ISCC final notes (part1)

I made a famous dish, and this time I attended the ISCC finals. After the competition, I wrote some notes to entertain myself. Please fly over here ~

This competition simulates the actual environment. 20 people are divided into four groups. The competition passes through the actual situation in the network environment and social engineering in the living environment, the objective is to obtain the flag from all the host devices in the competition environment, and use crack to submit the plaintext key in the flag for points.

(The detailed records and technical details of the competition are written in the report documents submitted by the Group. Click here to download them)

 

I drew a topology as follows:

It's a bit ugly -,-

The four boxes are Area D, which is the defensive position of the four groups. We need to win the two servers first and then break into the melee area in the middle. The yellow is a Wireless AP, and the domain is connected to a red server, connect to a purple Android phone in a Wi-Fi Environment

----- I edited the above, and the following is serious ----

The assigned IP address is 192.168.5.x.

The target servers in the starting zone D are 192.168.5.1 and 192.168.5.2.

Both enable some common services after nmap, and both have port 80 or other ports to enable web Services.

The penetration of 192.168.1.1 has no highlights. getshell captures the hash and logs on.

192.168.1.2 is a linux, centos5.6, and kernel version 2.6.18.

Getshell has nothing to say, but it's just a matter of Elevation of Privilege. Please teach me! This version of the Special chrysanthemum is hard, and the final failure to raise the right

We took 2003 of the attack and enabled vpn penetration.

Scan to the target. getshell is followed by the oracle database, and 03 running oracle is almost all system permissions. Therefore, oracle is used for permission escalation.

I have never been too familiar with oracle, so I learned the new posture here:

SqlPlus remote connection to oracle

C: \ oracle> sqlplus/nolog

SQL> connect world/world123 @ (description = (address_list = (address = (protocol = tcp) (host = 192.168.4.1) (port = 1521 ))) (connect_data = (SID = myoracle )));

After viewing, the user world has high permissions, including DBA and JAVA_ADMIN.

You can use Oracle to create and compile a java class, and execute system commands by creating a stored procedure. The account is successfully added.

 

Then I started several more servers. One of them opened 80 and 85 services on the web. The system was linux and 85 used shopex. After the exp was directly getshell, I found it unreliable to use exp for privilege escalation, after asking for help from the rootoorotor, I knew that I could use a redhat5.5 vulnerability to escalate the privilege in one sentence and raise the posture again. The following is a sentence:

$ Printf "install uprobes/bin/sh"> exploit. conf; MODPROBE_OPTIONS = "-C exploit. conf" staprun-u whatever

The root permission is obtained successfully.

After this server was obtained, it was a single-connection target according to the topology, So it started to hurt. The station pants were separated, and the database directed to the next hop server, the mysql server of win2008, I used it as a database server separately, but I got the mysql user name and password, and I could get the shell of the server. After I forwarded it through lcx, I got a headache, at that time, it was very sb who did not expect to use the exp of 08 to give a try. He only thought of permission escalation for udf or mof, but he had insufficient permissions and had no directories, later, when I flipped through the Server Directory, I saw a FileZilla

This is a breakthrough. I feel that since I cannot raise the system permission, I can directly raise the ftp permission if I can have the file management function, various types of forwarding (a little complicated, specifically written in the document report after the group stage), finally got the target flag

---- I am a food forced cut line -------

This competition shows that I am not lascivious. After the competition, I still thought of several ideas to solve the penetration goal. For details, see part2 (although I don't know when to write it)