HTB Perfection

Perfection (Linux · Easy)

RubySSTI+hashcat

枚举

nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
nmap -sC -sV -sT -T4 10.10.11.253

Nmap scan report for 10.10.11.253 (10.10.11.253)
Host is up (0.26s latency).
Not shown: 984 closed tcp ports (conn-refused)
PORT      STATE    SERVICE        VERSION
6/tcp     filtered unknown
22/tcp    open     ssh            OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 80:e4:79:e8:59:28:df:95:2d:ad:57:4a:46:04:ea:70 (ECDSA)
|_  256 e9:ea:0c:1d:86:13:ed:95:a9:d0:0b:c8:22:e4:cf:e9 (ED25519)
33/tcp    filtered dsp
80/tcp    open     http           nginx
|_http-title: Weighted Grade Calculator
1010/tcp  filtered surf
1151/tcp  filtered unizensus
1277/tcp  filtered miva-mqs
1352/tcp  filtered lotusnotes
3221/tcp  filtered xnm-clear-text
5431/tcp  filtered park-agent
6129/tcp  filtered unknown
6566/tcp  filtered sane-port
6792/tcp  filtered unknown
10616/tcp filtered unknown
10629/tcp filtered unknown
41511/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

dirsearch

image-20240429203253429

网页底部，提供了相关信息，Ruby Web

image-20240430134229759

/weighted-grade，在此测试

image-20240430134406811

恶意输入被阻止，fuzz

image-20240430140345271

image-20240430140505438

SSTI测试，https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection#erb-ruby

image-20240430140704412

Shell

image-20240430141704261

反弹shell

image-20240430142218162

image-20240430142333239

权限提升

sudo suid 没什么好利用的

image-20240430142930032

下载PEASS-ng进行提权分析

image-20240430143443896

1
2
chmod +x linpeas.sh
./linpeas.sh

Files with Interesting Permissions

image-20240430144613273

/var/mail/susan

image-20240430144855377

译：由于学生路径数据泄露，我们将过渡到木星年级，我认为我们也应该迁移我们的证书（包括其他学生在我们班上）到新平台。我还建议制定一个新的密码规范，让每个人都能更轻松地使用。密码格式为：
{firstname}_｛名字倒过来｝_｛随机生成的1到1000000000之间的整数}
请注意，名字的所有字母都应该转换成小写字母。请尽可能向我提供有关迁移的最新信息。我目前正在该平台上注册我们的大学。
-Tina，你可爱的学生

/home/susan/Migration/pupilpath_credentials.db

image-20240430145154409

显示不全，传过来用sqlite工具打开

image-20240430145853820

image-20240430150010098

hash-identifier

识别哈希加密类型

image-20240430150306305

hashcat

1
hashcat -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f  "susan_nasus_?d?d?d?d?d?d?d?d?d"

-m 1400 是 sha-256

-a 3 是掩码攻击，知道密码是9位长，设定一个掩码?d?d?d?d?d?d?d?d?d (字母l，任意a)

image-20240430150758897

1
ssh susan@10.10.11.253

image-20240430151550277

⬆︎TOP