信息收集
# nmap -sn 192.168.1.0/24 -oN live.port
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-30 21:10 CST
Nmap scan report for 192.168.1.1 (192.168.1.1)
Host is up (0.00075s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 0bcc61d9e6ea39148e78c7c68571e53 (192.168.1.2)
Host is up (0.00055s latency).
MAC Address: 00:50:56:FE:B1:6F (VMware)
Nmap scan report for 192.168.1.97 (192.168.1.97)
Host is up (0.00011s latency).
MAC Address: 00:0C:29:AF:FE:0C (VMware)
Nmap scan report for 192.168.1.254 (192.168.1.254)
Host is up (0.00021s latency).
MAC Address: 00:50:56:E2:FC:91 (VMware)
Nmap scan report for 192.168.1.60 (192.168.1.60)
Host is up.
探测到目标靶机IP地址为192.168.1.97
# nmap -sT --min-rate 10000 -p- 192.168.1.97 -oN port.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-30 21:24 CST
Nmap scan report for 192.168.1.97 (192.168.1.97)
Host is up (0.0021s latency).
Not shown: 65529 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3306/tcp open mysql
6667/tcp open irc
MAC Address: 00:0C:29:AF:FE:0C (VMware)
开放的端口信息比较多，当然还是先以80端口为重点，寻找突破点，其他的端口作为辅助；6667端口暂时还不知道是什么样的服务~
# nmap -sT -sC -sV -O -p80,22,139,445,3306,6667 192.168.1.97 -oN details.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-30 21:24 CST
Nmap scan report for 192.168.1.97 (192.168.1.97)
Host is up (0.00055s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 b5:38:66:0f:a1:ee:cd:41:69:3b:82:cf:ad:a1:f7:13 (DSA)
| 2048 58:5a:63:69:d0:da:dd:51:cc:c1:6e:00:fd:7e:61:d0 (RSA)
| 256 61:30:f3:55:1a:0d:de:c8:6a:59:5b:c9:9c:b4:92:04 (ECDSA)
|_ 256 1f:65:c0:dd:15:e6:e4:21:f2:c1:9b:a3:b6:55:a0:45 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-title: Backnode
|_http-generator: Silex v2.2.7
| http-robots.txt: 4 disallowed entries
|_/old/ /test/ /TR2/ /Backnode_files/
|_http-server-header: Apache/2.4.7 (Ubuntu)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open `JRSV Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
3306/tcp open mysql MySQL (unauthorized)
6667/tcp open irc InspIRCd
| irc-info:
| server: Admin.local
| users: 1
| servers: 1
| chans: 0
| lusers: 1
| lservers: 0
| source ident: nmap
| source host: 192.168.1.60
|_ error: Closing link: (nmap@192.168.1.60) [Client exited]
MAC Address: 00:0C:29:AF:FE:0C (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Hosts: LAZYSYSADMIN, Admin.local; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: lazysysadmin
| NetBIOS computer name: LAZYSYSADMIN\x00
| Domain name: \x00
| FQDN: lazysysadmin
|_ System time: 2024-01-30T23:24:42+10:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -3h20m00s, deviation: 5h46m24s, median: 0s
|_nbstat: NetBIOS name: LAZYSYSADMIN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2024-01-30T13:24:42
|_ start_date: N/A
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.86 seconds
详细信息探测的结果比较多，挑选出来重点：80端口Apache2.4.7 存在robots文件，samba服务探测到工作组信息，操作系统是Ubuntu系统！6667端口也有信息，但是这里还没有了解，先向下看看，一会去了解下irc服务是什么；smb探测到了os的计算机名等信息！
# nmap -sT --script=vuln -p80,22,139,445,3306,6667 192.168.1.97 -oN vuln.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-30 21:24 CST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 192.168.1.97 (192.168.1.97)
Host is up (0.00075s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-slowloris-check:
| VULNERABLE:
| Slowloris DOS attack
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2007-6750
| Slowloris tries to keep many connections to the target web server open and hold
| them open as long as possible. It accomplishes this by opening connections to
| the target web server and sending a partial request. By doing so, it starves
| the http server's resources causing Denial Of Service.
|
| Disclosure date: 2009-09-17
| References:
| http://ha.ckers.org/slowloris/
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
| http-enum:
| /wordpress/: Blog
| /test/: Test page
| /robots.txt: Robots file
| /info.php: Possible information file
| /phpmyadmin/: phpMyAdmin
| /wordpress/wp-login.php: Wordpress login page.
| /apache/: Potentially interesting directory w/ listing on 'apache/2.4.7 (ubuntu)'
|_ /old/: Potentially interesting directory w/ listing on 'apache/2.4.7 (ubuntu)'
| http-sql-injection:
| Possible sqli for queries:
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DD%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DD%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DD%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DD%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DD%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=N%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=D%3BO%3DA%27%20OR%20sqlspider
| http://192.168.1.97:80/Backnode_files/?C=S%3BO%3DA%27%20OR%20sqlspider
|_ http://192.168.1.97:80/Backnode_files/?C=M%3BO%3DA%27%20OR%20sqlspider
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3306/tcp open mysql
6667/tcp open irc
| irc-botnet-channels:
|_ ERROR: TIMEOUT
|_irc-unrealircd-backdoor: Server closed connection, possibly due to too many reconnects. Try again with argument irc-unrealircd-backdoor.wait set to 100 (or higher if you get this message again).
MAC Address: 00:0C:29:AF:FE:0C (VMware)
Host script results:
|_smb-vuln-ms10-054: false
| smb-vuln-regsvc-dos:
| VULNERABLE:
| Service regsvc in Microsoft Windows systems vulnerable to denial of service
| State: VULNERABLE
| The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
| pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
| while working on smb-enum-sessions.
|_
|_smb-vuln-ms10-061: false
默认漏洞脚本的探测结果显示存在几个感兴趣的目录，同时存在wordpress目录，那应该就是wordpress了！很大的概率是通过wordpress进行建立立足点；
这里去了解了一下什么是irc：
寻找立足点
既然80端口上存在wordpress，这个是我们比较熟悉的，那就先从这里入手；
可以看到下面存在一句英文"My mind in MYSQL" 提示我们思路应该在MYSQL上面？看一下robots文件：
存在几个目录，尝试都访问一下：old目录：
下面这个目录是存在文件的，其他的都没有，虽然没有，但是可以查看是不是开启了PUT方法等，能直接上传文件！
上面信息收集的时候，还看到了几个其他的目录，这里也都挨着去访问一下看看！
phpmyadmin界面：
这里尝试了一下弱口令，但是没有什么效果：
查看wordpress目录：
发现可能存在用户名为togie，同时在评论处，发现了Admin：
这里先尝试利用wpscan进行初步的漏洞和用户等信息的探测！wpscan识别到存在用户：
但是并没有上面我们发现的togie用户~ 但是利用wpscan并没有寻找到存在漏洞的插件等：
尝试弱口令登录到wordpress的后台：
可以看到test目录是不可以利用PUT方式上传文件的！这里去尝试了几个wordpress的后台弱口令，均以失败而告终！这个togie（网站上说了很多次togie 感觉这个用户还是有东西的！）用户既然不是wordpress的用户，那是谁的用户？mysql 还是ssh？
mysql无法登录，尝试一下togie去登录ssh，直接上hydra吧，毕竟也不知道密码，巧了真爆破出来了：
接下来去登录：
先确认靶标情况：
接下来就是提权了！
提权
因为我们在ssh登陆成功的时候，出现了系统的信息，内存等使用率；这里会不会涉及到motd提权？看一下吧：
哎？ rbash了！需要绕过了这就！看看能使用sudo不，查看下当前用户的权限呗：
没问题，非常好了！三个ALL！
那就直接提权了！看看flag文件！这个靶机比较简单，看起来很复杂，但是实际上很简单了！
总结
昨晚打完之后，闲来无事看了一下红笔师傅的讲解视频，跟自己的打法完全不同，所以来复盘一下红笔师傅的打法：
回到我们wpscan没有什么信息，同时发现了togie用户，但是并不是一个wordpress的用户！于是到了这里似乎80端口上无法进一步去利用了~ 既然靶机开放了139 445端口，所以就尝试去登陆一下：
利用enum4linux进行信息的枚举：
发现了打印机和共享，尝试来链接共享，利用smbclient去登录：
直接无密码登录，上来发现了很多的文件和目录信息，所以直接给下载下来！直接下载当前目录下面所有的文件，然后看到存在wordpress目录，看到存在配置文件，也下载下来：
prompt OFF是将提示关闭掉，所以我们下载文件的时候，就不会每次询问我们！
Backnode_files目录下面似乎没什么有价值的东西，存在一个文件名比较奇怪的图片，之前我们就看到了，当时还去尝试了base64解码，似乎没什么东西，继续看其他的目录：
其他的目录也没什么东西了，所以这里我们就退出了，看一下下载得到的东西有什么价值嘛：
提示一个密码是12345（也不知道是谁的密码）
插件上传getshell
wp的配置文件中发现了数据库的账号和密码信息！于是拿着两个密码和一个账号去碰撞wordpress的后台！最终利用数据库的账号和密码信息，成功登陆到了wordpress的后台，接下来就是利用插件等进行RCE：
先给写好的反弹shell，进行压缩，形成压缩包！
直接将其他的插件头拿过来改一下：
然后上传安装即可！
然后访问插件中的文件：
192.168.1.97/wordpress/wp-content/plugins/sh/sh.php
成功拿到初始的立足点！
修改404文件getshell
还有一种方式是直接编辑写反弹shell：（往404页面里面写反弹shell脚本）
更新之后，想办法触发404页面的执行：
