概述

信息收集

主机发现

nmap -sP 192.168.2.0/24
Starting Nmap 7.92 ( https://nmap.org ) 

Nmap scan report for 192.168.2.159
Host is up (0.016s latency).

端口服务扫描

nmap -p-  192.168.2.159  
Starting Nmap 7.92 ( https://nmap.org ) 
Nmap scan report for 192.168.2.159
Host is up (0.042s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 11.50 seconds

map -p21,22,80 -sV -A -T5 192.168.2.159
Starting Nmap 7.92 ( https://nmap.org ) 
Nmap scan report for 192.168.2.159
Host is up (0.0100s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.2
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 12:4e:f8:6e:7b:6c:c6:d8:7c:d8:29:77:d1:0b:eb:72 (DSA)
|   2048 72:c5:1c:5f:81:7b:dd:1a:fb:2e:59:67:fe:a6:91:2f (RSA)
|   256 06:77:0f:4b:96:0a:3a:2c:3b:f0:8c:2b:57:b5:97:bc (ECDSA)
|_  256 28:e8:ed:7c:60:7f:19:6c:e3:24:79:31:ca:ab:5d:2d (ED25519)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
| http-robots.txt: 2 disallowed entries 
|_/php/ /temporary/
|_http-title: DeRPnStiNK
|_http-server-header: Apache/2.4.7 (Ubuntu)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.68 seconds

目录扫描

1	dirsearch -u http://192.168.2.159/ -x 403

roboot.txt

/php

1	dirsearch -u http://192.168.2.159/php -x 403

/temporary

1	dirsearch -u http://192.168.2.159/temporary/ -x 403

/weblog

1	dirsearch -u http://192.168.2.159/weblog/ -x 403

flag

1
2
3

DeRPnStiNK
	
<--flag1(52E37291AEDF6A46D7D0BB8A6312F4F9F1AA4975C248C3F0E008CBA09D6E9166) -->

info.txt

此处提示说需要修改host文件，在上述对weblog进行目录扫描的时候，显示回跳转到derpnstink.local域名下，所以修改hosts的时候与之对应。

漏洞利用

弱口令admin/admin登录后，开始查看功能点，找到添加幻灯片的页面可以上传文件，直接上传php后门，上传后跳转首页，没找到返回路径，不知道是否上传成功，然后重新走了一遍正常上传图片的流程，审查元素，找到图片上传路径。

http://derpnstink.local/weblog/wp-content/uploads/slideshow-gallery/33.png

然后直接访问刚出上传的文件1.php。发现存在该文件，蚁剑连接成功。

权限提升

虽然找到了mysql root账户的密码，但是由于mysql是mysql用户启动，所以不能使用udf提权。

user = name mysqld程序在启动后将在给定UNIX/Linux账户下运行; mysqld必须从root账户启动才干在启动后切换到还有一个账户下运行; mysqld_safe脚本将默认使用–user=mysql选项来启动mysqld程序。

CVE-2021-4034

https://github.com/arthepsy/CVE-2021-4034/blob/main/cve-2021-4034-poc.c

flag

1 2	cat /home/stinky/Desktop/flag.txt flag3(07f62b021771d3cf67e2e1faf18769cc5e5c119ad7d4d1847a11e11d6d5a7ecb)

1 2	find /root -name flag* cat /root/Desktop/flag.txt