VulnHub—DC-5

最新推荐文章于 2024-07-28 21:48:18 发布

弥敦道人

最新推荐文章于 2024-07-28 21:48:18 发布

阅读量723

点赞数

分类专栏： OSCP 文章标签： linux nginx

本文链接：https://blog.csdn.net/weixin_39219503/article/details/104133508

版权

本文详细介绍了在VulnHub平台上的DC-5靶场环境中进行渗透测试的过程。首先，通过环境搭建和信息收集，发现了靶机IP并进行端口扫描，揭示了80和111端口开放。接着，通过Web页面的LFI漏洞，找到了nginx日志文件，并利用这个漏洞获取了shell。最后，通过挖掘并利用一个程序的本地提权漏洞，成功获得了root权限并拿到flag。

摘要由CSDN通过智能技术生成

01 环境搭建

靶机环境下载：https://www.vulnhub.com/entry/dc-5,314/
题目信息如下，只有一个flag

Description
DC-5 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

The plan was for DC-5 to kick it up a notch, so this might not be great for beginners, but should be ok for people with intermediate or better experience. Time will tell (as will feedback).

As far as I am aware, there is only one exploitable entry point to get in (there is no SSH either). This particular entry point may be quite hard to identify, but it is there. You need to look for something a little out of the ordinary (something that changes with a refresh of a page). This will hopefully provide some kind of idea as to what the vulnerability might involve.

And just for the record, there is no phpmailer exploit involved. :-)

The ultimate goal of this challenge is to get root and to read the one and only flag.

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.

For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won't give you