2020 December Metasploit community CTF

环境准备

两台靶机:

2020-12-07 10:51:45.687490 Ubuntu Target 185.245.3.246 m0nk3y
2020-12-07 10:51:45.679223 Kali Jump Host 185.245.3.246 m0nk3y

image-20201207185351417

Kali 作为跳板机去打 内网Ubuntu。

Kali : 3.85.234.26

Ubuntu: 172.15.53.85

题目如下:

![image-20201207190045534](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207190045534.png)

ssh 登录 kali

1
ssh -i metasploit_ctf_kali_ssh_key.pem [email protected]

![](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207190722932.png)

直接开淦

When you find a challenge flag, calculate and submit the MD5 checksum of the PNG image to receive points! Hashes are not case sensitive.

说人话,flag就是找到的图片的 md5值,忽略大小写。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[email protected]:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9001
inet 172.15.53.84 netmask 255.255.255.240 broadcast 172.15.53.95
inet6 fe80::866:3aff:fe77:1953 prefixlen 64 scopeid 0x20<link>
ether 0a:66:3a:77:19:53 txqueuelen 1000 (Ethernet)
RX packets 686 bytes 70099 (68.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 767 bytes 81674 (79.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 413 bytes 123225 (120.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 413 bytes 123225 (120.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

ifconfig, 可以看到内网ip为 172.15.53.84, 而Ubuntu 目标ip为 172.15.53.85 。为同一个内网ip中。

nmap 扫端口

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
[email protected]:~$ nmap -v 172.15.53.85
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-07 11:17 UTC
Initiating Ping Scan at 11:17
Scanning 172.15.53.85 [2 ports]
Completed Ping Scan at 11:17, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:17
Completed Parallel DNS resolution of 1 host. at 11:17, 0.00s elapsed
Initiating Connect Scan at 11:17
Scanning 172.15.53.85 [1000 ports]
Discovered open port 8080/tcp on 172.15.53.85
Discovered open port 80/tcp on 172.15.53.85
Discovered open port 8888/tcp on 172.15.53.85
Discovered open port 8200/tcp on 172.15.53.85
Discovered open port 9000/tcp on 172.15.53.85
Discovered open port 9009/tcp on 172.15.53.85
Discovered open port 5555/tcp on 172.15.53.85
Discovered open port 9001/tcp on 172.15.53.85
Discovered open port 9010/tcp on 172.15.53.85
Discovered open port 1080/tcp on 172.15.53.85
Completed Connect Scan at 11:17, 0.03s elapsed (1000 total ports)
Nmap scan report for 172.15.53.85
Host is up (0.0014s latency).
Not shown: 990 closed ports
PORT STATE SERVICE
80/tcp open http
1080/tcp open socks
5555/tcp open freeciv
8080/tcp open http-proxy
8200/tcp open trivnet1
8888/tcp open sun-answerbook
9000/tcp open cslistener
9001/tcp open tor-orport
9009/tcp open pichat
9010/tcp open sdr

开启了80端口,先不忙搭nps隧道啥的,我直接curl 请求一下这个 http web服务。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
[email protected]:~$ curl 172.15.53.85
<!doctype html>

<html lang="en">
<head>
<meta charset="utf-8">

<title>Metasploit CTF</title>
<link rel="stylesheet" href="css/styles.css?v=1.0">

<style>
body {
margin: 0;
font-family: sans-serif;
}

.h2 {
font-size: 2em;
color: #222;
margin-bottom: 0.2em;
}

.container {
text-align: center;
display: flex;
align-items: center;
justify-content: center;
flex-direction: column;
height: 100vh;
}
</style>
</head>

<body>
<div class="container">
<div>
<h2>Welcome!</h2>
<img src="4_of_hearts.png" />
<p>Your remaining challenges are on other ports</p>
</div>
</div>
</body>
</html>

curl 下载一下这个图片。

1
2
3
4
5
6
7
8
[email protected]:~$ curl -O 172.15.53.85/4_of_hearts.png
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 94015 100 94015 0 0 12.8M 0 --:--:-- --:--:-- --:--:-- 12.8M
[email protected]:~$ ls
4_of_hearts.png configure_kali.sh
[email protected]:~$ md5sum 4_of_hearts.png
776d1d5ecfb91f71aecad71cb3c7c9d1 4_of_hearts.png

得到这个flag:776d1d5ecfb91f71aecad71cb3c7c9d1。并且给了hint,Your remaining challenges are on other ports。那就再来一个全端口扫描吧。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
[email protected]:~$ nmap -p 1-65535 172.15.53.85
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-07 11:34 UTC
Nmap scan report for 172.15.53.85
Host is up (0.0037s latency).
Not shown: 65515 closed ports
PORT STATE SERVICE
80/tcp open http
1080/tcp open socks
1337/tcp open waste
4545/tcp open worldscores
5555/tcp open freeciv
6868/tcp open acctopus-cc
8080/tcp open http-proxy
8092/tcp open unknown
8101/tcp open ldoms-migr
8123/tcp open polipo
8200/tcp open trivnet1
8201/tcp open trivnet2
8202/tcp open aesop
8888/tcp open sun-answerbook
9000/tcp open cslistener
9001/tcp open tor-orport
9007/tcp open ogs-client
9008/tcp open ogs-server
9009/tcp open pichat
9010/tcp open sdr

有点疑问,有些端口,用浏览器无法正常,curl却能返回一些信息。(原来是有联系的。

因为搞其他8080端口需要交互了,所以得弄个转发,在本机操作一下。

nps可以不落地配置文件启动:

1
./npc -server=ip:port -vkey=web界面中显示的密钥

nps建立成功后创建隧道。http 和 socks 代理就行啦。(这个时候可以把kali这台机器当做是我们已经GetShell 后的一台边界主机,因为kali 能出网,也能访问内网应用),kali 机器上安装 npc。

浏览器和proxychains4设置成nps 代理,这样就能在浏览器和 工具都在代理了。(或者直接用Proxifier

![image-20201207210033802](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207210033802.png)

![image-20201207210239170](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207210239170.png)


OK, 代理问题解决好了后,就继续淦。

80端口 4 of Hearts

80端口访问的那张图片的md5.

8080端口

4545端口

![image-20201208003754322](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208003754322.png)

看到simplehttp 和 python,用curl请求一下果然有类似flag的文件,

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href="8_of_hearts.elf">8_of_hearts.elf</a></li>
<li><a href="8_of_hearts.enc">8_of_hearts.enc</a></li>
</ul>
<hr>
</body>
</html>

用curl -o 这次好像不能下载了, 用wget下载就可以了。

8_of_hearts.elf
8_of_hearts.enc

得到这两个二进制文件。

xxd 查看一下

![image-20201208004140345](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208004140345.png)

拖入IDA,F5一波(x),查看字符串:

![image-20201208005344308](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208005344308.png)

F5一下 main函数:

![image-20201208005832787](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208005832787.png)

6868端口

8092端口

![image-20201208011629368](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208011629368.png)

8101端口

![image-20201207221508164](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207221508164.png)

8200 文件上传GetShell

BP 要先设置 socks ,然后才能正常的抓包和重放。

![image-20201207215251038](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207215251038.png)

有两种错误:

  • Unsupported mime type (文件上传的后缀和content-type 不对应)
  • Unsupported file format(gif以及其他后缀,只能传 jpg 和 png)

![image-20201208000008329](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208000008329.png)

8202端口

![image-20201208012652639](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208012652639.png)

8888端口

![image-20201208012835327](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208012835327.png)

9000端口

![image-20201208013004434](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208013004434.png)

9001端口

![image-20201208013102209](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201208013102209.png)

9010端口 Queen of Hearts

直接访问,给了一个jar包。

![image-20201207211819717](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207211819717.png)

1
2
3
4
5
6
──> java -jar QOH_Client.jar                        ──(一,1207)─┘
Usage:
java -jar QOH_Client.jar <ip> <port>

where port is generally 9008
──> proxychains4 java -jar QOH_Client.jar 172.15.53.85 9008

[proxychains] Strict chain … xx.xx.xxx.116:6443 … xx.xx.xxx.116:6080 … 172.15.53.85:9008 … OK
Successfully connected to the server!
Please select an available action from the list below:
[1] Lists available files on the server
[2] Download available files from the server
[3] Authenticate to the server

1
Executing action…
Listing available files to download:

test.txt
queen_of_hearts.png
todo.md

Please select an available action from the list below:
[1] Lists available files on the server
[2] Download available files from the server
[3] Authenticate to the server

2
Executing action…
Checking authentication status…
You are not authenticated. Please authenticate before attempting to download from the server

要拿Queen of Hearts这个题的flag,要知道密码,em,好像不能暴破,先放一下。

9007端口 Red Joker

![image-20201207212225564](/Users/m0nk3y/Library/Application Support/typora-user-images/image-20201207212225564.png)

下载里面就有一个图片,直接 md5 filename 获取flag

1
2
3
┌─(~/CTF/metasploit_ctf/red_joker)─────────────────────────────────────────────────────────────────────────────────────────────────([email protected]:s000)─┐
└─(21:24:29)──> md5 joker_red.png ──(一,1207)─┘
MD5 (joker_red.png) = ded8965ad103400300b7180b42f55e28

9009

1
2
3
4
5
6
7
└─(01:32:22)──> proxychains4 curl http://172.15.53.85:9009                                                                                      ──(二,1208)─┘
[proxychains] config file found: /usr/local/etc/proxychains.conf
[proxychains] preloading /usr/local/Cellar/proxychains-ng/4.14/lib/libproxychains4.dylib
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain ... 45.76.110.116:6443 ... 45.76.110.116:6080 ... 172.15.53.85:9009 ... OK
SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
Protocol mismatch.

国外友人的WP

https://rushisec.net/metasploit-ctf-2020-writeup/#9ofheartsport53

https://ctftime.org/event/1200/tasks/

挺不错的,就是发现比赛有点晚了,就打了一会儿就给停了vps。

Author: m0nk3y
Link: https://hack-for.fun/d22f.html
Copyright Notice: All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.