HTB:Ignition[WriteUP]

目录

连接至HTB服务器并启动靶机

[1.Which service version is found to be running on port 80?](#1.Which service version is found to be running on port 80?)

[2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?](#2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?)

[3.What is the virtual host name the webpage expects to be accessed by?](#3.What is the virtual host name the webpage expects to be accessed by?)

[4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?](#4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?)

[5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?](#5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?)

[6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?](#6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?)

​编辑ROOT_FLAG:797d6c988d9dc5865e010b9410f247e0


连接至HTB服务器并启动靶机

靶机IP:10.129.1.27

分配IP:10.10.16.12


1.Which service version is found to be running on port 80?

使用nmap 对靶机80端口进行脚本、服务信息扫描:

复制代码
nmap -sC -sV -p 80 {TARGET_IP}

nmap 扫描结果可见,在VERSION 栏目下的服务版本为:nginx 1.14.2


2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?

使用curl 对靶机URL进行访问,使用**-i**参数使输出包含响应头

由curl输出结果可见,访问靶机HTTP地址响应状态码:302


3.What is the virtual host name the webpage expects to be accessed by?

直接使用浏览器对靶机URL:**http://{TARGET_IP}**进行访问:

或者使用curl 中的**-v** 参数再次访问http://{TARGET_IP}

发现被重定向到了:ignition.htb


4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?

我们这里尝试修改本地hosts文件,使该域名从本地解析

hosts文件通常默认路径为:/etc/hosts

使用vim打开hosts文件:

复制代码
vim /etc/hosts

在文件中添加一行:{TARGET_IP} ignition.htb

或者直接在命令行中输入,表示将改行字符串追加进hosts中:

复制代码
echo '{TARGET_IP} ignition.htb' >> /etc/hosts

5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?

再次使用浏览器对ignition.htb进行访问,发现已经正常显示页面:

我这里使用gobuster对该域名进行目录爆破:

复制代码
gobuster dir --url http://ignition.htb --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

使用浏览器尝试对**/admin** 进行访问:

可以成功进入后台登录界面,完整路径:http://ignition.htb/admin


6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?

随便抓一个AI来问一下magento 的最短密码长度,发现是7 位,而且默认开启登录限制的

这道题最后我也是通过看了官方WP知道是弱口令猜解:

账户:admin

密码:qwerty123

进入后台面板:

ROOT_FLAG:797d6c988d9dc5865e010b9410f247e0

相关推荐
ALe要立志成为web糕手1 天前
SESSION_UPLOAD_PROGRESS 的利用
python·web安全·网络安全·ctf
jingshaoyou2 天前
Strongswan linked_list_t链表 注释可独立运行测试
数据结构·链表·网络安全·list
鹅肝手握高V五色2 天前
Wireshark入门教程:如何抓取和过滤网络数据包
websocket·网络协议·tcp/ip·http·网络安全·https·udp
nixiaoge2 天前
RCE漏洞
网络安全
禾木KG2 天前
网络安全-等级保护(等保) 1-0 等级保护制度公安部前期发文总结
网络安全
网络抓包与爬虫2 天前
Wireshark——抓包分析
websocket·网络协议·tcp/ip·http·网络安全·https·udp
仙女很美哦2 天前
Flutter视频播放、Flutter VideoPlayer 视频播放组件精要
websocket·网络协议·tcp/ip·http·网络安全·https·udp
CYRUS STUDIO2 天前
Unidbg Trace 反 OLLVM 控制流平坦化(fla)
android·汇编·算法·网络安全·逆向·ollvm
写代码的小王吧2 天前
【Java可执行命令】(十)JAR文件签名工具 jarsigner:通过数字签名及验证保证代码信任与安全,深入解析 Java的 jarsigner命令~
java·开发语言·网络·安全·web安全·网络安全·jar