vulnhub靶场合集之earth靶场渗透

最新推荐文章于 2024-08-15 14:04:56 发布

SebastianShelby

最新推荐文章于 2024-08-15 14:04:56 发布

阅读量660

点赞数 18

文章标签：安全 web安全

本文链接：https://blog.csdn.net/weixin_62297109/article/details/139413970

版权

前言

最近闲来无事，搞搞vulnbub靶场玩一玩，选个简单的

地址在这：The Planets: Earth ~ VulnHub

直接点击跳转下载就好了

信息收集

down下来以后是个ova文件，直接点击导入到vm里就可以。

我习惯性改net连接，桥接也可以，你们看着来。

上nmap扫吧，扫自己ip段

靶机ip就是130，端口开着22，80，443

访问一下看一看。

80是400，443是↓

我拿goby扫了一遍，抓包看了看，没啥东西，

然后又拿nmap扫了一遍

nmap -A -p 1-65535 192.168.88.130

6，看到有DNS解析，

把IP和域名放/etc/hosts里面，然后在虚机里访问

看到这个，用dirsearch扫扫这两个目录，

结果是有一个admin还有robots.txt，可以访问

其他都没用，试试最后一个

.txt 可以访问，全英文，翻译了一下，大概意思是，用XOR做的加密，terra是用户名，testdata,txt是测试页面，访问一下是这个玩意

According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago.

web登录

加解密，那请大佬写脚本吧：

a = "According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago."
b = "2402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a"
d = [0x24, 0x02, 0x11, 0x1b, 0x1a, 0x07, 0x05, 0x07, 0x0a, 0x41, 0x00, 0x0a, 0x43, 0x1a, 0x00, 0x0a, 0x0e, 0x0a, 0x0f, 0x04, 0x10, 0x46, 0x01, 0x16, 0x4d, 0x05, 0x0f, 0x07, 0x0c, 0x0f, 0x15, 0x54, 0x0d, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x0c, 0x06, 0x41, 0x0f, 0x09, 0x01, 0x42, 0x0e, 0x10, 0x5c, 0x0d, 0x07, 0x4d, 0x04, 0x18, 0x1a, 0x01, 0x04, 0x1c, 0x17, 0x0d, 0x4f, 0x4c, 0x2c, 0x0c, 0x13, 0x00, 0x0d, 0x43, 0x0e, 0x0e, 0x1c, 0x0a, 0x00, 0x06, 0x41, 0x0b, 0x42, 0x0d, 0x07, 0x4d, 0x55, 0x40, 0x46, 0x45, 0x03, 0x1b, 0x18, 0x04, 0x0a, 0x03, 0x07, 0x4d, 0x18, 0x11, 0x04, 0x11, 0x1b, 0x41, 0x0f, 0x00, 0x0a, 0x4c, 0x41, 0x33, 0x5d, 0x1c, 0x1d, 0x04, 0x0f, 0x4e, 0x07, 0x0d, 0x04, 0x52, 0x12, 0x01, 0x11, 0x1f, 0x1d, 0x4d, 0x03, 0x1d, 0x09, 0x0f, 0x01, 0x0e, 0x00, 0x47, 0x1c, 0x07, 0x00, 0x16, 0x47, 0x48, 0x1a, 0x0b, 0x41, 0x2b, 0x12, 0x17, 0x15, 0x1a, 0x53, 0x1b, 0x43, 0x04, 0x00, 0x1e, 0x15, 0x1b, 0x17, 0x1a, 0x44, 0x41, 0x02, 0x0e, 0x03, 0x07, 0x41, 0x05, 0x44, 0x18, 0x10, 0x0c, 0x13, 0x0b, 0x17, 0x45, 0x08, 0x1c, 0x54, 0x1c, 0x0b, 0x09, 0x49, 0x02, 0x02, 0x11, 0x04, 0x0d, 0x1b, 0x41, 0x0f, 0x09, 0x01, 0x42, 0x03, 0x01, 0x53, 0x09, 0x1b, 0x4d, 0x15, 0x01, 0x53, 0x04, 0x07, 0x14, 0x11, 0x0b, 0x17, 0x4c, 0x2c, 0x0c, 0x13, 0x00, 0x0d, 0x44, 0x1b, 0x41, 0x0f, 0x13, 0x08, 0x0d, 0x12, 0x14, 0x5c, 0x0d, 0x07, 0x08, 0x41, 0x0f, 0x1d, 0x01, 0x41, 0x01, 0x01, 0x1a, 0x05, 0x0d, 0x0a, 0x08, 0x4d, 0x54, 0x09, 0x06, 0x09, 0x05, 0x07, 0x09, 0x02, 0x42, 0x15, 0x0b, 0x14, 0x1c, 0x1d, 0x08, 0x41, 0x1e, 0x01, 0x0a, 0x0d, 0x1b, 0x12, 0x0d, 0x11, 0x0d, 0x1d, 0x04, 0x0e, 0x1a, 0x45, 0x0c, 0x0e, 0x41, 0x0f, 0x09, 0x04, 0x07, 0x13, 0x0b, 0x56, 0x01, 0x16, 0x4d, 0x00, 0x00, 0x17, 0x49, 0x41, 0x1e, 0x15, 0x1c, 0x06, 0x1e, 0x45, 0x4d, 0x00, 0x11, 0x17, 0x0c, 0x0a, 0x08, 0x0d, 0x47, 0x0a, 0x10, 0x06, 0x05, 0x5a, 0x01, 0x06, 0x00, 0x12, 0x40, 0x53, 0x36, 0x0e, 0x1f, 0x11, 0x48, 0x04, 0x09, 0x06, 0x01, 0x0e, 0x13, 0x0c, 0x00, 0x09, 0x0d, 0x4e, 0x02, 0x13, 0x0b, 0x05, 0x01, 0x5a, 0x0b, 0x10, 0x4d, 0x08, 0x00, 0x17, 0x0c, 0x02, 0x13, 0x00, 0x0d, 0x10, 0x4c, 0x1d, 0x05, 0x00, 0x00, 0x45, 0x0f, 0x01, 0x07, 0x0b, 0x47, 0x08, 0x03, 0x18, 0x44, 0x5c, 0x09, 0x03, 0x08, 0x41, 0x0f, 0x01, 0x0c, 0x12, 0x17, 0x1a, 0x48, 0x02, 0x1f, 0x49, 0x08, 0x00, 0x06, 0x09, 0x1a, 0x48, 0x00, 0x1d, 0x47, 0x51, 0x4c, 0x50, 0x44, 0x56, 0x01, 0x19, 0x01, 0x08, 0x01, 0x1d, 0x45, 0x18, 0x17, 0x15, 0x1a, 0x10, 0x4c, 0x08, 0x0a, 0x0e, 0x5a]
flag = ""


for i in range(0, len(a)):
    flag += chr(d[i] ^ ord(a[i]))
print(flag)

结果是：