DC-1渗透靶机详解

萌新DC系列靶机渗透详解之DC-1

在渗透测试之前,有自己的渗透思路

1. 明确目标

我们的目标应该是找齐里面所有的 flag

根据每个 flag 的提示找到下一个 flag

2. 信息收集

使用扫描工具寻找目标ip,在同一个网段下使用 arp-scan 扫描即可

└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:f2:1a:d5, IPv4: 192.168.0.111
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.0.1     f4:6a:92:10:12:f2       SHENZHEN FAST TECHNOLOGIES CO.,LTD
192.168.0.104   58:a0:23:79:16:11       Intel Corporate
192.168.0.100   48:2c:a0:e5:36:51       Xiaomi Communications Co Ltd
192.168.0.103   8c:c8:4b:60:79:f1       CHONGQING FUGUI ELECTRONICS CO.,LTD.
192.168.0.119   8c:c8:4b:60:79:f1       CHONGQING FUGUI ELECTRONICS CO.,LTD.

5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.038 seconds (125.61 hosts/sec). 5 responded

因为是自己的实验环境,机器比较少 很明显就能看出 靶机是 192.168.0.119

3. 漏洞探测

使用 nmap -A 命令收集信息

使用 nmap 自带的漏洞扫描脚本(时间可能比较长)

└─# nmap --script=vuln -A 192.168.0.119
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-18 15:00 CST
Nmap scan report for localhost (192.168.0.119)
Host is up (0.0046s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)
80/tcp  open  http    Apache httpd 2.2.22 ((Debian))
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=localhost
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://localhost:80/
|     Form id: user-login-form
|_    Form action: /node?destination=node
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /rss.xml: RSS or Atom feed
|   /robots.txt: Robots file
|   /UPGRADE.txt: Drupal file
|   /INSTALL.txt: Drupal file
|   /INSTALL.mysql.txt: Drupal file
|   /INSTALL.pgsql.txt: Drupal file
|   /: Drupal version 7 
|   /README: Interesting, a readme.
|   /README.txt: Interesting, a readme.
|   /0/: Potentially interesting folder
|_  /user/: Potentially interesting folder
|_http-server-header: Apache/2.2.22 (Debian)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-vuln-cve2014-3704: 
|   VULNERABLE:
|   Drupal - pre Auth SQL Injection Vulnerability #找出了这个系统版本的sql漏洞
|     State: VULNERABLE (Exploitable)	
|     IDs:  CVE:CVE-2014-3704				#有漏洞的编号 和描述↓
|         The expandArguments function in the database abstraction API in
|         Drupal core 7.x before 7.32 does not properly construct prepared
|         statements, which allows remote attackers to conduct SQL injection
|         attacks via an array containing crafted keys.
|           
|     Disclosure date: 2014-10-15
|     References:
|       https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
|       http://www.securityfocus.com/bid/70595
|       https://www.drupal.org/SA-CORE-2014-005
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3704
# ....................略....................
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 218.35 seconds

4. 漏洞验证

使用 metasploit 进行渗透

# 首先肯定要进入metasploit吧
msfconsole 
[!] The following modules could not be loaded!../
[!]     /usr/share/metasploit-framework/modules/auxiliary/scanner/msmail/onprem_enum.go
[!]     /usr/share/metasploit-framework/modules/auxiliary/scanner/msmail/host_id.go
[!]     /usr/share/metasploit-framework/modules/auxiliary/scanner/msmail/exchange_enum.go
[!] Please see /root/.msf4/logs/framework.log for details.
                                                  

MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM                MMMMMMMMMM
MMMN$                           vMMMM
MMMNl  MMMMM             MMMMM  JMMMM
MMMNl  MMMMMMMN       NMMMMMMM  JMMMM
MMMNl  MMMMMMMMMNmmmNMMMMMMMMM  JMMMM
MMMNI  MMMMMMMMMMMMMMMMMMMMMMM  jMMMM
MMMNI  MMMMMMMMMMMMMMMMMMMMMMM  jMMMM
MMMNI  MMMMM   MMMMMMM   MMMMM  jMMMM
MMMNI  MMMMM   MMMMMMM   MMMMM  jMMMM
MMMNI  MMMNM   MMMMMMM   MMMMM  jMMMM
MMMNI  WMMMM   MMMMMMM   MMMM#  JMMMM
MMMMR  ?MMNM             MMMMM .dMMMM
MMMMNm `?MMM             MMMM` dMMMMM
MMMMMMN  ?MM             MM?  NMMMMMN
MMMMMMMMNe                 JMMMMMNMMM
MMMMMMMMMMNm,            eMMMMMNMMNMM
MMMMNNMNMMMMMNx        MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
        https://metasploit.com


       =[ metasploit v6.0.49-dev                          ]
+ -- --=