAL+ OK AUTH=PLAINA0001 SASL-IR capabilities have post-login listed ID IDLE LOGIN-REFERRALS IMAP4rev1 more Pre-login| ssl-cert: Subject: commonName=chaos| Subject Alternative Name: DNS:chaos| Not valid before: 2018-10-28T10:01:49|_Not valid after: 2028-10-25T10:01:49|_ssl-date: TLS randomness does not represent time995/tcp open ssl/pop3 Dovecot pop3d|_pop3-capabilities: AUTH-RESP-CODE UIDL TOP SASL(PLAIN) RESP-CODES CAPA USER PIPELINING| ssl-cert: Subject: commonName=chaos| Subject Alternative Name: DNS:chaos| Not valid before: 2018-10-28T10:01:49|_Not valid after: 2028-10-25T10:01:49|_ssl-date: TLS randomness does not represent time10000/tcp open http MiniServ 1.890 (Webmin httpd)|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 58.63 seconds

靶機上運行這http服，pop3 imap 以及它們對應的ssl加密後的服務，還有一個就是監聽在1000的MiniServ

我們看下80埠

80埠：

發現靶機是不允許直接使用IP進行訪問的，那麼我們修改下/etc/hosts文件

再次訪問

這裡我們用gobuster爆破下目錄，為了結果的準確我把IP類型的地址和域名類型的地址都掃描了一遍

出現的結果不同，但是都是一個問題就是網站目錄可直接訪問，在IP的掃描結果中我們發現了wp（wordpress），這裡我們只能用IP去訪問用域名去訪問是沒有的

那麼我們就用wpscan去掃描下，這裡用tee命令在輸出結果到終端的同時也把結果輸出到文件中去。

這裡掃描出了2條有用的資訊，這裡有個用戶名字叫human

我們嘗試把human當成密碼輸入到剛剛頁面那篇的加密文章，發現是正確的並且我們得到了webmail的帳戶和密碼

Creds for webmail :username – ayushpassword – jiujitsu

我們是有看到靶機是運行這郵件系統的，我們用這個嘗試去登陸，我們再再hosts中增加webmai.chaos.htb的記錄

然後輸入webmail.chaos.htb進行登陸

然後我們在草稿箱中發現了這個

一個是加密後的資訊，一個是加密的腳本文件，郵件也說了「你就是密碼」，所以我們可以先拿sahay當作密碼進行嘗試破解

以下是加密的腳本文件

def encrypt(key, filename): chunksize = 64*1024 outputFile = "en" + filename filesize = str(os.path.getsize(filename)).zfill(16) IV =Random.new().read(16) encryptor = AES.new(key, AES.MODE_CBC, IV) with open(filename, 'rb') as infile: with open(outputFile, 'wb') as outfile: outfile.write(filesize.encode('utf-8')) outfile.write(IV) while True: chunk = infile.read(chunksize) if len(chunk) == 0: break elif len(chunk) % 16 != 0: chunk += b' ' * (16 – (len(chunk) % 16)) outfile.write(encryptor.encrypt(chunk)) def getKey(password): hasher = SHA256.new(password.encode('utf-8')) return hasher.digest()

根據加密腳本寫出對應的解密腳本

from Crypto.Hash import SHA256from Crypto.Cipher import AESimport Crypto.Cipher.AESfrom binascii import hexlify, unhexlify def encrypt(key, filename): chunksize = 64*1024 outputFile = "en" + filename filesize = str(os.path.getsize(filename)).zfill(16) IV =Random.new().read(16) encryptor = AES.new(key, AES.MODE_CBC, IV) with open(filename, 'rb') as infile: with open(outputFile, 'wb') as outfile: outfile.write(filesize.encode('utf-8')) outfile.write(IV) while True: chunk = infile.read(chunksize) if len(chunk) == 0: break elif len(chunk) % 16 != 0: chunk += b' ' * (16 – (len(chunk) % 16)) outfile.write(encryptor.encrypt(chunk)) def getKey(password): hasher = SHA256.new(password.encode('utf-8')) return hasher.digest() if __name__=="__main__": chunksize = 64*1024 mkey = getKey("sahay") mIV = (b"0000000000000234") decipher = AES.new(mkey,AES.MODE_CBC,mIV) with open("enim_msg.txt", 'rb') as infile: chunk = infile.read(chunksize) plaintext = decipher.decrypt(chunk) print plaintext

執行解密腳本得到Base64加密後的結果：