<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[admin741admin的博客]]></title><description><![CDATA[]]></description><link>https://blog.csdn.net/admin741admin</link><language>zh-cn</language><generator>https://blog.csdn.net/</generator><copyright><![CDATA[Copyright &copy; admin741admin]]></copyright><item><title><![CDATA[第三篇红队笔记-百靶精讲之SickOS]]></title><link>https://blog.csdn.net/admin741admin/article/details/128494011</link><guid>https://blog.csdn.net/admin741admin/article/details/128494011</guid><author>admin741admin</author><pubDate>Tue, 11 Jun 2024 11:11:08 +0800</pubDate><description><![CDATA[提权到SickOS账户

mysql配置文件config.php

尝试mysql用户密码 sickos john@123


进一步提权]]></description><category></category></item><item><title><![CDATA[第二篇红队笔记-百靶精讲之JARBAS-Jenkins-crontab]]></title><link>https://blog.csdn.net/admin741admin/article/details/128439697</link><guid>https://blog.csdn.net/admin741admin/article/details/128439697</guid><author>admin741admin</author><pubDate>Tue, 11 Jun 2024 11:10:55 +0800</pubDate><description><![CDATA[https://www.vulnhub.com/entry/jarbas-1,232/

主机发现

nmap端口扫描

Web渗透

dirb目录扫描



获取初级系统权限

漏洞：构建任务时候可以输入shell



Crontab系统提权


总结

]]></description><category></category></item><item><title><![CDATA[第一篇红队笔记-百靶精讲之W1R3S-john]]></title><link>https://blog.csdn.net/admin741admin/article/details/128425622</link><guid>https://blog.csdn.net/admin741admin/article/details/128425622</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:57:38 +0800</pubDate><description><![CDATA[etc/shadow 文件，用于存储 Linux 系统中用户的密码信息，又称为“影子文件”。早期的 UNIX 密码放在 /etc/passwd 文件中，由于该文件允许所有用户读取，易导致用户密码泄露，因此从 /etc/passwd 文件中分离出来，并单独放到了此文件中。/etc/shadow 文件只有 root 用户拥有读权限，保证了用户密码的安全性。fileName=/etc/shadow 文件fileName重复时候，不重复，只能添加–show参数查看。]]></description><category></category></item><item><title><![CDATA[htb-linux-10-solidstate]]></title><link>https://blog.csdn.net/admin741admin/article/details/130562153</link><guid>https://blog.csdn.net/admin741admin/article/details/130562153</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:57:21 +0800</pubDate><description><![CDATA[nmap



web渗透

smtp

james


脚本反弹失败

尝试默认账号密码


修改用户密码


pop3

发现ssh用户
同时提醒受限制-Your access is restricted at the moment


shell

rbash受限制


查看flag

解除rbash
脚本-失败



]]></description><category></category></item><item><title><![CDATA[htb-linux-9-sense]]></title><link>https://blog.csdn.net/admin741admin/article/details/130492595</link><guid>https://blog.csdn.net/admin741admin/article/details/130492595</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:57:00 +0800</pubDate><description><![CDATA[靶机非常慢。]]></description><category></category></item><item><title><![CDATA[htb-linux-8-nineveh-hydra-Pspy-chkrootkit]]></title><link>https://blog.csdn.net/admin741admin/article/details/130423863</link><guid>https://blog.csdn.net/admin741admin/article/details/130423863</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:56:37 +0800</pubDate><description><![CDATA[exploit关键词。]]></description><category></category></item><item><title><![CDATA[htb-linux-7-cronos-53-dns-nslookup-axfr]]></title><link>https://blog.csdn.net/admin741admin/article/details/130411653</link><guid>https://blog.csdn.net/admin741admin/article/details/130411653</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:56:26 +0800</pubDate><description><![CDATA[尝试sql注入(忘记截图)]]></description><category></category></item><item><title><![CDATA[htb-linux-6-beep]]></title><link>https://blog.csdn.net/admin741admin/article/details/130395960</link><guid>https://blog.csdn.net/admin741admin/article/details/130395960</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:51:29 +0800</pubDate><description><![CDATA[目录扫描漏洞关键词。]]></description><category></category></item><item><title><![CDATA[htb-linux-5-nibbles]]></title><link>https://blog.csdn.net/admin741admin/article/details/130392717</link><guid>https://blog.csdn.net/admin741admin/article/details/130392717</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:51:15 +0800</pubDate><description><![CDATA[源码解析目录爆破关键词搜索。]]></description><category></category></item><item><title><![CDATA[htb-linux-4-bashed]]></title><link>https://blog.csdn.net/admin741admin/article/details/130388976</link><guid>https://blog.csdn.net/admin741admin/article/details/130388976</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:51:04 +0800</pubDate><description><![CDATA[dev入口反弹shell。猜有自动执行py脚本。]]></description><category></category></item><item><title><![CDATA[htb-linux-3-shocker]]></title><link>https://blog.csdn.net/admin741admin/article/details/130374731</link><guid>https://blog.csdn.net/admin741admin/article/details/130374731</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:50:49 +0800</pubDate><description><![CDATA[由于只有80端口，只考虑目录扫描和静态文件提醒为什么能能知道http://10.10.10.56/cgi-bin/user.sh？curl访问该文件。]]></description><category></category></item><item><title><![CDATA[htb-linux-2-brainfuck-wpscan-pop3-ssh2john]]></title><link>https://blog.csdn.net/admin741admin/article/details/130317535</link><guid>https://blog.csdn.net/admin741admin/article/details/130317535</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:50:38 +0800</pubDate><description><![CDATA[SMTP 的全称是“Simple Mail Transfer Protocol”，即简单邮件传输协议。它是一组用于从源地址到目的地址传输邮件的规范，通过它来控制邮件的中转方式。SMTP 协议属于 TCP/IP 协议簇，它帮助每台计算机在发送或中转信件时找到下一个目的地。什么是POP3，POP 即为 Post Office Protocol 的简称，是一种电子邮局传输协议，而 POP3 是它的第三个版本，是规定了怎样将个人计算机连接到 Internet 的邮件服务器和下载电子邮件的电子协议。]]></description><category></category></item><item><title><![CDATA[htb-linux-1-lame-smb3.0.20]]></title><link>https://blog.csdn.net/admin741admin/article/details/130292025</link><guid>https://blog.csdn.net/admin741admin/article/details/130292025</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:50:08 +0800</pubDate><description><![CDATA[namp

smb漏洞

搜索关键词



其他
smb

Samba是在linux和unix系统上实现SMB（Server  Message Block，信息服务块）协议的一款免费软件。SMB是一种在局域网上共享文件和打印机的通信协议，它在局域网内使用linux和Windows系统的机器之间提供文件及打印机等资源的共享服务。


]]></description><category></category></item><item><title><![CDATA[htb-window-4-Optimum-HttpFileServer 2.3]]></title><link>https://blog.csdn.net/admin741admin/article/details/130350855</link><guid>https://blog.csdn.net/admin741admin/article/details/130350855</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:49:03 +0800</pubDate><description><![CDATA[【代码】htb-window-4-Optimum-HttpFileServer 2.3。]]></description><category></category></item><item><title><![CDATA[htb-window-3-Devel-ftp-ms-msf]]></title><link>https://blog.csdn.net/admin741admin/article/details/130338800</link><guid>https://blog.csdn.net/admin741admin/article/details/130338800</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:48:36 +0800</pubDate><description><![CDATA[靶机下载ms和反弹shell(一般在C:\Users\Public)靶机下载Invoke-PowerShellTcp.ps1。下载对应的ms-ms15-051。上传cmdasp.aspx。sherlock发现漏洞。]]></description><category></category></item><item><title><![CDATA[htb-window-2-blue-smb]]></title><link>https://blog.csdn.net/admin741admin/article/details/130336703</link><guid>https://blog.csdn.net/admin741admin/article/details/130336703</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:48:15 +0800</pubDate><description><![CDATA[nmap

msf

漏洞搜索

配置

获取flag



]]></description><category></category></item><item><title><![CDATA[htb-window-1-legacy-smb]]></title><link>https://blog.csdn.net/admin741admin/article/details/130332273</link><guid>https://blog.csdn.net/admin741admin/article/details/130332273</guid><author>admin741admin</author><pubDate>Sun, 09 Jun 2024 11:46:43 +0800</pubDate><description><![CDATA[漏洞定位反弹获取flag。]]></description><category></category></item><item><title><![CDATA[第四篇红队笔记-百靶精讲之Prime-wfuzz-wpscan-openssl enc]]></title><link>https://blog.csdn.net/admin741admin/article/details/128507078</link><guid>https://blog.csdn.net/admin741admin/article/details/128507078</guid><author>admin741admin</author><pubDate>Sat, 08 Jun 2024 00:26:20 +0800</pubDate><description><![CDATA[我执行的结果是：failed to load prog ‘Permission denied’。不确定是否ubuntu版本问题。]]></description><category></category></item><item><title><![CDATA[第六篇红队笔记-百靶精讲之pWnOS2.0]]></title><link>https://blog.csdn.net/admin741admin/article/details/128603806</link><guid>https://blog.csdn.net/admin741admin/article/details/128603806</guid><author>admin741admin</author><pubDate>Sat, 08 Jun 2024 00:16:30 +0800</pubDate><description><![CDATA[ip修改


主机发现

nmap端口扫描

Web渗透



文件上传漏洞利用


获得初级系统shell

敏感文件获取


MySQL数据获取

Root和总结

直接尝试mysql账号



]]></description><category></category></item><item><title><![CDATA[第七篇红队笔记-百靶精讲之pWnOS1.0-Authorized_keys-prng-shellshock]]></title><link>https://blog.csdn.net/admin741admin/article/details/128618171</link><guid>https://blog.csdn.net/admin741admin/article/details/128618171</guid><author>admin741admin</author><pubDate>Sat, 08 Jun 2024 00:16:15 +0800</pubDate><description><![CDATA[home/vmware/.ssh/authorized_keys 是各个公钥存放的路径比如本地window 想免密码直接ssh连接linux，window先本地生成id_rsa私钥和id_rea.pub公钥通过类似scp工具把id_rea.pub公钥上传目标linux的.ssh/authorized_keys目录。]]></description><category></category></item></channel></rss>