Lazysysadmin - linux

目录

信息收集

访问80端口页面-backnode

目录遍历

wordpress

WPscan

enum4linux

发现共享OK

nikto扫描

phpmyadmin

查看共享目录

找到wordpress密码 wp-config.php

登录成功

文件上传修改

反弹木马

(二) phpmyadmin

SSH登录

sudo提权

参考链接

---

信息收集

root@kali:~# nmap -A 192.168.243.159
Starting Nmap 7.70 ( https://nmap.org ) at 2020-12-27 20:40 EST
Nmap scan report for bogon (192.168.243.159)
Host is up (0.00063s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 b5:38:66:0f:a1:ee:cd:41:69:3b:82:cf:ad:a1:f7:13 (DSA)
|   2048 58:5a:63:69:d0:da:dd:51:cc:c1:6e:00:fd:7e:61:d0 (RSA)
|   256 61:30:f3:55:1a:0d:de:c8:6a:59:5b:c9:9c:b4:92:04 (ECDSA)
|_  256 1f:65:c0:dd:15:e6:e4:21:f2:c1:9b:a3:b6:55:a0:45 (ED25519)
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
|_http-generator: Silex v2.2.7
| http-robots.txt: 4 disallowed entries 
|_/old/ /test/ /TR2/ /Backnode_files/
|_http-server-header: Apache/2.4.7 (Ubun