HTB：Ignition[WriteUP]

目录

连接至HTB服务器并启动靶机

1.Which service version is found to be running on port 80?

2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?

3.What is the virtual host name the webpage expects to be accessed by?

4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?

5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?

6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?

​编辑ROOT_FLAG：797d6c988d9dc5865e010b9410f247e0

---

连接至HTB服务器并启动靶机

靶机IP：10.129.1.27

分配IP：10.10.16.12

---

1.Which service version is found to be running on port 80?

使用nmap对靶机80端口进行脚本、服务信息扫描：

nmap -sC -sV -p 80 {TARGET_IP}

由nmap扫描结果可见，在VERSION栏目下的服务版本为：nginx 1.14.2

---

2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?

使用curl对靶机URL进行访问，使用-i参数使输出包含响应头

由curl输出结果可见，访问靶机HTTP地址响应状态码：302

---

3.What is the virtual host name the webpage expects to be accessed by?

直接使用浏览器对靶机URL：http://{TARGET_IP}进行访问：

或者使用curl中的-v参数再次访问http://{TARGET_IP}：

发现被重定向到了：ignition.htb

---

4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?

我们这里尝试修改本地hosts文件，使该域名从本地解析

hosts文件通常默认路径为：/etc/hosts

使用vim打开hosts文件：

vim /etc/hosts

在文件中添加一行：{TARGET_IP} ignition.htb

或者直接在命令行中输入，表示将改行字符串追加进hosts中：

echo '{TARGET_IP} ignition.htb' >> /etc/hosts

---

5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?

再次使用浏览器对ignition.htb进行访问，发现已经正常显示页面：

我这里使用gobuster对该域名进行目录爆破：

gobuster dir --url http://ignition.htb --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

使用浏览器尝试对/admin进行访问：

可以成功进入后台登录界面，完整路径：http://ignition.htb/admin

---

6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?

随便抓一个AI来问一下magento的最短密码长度，发现是7位，而且默认开启登录限制的


这道题最后我也是通过看了官方WP知道是弱口令猜解：

账户：admin
密码：qwerty123

进入后台面板：

ROOT_FLAG：797d6c988d9dc5865e010b9410f247e0