一 题目
Tags
Web、Custom Applications、Apache、Reconnaissance、Web Site Structure Discovery、Default Credentials
译文:Web、定制应用程序、Apache、侦察、网站结构发现、默认凭证
Connect
To attack the target machine, you must be on the same network.Connect to the Starting Point VPN using one of the following options.
It may take a minute for HTB to recognize your connection.If you don't see an update after 2-3 minutes, refresh the page.
译文:要攻击目标机器,您必须位于同一网络上。使用以下选项之一连接到起点 VPN。
HTB 可能需要一分钟才能识别您的连接。如果 2-3 分钟后没有看到更新,请刷新页面。
SPAWN MACHINE
Spawn the target machine and the IP will show here.
译文:生成目标机器,IP 将显示在此处
TASK 1
Directory Brute-forcing is a technique used to check a lot of paths on a web server to find hidden pages. Which is another name for this?
(i) Local File Inclusion, (ii) dir busting, (iii) hash cracking.
译文:目录暴破是一种用于检查 Web 服务器上的大量路径以查找隐藏页面的技术。哪一个是他的别称?
(i) Local File Inclusion, (ii) dir busting, (iii) hash cracking.
答:dir busting
TASK 2
What switch do we use for nmap's scan to specify that we want to perform version detection?
译文:nmap的扫描我们用什么参数来指定我们要进行版本检测
答:-sV
TASK 3
What does Nmap report is the service identified as running on port 80/tcp?
译文:Nmap 报告在端口 80/tcp 上运行什么服务?
答:http
TASK 4
What server name and version of service is running on port 80/tcp?
译文:端口 80/tcp 上运行的服务器名称和服务版本是什么?
答:nginx 1.14.2
TASK 5
What switch do we use to specify to Gobuster we want to perform dir busting specifically?
译文:我们使用什么参数来指定 Gobuster 专门执行目录破坏?
答:dir
TASK 6
When using gobuster to dir bust, what switch do we add to make sure it finds PHP pages?
译文:当使用 gobuster 来 dirbust 时,我们添加什么参数来确保它找到 PHP 页面?
答:-x php
TASK 7
What page is found during our dir busting activities?
译文:在目录爆破中找到了哪个页面?
答:admin.php
TASK 8
What is the HTTP status code reported by Gobuster for the discovered page?
译文:使用Gobuster 发现的页面的 HTTP 状态代码是什么?
答:200
SUBMIT FLAG
Submit root flag
译文:提交根标志
二 实验过程
靶机ip地址:10.129.128.220
1.端口扫描
nmap -sV 10.129.128.220
2.访问web页面
3.使用gobuster进行目录爆破
./gobuster dir -u http://10.129.128.220/ -w php.txt
4.目录爆破发现:http://10.129.128.220/admin.php,进行访问
5.尝试使用admin:admin进行登录