DC-8靶机笔记-CSDN博客

本文链接：https://blog.csdn.net/weixin_43263451/article/details/120676871

DC-8

DC-8 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

This challenge is a bit of a hybrid between being an actual challenge, and being a “proof of concept” as to whether two-factor authentication installed and configured on Linux can prevent the Linux server from being exploited.

The “proof of concept” portion of this challenge eventuated as a result of a question being asked about two-factor authentication and Linux on Twitter, and also due to a suggestion by @theart42.

The ultimate goal of this challenge is to bypass two-factor authentication, get root and to read the one and only flag.

You probably wouldn’t even know that two-factor authentication was installed and configured unless you attempt to login via SSH, but it’s definitely there and doing it’s job.

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.

For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won’t give you the answer, instead, I’ll give you an idea about how to move forward.

信息搜集

发现开启了80以及22端口

先去前台瞅瞅

点击文章，发现url中只是参数值不同罢了

猜测后端可能是根据where nid=$nid;来从数据库搜索出内容然后将内容添加到页面相应位置

尝试看有没有sql注入这个地方

从返回信息看还真有，而且是数字型注入

脱库

话不多说，上sqlmap脱库

查看表

有个users表，先看看有啥字段

dump出name以及pass

暴力破解

用john来破解加密密码

admin的密码尝试了无法破解出来

接下来尝试john的

先将密码存放在dc8_pass1.txt中

暴力破解出密码

john dc8_pass1.txt

得到密码turtle

登陆后台

看看哪里存在写马点

先看看add content处看能否写入php代码

好像没有php code的选项

再找找别的地方

可以修改个人信息

发现一处文件上传

尝试上传shell

发现给我们改了后缀，并且后缀名必须为jpg之类的

尝试上传图片马

发现给我们把php添加了_，解析漏洞也用不了了

要么就文件包含但是没找到该漏洞点

那再找找其他写马点

点击contacts下的webform后发现

有个表单修改

发现可以修改提交表单成功后的提示信息(当我们提交表单后，会跳转到确认页，然后确认页会显示success!!!)

我们看看这里能不能添加php code，发现是可以的，也就是给确认页添加php代码

我们添加一句话木马到确认页，然后执行反弹shell

添加一句话木马(注意要在一句话木马前面加点字符，要不一句话木马无法执行，qwq不知道什么逻辑)

点击保存后

正常提交个表单，看看配置是否成功

可以看出配置成功了，确认页的url就是上方这个，尝试执行命令

说明一句话木马写进去了

反弹shell

本地监听9000端口

靶机执行反弹命令

看一下本地，发现反弹shell成功

变为交互式shell

提权

看看sudo -l

没有密码，先放一边

现在反弹回来的shell会出现按方向键乱码的情况，并且不会补全

这是编码方式的问题

解决方法：
1、 Ctrl+Z 将当前进程 放 后台运行
2、stty -echo raw
3、fg %1 # 将前面的放入后台运行的进程 1 ，放在前台运行
接下来就好了

https://blog.csdn.net/qq_42342141/article/details/110408110