Vulnhub靶机 symfonos.local 1

得到了一个用户名和三个密码
尝试登录
helios：qwerty

下载文件查看内容

第一个

Helios (also Helius) was the god of the Sun in Greek mythology. He was thought to ride a golden chariot which brought the Sun across the skies each day from the east (Ethiopia) to the west (Hesperides) while at night he did the return journey in leisurely fashion lounging in a golden cup. The god was famously the subject of the Colossus of Rhodes, the giant bronze statue considered one of the Seven Wonders of the Ancient World.

第二个

/h3l105是一个页面

wp的页面

改/etc/hosts
加入192.168.80.144 symfonos.local

wpscan --url http://symfonos.local/h3l105 -eu,p

找到两个插件
搜漏洞

两个都是本地文件包含

用smtp反射shell

拿到helios的权限
准备提权

调用了curl命令

在/tmp写一个curl
加入环境变量
给权限
运行脚本
提权成功