HTB:Ignition[WriteUP]

目录

连接至HTB服务器并启动靶机

[1.Which service version is found to be running on port 80?](#1.Which service version is found to be running on port 80?)

[2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?](#2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?)

[3.What is the virtual host name the webpage expects to be accessed by?](#3.What is the virtual host name the webpage expects to be accessed by?)

[4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?](#4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?)

[5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?](#5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?)

[6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?](#6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?)

​编辑ROOT_FLAG:797d6c988d9dc5865e010b9410f247e0


连接至HTB服务器并启动靶机

靶机IP:10.129.1.27

分配IP:10.10.16.12


1.Which service version is found to be running on port 80?

使用nmap 对靶机80端口进行脚本、服务信息扫描:

复制代码
nmap -sC -sV -p 80 {TARGET_IP}

nmap 扫描结果可见,在VERSION 栏目下的服务版本为:nginx 1.14.2


2.What is the 3-digit HTTP status code returned when you visit http://{machine IP}/?

使用curl 对靶机URL进行访问,使用**-i**参数使输出包含响应头

由curl输出结果可见,访问靶机HTTP地址响应状态码:302


3.What is the virtual host name the webpage expects to be accessed by?

直接使用浏览器对靶机URL:**http://{TARGET_IP}**进行访问:

或者使用curl 中的**-v** 参数再次访问http://{TARGET_IP}

发现被重定向到了:ignition.htb


4.What is the full path to the file on a Linux computer that holds a local list of domain name to IP address pairs?

我们这里尝试修改本地hosts文件,使该域名从本地解析

hosts文件通常默认路径为:/etc/hosts

使用vim打开hosts文件:

复制代码
vim /etc/hosts

在文件中添加一行:{TARGET_IP} ignition.htb

或者直接在命令行中输入,表示将改行字符串追加进hosts中:

复制代码
echo '{TARGET_IP} ignition.htb' >> /etc/hosts

5.Use a tool to brute force directories on the webserver. What is the full URL to the Magento login page?

再次使用浏览器对ignition.htb进行访问,发现已经正常显示页面:

我这里使用gobuster对该域名进行目录爆破:

复制代码
gobuster dir --url http://ignition.htb --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

使用浏览器尝试对**/admin** 进行访问:

可以成功进入后台登录界面,完整路径:http://ignition.htb/admin


6.Look up the password requirements for Magento and also try searching for the most common passwords of 2023. Which password provides access to the admin account?

随便抓一个AI来问一下magento 的最短密码长度,发现是7 位,而且默认开启登录限制的

这道题最后我也是通过看了官方WP知道是弱口令猜解:

账户:admin

密码:qwerty123

进入后台面板:

ROOT_FLAG:797d6c988d9dc5865e010b9410f247e0

相关推荐
迷路的小绅士8 小时前
防火墙技术深度解析:从包过滤到云原生防火墙的部署与实战
网络安全·云原生·防火墙技术·包过滤防火墙·状态检测防火墙
浩浩测试一下11 小时前
计算机网络中的DHCP是什么呀? 详情解答
android·网络·计算机网络·安全·web安全·网络安全·安全架构
蚁景网络安全12 小时前
从字节码开始到ASM的gadgetinspector源码解析
网络安全
浩浩测试一下14 小时前
SQL注入高级绕过手法汇总 重点
数据库·sql·安全·web安全·网络安全·oracle·安全架构
谈不譚网安15 小时前
CSRF请求伪造
前端·网络安全·csrf
JM丫16 小时前
PWNOS:2.0(vulnhub靶机)
网络安全
半路_出家ren18 小时前
流量抓取工具(wireshark)
网络·网络协议·测试工具·网络安全·wireshark·流量抓取工具
ALe要立志成为web糕手20 小时前
[BJDCTF2020]EzPHP
web安全·网络安全·php·ctf
自由鬼21 小时前
开源漏洞扫描器:OpenVAS
运维·服务器·安全·网络安全·开源·漏洞管理
TazmiDev1 天前
2025 XYCTF ezsql 详细教程wp
web安全·网络安全·ctf·sql注入·布尔盲注